Connection to WebService by a Signed Binary Proxy

[rule]
description = """
Identifies DNS queries to common web services by a signed Microsoft binary execution proxy. Adversaries may implement
command and control communications that use common web services in order to hide their activity.
"""
id = "c567240c-445b-4000-9612-b5531e21e050"
license = "Elastic License v2"
name = "Connection to WebService by a Signed Binary Proxy"
os_list = ["windows"]
reference = [
    "https://www.elastic.co/security-labs/doing-time-with-the-yipphb-dropper",
    "https://www.elastic.co/security-labs/globally-distributed-stealers",
]
version = "1.0.70"

query = '''
sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*") and
    (
     process.name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", "vbc.exe",
                     "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe","RegSvcs.exe",
                     "msxsl.exe", "xwizard.exe", "csc.exe", "net.exe", "certutil.exe", "ssh.exe",
                     "scp.exe", "msiexec.exe", "bitsadmin.exe") or
     process.pe.original_file_name : ("wscript.exe", "cscript.exe", "regsvr32.exe", "mshta.exe", "rundll32.exe", 
                                      "vbc.exe", "msbuild.exe", "wmic.exe", "cmstp.exe", "RegAsm.exe", "installutil.exe", 
                                      "RegSvcs.exe", "msxsl.exe", "xwizard.exe", "csc.exe", "net.exe",
                                      "certutil.exe", "ssh.exe", "scp.exe", "msiexec.exe", "bitsadmin.exe") or
     process.code_signature.subject_name == "OpenJS Foundation" or
     process.executable : ("?:\\Program Files\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Program Files (x86)\\Java\\jre*\\bin\\javaw.exe",
                           "?:\\Users\\*\\AppData\\*\\jre\\bin\\javaw.exe",
                           "?:\\ProgramData\\*\\javaw.exe",
                           "?:\\ProgramData\\javaw.exe",
                           "?:\\Users\\Public\\*\\javaw.exe",
                           "?:\\Windows\\Microsoft.NET\\*.exe") or
     ((process.name : "powershell.exe" or process.pe.original_file_name == "PowerShell.EXE") and process.args_count >= 2)
     ) and
     not (process.name : "rundll32.exe" and process.command_line : "*davclnt.dll,DavSetCookie*") and
     not (process.parent.executable : ("?:\\Program Files\\Microsoft SQL Server\\MSSQL*.EXE", "?:\\Program Files\\WindowsApps\\Microsoft.*.exe") and
          process.name : ("powershell.exe", "pwsh.exe")) and
     not (process.name : "java.exe" and process.parent.executable : "?:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe") and
     not (process.name : "java.exe" and process.args_count >= 5) and
     not process.executable : ("?:\\Program Files\\Microsoft Visual Studio\\*\\MSBuild.exe", "?:\\Program Files (x86)\\Microsoft Visual Studio\\*\\MSBuild.exe") and
     not (process.name : "javaw.exe" and
          process.parent.executable : ("?:\\Program Files\\QZ Tray\\qz-tray.exe", "?:\\Program Files (x86)\\PGP Tool\\pgptool.exe", "?:\\Program Files\\OWASP\\Zed Attack Proxy\\ZAP.exe")) and
     not (process.name : "rundll32.exe" and process.args : "?:\\WINDOWS\\Installer\\MSI*.tmp,zzzzInvokeManagedCustomActionOutOfProc") and
     /* BlueIris - Camera IOT monitoring sw using telegram to upload pictures */
     not (process.name : "curl.exe" and process.parent.name : "cmd.exe" and process.parent.args : "C:\\BlueIris\\Telegram-Upload\\upload.cmd ") and
     not (process.name : "curl.exe" and process.parent.executable : "?:\\Program Files\\Neovim\\bin\\nvim.exe") and
     not (process.code_signature.subject_name in ("EFI Software (Electronics for Imaging, Inc.)", "Fiery, LLC", "EFI Software (Electronics for Imaging Inc.)") and
          process.code_signature.trusted == true) and
     not process.hash.sha256 in ("4337adaa6b26ea9ad6d7bd0871d49531442ba3d8a24aecc1a5a0f26378de4f78", "56b1c3941b781a00e3cd0df0c523242a4521930964f889c4b8baecd282c419b3") and
     not process.executable :
                       ("?:\\Program Files\\Git\\mingw64\\bin\\curl.exe",
                        "?:\\Program Files\\Fiery\\Components\\Common files\\curl.exe",
                        "?:\\Program Files\\Fiery\\Fiery Command WorkStation\\curl.exe",
                        "?:\\Program Files\\Microsoft Visual Studio\\*\\node.exe") and
     not (process.name : "rundll32.exe" and
          process.args : ("?:\\Program Files\\Microsoft Office\\root\\*",
                          "?:\\PROGRA~2\\MICROS~1\\Office*.CPL*",
                          "?:\\Program Files (x86)\\F5 VPN\\*",
                          "?:\\Program Files\\F5 VPN\\*",
                          "?:\\Program Files (x86)\\Microsoft Office\\root\\*",
                          "?:\\Windows\\system32\\shell32.dll,Control_RunDLL",
                          "?:\\WINDOWS\\SYSTEM32\\EDGEHTML.dll,#141",
                          "?:\\WINDOWS\\System32\\shell32.dll,SHCreateLocalServerRunDll",
                          "C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll,",
                          "?:\\PROGRA~2\\MICROS~2\\Office*\\*.CPL*",
                          "?:\\Windows\\System32\\mshtml.dll,PrintHTML", 
                          "?:\\PROGRA~?\\MICROS~?\\Office??\\MLCFG32.CPL,@0", 
                          "AppXDeploymentExtensions.OneCore.dll,ShellRefresh",
                          "C:\\Windows\\System32\\LogiLDA.dll,LogiFetch",
                          "C:\\Windows\\System32\\mshtml.dll,PrintHTML*")) and
      not process.parent.executable : "C:\\Program Files\\Microsoft SQL Server\\150\\DTS\\Binn\\ISServerExec.exe" and
      not process.parent.executable : ("C:\\Program Files\\Logi\\LogiBolt\\LogiBolt.exe",
                                       "C:\\Program Files (x86)\\Avaya\\Avaya one-X Agent\\OneXAgentUI.exe",
                                       "C:\\Program Files (x86)\\HP\\StatusAlerts\\bin\\HPStatusAlerts.exe",
                                       "C:\\Program Files\\AutoHotkey\\AutoHotkeyU64.exe",
                                       "C:\\Program Files\\Microsoft VS Code\\Code.exe") and
      not (process.name : "powershell.exe" and process.parent.name : "wsmprovhost.exe" and
           process.command_line : "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -Version 5.1 -s -NoLogo -NoProfile") and
      not (process.name : "curl.exe" and process.parent.name : "powershell.exe" and
           process.command_line : "\"C:\\Windows\\System32\\curl.exe\" -L -s -H \"User-Agent: PowerShell\" -H \"Accept: application/vnd.github+json\" https://api.github.com/repos/PowerShell/PowerShell/releases") and
      not (process.name : "curl.exe" and process.args :  ("DNS: %{time_namelookup}s\\nConnect: %{time_connect}s\\nStartTransfer: %{time_starttransfer}s\\nTotal: %{time_total}s\\n", "https://login.microsoftonline.com/*"))
  ]
  [dns where
    dns.question.name :
    (
        "raw.githubusercontent.*",
        "pastebin.*",
        "paste.ee",
        "ghostbin.com",
        "drive.google.com",
        "?.docs.live.net",
        "api.dropboxapi.*",
        "content.dropboxapi.*",
        "*dl.dropboxusercontent.*",
        "api.onedrive.com",
        "*.onedrive.org",
        "onedrive.live.com",
        "storage.googleapis.com",
        "www.googleapis.com",
        "filebin.net",
        "*.ngrok.io",
        "ngrok.com",
        "*.portmap.*",
        "*serveo.net",
        "*localtunnel.me",
        "*pagekite.me",
        "*localxpose.io",
        "*notabug.org",
        "rawcdn.githack.*",
        "paste.nrecom.net",
        "zerobin.net",
        "controlc.com",
        "requestbin.net",
        "slack.com",
        "api.slack.com",
        "slack-redir.net",
        "slack-files.com",
        "cdn.discordapp.com",
        "discordapp.com",
        "discord.com",
        "apis.azureedge.net",
        "cdn.sql.gg",
        "?.top4top.io",
        "top4top.io",
        "www.uplooder.net",
        "*.cdnmegafiles.com",
        "transfer.sh",
        "updates.peer2profit.com",
        "api.telegram.org",
        "t.me",
        "meacz.gq",
        "rwrd.org",
        "*.publicvm.com",
        "*.blogspot.com",
        "api.mylnikov.org",
        "script.google.com",
        "script.googleusercontent.com",
        "paste4btc.com",
        "workupload.com",
        "temp.sh",
        "filetransfer.io",
        "gofile.io",
        "store?.gofile.io",
        "tiny.one",
        "api.notion.com",
        "graph.microsoft.com",
        "*.sharepoint.com",
        "*upload.ee",
        "bit.ly",
        "t.ly",
        "cutt.ly",
        "mbasic.facebook.com",
        "login.live.com",
        "login.microsoftonline.com",
        "api.gofile.io",
        "file.io",
        "api.anonfiles.com",
        "api.trello.com",
        "api.notion.com",
        "gist.githubusercontent.com",
        "dpaste.com",
        "*azurewebsites.net",
        "*.zulipchat.com",
        "*.4shared.com",
        "filecloud.me",
        "i.ibb.co",
        "files.catbox.moe",
        "*.getmyip.com",
        "files.pythonhosted.org",
        "mockbin.org",
        "webhook.site",
        "run.mocky.io",
        "*infinityfreeapp.com",
        "free.keep.sh",
        "tinyurl.com",
        "ftpupload.net",
        "lobfile.com",
        "*.ngrok-free.app",
        "www.myexternalip.com",
        "*.aternos.me",
        "cdn??.space",
        "*.pcloud.com",
        "mediafire.zip",
        "urlz.fr",
        "api.github.com",
        "rentry.co",
        "*.b-cdn.net", 
        "pastecode.dev",
        "the.earth.li",
        "*.trycloudflare.com",
        "shorturl.at",
        "bitly.cx",
        "*.netlify.app", 
        "*.supabase.co",
        "envs.sh"
    ) and
    /* common to use powershell script by Microsoft Cloud sysadmins */
    not (process.name : ("powershell.exe", "pwsh.exe", "javaw.exe", "node.exe", "dfsvc.exe", "rundll32.exe") and
         dns.question.name : ("graph.microsoft.com", "*.sharepoint.com", "login.microsoftonline.com", "login.live.com",
                              "raw.githubusercontent.com", "api.github.com", "storage.googleapis.com")) and
    not (dns.question.name : "rev-resolve.azurewebsites.net" and process.name : "wscript.exe") and
    not (process.name : "powershell.exe" and dns.question.name like "*.azurewebsites.net") and
    not (process.name == "dfsvc.exe" and dns.question.name in ("innateclient.azurewebsites.net", "hybridconfigwizard.azurewebsites.net", "tmtdist.azurewebsites.net")) and
    not (process.executable : ("?:\\Program Files\\Git\\mingw64\\bin\\curl.exe", "C:\\Users\\*\\.babun\\cygwin\\bin\\curl.exe", "C:\\Users\\*\\Git\\mingw64\\bin\\curl.exe", "C:\\curl\\bin\\curl.exe") and
         dns.question.name in ("api.github.com", "raw.githubusercontent.com", "graph.microsoft.com"))
  ]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1071"
name = "Application Layer Protocol"
reference = "https://attack.mitre.org/techniques/T1071/"
[[threat.technique.subtechnique]]
id = "T1071.004"
name = "DNS"
reference = "https://attack.mitre.org/techniques/T1071/004/"


[[threat.technique]]
id = "T1102"
name = "Web Service"
reference = "https://attack.mitre.org/techniques/T1102/"


[threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"

[internal]
min_endpoint_version = "7.15.0"