quasar_and_loader #3609
quasar_and_loader #3609
Conversation
| @@ -1,7 +1,7 @@ | |||
| name: Executables Or Script Creation In Suspicious Path | |||
| id: a7e3f0f0-ae42-11eb-b245-acde48001122 | |||
| version: 16 | |||
| date: '2025-05-06' | |||
| version: '17' | |||
There was a problem hiding this comment.
@tccontre This is a comment for all the rules you changed. Please do not use the single quote in the version field
| version: '17' | |
| version: 17 |
| - Powershell Script Block Logging 4104 | ||
| search: | ||
| '`powershell` EventCode=4104 (ScriptBlockText = "*SELECT*" OR ScriptBlockText | ||
| - Powershell Script Block Logging 4104 |
There was a problem hiding this comment.
A lot of changes are also related to indentation. Which we want to have. So if you can avoid changing that
| of the system. | ||
| data_source: | ||
| - Windows Event Log Security 4663 | ||
| search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN("*\\Filezilla.exe")) |
There was a problem hiding this comment.
I suggest you add the full path of FileZilla to avoid FN.
| could lead to data exfiltration, credential theft, or further compromise of the system. | ||
| data_source: | ||
| - Windows Event Log Security 4663 | ||
| search: '`wineventlog_security` EventCode=4663 NOT (ProcessName IN("*\\iexplore.exe")) |
There was a problem hiding this comment.
I suggest you add full paths instead of just the process name to avoid FNs
| @@ -0,0 +1,73 @@ | |||
| name: Windows Unusual Mozilla NSS-Mozglue Access | |||
There was a problem hiding this comment.
This analytic is for ImageLoad so the title needs to be different
| search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\mozglue.dll", "*\\nss3.dll") | ||
| NOT(process_name IN("firefox.exe", "thunderbird.exe")) NOT(process_path IN("*\\program files*")) |
There was a problem hiding this comment.
nss3 can also be used by other processes. For example Code42 C:\Program Files\Code42\nlib\nss3.dll
For mozglue. I think its also worth filtering additional Mozilla products https://www.mozilla.org/en-US/products/
maybe install the most known and add filters
| "*opera.exe","*Opera Software\Opera GX Stable\Login Data*", true | ||
| "*opera.exe","*Opera Software\Opera GX Stable\Local State*", true | ||
| "*yandex.exe","*Yandex\YandexBrowser\User Data\Default\Ya Passman Data*", true | ||
| "*yandex.exe","*Yandex\YandexBrowser\User Data\Local State*", true |
There was a problem hiding this comment.
The corresponding lookup yaml file needs to also be updated.
| as lastTime from datamodel=Endpoint.Processes where ( Processes.parent_process= | ||
| "*ping*" Processes.parent_process = *-n* Processes.parent_process="* Nul*" Processes.parent_process | ||
| IN ("*>*", "*>*") Processes.parent_process IN ("*&*", "*& *") ) OR ( Processes.process | ||
| = "*ping*" Processes.process = *-n* Processes.process="* Nul*" Processes.process | ||
| IN ("*>*", "*>*") Processes.process IN ("*&*", "*& *") ) by Processes.action | ||
| Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec | ||
| Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name | ||
| Processes.parent_process_path Processes.process Processes.process_exec Processes.process_guid | ||
| Processes.process_hash Processes.process_id Processes.process_integrity_level Processes.process_name | ||
| Processes.process_path Processes.user Processes.user_id Processes.vendor_product |
There was a problem hiding this comment.
Can you please keep the old formatting, as its clearer to understand than this.
Updated
New
tag
new analytic story
What does this PR have in it? Screenshots are worth 1000 words 😄
Checklist
<platform>_<mitre att&ck technique>_<short description>nomenclatureNotes For Submitters and Reviewers
buildCI job when it fails will likely show an error about what is failing. You may have a very descriptive error of the specific field(s) in the specific file(s) that is causing an issue. In some cases, its also possible there is an issue with the YAML. Many of these can be caught with the pre-commit hooks if you set them up. These errors will be less descriptive as to what exactly is wrong, but will give you a column and row position in a specific file where the YAML processing breaks. If you're having trouble with this, feel free to add a comment to your PR tagging one of the maintainers and we'll be happy to help troubleshoot it.