Wortell

wortell · Aug 28, 2019 · fc1547b · fc1547b
1 parent 59cd243
commit fc1547b
Show file tree

Hide file tree

Showing 101 changed files with 61 additions and 0 deletions.
diff --git a/KQL_apt_apt29_thinktanks.txt b/KQL_apt_apt29_thinktanks.txt
diff --git a/KQL_apt_babyshark.txt b/KQL_apt_babyshark.txt
diff --git a/KQL_apt_bear_activity_gtr19.txt b/KQL_apt_bear_activity_gtr19.txt
diff --git a/KQL_apt_cloudhopper.txt b/KQL_apt_cloudhopper.txt
diff --git a/KQL_apt_dragonfly.txt b/KQL_apt_dragonfly.txt
diff --git a/KQL_apt_elise.txt b/KQL_apt_elise.txt
diff --git a/KQL_apt_empiremonkey.txt b/KQL_apt_empiremonkey.txt
diff --git a/KQL_apt_equationgroup_dll_u_load.txt b/KQL_apt_equationgroup_dll_u_load.txt
diff --git a/KQL_apt_hurricane_panda.txt b/KQL_apt_hurricane_panda.txt
diff --git a/KQL_apt_judgement_panda_gtr19.txt b/KQL_apt_judgement_panda_gtr19.txt
diff --git a/KQL_apt_pandemic.txt b/KQL_apt_pandemic.txt
diff --git a/KQL_apt_slingshot.txt b/KQL_apt_slingshot.txt
diff --git a/KQL_apt_sofacy.txt b/KQL_apt_sofacy.txt
diff --git a/KQL_apt_sofacy_zebrocy.txt b/KQL_apt_sofacy_zebrocy.txt
diff --git a/KQL_apt_ta17_293a_ps.txt b/KQL_apt_ta17_293a_ps.txt
diff --git a/KQL_apt_tropictrooper.txt b/KQL_apt_tropictrooper.txt
diff --git a/KQL_apt_turla_namedpipes.txt b/KQL_apt_turla_namedpipes.txt
diff --git a/KQL_apt_unidentified_nov_18.txt b/KQL_apt_unidentified_nov_18.txt
diff --git a/KQL_apt_zxshell.txt b/KQL_apt_zxshell.txt
diff --git a/KQL_crime_fireball.txt b/KQL_crime_fireball.txt
diff --git a/KQL_powershell_xor_commandline.txt b/KQL_powershell_xor_commandline.txt
diff --git a/KQL_sysmon_susp_rdp.txt b/KQL_sysmon_susp_rdp.txt
@@ -0,0 +1,49 @@
+// title: Suspicious Outbound RDP Connections 
+// description: Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible lateral movement
+//
+// reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
+//
+// original author: Markus Neis (Swisscom)
+// KQL author: Maarten Goet (condicio)
+//
+// MITRE ATT&CK: lateral_movement, t1210 
+
+Event 
+| parse EventData with 
+  * 'Data Name="RuleName">' RuleName '<' 
+  * 'Data Name="UtcTime">' UtcTime '<' 
+  * 'Data Name="ProcessGuid">' ProcessGuid '<' 
+  * 'Data Name="ProcessId">' ProcessId '<' 
+  * 'Data Name="Image">' Image '<' 
+  * 'Data Name="User">' User '<' 
+  * 'Data Name="Protocol">' Protocol '<' 
+  * 'Data Name="Initiated">' Initiated '<' 
+  * 'Data Name="SourceIsIpv6">' SourceIsIpv6 '<' 
+  * 'Data Name="SourceIp">' SourceIp '<' 
+  * 'Data Name="SourceHostname">' SourceHostname '<' 
+  * 'Data Name="SourcePort">' SourcePort '<' 
+  * 'Data Name="SourcePortName">' SourcePortName '<' 
+  * 'Data Name="DestinationIsIpv6">' DestinationIsIpv6 '<' 
+  * 'Data Name="DestinationIp">' DestinationIp '<' 
+  * 'Data Name="DestinationHostname">' DestinationHostname '<' 
+  * 'Data Name="DestinationPort">' DestinationPort '<' 
+  * 'Data Name="DestinationPortName">' DestinationPortName '<' 
+  *  
+ | where ((EventID == "3" and DestinationPort == "3389") and not 
+   (Image endswith "\\mstsc.exe" 
+ or Image endswith "\\RTSApp.exe" 
+ or Image endswith "\\RTS2App.exe" 
+ or Image endswith "\\RDCMan.exe" 
+ or Image endswith "\\ws_TunnelService.exe" 
+ or Image endswith "\\RSSensor.exe" 
+ or Image endswith "\\RemoteDesktopManagerFree.exe" 
+ or Image endswith "\\RemoteDesktopManager.exe" 
+ or Image endswith "\\RemoteDesktopManager64.exe" 
+ or Image endswith "\\mRemoteNG.exe" 
+ or Image endswith "\\mRemote.exe" 
+ or Image endswith "\\Terminals.exe" 
+ or Image endswith "\\spiceworks-finder.exe" 
+ or Image endswith "\\FSDiscovery.exe" 
+ or Image endswith "\\FSAssessment.exe" 
+ or Image endswith "\\MobaRTE.exe" 
+ or Image endswith "\\chrome.exe"))
diff --git a/KQL_win_GPO_scheduledtasks.txt b/KQL_win_GPO_scheduledtasks.txt
diff --git a/KQL_win_account_backdoor_dcsync_rights.txt b/KQL_win_account_backdoor_dcsync_rights.txt
diff --git a/KQL_win_account_discovery.txt b/KQL_win_account_discovery.txt
diff --git a/KQL_win_admin_rdp_login.txt b/KQL_win_admin_rdp_login.txt
diff --git a/KQL_win_admin_share_access.txt b/KQL_win_admin_share_access.txt
diff --git a/KQL_win_alert_active_directory_user_control.txt b/KQL_win_alert_active_directory_user_control.txt
diff --git a/KQL_win_alert_ad_user_backdoors.txt b/KQL_win_alert_ad_user_backdoors.txt
diff --git a/KQL_win_alert_enable_weak_encryption.txt b/KQL_win_alert_enable_weak_encryption.txt
diff --git a/KQL_win_alert_hacktool_use.txt b/KQL_win_alert_hacktool_use.txt
diff --git a/KQL_win_atsvc_task.txt b/KQL_win_atsvc_task.txt
diff --git a/KQL_win_attrib_hiding_files.txt b/KQL_win_attrib_hiding_files.txt
diff --git a/KQL_win_bypass_squiblytwo.txt b/KQL_win_bypass_squiblytwo.txt
diff --git a/KQL_win_cmdkey_recon.txt b/KQL_win_cmdkey_recon.txt
diff --git a/KQL_win_cmstp_com_object_access.txt b/KQL_win_cmstp_com_object_access.txt
diff --git a/KQL_win_dcsync.txt b/KQL_win_dcsync.txt
diff --git a/KQL_win_disable_event_logging.txt b/KQL_win_disable_event_logging.txt
diff --git a/KQL_win_exploit_cve_2015_1641.txt b/KQL_win_exploit_cve_2015_1641.txt
diff --git a/KQL_win_exploit_cve_2017_0261.txt b/KQL_win_exploit_cve_2017_0261.txt
diff --git a/KQL_win_exploit_cve_2017_11882.txt b/KQL_win_exploit_cve_2017_11882.txt
diff --git a/KQL_win_exploit_cve_2017_8759.txt b/KQL_win_exploit_cve_2017_8759.txt
diff --git a/KQL_win_hack_rubeus.txt b/KQL_win_hack_rubeus.txt
diff --git a/KQL_win_impacket_secretdump.txt b/KQL_win_impacket_secretdump.txt
diff --git a/KQL_win_lethalhta.txt b/KQL_win_lethalhta.txt
diff --git a/KQL_win_lm_namedpipe.txt b/KQL_win_lm_namedpipe.txt
diff --git a/KQL_win_mal_adwind.txt b/KQL_win_mal_adwind.txt
diff --git a/KQL_win_mal_lockergoga.txt b/KQL_win_mal_lockergoga.txt
diff --git a/KQL_win_mal_ursnif.txt b/KQL_win_mal_ursnif.txt
diff --git a/KQL_win_mal_wannacry.txt b/KQL_win_mal_wannacry.txt
diff --git a/KQL_win_mal_wceaux_dll.txt b/KQL_win_mal_wceaux_dll.txt
diff --git a/KQL_win_malware_dridex.txt b/KQL_win_malware_dridex.txt
diff --git a/KQL_win_malware_notpetya.txt b/KQL_win_malware_notpetya.txt
diff --git a/KQL_win_malware_script_dropper.txt b/KQL_win_malware_script_dropper.txt
diff --git a/KQL_win_malware_wannacry.txt b/KQL_win_malware_wannacry.txt
diff --git a/KQL_win_mavinject_proc_inj.txt b/KQL_win_mavinject_proc_inj.txt
diff --git a/KQL_win_mshta_spawn_shell.txt b/KQL_win_mshta_spawn_shell.txt
diff --git a/KQL_win_net_ntlm_downgrade.txt b/KQL_win_net_ntlm_downgrade.txt
diff --git a/KQL_win_netsh_fw_add.txt b/KQL_win_netsh_fw_add.txt
diff --git a/KQL_win_netsh_port_fwd.txt b/KQL_win_netsh_port_fwd.txt
diff --git a/KQL_win_netsh_port_fwd_3389.txt b/KQL_win_netsh_port_fwd_3389.txt
diff --git a/KQL_win_office_shell.txt b/KQL_win_office_shell.txt
diff --git a/KQL_win_overpass_the_hash.txt b/KQL_win_overpass_the_hash.txt
diff --git a/KQL_win_pass_the_hash.txt b/KQL_win_pass_the_hash.txt
diff --git a/KQL_win_plugx_susp_exe_locations.txt b/KQL_win_plugx_susp_exe_locations.txt
diff --git a/KQL_win_possible_applocker_bypass.txt b/KQL_win_possible_applocker_bypass.txt
diff --git a/KQL_win_powershell_amsi_bypass.txt b/KQL_win_powershell_amsi_bypass.txt
diff --git a/KQL_win_powershell_b64_shellcode.txt b/KQL_win_powershell_b64_shellcode.txt
diff --git a/KQL_win_powershell_dll_execution.txt b/KQL_win_powershell_dll_execution.txt
diff --git a/KQL_win_powershell_download.txt b/KQL_win_powershell_download.txt
diff --git a/KQL_win_powershell_renamed_ps.txt b/KQL_win_powershell_renamed_ps.txt
diff --git a/KQL_win_powershell_suspicious_parameter_variation.txt b/KQL_win_powershell_suspicious_parameter_variation.txt
diff --git a/KQL_win_process_creation_bitsadmin_download.txt b/KQL_win_process_creation_bitsadmin_download.txt
diff --git a/KQL_win_psexesvc_start.txt b/KQL_win_psexesvc_start.txt
diff --git a/KQL_win_rdp_bluekeep_poc_scanner.txt b/KQL_win_rdp_bluekeep_poc_scanner.txt
@@ -0,0 +1,12 @@
+// title: Scanner PoC for CVE-2019-0708 RDP RCE vuln
+// description: Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to  CVE-2019-0708 RDP RCE aka BlueKeep
+//
+// references: https://twitter.com/AdamTheAnalyst/status/1134394070045003776 & https://github.com/zerosum0x0/CVE-2019-0708
+//
+// original authors: Florian Roth (sigma rule), Adam Bradbury (idea)
+// KQL author: Maarten Goet (condicio)
+//
+// MITRE ATT&CK: lateral_movement, t1210 
+
+SecurityEvent 
+| where (EventID == "4625" and AccountName == "AAAAAAA")
diff --git a/KQL_win_rdp_localhost_login.txt b/KQL_win_rdp_localhost_login.txt
diff --git a/KQL_win_rdp_reverse_tunnel.txt b/KQL_win_rdp_reverse_tunnel.txt
diff --git a/KQL_win_sdbinst_shim_persistence.txt b/KQL_win_sdbinst_shim_persistence.txt
diff --git a/KQL_win_shell_spawn_susp_program.txt b/KQL_win_shell_spawn_susp_program.txt
diff --git a/KQL_win_spn_enum.txt b/KQL_win_spn_enum.txt
diff --git a/KQL_win_susp_add_sid_history.txt b/KQL_win_susp_add_sid_history.txt
diff --git a/KQL_win_susp_bcdedit.txt b/KQL_win_susp_bcdedit.txt
diff --git a/KQL_win_susp_calc.txt b/KQL_win_susp_calc.txt
diff --git a/KQL_win_susp_certutil_command.txt b/KQL_win_susp_certutil_command.txt
diff --git a/KQL_win_susp_certutil_encode.txt b/KQL_win_susp_certutil_encode.txt
diff --git a/KQL_win_susp_cli_escape.txt b/KQL_win_susp_cli_escape.txt
diff --git a/KQL_win_susp_dsrm_password_change.txt b/KQL_win_susp_dsrm_password_change.txt
diff --git a/KQL_win_susp_failed_logon_reasons.txt b/KQL_win_susp_failed_logon_reasons.txt
diff --git a/KQL_win_susp_interactive_logons.txt b/KQL_win_susp_interactive_logons.txt
diff --git a/KQL_win_susp_kerberos_manipulation.txt b/KQL_win_susp_kerberos_manipulation.txt
diff --git a/KQL_win_susp_lsass_dump.txt b/KQL_win_susp_lsass_dump.txt
diff --git a/KQL_win_susp_mshta_execution.txt b/KQL_win_susp_mshta_execution.txt
diff --git a/KQL_win_susp_net_recon_activity.txt b/KQL_win_susp_net_recon_activity.txt
diff --git a/KQL_win_susp_psexec.txt b/KQL_win_susp_psexec.txt
diff --git a/KQL_win_susp_raccess_sensitive_fext.txt b/KQL_win_susp_raccess_sensitive_fext.txt
diff --git a/KQL_win_susp_rc4_kerberos.txt b/KQL_win_susp_rc4_kerberos.txt
diff --git a/KQL_win_susp_sdelete.txt b/KQL_win_susp_sdelete.txt
diff --git a/KQL_win_susp_security_eventlog_cleared.txt b/KQL_win_susp_security_eventlog_cleared.txt
diff --git a/KQL_win_susp_time_modification.txt b/KQL_win_susp_time_modification.txt
diff --git a/KQL_win_svcctl_remote_service.txt b/KQL_win_svcctl_remote_service.txt
diff --git a/KQL_win_user_added_to_local_administrators.txt b/KQL_win_user_added_to_local_administrators.txt