Skip to content

WIP - 02Rel3 - #1206

Merged
patel-bhavin merged 82 commits into
developfrom
02rel3
Mar 4, 2021
Merged

patel-bhavin merged 82 commits into
developfrom
02rel3

Conversation

@MHaggis

@MHaggis MHaggis commented Feb 22, 2021 •

Copy link
Copy Markdown
Contributor

New Analytic Stories

  • Silver Sparrow
  • HAFNIUM Group

New Detections

  • Cobalt Strike Named Pipes (Passed)
  • Suspicious DLLHost no Command Line Arguments (Passed)
  • Suspicious GPUpdate no Command Line Arguments (Passed)
  • Suspicious SearchProtocolHost no Command Line Arguments (Passed)
  • Suspicious PlistBuddy Usage (Experimental)
  • Suspicious SQLite3 LSAQuarantine Behavior (Experimental)
  • Suspicious Curl Network Connection (Experimental)
  • Ryuk Wake on LAN Command (Works, but batch not passing)
  • Suspicious Scheduled Task from Public Directory (Passed)
  • Fodhelper UAC Bypass (Passed)
  • Eventvwr UAC Bypass (Passed)
  • Any PowerShell DownloadString (Passed)
  • Any PowerShell DownloadFile (Works, but batch not passing)
  • Unified Messaging Service Spawning a Process (Experimental)
  • Suspicious Unified Messaging Service File Writes (Experimental)
  • Nishang PowershellTCPOneLine (Passed)
  • W3WP Spawning Shells (Experimental)

Updated Analytic Stories

  • Cobalt Strike
  • Suspicious MSHTA Activity (formatting issues)

Updated Detections

  • NTdsutil Export NTDS
  • Suspicious MSBuild Path
  • Suspicious MSBuild Rename
  • Suspicious Microsoft Workflow Compiler Rename
  • Detect Regsvr32 Application Control Bypass
  • Windows DisableAntiSpyware Registry (Passed)

@request-info

request-info Bot commented Feb 22, 2021

Copy link
Copy Markdown

We would appreciate it if you could provide us with more info about this issue/pr!

@MHaggis MHaggis added WIP DO NOT MERGE Work in Progress and removed needs-more-info labels Feb 22, 2021
@P4T12ICK

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Cobalt Strike Named Pipes ✅

  • diskUsage: 143360
  • runDuration: 1.425s
  • scanCount: 1112

@P4T12ICK

P4T12ICK commented Mar 3, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Suspicious Scheduled Task from Public Directory ✅

  • diskUsage: 286720
  • runDuration: 2.148s
  • scanCount: 6

@P4T12ICK

P4T12ICK commented Mar 3, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Suspicious Scheduled Task from Public Directory ✅

  • diskUsage: 286720
  • runDuration: 2.207s
  • scanCount: 6

@P4T12ICK

P4T12ICK commented Mar 3, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Ryuk Wake on LAN Command ❌

  • diskUsage: 479232
  • runDuration: 1.607s
  • scanCount: 11

@P4T12ICK

P4T12ICK commented Mar 3, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Any Powershell DownloadFile ❌

  • diskUsage: 401408
  • runDuration: 11.225s
  • scanCount: 16368

@P4T12ICK

P4T12ICK commented Mar 3, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Nishang PowershellTCPOneLine ✅

  • diskUsage: 282624
  • runDuration: 1.5170000000000001s
  • scanCount: 3

@P4T12ICK

P4T12ICK commented Mar 3, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Ryuk Wake on LAN Command ❌

  • diskUsage: 483328
  • runDuration: 1.7690000000000001s
  • scanCount: 7

@P4T12ICK

P4T12ICK commented Mar 4, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Ryuk Wake on LAN Command ❌

  • diskUsage: 483328
  • runDuration: 1.703s
  • scanCount: 1

@P4T12ICK

P4T12ICK commented Mar 4, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Any Powershell DownloadFile ❌

  • diskUsage: 401408
  • runDuration: 14.116s
  • scanCount: 21427

@MHaggis MHaggis removed the WIP DO NOT MERGE Work in Progress label Mar 4, 2021
@patel-bhavin
patel-bhavin merged commit 0223d6f into develop Mar 4, 2021
@delete-merged-branch
delete-merged-branch Bot deleted the 02rel3 branch March 4, 2021 19:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants