YARA-L rules: 3d

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule ttp_windows_sharepoint_cve_2025_53770_webshell_attempted {
  meta:
    author = "Google Cloud Security"
    rule_name = "Attempted SharePoint Webshell Creation CVE-2025-53770"
    description = "Detects the attempted creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of an attempt to exploit the SharePoint Server vulnerability CVE-2025-53770."
    severity = "High"
    tactic = "TA0003"
    technique = "T1505.003"
    false_positives = "Extremely Low, as the filename and location are highly specific to this exploit."
    reference = "https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/"
    rule_id = "mr_c174ff49-5dd5-42c5-b41b-8b11b42c0a64"

  events:
      // Event must be a file creation on a Windows system
      (
        $e.metadata.event_type = "FILE_CREATION" or
        $e.metadata.event_type = "STATUS_UPDATE"
      )
      // The file path must be within the SharePoint 15 or 16 hive's LAYOUTS directory.
      $e.target.file.full_path = /[\x2F\x5C]+(?:Program\ Files|Progra~[1-9])[\x2F\x5C]+(?:Common\ Files|Common~[1-9])[\x2F\x5C]+(?:Microsoft\ Shared|Micros~[1-9])[\x2F\x5C]+(?:Web\ Server\ Extensions|WebSer~[1-9])[\x2F\x5C]+16[\x2F\x5C]+TEMPLATE[\x2F\x5C]+LAYOUTS[\x2F\x5C]+spinstall0\.aspx/ nocase
      // Capture hostname for match
      $hostname = strings.coalesce($e.principal.asset_id, $e.principal.asset.asset_id, $e.principal.hostname)

  match:
    $hostname over 5m

  outcome:
    $risk_score = max(85)
    $vendor_name = array_distinct($e.metadata.vendor_name)
    $product_name = array_distinct($e.metadata.product_name)
    $event_count = count_distinct($e.metadata.id)
    $victim_name = array_distinct($hostname)
    $victim_asset_id = array_distinct($e.principal.asset.asset_id)
    $victim_ip = array_distinct($e.principal.asset.ip)
    $result = "attempted"
    $result_time = min($e.metadata.event_timestamp.seconds)
    $file_paths = array_distinct($e.target.file.full_path)

 condition:
   $e
}

// Copyright 2024 Google LLC. Licensed under Apache-2.0.

rule github_personal_access_token_created_from_tor_ip_address {

  meta:
    author = "Google Cloud Security"
    description = "Detects when a GitHub Personal Access Token is created from a known Tor exit node IP address. An adversary may create a Personal Access Token before carrying out follow up actions such as cloning GitHub repositories to steal data."
    rule_id = "mr_39b42a3c-6b7a-4fa7-a6ca-df084ca92da4"
    rule_name = "GitHub Personal Access Token Created from Tor IP Address"
    assumption = "Your GitHub enterprise audit log settings are configured to log the source IP address for events. Reference: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/displaying-ip-addresses-in-the-audit-log-for-your-organization"
    type = "alert"
    severity = "High"
    priority = "High"
    platform = "GitHub"
    data_source = "github"
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "Account Manipulation: Additional Cloud Credentials"
    mitre_attack_url = "https://attack.mitre.org/versions/v14/techniques/T1098/001/"
    mitre_attack_version = "v14"
    reference = "https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise"
    tags = "tor"

  events:
    $github.metadata.vendor_name = "GITHUB" nocase
    $github.metadata.product_name = "GITHUB"
    $github.metadata.product_event_type = "personal_access_token.request_created"
    $github.principal.ip = $ip

    // Tor IP address list is provided by Google Cloud Threat Intelligence (GCTI) feed
    $gcti_feed.graph.entity.artifact.ip = $ip
    $gcti_feed.graph.metadata.entity_type = "IP_ADDRESS"
    $gcti_feed.graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"
    $gcti_feed.graph.metadata.product_name = "GCTI Feed"
    $gcti_feed.graph.metadata.source_type = "GLOBAL_CONTEXT"

  match:
    $ip over 30m

  outcome:
    $risk_score = max(85)
    $mitre_attack_tactic = "Persistence, Privilege Escalation"
    $mitre_attack_technique = "Account Manipulation: Additional Cloud Credentials"
    $mitre_attack_technique_id = "T1098.001"
    $event_count = count_distinct($github.metadata.id)
    $principal_ip = array_distinct($github.principal.ip)
    $principal_user_userid = array_distinct($github.principal.user.userid)
    $principal_ip_country = array_distinct($github.principal.ip_geo_artifact.location.country_or_region)
    $principal_ip_state = array_distinct($github.principal.ip_geo_artifact.location.state)
    $principal_ip_city = array_distinct($github.principal.location.city)
    $security_result_summary = array_distinct($github.security_result.summary)

  condition:
    $github and $gcti_feed
}

// Copyright 2025 Google LLC. Licensed under Apache-2.0.

rule new_run_key_pointing_to_suspicious_folder {

  meta:
    author = "Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems)"
    description = "Detects suspicious new RUN key element pointing to an executable in a suspicious folder"
    reference = "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_susp_run_key_img_folder.yml"
    license = "https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md"
    rule_name = "New RUN Key Pointing to Suspicious Folder"
    rule_id = "mr_ffc6cf7a-3eaf-4ca1-8dba-9a2d466f2a3a"
    sigma_uuid = "02ee49e2-e294-4d0f-9278-f5b3212fc588"
    sigma_status = "experimental"
    tactic = "TA0005"
    technique = "T1547.001"
    type = "Detection"
    data_source = "Sysmon"
    platform = "Windows"
    severity = "High"
    priority = "High"
    false_positives = "Software using weird folders for updates"

  events:
    $reg.metadata.event_type = "REGISTRY_MODIFICATION"
    (
        strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\software\\microsoft\\windows\\currentversion\\run") or
        strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\software\\wow6432node\\microsoft\\windows\\currentversion\\run") or
        strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\run")
    )
    and
    (
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\perflogs") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\programdata") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\windows\\temp") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\temp") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\appdata\\local\\temp") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\appdata\\roaming") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\$recycle.bin") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\users\\default") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\users\\public") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "%temp%") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "%tmp%") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "%public%") or
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "%appdata%") or
        (
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), ":\\users\\") and
            (
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\favorites") or
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\favourites") or
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\contacts") or
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\music") or
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\pictures") or
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\documents") or
                strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\photos")
            )
        )
    )
    not (
        strings.contains(strings.to_lower($reg.target.registry.registry_key), "\\microsoft\\windows\\currentversion\\runonce\\") and
        strings.starts_with(strings.to_lower($reg.principal.process.file.full_path), "c:\\windows\\softwaredistribution\\download\\") and
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "rundll32.exe ") and
        strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "c:\\windows\\system32\\advpack.dll,delnoderundll32") and
        (
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "\\appdata\\local\\temp\\") or
            strings.contains(strings.to_lower($reg.target.registry.registry_value_data), "c:\\windows\\temp\\")
        )
    )

    $reg.principal.hostname = $hostname

  match:
    $hostname over 5m

  outcome:
    //example usage of specifying test user and hostname to adjust risk score
    $risk_score = max(if($reg.principal.user.userid = "user" and $reg.principal.hostname = "hostname", 0, 15))
    $principal_hostname = array_distinct($reg.principal.hostname)
    $principal_process_pid = array_distinct($reg.principal.process.pid)
    $principal_process_file_full_path = array_distinct($reg.principal.process.file.full_path)
    $principal_process_product_specific_process_id = array_distinct($reg.principal.process.product_specific_process_id)
    $principal_user_userid = array_distinct($reg.principal.user.userid)
    $target_registry_key = array_distinct($reg.target.registry.registry_key)
    $target_registry_value_data = array_distinct($reg.target.registry.registry_value_data)
    $log_type = array_distinct(strings.concat($reg.metadata.log_type,"/",$reg.metadata.product_event_type))

  condition:
    $reg
}