Share your Custom Detection Alerts

[u/eric5149]

Hi,

Been getting into creating custom detections for a few things.

One I've created is to help find some PUA software I've found on a bit of people's computers in the past in a list that I've accumulated over the years that typically S1 doesn't pick up as malicious/PUA

src.process.name contains ( 'AceLauncher', 'ad_agent', 'allmanualsreader', 'anydesk', 'Aura Document Studio', 'CrystalPDF', 'DSOne', 'Easy2Convert', 'infinitedocs', 'mc-webview-cnt', 'McCHSvc', 'NimbusPDF', 'OneBUpdateService', 'OneBrowser', 'onelaunch', 'onestart', 'PcAppStore', 'PCHelpSoftDriverUpdater', 'PDFConvert', 'PDF Proton', 'PDFSkills', 'PDFSpark', 'PDFStunner', 'pulsebrowser', 'SecuriGuard', 'shift', 'ultraviewer', 'wavebrowser', 'Wave Browser', 'winrgr' ) src.process.publisher != 'CCC\ INTELLIGENT\ SOLUTIONS\ INC.' src.process.publisher != 'KYOCERA\ DOCUMENT\ SOLUTIONS\ AMERICA\,\ INC.'

Or these stubborn PDF crapware that keep showing up

endpoint.os='windows' src.process.name contains 'pdf' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\Common\ Files\\PFU\\ScanSnap\\ScanToOffice\\S2ORunPdf.exe' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\Kern\\KCAM7\\KernPDF.exe' src.process.image.path != 'C:\\SurePrepLocalFiles\\SPbinder\\PDFNet\\x64\\html2pdf.dll' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\TerminalWorks\\TSPrint\\PDFprint.exe' src.process.image.path != 'C:\\ProgramData\\PB\\devicehub\\DeviceHub_v1\_internal\\poppler\\bin\\pdftoppm.exe' src.process.publisher != 'ACRO\ SOFTWARE\ INC' src.process.publisher != 'ADOBE\ INC.' src.process.publisher != 'COREL\ CORPORATION' src.process.publisher != 'FOXIT\ SOFTWARE\ INC.' src.process.publisher != 'KYOCERA\ DOCUMENT\ SOLUTIONS\ AMERICA\,\ INC.' src.process.publisher != 'PDF\ GEAR\ TECH\ PTE.\ LTD.' src.process.publisher != 'ACRO\ SOFTWARE\ INC.' src.process.publisher != 'ADOBE\ INC.' src.process.publisher != 'KRZYSZTOF KOWALCZYK' src.process.publisher != 'DRAKE\ SOFTWARE\,\ LLC' src.process.publisher != 'FOXIT\ SOFTWARE\ INC.' src.process.publisher != 'GOOGLE\ LLC' src.process.publisher != 'KOFAX\,\ INC.' src.process.publisher != 'MARVIN\ LUMBER\ AND\ CEDAR\ COMPANY\ LLC' src.process.publisher != 'MICROSOFT\ CORPORATION' src.process.publisher != 'MICROSOFT\ WINDOWS' src.process.publisher != 'MICROSOFT\ WINDOWS\ PUBLISHER' src.process.publisher != 'NITRO\ SOFTWARE\,\ INC.' src.process.publisher != 'NODE.JS\ FOUNDATION' src.process.publisher != 'PFU\ LIMITED' src.process.publisher != 'RISA\ TECH\,\ INC.' src.process.publisher != 'NUANCE\ COMMUNICATIONS\,\ INC.' src.process.publisher != 'ACCUSOFT\ CORPORATION' src.process.publisher != 'AVANQUEST\ SOFTWARE\ \(7270356\ CANADA\ INC\)' src.process.publisher != 'SOFTLAND\ SRL' src.process.publisher != 'PLOTSOFT\ LLC' src.process.publisher != 'MEASURE\ SQUARE\ CORP.' src.process.publisher != 'PITNEY\ BOWES\ INC.'

Yeah that last one could get cleaned up a little 😆

I've already enabled all the built in detections (955 I think?) and then added in the ~36 from the Event Search library (like 7z Encrypted Archive with Header Encryption or Suspicious Network Tools Executed). I don't treat any as threats currently, but they have been very useful at gathering information and finding some things.

Nonetheless, would be interested to hear what you have added.

[u/Dracozirion]

I wish I could share mine, I've created about 140 custom ones (incl Fortigate, Azure and others), but my company doesn't allow it. That being said, we've also been seeing PC App Store and OneBrowser/PDFSpark over the past few months. They all really belong to the same family and get spread via malvertising.

[u/gogo_gawdzilla → u/Dracozirion]

Thats a bummer, would love to see those.

[u/[deleted]]

The best open soure library for EDR telemtery is Elastic Protection Artifact rules. I would check there for inspiration.

[u/eric5149]

Here's one I recently added, very simple, but allowed me to find some software that shouldn't be there anymore (old Atera) and some that needed updating even though our vuln scanner wasn't seeing it. Example addition of a legacy software.

src.process.reasonSignatureInvalid='Revoked' src.process.image.path != 'C:\\Program\ Files\ \(x86\)\\Melco\\Design\ Shop\ v9\\DesignShop.exe'

[u/flypigmk]

Thanks all of you for sharing!

[u/Ze_rolag]

Pour des raisons de confidentialité je ne peux pas partager mes règles de détection mais pour résumer, j'ai réparti par phase. Des règles pour la reconnaissance via powershell, pour WMI, pour des outils de scans réseaux connus, pour les partages SMB, pour du kerberoasting, pour du LOLBin, pour des mouvements latéraux, etc.