Skip to content

Instantly share code, notes, and snippets.

View mgraeber-rc's full-sized avatar

Matt Graeber mgraeber-rc

87 followers · 0 following
View GitHub Profile
@mgraeber-rc
mgraeber-rc / LayoutNewSubTechniques.ps1
Created March 31, 2020 17:44
Making the new sub-technique JSON a little more readable for me
Invoke-WebRequest -Uri https://attack.mitre.org/docs/subtechniques/subtechniques-crosswalk.json |
Select-Object -ExpandProperty Content |
ConvertFrom-Json |
ForEach-Object {
$OldTID = Get-Member -InputObject $_ -MemberType NoteProperty -Name T* |
Select-Object -ExpandProperty Name;
[PSCustomObject] @{ OldTID = $OldTID; NewTID = $_.$OldTID[0].id; Explanation = $_.$OldTID[0].explanation } } |
Sort-Object NewTID, OldTID
@mgraeber-rc
mgraeber-rc / CS_Beacon_TEARDROP_Config.json
Created December 22, 2020 16:23
Extracted Cobalt Strike Beacon config for 3cfbf519913d703a802423e6e3fb734abf8297971caccc7ae45df172196b6e84 from this post: https://research.checkpoint.com/2020/sunburst-teardrop-and-the-netsec-new-normal/
{
"BeaconType": [
"HTTPS"
],
"Port": 443,
"SleepTime": 5000,
"MaxGetSize": 1049611,
"Jitter": 99,
"MaxDNS": 255,
"C2Server": "static.rennorigroup.com,/api/v1/meemes/latest",
@mgraeber-rc
mgraeber-rc / powershell_structured_query.xml
Created March 16, 2021 17:33
Example custom event view I used to display only relevant PowerShell logs for a demo
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">
*[System[(EventID='4688')]]
and
*[EventData[Data[@Name='NewProcessName']='C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe']]
</Select>
<Select Path="Microsoft-Windows-PowerShell/Operational">
*[System[(EventID='4104')]]
and
@mgraeber-rc
mgraeber-rc / Non_Microsoft_Driver_Load_Audit.xml
Created February 26, 2021 17:38
A WDAC audit-mode policy that will log all non-Windows-signed driver loads and any driver that is not WHQL or EV signed.
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
<VersionEx>10.0.0.0</VersionEx>
<PolicyTypeID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyTypeID>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<Rules>
<Rule>
<Option>Enabled:Unsigned System Integrity Policy</Option>
</Rule>
<Rule>
@mgraeber-rc
mgraeber-rc / log_nothing.xml
Created March 16, 2021 14:43
A sysmon configuration that defaults to logging nothing. I use this as a baseline configuration for testing purposes where I can selectively turn on log sources by changing "include" to "exclude"
<Sysmon schemaversion="4.50">
<HashAlgorithms>md5,sha256</HashAlgorithms>
<EventFiltering>
<!--Event ID 1: Process creation-->
<ProcessCreate onmatch="include"></ProcessCreate>
<!--Event ID 2: A process changed a file creation time-->
<FileCreateTime onmatch="include"></FileCreateTime>
<!--Event ID 3: Network connection-->
<NetworkConnect onmatch="include"></NetworkConnect>
<!--Event ID 5: Process terminated-->
@mgraeber-rc
mgraeber-rc / Windows_Application_Control_Mitigation_Coverage.json
Created May 27, 2021 13:44
MITRE ATT&CK Navigator Layer - Windows Application Control Mitigation Coverage: Techniques on Windows endpoints that would be prevented, mitigated, or detected by the enforcement of an application control/application allowlisting solution.
{
"name": "Windows Application Control Mitigation Coverage",
"versions": {
"attack": "9",
"navigator": "4.3",
"layer": "4.2"
},
"domain": "enterprise-attack",
"description": "Techniques on Windows endpoints that would be prevented, mitigated, or detected by the enforcement of an application control/application allowlisting solution.\n\nAuthor: Matt Graeber, Red Canary",
"filters": {
@mgraeber-rc
mgraeber-rc / DefaultWindows_Audit.xml
Last active July 29, 2021 00:41
Modified default window-only audit WDAC with WHQL rules removed
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
<VersionEx>10.0.1.0</VersionEx>
<PolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyID>
<BasePolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</BasePolicyID>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<Rules>
<Rule>
<Option>Enabled:Unsigned System Integrity Policy</Option>
</Rule>
@mgraeber-rc
mgraeber-rc / GenerateWHQLDriverRules.ps1
Created July 27, 2021 17:23
# Create a scratch directory as the destination for drivers that would have failed to load due to WHQL enforcement.
mkdir Drivers
# After a reboot, list all drivers that would have failed WHQL enforcement - i.e. event ID 3082 events
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-CodeIntegrity/Operational'; Id = 3082 } | ForEach-Object { "C:$($_.Properties[1].Value)" } | Sort-Object -Unique | Get-ChildItem | Copy-Item -Destination .\Drivers\
# Get signer information for all the affected drivers
$DriverSigners = Get-SystemDriver -ScanPath .\Drivers\ -NoScript -NoShadowCopy
# Build a WHQLPublisher allow rule for the WHQL signed drivers that will only allow WHQL-signed drivers issued to a specific vendor.
@mgraeber-rc
mgraeber-rc / AuditNonWindowsDrivers.xml
Created April 27, 2021 13:43
An audit-mode driver-only WDAC ruleset that will log driver loads of non-Windows-signed drivers. Microsoft-Windows-CodeIntegrity/Operational Event Log Event ID 3076
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
<VersionEx>10.0.1.0</VersionEx>
<PolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</PolicyID>
<BasePolicyID>{A244370E-44C9-4C06-B551-F6016E563076}</BasePolicyID>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<Rules>
<Rule>
<Option>Enabled:Unsigned System Integrity Policy</Option>
</Rule>
@mgraeber-rc
mgraeber-rc / AllowAllRuleAdded.xml
Created August 31, 2021 14:48
Resulting driver deny policy resulting from a few tweaks of Microsoft's supplied policy
<?xml version="1.0" encoding="utf-8"?>
<SiPolicy xmlns="urn:schemas-microsoft-com:sipolicy">
<VersionEx>10.0.0.0</VersionEx>
<PlatformID>{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}</PlatformID>
<Rules>
<Rule>
<Option>Enabled:Unsigned System Integrity Policy</Option>
</Rule>
<Rule>
<Option>Enabled:Audit Mode</Option>