Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Content] 8.3 - Add Investigation Guides #1937

Merged
merged 8 commits into from
May 19, 2022
Merged

[Security Content] 8.3 - Add Investigation Guides #1937

merged 8 commits into from
May 19, 2022

Conversation

w0rk3r
Copy link
Contributor

@w0rk3r w0rk3r commented Apr 22, 2022

Summary

Adds Investigation guides to the following rules:

  • Enumeration of Administrator Accounts
  • Account Discovery Command via SYSTEM Account (Also renames the file to match the new title)
  • File and Directory Discovery
  • Windows Network Enumeration
  • Peripheral Device Discovery
  • External IP Lookup from Non-Browser Process
  • Enumeration of Privileged Local Groups Membership
  • Remote System Discovery Commands
  • Security Software Discovery using WMIC
  • Whoami Process Activity

@w0rk3r w0rk3r added Rule: Tuning tweaking or tuning an existing rule OS: Windows windows related rules Domain: Endpoint Security Content labels Apr 22, 2022
@w0rk3r w0rk3r self-assigned this Apr 22, 2022
Mikaayenson
Mikaayenson approved these changes Apr 25, 2022
View reviewed changes
Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good @w0rk3r !

  • I added a couple suggestions that affect multiple files.
  • There was one file that had a typo in the description
    Other than that, LGTM.

rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_net_view.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_privileged_localgroup_membership.toml Outdated Show resolved Hide resolved
rules/windows/discovery_privileged_localgroup_membership.toml Outdated Show resolved Hide resolved
rules/windows/discovery_remote_system_discovery_commands_windows.toml Show resolved Hide resolved
imays11
imays11 approved these changes May 6, 2022
View reviewed changes
Copy link
Contributor

@imays11 imays11 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great work

terrancedejesus
terrancedejesus approved these changes May 6, 2022
View reviewed changes
Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

nastasha-solomon
nastasha-solomon reviewed May 9, 2022
View reviewed changes
Copy link
Contributor

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for all the work you've done on these @w0rk3r! It may look like I've left a lot of edits, but they're mostly minor tweaks. Thanks again!

rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_net_view.toml Outdated Show resolved Hide resolved
rules/windows/discovery_net_view.toml Show resolved Hide resolved
rules/windows/discovery_net_view.toml Outdated Show resolved Hide resolved
rules/windows/discovery_file_dir_discovery.toml Outdated Show resolved Hide resolved
rules/windows/discovery_command_system_account.toml Show resolved Hide resolved
joepeeples
joepeeples reviewed May 12, 2022
View reviewed changes
Copy link
Contributor

@joepeeples joepeeples left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a few more comments, in addition to the other reviewers. Thanks for your help!

rules/windows/discovery_command_system_account.toml Outdated Show resolved Hide resolved
rules/windows/discovery_command_system_account.toml Outdated Show resolved Hide resolved
rules/windows/discovery_post_exploitation_external_ip_lookup.toml Outdated Show resolved Hide resolved
rules/windows/discovery_file_dir_discovery.toml Outdated Show resolved Hide resolved
rules/windows/discovery_privileged_localgroup_membership.toml Outdated Show resolved Hide resolved
rules/windows/discovery_privileged_localgroup_membership.toml Show resolved Hide resolved
@w0rk3r
Copy link
Contributor Author

w0rk3r commented May 16, 2022

Hey @nastasha-solomon @joepeeples, I've applied the suggestions across the guides and also the changes done in the refactor PR. This one is ready for a final review. Thanks!

nastasha-solomon
nastasha-solomon reviewed May 16, 2022
View reviewed changes
Copy link
Contributor

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks great, thanks @w0rk3r ! Just left one comment that can be applied across the board if you accept it. Thanks!

rules/windows/discovery_admin_recon.toml Show resolved Hide resolved
Samirbous
Samirbous approved these changes May 17, 2022
View reviewed changes
Copy link
Contributor

@Samirbous Samirbous left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

left few suggestions, otherwise LGTM

rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Show resolved Hide resolved
rules/windows/discovery_command_system_account.toml Show resolved Hide resolved
rules/windows/discovery_net_view.toml Outdated Show resolved Hide resolved
rules/windows/discovery_peripheral_device.toml Show resolved Hide resolved
rules/windows/discovery_peripheral_device.toml Outdated Show resolved Hide resolved
rules/windows/discovery_post_exploitation_external_ip_lookup.toml Outdated Show resolved Hide resolved
rules/windows/discovery_security_software_wmic.toml Outdated Show resolved Hide resolved
@nastasha-solomon nastasha-solomon self-requested a review May 18, 2022 18:41
nastasha-solomon
nastasha-solomon approved these changes May 19, 2022
View reviewed changes
Copy link
Contributor

@nastasha-solomon nastasha-solomon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left a handful of super minor edits. Looks good to go otherwise! Thanks @w0rk3r !

rules/windows/discovery_command_system_account.toml Show resolved Hide resolved
rules/windows/discovery_file_dir_discovery.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Outdated Show resolved Hide resolved
rules/windows/discovery_net_view.toml Outdated Show resolved Hide resolved
rules/windows/discovery_peripheral_device.toml Outdated Show resolved Hide resolved
rules/windows/discovery_admin_recon.toml Show resolved Hide resolved
rules/windows/discovery_net_view.toml Show resolved Hide resolved
rules/windows/discovery_peripheral_device.toml Show resolved Hide resolved
rules/windows/discovery_remote_system_discovery_commands_windows.toml Show resolved Hide resolved
rules/windows/discovery_security_software_wmic.toml Show resolved Hide resolved
@w0rk3r w0rk3r merged commit a1bdf2b into main May 19, 2022
@w0rk3r w0rk3r deleted the investigation_guides_8.3_1 branch May 19, 2022 16:23
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
d156d35 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

Removed changes from:
- rules/windows/discovery_net_command_system_account.toml

(selectively cherry picked from commit a1bdf2b)
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
fea19ee 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

Removed changes from:
- rules/windows/discovery_net_command_system_account.toml

(selectively cherry picked from commit a1bdf2b)
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
db448bf 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

Removed changes from:
- rules/windows/discovery_net_command_system_account.toml

(selectively cherry picked from commit a1bdf2b)
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
1827720 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit a1bdf2b)
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
07ea5b7 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit a1bdf2b)
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
9cbf60a 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit a1bdf2b)
protectionsmachine pushed a commit that referenced this pull request May 19, 2022
@w0rk3r @github-actions
[Security Content] 8.3 - Add Investigation Guides (#1937)
5459c43 
* 8.3 - Add Investigation Guides

* Apply suggestions

* Apply the refactor

* Apply suggestions from Samir

* .

Co-authored-by: Colson Wilhoit <[email protected]>

(cherry picked from commit a1bdf2b)
@terrancedejesus terrancedejesus mentioned this pull request Jun 20, 2022
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nastasha-solomon nastasha-solomon nastasha-solomon approved these changes

@Samirbous Samirbous Samirbous approved these changes

@terrancedejesus terrancedejesus terrancedejesus approved these changes

@imays11 imays11 imays11 approved these changes

@Mikaayenson Mikaayenson Mikaayenson approved these changes

@brokensound77 brokensound77 Awaiting requested review from brokensound77

@DefSecSentinel DefSecSentinel Awaiting requested review from DefSecSentinel

@jmikell821 jmikell821 Awaiting requested review from jmikell821

@benironside benironside Awaiting requested review from benironside

@joepeeples joepeeples Awaiting requested review from joepeeples

Assignees

@w0rk3r w0rk3r

Labels
backport: auto Domain: Endpoint OS: Windows windows related rules Rule: Tuning tweaking or tuning an existing rule Security Content
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@w0rk3r @Mikaayenson @imays11 @Samirbous @nastasha-solomon @joepeeples @terrancedejesus @DefSecSentinel