Potential Persistence Via Security Descriptors - ScriptBlock

Status: test
Severity: high
Log source: category ps_script, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique
Privilege Escalation	No specific technique
Defense Impairment	No specific technique

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Potential Persistence Via Security Descriptors - ScriptBlock
id: 2f77047c-e6e9-4c11-b088-a3de399524cd
status: test
description: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.
references:
    - https://github.com/HarmJ0y/DAMP
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-05
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'win32_Trustee'
            - 'win32_Ace'
            - '.AccessMask'
            - '.AceType'
            - '.SetSecurityDescriptor'
        ScriptBlockText|contains:
            - '\Lsa\JD'
            - '\Lsa\Skew1'
            - '\Lsa\Data'
            - '\Lsa\GBG'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ScriptBlockText|contains|all:
        - 'win32_Trustee'
        - 'win32_Ace'
        - '.AccessMask'
        - '.AceType'
        - '.SetSecurityDescriptor'
    ScriptBlockText|contains:
        - '\Lsa\JD'
        - '\Lsa\Skew1'
        - '\Lsa\Data'
        - '\Lsa\GBG'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`.AccessMask` `.AceType` `.SetSecurityDescriptor` `\Lsa\Data` `\Lsa\GBG` `\Lsa\JD` `\Lsa\Skew1` `win32_Ace` `win32_Trustee`	`field:"ScriptBlockText" kind:match`