Skip to content

Analytic Updates - 01262021 - #1107

Merged
patel-bhavin merged 101 commits into
developfrom
msbuild
Jan 27, 2021
Merged

Analytic Updates - 01262021#1107
patel-bhavin merged 101 commits into
developfrom
msbuild

Conversation

@MHaggis

@MHaggis MHaggis commented Jan 15, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor

New Analytic Stories:

  • Trusted Developer Utilities Proxy Execution
  • Trusted Developer Utilities Proxy Execution MSBuild

New Analytics:

Trusted Developer Utilities Proxy Execution MSBuild

  • Suspicious MSBuild Rename (Passed)
  • Suspicious MSBuild Spawn (Passed)
  • Suspicious msbuild path (Passed)

Trusted Developer Utilities Proxy Execution

  • Suspicious microsoft workflow compiler rename (Passed)
  • Suspicious microsoft workflow compiler usage (Passed)

Suspicious MSHTA Activity

  • Suspicious mshta child process (Passed)
  • Detect MSHTA Url in Command Line (Passed)
  • Detect Rundll32 Inline HTA Execution (Passed)
  • Suspicious mshta spawn (Passed)
  • Detect mshta inline hta execution (Passed)

Ryuk Ransomware

  • NLTest Domain Trust Discovery (Passed)
  • WBAdmin Delete System Backups (Passed)

mhaag-spl
T1127.001 MSbuild
0eba487 
MSbuild detections and test.
@MHaggis MHaggis added the WIP DO NOT MERGE Work in Progress label Jan 15, 2021
mhaag-spl added 8 commits January 15, 2021 15:06
mhaag-spl
Revert "T1127.001 MSbuild"
e27ad13 
This reverts commit 0eba487.
mhaag-spl
Revert "Revert "T1127.001 MSbuild""
9617d4d 
This reverts commit e27ad13.
mhaag-spl
Revert "Revert "Revert "T1127.001 MSbuild"""
fd5e4ad 
This reverts commit 9617d4d.
mhaag-spl
Revert "Revert "Revert "Revert "T1127.001 MSbuild""""
08488e0 
This reverts commit fd5e4ad.
mhaag-spl
MSBuild
2e9bd74 
fixes
mhaag-spl
ID Collision
7414436
mhaag-spl
Update suspicious_msbuild_netconn.yml
bcf56fa
mhaag-spl
MSHTA
28827c7 
Modified inlne mshta execution with the `about` protocol handler.
Added new mshta.exe child process analytic
@MHaggis MHaggis changed the title T1127.001 MSbuild Analytic Updates - 01182021 Jan 18, 2021
@splunk splunk deleted a comment from P4T12ICK Jan 19, 2021
@splunk splunk deleted a comment from P4T12ICK Jan 19, 2021
@splunk splunk deleted a comment from P4T12ICK Jan 19, 2021
@splunk splunk deleted a comment from P4T12ICK Jan 19, 2021
@splunk splunk deleted a comment from P4T12ICK Jan 19, 2021
@splunk splunk deleted a comment from P4T12ICK Jan 19, 2021
@P4T12ICK

P4T12ICK commented Jan 26, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Detect mshta spawning a process ✅

  • diskUsage: 397312
  • runDuration: 11.790000000000001s
  • scanCount: 17702

P4T12ICK
P4T12ICK reviewed Jan 27, 2021
View reviewed changes
Comment thread detections/endpoint/suspicious_msbuild_path.yml Outdated
Comment thread detections/endpoint/suspicious_msbuild_path.yml Outdated
Comment thread detections/endpoint/suspicious_msbuild_rename.yml Outdated
Comment thread detections/endpoint/suspicious_msbuild_spawn.yml
@P4T12ICK

P4T12ICK commented Jan 27, 2021

Copy link
Copy Markdown
Collaborator

This PR was created by Automated Detection Testing Service 🤖

Tested detections:

Detect renamed msbuild execution ✅

  • diskUsage: 299008
  • runDuration: 2.657s
  • scanCount: 3205

P4T12ICK
P4T12ICK previously approved these changes Jan 27, 2021
View reviewed changes

@P4T12ICK P4T12ICK left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

github-actions Bot and others added 2 commits January 27, 2021 17:14
@github-actions
Branch was auto-updated.
c050d18
mhaag-spl
Update suspicious_msbuild_path.yml
5b86943 
Modified to exclude all version path. Updated false positive info and description to reflect Visual Studio usage of msbuild.
@MHaggis
MHaggis requested a review from P4T12ICK January 27, 2021 19:39
@patel-bhavin
patel-bhavin merged commit 06033d9 into develop Jan 27, 2021
@delete-merged-branch
delete-merged-branch Bot deleted the msbuild branch January 27, 2021 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@patel-bhavin patel-bhavin patel-bhavin approved these changes
@P4T12ICK P4T12ICK Awaiting requested review from P4T12ICK P4T12ICK is a code owner

Assignees

No one assigned

Labels

WIP DO NOT MERGE Work in Progress

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@MHaggis @P4T12ICK @patel-bhavin