Suspicious LOLBINs User Agent

title: Security Eventlog Cleared				# описание правила
id: f2f01843-e7b8-4f95-a35a-d23584476423			# идентификатор правила
description: Some threat groups tend to delete the local 'Security' Eventlog using certain utitlities							# описание детекта
tags:								# тег правила
- attack.defense_evasion					# тактика MITRE ATT&CK
- attack.t1070							# техника MITRE ATT&CK
- car.2016-04-002						# аналитика
author: Florian Roth
date: 2017/02/19
logsource:							# источник обнаружения
product: windows						# продукт
service: security						# сервис получения событий
detection:							# процесс обнаружения
selection:
EventID:
- 517
- 1102
condition: selection
falsepositives:
- Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
- System provisioning (system reset before the golden image creation)
level: high

title: Suspicious LOLBINs User Agent			# описание правила
id: 04427190-98d6-4bba-a0fb-5db3b73ec245		# уникальный идентификатор
description: Detect suspicious usage of LOLBIN tools	# описание детекта
date: 2021/04/05					# дата создания правила
modified: 2021/04/05					# дата последнего изменения
references:						# список источников
  - https://lolbas-project.github.io/lolbas/Binaries/Certreq/
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil//
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
  - https://lolbas-project.github.io/lolbas/Binaries/Msiexec
tags:							# тег правила
  - attack.comand_and_control				# тактика MITRE ATT&CK
  - attack.t1105					# техника MITRE ATT&CK
logsource:						# источник журнала
  category: webserver					# категория журнала
detection:						# процесс обнаружения
  certreq_ua:						# скачивание ПО с помощью certreq
    c-useragent|startswith:
      - 'Mozilla/4.0 (compatible; Win32; NDES client')
  powershell_iwr_ua:					# скачивание ПО с помощью PowerShell
    c-useragent|contains|all:
      - 'Mozilla/'
      - 'WindowsPowerShell/'
  powershell_iwr_whitelists:
    - c-uri:
      - '/adfs/probe'
    - curl|endswith:
      - '.crl'
  certutil_ua:						# скачивание ПО с помощью certutil
    c-useragent|startswith:
      - 'Microsoft-CryptoAPI/'
  certutil_whitelist:
    - cs-host|startswith:
        - 'ocsp.'
    - cs-host:
      - 'ctldl.windowsupdate.com'
    - cs(Content-Type):
      - 'application/pkix-cert'
      - 'application/pkix-crl'
      - 'application/pkcs7-mime'
      - 'application/ocsp-response'
      - 'application/timestamp-reply'
    - c-uri|endswith:
      - '.crl'
      - '.crt'
      - '.p7c'
  regsvr32_ua:						# скачивание ПО с помощью regsvr32
    c-useragent|startswith:
      - 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E'
  regsvr32_whitelist:
    c-useragent|contains:
     - 'MSOffice'
  msiexec_ua:						# скачивание ПО с помощью msiexec
    c-useragent:
      - "Windows Installer"
  condition: certreq_ua or (powershell_iwr_ua and not powershell_iwr_whitelists) or (certutil_ua and not certutil_whitelist) or (regsvr32_ua and not regsvr32_whitelist) or msiexec_ua
fields:							# оценка события
  - c-uri
  - client_ip
  - fields
falsepositives:
  - certutil.exe can upload other types of crypto files, in that case, the need to be added to the whitelist.
  - Powershell iwr commandlet can later be used for other internal windows tasks.
level: medium

source = 'webaccess log' and (userAgent ~ 'Mozilla/4.0 (compatible; Win32; NDES client') OR ((userAgent ~ 'Mozilla/' and userAgent ~ 'WindowsPowerShell/') AND (url !~ '/adfs/probe' and url NOT MATCH '\.crl$')) OR ((userAgent MATCH '^Microsoft-CryptoAPI/') and (url NOT MATCH '^http?://ocsp\.' and url !~ 'ctldl.windowsupdate.com' and url !~ "www.download.windowsupdate.com" and mime != 'application/pkix-cert' and mime != 'application/pkix-crl' and mime != 'application/pkcs7-mime' and mime != 'application/ocsp-response' and mime != 'application/timestamp-reply' and url NOT MATCH '\.crl$' and url NOT MATCH '\.crt$' and url NOT MATCH '\.p7c$')) OR ((userAgent ~ 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E') AND (userAgent !~ 'Office' and url !~ 'oneclient.sfx.ms' and url !~ 'live.com')) OR (userAgent = 'Windows Installer').