Skip to content

Instantly share code, notes, and snippets.

Avatar
🍻
Working from home

Roberto Rodriguez Cyb3rWard0g

🍻
Working from home
View GitHub Profile
View elastalert_sysmon_powershell_suspicious_parameter_variation_needsfix2.yml
alert:
- slack
slack_webhook_url: https://hooks.slack.com/services/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
description: Detects suspicious PowerShell invocation with a parameter substring
filter:
- query:
query_string:
query: (process_path:("*\\Powershell.exe") AND event_id:"1" AND process_command_line:("
\-windowstyle h " " \-windowstyl h" " \-windowsty h" " \-windowst h" " \-windows
h" " \-windo h" " \-wind h" " \-win h" " \-wi h" " \-win h " " \-win hi "
View sigma_sysmon_powershell_suspicious_parameter_variation_needsfix2.yml
title: Suspicious PowerShell Parameter Substring
status: experimental
description: Detects suspicious PowerShell invocation with a parameter substring
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
tags:
- attack.execution
- attack.t1086
author: Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix)
logsource:
View ksql_demo.yml
# HELK KSQL Winlogbeat Config - Blog
# Author: Roberto Rodriguez (@Cyb3rWard0g)
# License: GPL-3.0
winlogbeat.event_logs:
- name: Microsoft-windows-sysmon/operational
ignore_older: 4h
#----------------------------- Kafka output --------------------------------
output.kafka:
# initial brokers for reading cluster metadata
hosts: ["192.168.64.138:9092"]
View sysmon-ksql-processcreate-event
12/18/18 10:42:32 PM UTC , NULL ,
{
"@timestamp":"2018-12-18T22:42:32.841Z",
"@metadata":
{
"beat":"winlogbeat",
"type":"doc",
"version":"6.5.3",
"topic":"winlogbeat"
},
View sysmon-ksql-networkconnection-event
12/18/18 10:42:58 PM UTC , NULL ,
{
"@timestamp":"2018-12-18T22:42:58.788Z",
"@metadata":
{
"beat":"winlogbeat",
"type":"doc",
"version":"6.5.3",
"topic":"winlogbeat"
},
View sysmon-join.commands
CREATE STREAM WINLOGBEAT_STREAM (source_name VARCHAR, type VARCHAR, task VARCHAR, log_name VARCHAR, computer_name VARCHAR, event_data STRUCT< UtcTime VARCHAR, ProcessGuid VARCHAR, ProcessId INTEGER, Image VARCHAR, FileVersion VARCHAR, Description VARCHAR, Product VARCHAR, Company VARCHAR, CommandLine VARCHAR, CurrentDirectory VARCHAR, User VARCHAR, LogonGuid VARCHAR, LogonId VARCHAR, TerminalSessionId INTEGER, IntegrityLevel VARCHAR, Hashes VARCHAR, ParentProcessGuid VARCHAR, ParentProcessId INTEGER, ParentImage VARCHAR, ParentCommandLine VARCHAR, Protocol VARCHAR, Initiated VARCHAR, SourceIsIpv6 VARCHAR, SourceIp VARCHAR, SourceHostname VARCHAR, SourcePort INTEGER, SourcePortName VARCHAR, DestinationIsIpv6 VARCHAR, DestinationIp VARCHAR, DestinationHostname VARCHAR, DestinationPort INTEGER, DestinationPortName VARCHAR>, event_id INTEGER) WITH (KAFKA_TOPIC='winlogbeat', VALUE_FORMAT='JSON');
CREATE STREAM WINLOGBEAT_STREAM_REKEY WITH (VALUE_FORMAT='JSON', PARTITIONS=1, TIMESTAMP='event_date_creation') AS SEL
View sysmon_event_manifest_v9.0.xml
<manifest schemaversion="4.2" binaryversion="8.00">
<configuration>
<options>
<!-- Command-line only options -->
<option switch="i" name="Install" argument="optional" noconfig="true" exclusive="true" />
<option switch="c" name="Configuration" argument="optional" noconfig="true" exclusive="true" />
<option switch="u" name="UnInstall" argument="none" noconfig="true" exclusive="true" />
<option switch="m" name="Manifest" argument="none" noconfig="true" exclusive="true" />
<option switch="t" name="DebugMode" argument="none" noconfig="true" />
<option switch="s" name="PrintSchema" argument="optional" noconfig="true" exclusive="true" />
View securityevent-4688-schema.xml
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4688</EventID>
<Version>2</Version>
<Level>0</Level>
<Task>13312</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2019-09-17T03:03:59.074909100Z" />
View ruben-silkserviceconfig-template.xml
<SilkServiceConfig>
<!--
This is a user collector
-> Microsoft-Windows-DotNETRuntime
-> GUID or string based name
-->
<ETWCollector>
<Guid>45c82358-c52d-4892-8237-ba001d396fb4</Guid>
<CollectorType>user</CollectorType>
<ProviderName>e13c0d23-ccbc-4e12-931b-d9cc2eee27e4</ProviderName>
View dotnetruntime-silkservice-config.xml
<SilkServiceConfig>
<!--
Microsoft-Windows-DotNETRuntime ETW Provider
-->
<ETWCollector>
<Guid>072e0373-213b-4e3d-881a-6430d6d9e369</Guid>
<CollectorType>user</CollectorType>
<ProviderName>e13c0d23-ccbc-4e12-931b-d9cc2eee27e4</ProviderName>
<UserKeywords>0x2038</UserKeywords>
<OutputType>eventlog</OutputType>