Closed sebastiendamaye closed 3 years ago
@sebastiendamaye thanks! We'll convert this to our YAML and merge it in shortly.
Added in fd00cd9. Thanks again @sebastiendamaye !
Greetings, this comment will probably be lost since the issue is closed but I found a typo in the pseudo code as well as the Splunk query when implementing this analytic.
OR (exe=lasass.exe AND image_path!="C:\\Windows\\System32\\lsass.exe")
Typo is exe=lasass.exe instead of exe=lsass.exe
Thank you for ur contributions 🙏.
Typo in CAR-2021-04-001: Common Windows Process Masquerading !!
Greetings, this comment will probably be lost since the issue is closed but I found a typo in the pseudo code as well as the Splunk query when implementing this analytic.
OR (exe=lasass.exe AND image_path!="C:\\Windows\\System32\\lsass.exe")
Typo is exe=lasass.exe instead of exe=lsass.exe
Thank you for ur contributions pray.
Thank you AlaZegnani. I've updated the content in the initial request. Not sure if it will be reflexted on the MITRE CAR portal though.
CAR-2021-02-12: Common Windows Process Masquerading
Masquerading (T1036) is defined by MITRE ATT&CK as follows:
Malware authors often use this technique to hide malicious executables behind legitimate Windows executable's names (e.g.
lsass.exe
,svchost.exe
, ...).There are several sub-techniques, but this analytics focuses on Match Legitimate Name or Location only.
ATT&CK Coverage
Data Model Mappings
Analytic Code
With process monitoring, hunt for processes matching these criteria:
svchost.exe
,smss.exe
,wininit.exe
,taskhost.exe
, ...C:\Windows\System32\
orC:\Windows\SysWow64\
Examples:
To make sure the rule doesn't miss cases where the executable would be started from a sub-folder of these locations, the entire path is checked for the process path. The below example should be considered as suspicious:
Splunk Search (Splunk, Sysmon native)