New category file_access

[redsand]

Hi, I noticed a new category "file_access" but am not able to determine what the proper config settings should be for sigmac yaml translation/config. Happen to have any sample logs?

In reference to: 91cb43db-302a-47e3-b3c8-7ede481e27bf

[redsand]

Found another with: file_rename

[frack113]

As it is ETW:
RULE_ID: bbfd974c-248e-4435-8de6-1e938c79c5c1

Apr 13 15:44:53 DESKTOP-8JCQO81 AURORA: Trace MODULE: EventDistributor MESSAGE: Received event EVENT: "Company: Microsoft Corporation  Computer: DESKTOP-8JCQO81  Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}  Description: Windows Explorer  EventID: 27  Execution_ProcessID: 3448  Execution_ThreadID: 7840  ExtraInformation: 0x0  FileCreationDate: 2022-04-06T09:35:06  FileKey: 0xFFFFC0844DE10800  FileObject: 0xFFFFA78BA4A2A590  FilePath: \\Device\\HarddiskVolume4\\temp\\malware.dll  FileVersion: 10.0.19041.1620 (WinBuild.160101.0800)  Hashes: MD5=B1B2EEE7120B376CBE6B3813B9DA76E8,SHA1=C769B82F377CE176BFDC3CBF6433D545E3F7FF71,SHA256=D62AB0F58AC1D081AD5528EAD1A1DCC0F239A2E4CDD02C7E2D3B88290E34F3EE,IMPHASH=C293497DF792EBFC8FD3676A54AAE635  Image: C:\\Windows\\explorer.exe  ImageAge: 07d08h09m29s  InfoClass: 10  Irp: 0xFFFFA78BA967A548  IssuingThreadId: 7840  Keywords: 0x8000000000000800  Level: 4  Opcode: 0  OriginalFileName: EXPLORER.EXE  OriginalFilename: C:\\temp\\malware.txt  Product: Microsoft® Windows® Operating System  Provider_Guid: {EDD08927-9CC4-4E65-B970-C2560FB5C289}  Provider_Name: Microsoft-Windows-Kernel-File  Security_UserID: S-1-5-21-2360441858-3879321942-2637521084-500  TargetFilename: C:\\temp\\malware.dll  Task: 27  TimeCreated_SystemTime: 2022-04-13T17:44:50.0811082+02:00  Timestamp: 2040-04-21T16:16:17  User: SIMU\\Administrateur  Version: 1  " SOURCE: WinEventLog:Microsoft-Windows-Kernel-File/KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH
Apr 13 15:44:53 DESKTOP-8JCQO81 AURORA: Notice MODULE: Sigma MESSAGE: Sigma match found RULE_TITLE: Rename Common File to DLL File RULE_AUTHOR: frack113 RULE_DESCRIPTION: Detects cases in which a file gets renamed to .dll, which often happens to bypass perimeter protection RULE_FALSEPOSITIVES: Application installation RULE_ID: bbfd974c-248e-4435-8de6-1e938c79c5c1 RULE_LEVEL: medium RULE_LINK: https://github.com/SigmaHQ/sigma/blob/0.21-44-gaa96f8003/rules/windows/file_rename/file_rename_win_not_dll_to_dll.yml RULE_MODIFIED: 2022/03/13 RULE_PATH: public\windows\file_rename\file_rename_win_not_dll_to_dll.yms RULE_REFERENCES: https://twitter.com/ffforward/status/1481672378639912960, https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036/T1036.md#atomic-test-1---system-file-copied-to-unusual-location RULE_SIGTYPE: public COMPANY: Microsoft Corporation COMPUTER: DESKTOP-8JCQO81 CORRELATION_ACTIVITYID: {00000000-0000-0000-0000-000000000000} DESCRIPTION: Windows Explorer EVENTID: 27 EXECUTION_THREADID: 7840 EXTRAINFORMATION: 0x0 FILECREATIONDATE: 2022-04-06T09:35:06 FILEKEY: 0xFFFFC0844DE10800 FILEOBJECT: 0xFFFFA78BA4A2A590 FILEPATH: \Device\HarddiskVolume4\temp\malware.dll FILEVERSION: 10.0.19041.1620 (WinBuild.160101.0800) HASHES: MD5=B1B2EEE7120B376CBE6B3813B9DA76E8,SHA1=C769B82F377CE176BFDC3CBF6433D545E3F7FF71,SHA256=D62AB0F58AC1D081AD5528EAD1A1DCC0F239A2E4CDD02C7E2D3B88290E34F3EE,IMPHASH=C293497DF792EBFC8FD3676A54AAE635 IMAGE: C:\Windows\explorer.exe IMAGEAGE: 07d08h09m29s INFOCLASS: 10 IRP: 0xFFFFA78BA967A548 ISSUINGTHREADID: 7840 KEYWORDS: 0x8000000000000800 LEVEL: 4 MATCH_STRINGS: .dll in TargetFilename OPCODE: 0 ORIGINALFILENAME: EXPLORER.EXE ORIGINALFILENAME: C:\temp\malware.txt PROCESSID: 3448 PRODUCT: "Microsoft® Windows® Operating System" PROVIDER_GUID: {EDD08927-9CC4-4E65-B970-C2560FB5C289} PROVIDER_NAME: Microsoft-Windows-Kernel-File SECURITY_USERID: S-1-5-21-2360441858-3879321942-2637521084-500 TARGETFILENAME: C:\temp\malware.dll TASK: 27 TIMECREATED_SYSTEMTIME: 2022-04-13T17:44:50.0811082+02:00 TIMESTAMP: 2040-04-21T16:16:17 USER: SIMU\Administrateur VERSION: 1

RULE_ID: 91cb43db-302a-47e3-b3c8-7ede481e27bf

Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Trace MODULE: EventDistributor MESSAGE: Received event EVENT: "CommandLine: \"C:\\WINDOWS\\system32\\cmd.exe\"   Computer: DESKTOP-8JCQO81  Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}  CreateAttributes: 0x0  CreateOptions: 0x1200000  EventID: 12  Execution_ProcessID: 8500  Execution_ThreadID: 2588  FileName: \\Device\\HarddiskVolume4\\Users\\administrateur\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\wk02n0s0.default-release\\cookies.sqlite  FileObject: 0xFFFFA78BABF12220  Hashes: MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18  Image: C:\\Windows\\System32\\cmd.exe  Irp: 0xFFFFA78BAA1B50F8  IssuingThreadId: 2588  Keywords: 0x80000000000000a0  Level: 4  Opcode: 0  ParentCommandLine: C:\\WINDOWS\\Explorer.EXE /NoUACCheck  ParentImage: C:\\Windows\\explorer.exe  Provider_Guid: {EDD08927-9CC4-4E65-B970-C2560FB5C289}  Provider_Name: Microsoft-Windows-Kernel-File  Security_UserID: S-1-5-21-2360441858-3879321942-2637521084-500  ShareAccess: 0x7  TargetFilename: C:\\Users\\administrateur\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\wk02n0s0.default-release\\cookies.sqlite  Task: 12  TimeCreated_SystemTime: 2022-04-13T17:56:52.3530155+02:00  User: SIMU\\Administrateur  Version: 1  " SOURCE: WinEventLog:Microsoft-Windows-Kernel-File/KERNEL_FILE_KEYWORD_CREATE
Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Notice MODULE: Sigma MESSAGE: Sigma match found RULE_TITLE: Browser Credential Store Access RULE_AUTHOR: frack113 RULE_DESCRIPTION: Detects suspicious processes based on name and location that access the browser credential stores which can be the sign of credential stealing RULE_FALSEPOSITIVES: Antivirus, Anti-Spyware, Anti-Malware Software, Backup software RULE_ID: 91cb43db-302a-47e3-b3c8-7ede481e27bf RULE_LEVEL: medium RULE_LINK: https://github.com/SigmaHQ/sigma/blob/0.21-44-gaa96f8003/rules/windows/file_access/file_access_win_browser_credential_stealing.yml RULE_MODIFIED: 2022/04/11 RULE_PATH: public\windows\file_access\file_access_win_browser_credential_stealing.yms RULE_REFERENCES: https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users RULE_SIGTYPE: public COMMANDLINE: "\"C:\\WINDOWS\\system32\\cmd.exe\" " COMPUTER: DESKTOP-8JCQO81 CORRELATION_ACTIVITYID: {00000000-0000-0000-0000-000000000000} CREATEATTRIBUTES: 0x0 CREATEOPTIONS: 0x1200000 EVENTID: 12 EXECUTION_THREADID: 2588 FILENAME: \Device\HarddiskVolume4\Users\administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\wk02n0s0.default-release\cookies.sqlite FILEOBJECT: 0xFFFFA78BABF12220 HASHES: MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18 IMAGE: C:\Windows\System32\cmd.exe IRP: 0xFFFFA78BAA1B50F8 ISSUINGTHREADID: 2588 KEYWORDS: 0x80000000000000a0 LEVEL: 4 MATCH_STRINGS: \cookies.sqlite in FileName OPCODE: 0 PARENTCOMMANDLINE: C:\WINDOWS\Explorer.EXE /NoUACCheck PARENTIMAGE: C:\Windows\explorer.exe PROCESSID: 8500 PROVIDER_GUID: {EDD08927-9CC4-4E65-B970-C2560FB5C289} PROVIDER_NAME: Microsoft-Windows-Kernel-File SECURITY_USERID: S-1-5-21-2360441858-3879321942-2637521084-500 SHAREACCESS: 0x7 TARGETFILENAME: C:\Users\administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\wk02n0s0.default-release\cookies.sqlite TASK: 12 TIMECREATED_SYSTEMTIME: 2022-04-13T17:56:52.3530155+02:00 USER: SIMU\Administrateur VERSION: 1
Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Trace MODULE: EventDistributor MESSAGE: Received event EVENT: Computer: DESKTOP-8JCQO81  Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}  EventID: 14  Execution_ProcessID: 8500  Execution_ThreadID: 2588  FileKey: 0xFFFFC08444F4FB70  FileObject: 0xFFFFA78BABF12220  Image: C:\Windows\System32\cmd.exe  Irp: 0xFFFFA78BAA1B50F8  IssuingThreadId: 2588  Keywords: 0x8000000000000020  Level: 4  Opcode: 0  Provider_Guid: {EDD08927-9CC4-4E65-B970-C2560FB5C289}  Provider_Name: Microsoft-Windows-Kernel-File  Security_UserID: S-1-5-21-2360441858-3879321942-2637521084-500  Task: 14  TimeCreated_SystemTime: 2022-04-13T17:56:52.3530494+02:00  User: SIMU\Administrateur  Version: 1   SOURCE: WinEventLog:Microsoft-Windows-Kernel-File/KERNEL_FILE_KEYWORD_FILEIO?eventids=14
Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Trace MODULE: LsassDumpDetector MESSAGE: Detected file close FILE:  PROCESSID: 8500
Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Trace MODULE: EventDistributor MESSAGE: Received event EVENT: "CommandLine: \"C:\\WINDOWS\\system32\\cmd.exe\"   Computer: DESKTOP-8JCQO81  Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}  CreateAttributes: 0x0  CreateOptions: 0x1000021  EventID: 12  Execution_ProcessID: 8500  Execution_ThreadID: 2588  FileName: \\Device\\HarddiskVolume4\\Users\\administrateur\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\wk02n0s0.default-release\\  FileObject: 0xFFFFA78BAB07A660  Hashes: MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18  Image: C:\\Windows\\System32\\cmd.exe  Irp: 0xFFFFA78BAA1B50F8  IssuingThreadId: 2588  Keywords: 0x80000000000000a0  Level: 4  Opcode: 0  ParentCommandLine: C:\\WINDOWS\\Explorer.EXE /NoUACCheck  ParentImage: C:\\Windows\\explorer.exe  Provider_Guid: {EDD08927-9CC4-4E65-B970-C2560FB5C289}  Provider_Name: Microsoft-Windows-Kernel-File  Security_UserID: S-1-5-21-2360441858-3879321942-2637521084-500  ShareAccess: 0x7  TargetFilename: C:\\Users\\administrateur\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\wk02n0s0.default-release\\  Task: 12  TimeCreated_SystemTime: 2022-04-13T17:56:52.3531517+02:00  User: SIMU\\Administrateur  Version: 1  " SOURCE: WinEventLog:Microsoft-Windows-Kernel-File/KERNEL_FILE_KEYWORD_CREATE
Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Trace MODULE: EventDistributor MESSAGE: Received event EVENT: "CommandLine: \"C:\\WINDOWS\\system32\\cmd.exe\"   Computer: DESKTOP-8JCQO81  Correlation_ActivityID: {00000000-0000-0000-0000-000000000000}  CreateAttributes: 0x80  CreateOptions: 0x1000064  EventID: 12  Execution_ProcessID: 8500  Execution_ThreadID: 2588  FileName: \\Device\\HarddiskVolume4\\Users\\administrateur\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\wk02n0s0.default-release\\cookies.sqlite  FileObject: 0xFFFFA78BAB088120  Hashes: MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18  Image: C:\\Windows\\System32\\cmd.exe  Irp: 0xFFFFA78BAA1B50F8  IssuingThreadId: 2588  Keywords: 0x80000000000000a0  Level: 4  Opcode: 0  ParentCommandLine: C:\\WINDOWS\\Explorer.EXE /NoUACCheck  ParentImage: C:\\Windows\\explorer.exe  Provider_Guid: {EDD08927-9CC4-4E65-B970-C2560FB5C289}  Provider_Name: Microsoft-Windows-Kernel-File  Security_UserID: S-1-5-21-2360441858-3879321942-2637521084-500  ShareAccess: 0x3  TargetFilename: C:\\Users\\administrateur\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\wk02n0s0.default-release\\cookies.sqlite  Task: 12  TimeCreated_SystemTime: 2022-04-13T17:56:52.3533368+02:00  User: SIMU\\Administrateur  Version: 1  " SOURCE: WinEventLog:Microsoft-Windows-Kernel-File/KERNEL_FILE_KEYWORD_CREATE
Apr 13 15:56:52 DESKTOP-8JCQO81 AURORA: Notice MODULE: Sigma MESSAGE: Sigma match found RULE_TITLE: Browser Credential Store Access RULE_AUTHOR: frack113 RULE_DESCRIPTION: Detects suspicious processes based on name and location that access the browser credential stores which can be the sign of credential stealing RULE_FALSEPOSITIVES: Antivirus, Anti-Spyware, Anti-Malware Software, Backup software RULE_ID: 91cb43db-302a-47e3-b3c8-7ede481e27bf RULE_LEVEL: medium RULE_LINK: https://github.com/SigmaHQ/sigma/blob/0.21-44-gaa96f8003/rules/windows/file_access/file_access_win_browser_credential_stealing.yml RULE_MODIFIED: 2022/04/11 RULE_PATH: public\windows\file_access\file_access_win_browser_credential_stealing.yms RULE_REFERENCES: https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users RULE_SIGTYPE: public COMMANDLINE: "\"C:\\WINDOWS\\system32\\cmd.exe\" " COMPUTER: DESKTOP-8JCQO81 CORRELATION_ACTIVITYID: {00000000-0000-0000-0000-000000000000} CREATEATTRIBUTES: 0x80 CREATEOPTIONS: 0x1000064 EVENTID: 12 EXECUTION_THREADID: 2588 FILENAME: \Device\HarddiskVolume4\Users\administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\wk02n0s0.default-release\cookies.sqlite FILEOBJECT: 0xFFFFA78BAB088120 HASHES: MD5=8A2122E8162DBEF04694B9C3E0B6CDEE,SHA1=F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D,SHA256=B99D61D874728EDC0918CA0EB10EAB93D381E7367E377406E65963366C874450,IMPHASH=272245E2988E1E430500B852C4FB5E18 IMAGE: C:\Windows\System32\cmd.exe IRP: 0xFFFFA78BAA1B50F8 ISSUINGTHREADID: 2588 KEYWORDS: 0x80000000000000a0 LEVEL: 4 MATCH_STRINGS: \cookies.sqlite in FileName OPCODE: 0 PARENTCOMMANDLINE: C:\WINDOWS\Explorer.EXE /NoUACCheck PARENTIMAGE: C:\Windows\explorer.exe PROCESSID: 8500 PROVIDER_GUID: {EDD08927-9CC4-4E65-B970-C2560FB5C289} PROVIDER_NAME: Microsoft-Windows-Kernel-File SECURITY_USERID: S-1-5-21-2360441858-3879321942-2637521084-500 SHAREACCESS: 0x3 TARGETFILENAME: C:\Users\administrateur\AppData\Roaming\Mozilla\Firefox\Profiles\wk02n0s0.default-release\cookies.sqlite TASK: 12 TIMECREATED_SYSTEMTIME: 2022-04-13T17:56:52.3533368+02:00 USER: SIMU\Administrateur VERSION: 1

[redsand]

excellent, excellent! thank you very much. I've already updated my PR. Another question, is there a list of Event Trace sources this project is using to apply sigma? I am guessing this requires new code on my end to tap into etw sources, vs typical OpenEventLog? But rather OpenTrace/ProcessTrace etc?

[frack113]

I don't think there is a list of Event Trace.
for the file_rename, I wanted to detect one of the behavior of BazaLoader. I dug the ETW and the aurora devs found the right solution 😄 .
As I can access to the ETW now perharps will find a new way to detect threats this year, or will be one of my bad idea (system overload like my file_copy try)

[Neo23x0]

You could download Aurora Lite and check the ./log-sources folder in which we list all the sources and their ETW channels used in the free version (includes file_access file_rename)