野外 Windows LPE 0-day：洞察与检测策略

sequence with maxspan=5m 
下载地址
 by process.entity_id [process where event.action == "start" and user.id : "S-1-5-18"] by process.parent.entity_id

sequence by process.entity_id  
下载地址
 [any where event.category : ("file", "registry", "api") and user.id : "S-1-5-18"] until [process where event.action:"end"]

import "pe" rule lpe_clfs_strings {    strings:     $s1 = "NtQuerySystemInformation"     $s2 = "clfs.sys" nocase    condition:     uint16(0)==0x5a4d and (pe.imports("clfsw32.dll", "CreateLogFile") or pe.imports("clfsw32.dll", "AddLogContainer")) and all of ($s*)}rule lpe_clfs_unsigned {    condition:     uint16(0)==0x5a4d and pe.number_of_signatures == 0 and filesize <= 200KB and       (pe.imports("clfsw32.dll", "CreateLogFile") or pe.imports("clfsw32.dll", "AddLogContainer")) and       not (pe.imports("clfsw32.dll", "ReadLogRecord") or pe.imports("clfsw32.dll", "CreateLogMarshallingArea"))}

event.code : "shellcode_thread" and process.name : "dwm.exe" and user.name : DWM*

process where event.action == "start" and process.parent.executable : "?:\Windows\system32\dwm.exe" and user.id : ("S-1-5-90-0-*", "S-1-5-18") and process.executable : "?:\*" and  not process.executable : ("?:\Windows\System32\WerFault.exe", "?:\Windows\System32\ISM.exe", "?:\Windows\system32\dwm.exe")

(event.category :"file" or event.code :"malicious_file") and process.name :"dwm.exe" and user.id:S-1-5-90-0-* and (file.extension :(dll or exe) or file.Ext.header_bytes :4d5a*)

library where process.executable : "?:\Windows\System32\LogonUI.exe" and  user.id : "S-1-5-18" and  not dll.code_signature.status : "trusted" and  process.thread.Ext.call_stack_summary : "*combase.dll|dcomp.dll*"

any where (event.category in ("file", "library") or event.code : "malicious_file") and (  file.path : ("C:\*\Windows\WinSxS\*.dll", "C:\*\Windows\system32\*.dll", "C:\*\Windows\syswow64\*.dll", "C:\*\Windows\assembly\NativeImages*.dll") or   dll.path : ("C:\*\Windows\WinSxS\*.dll", "C:\*\Windows\system32\*.dll", "C:\*\Windows\syswow64\*.dll", "C:\*\Windows\assembly\NativeImages*.dll") )

sequence with maxspan=5m [process where event.action == "start" and  process.Ext.token.integrity_level_name in ("medium", "low")] by process.entity_id [process where event.action == "start" and  process.Ext.token.integrity_level_name == "system" and user.id : "S-1-5-18"] by process.parent.entity_id

from logs-endpoint.events.api*| where process.Ext.token.integrity_level_name in ("medium", "low") and Target.process.Ext.token.integrity_level_name == "system" and process.Ext.api.name in ("WriteProcessMemory", "VirtualProtect", "VirtualAllocEx", "VirtualProtectEx", "QueueUserAPC", "MapViewOfFile", "MapViewOfFileEx")| stats occurrences = count(*), agents = count_distinct(host.id) by process.Ext.api.name, process.executable, Target.process.executable| where agents == 1 and occurrences <= 100

from logs-endpoint.events.library-*| where host.os.family == "windows" and event.action == "load" and  starts_with(process.code_signature.subject_name, "Microsoft") and          user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20") and   process.code_signature.status == "trusted" and   dll.Ext.relative_file_creation_time <= 500 and  (dll.code_signature.exists == false or dll.code_signature.trusted == false) and     /* excluding noisy DLL paths */     not dll.path rlike """[C-F]:\Windows\(assembly|WinSxS|SoftwareDistribution|SystemTemp)\.+.dll""" and /* excluding noisy processes and potentially unrelated to exploits - svchost must be covered by a dedicated hunt to exclude service dlls and COM */not process.name in ("rundll32.exe", "regsvr32.exe", "powershell.exe", "msiexec.exe", "svchost.exe", "w3wp.exe", "mscorsvw.exe", "OfficeClickToRun.exe", "SetupHost.exe", "UpData.exe", "DismHost.exe")| stats occurrences = count(*), host_count = count_distinct(host.id) by dll.name, process.name/* loaded once and the couple dll.name process.name are present in one agent across the fleet */| where occurrences == 1 and host_count == 1

from logs-endpoint.events.file-*| where  @timestamp > now() - 30 day| where host.os.family == "windows" and event.category == "file" and event.action == "creation" and user.id in ("S-1-5-18", "S-1-5-19", "S-1-5-20", "S-1-5-90-0-*") and starts_with(file.Ext.header_bytes, "4d5a") and process.code_signature.status == "trusted" and starts_with(process.code_signature.subject_name, "Microsoft") and  process.executable rlike """[c-fC-F]:\Windows\(System32|SysWOW64)\[a-zA-Z0-9_]+.exe""" and not process.name in ("drvinst.exe", "MpSigStub.exe", "cmd.exe")| keep process.executable, host.id| stats occurrences = count(*), agents = count_distinct(host.id) by process.executable| where agents == 1 and occurrences == 1

api where process.pid != 4 and process.Ext.api.name : "WriteProcessMemory" and process.executable != null and    /*  kernel mode address range - decimal */   process.Ext.api.parameters.address > 281474976710655

In- the- Wild Windows LPE 0- days: Insights & Detection Strategieshttps://www.elastic.co/security-labs/itw-windows-lpe-0days-insights-and-detection-strategies