From 7412507eeefaefda6a43b8cf3eb6d7731e0ba515 Mon Sep 17 00:00:00 2001 From: kevross33 Date: Mon, 16 Jul 2018 11:48:04 +0100 Subject: [PATCH 1/4] Add in sig to detect suspicious regsvr bypasses Main one here is sig for squiblydoo technique --- .../windows/antiav_regsvr_bypass.py | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 modules/signatures/windows/antiav_regsvr_bypass.py diff --git a/modules/signatures/windows/antiav_regsvr_bypass.py b/modules/signatures/windows/antiav_regsvr_bypass.py new file mode 100644 index 000000000..b2b51656a --- /dev/null +++ b/modules/signatures/windows/antiav_regsvr_bypass.py @@ -0,0 +1,61 @@ +# Copyright (C) 2018 Kevin Ross +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program. If not, see . + +from lib.cuckoo.common.abstracts import Signature + +class AntiAVSquiblydooBypass(Signature): + name = "antiav_squiblydoo_bypass" + description = "Squiblydoo application whitelist bypass attempt" + severity = 3 + categories = ["bypass"] + authors = ["Kevin Ross"] + minimum = "2.0" + + def on_complete(self): + for cmdline in self.get_command_lines(): + if "regsvr32" in cmdline.lower() and "scrobj.dll" in cmdline.lower(): + self.mark_ioc("cmdline", cmdline) + + return self.has_marks() + +class AntiAVRegsvrScriptLaunch(Signature): + name = "antiav_regsrv_script_launch" + description = "Regsrv32 launching script module" + severity = 3 + categories = ["bypass"] + authors = ["Kevin Ross"] + minimum = "2.0" + + def on_complete(self): + for cmdline in self.get_command_lines(): + if "regsvr32" in cmdline.lower() and ("jscript.dll" in cmdline.lower() or "vbscript.dll" in cmdline.lower()): + self.mark_ioc("cmdline", cmdline) + + return self.has_marks() + +class AntiAVRegsvrHTTP(Signature): + name = "antiav_regsrv_http" + description = "Regsrv32 command line contains HTTP/HTTPS URL" + severity = 3 + categories = ["bypass"] + authors = ["Kevin Ross"] + minimum = "2.0" + + def on_complete(self): + for cmdline in self.get_command_lines(): + if "regsvr32" in cmdline.lower() and ("http\://" in cmdline.lower() or "https\://" in cmdline.lower()): + self.mark_ioc("cmdline", cmdline) + + return self.has_marks() From 4a5d49d2540f285221e653d7d06bcdf87ac1aa71 Mon Sep 17 00:00:00 2001 From: kevross33 Date: Mon, 16 Jul 2018 11:48:54 +0100 Subject: [PATCH 2/4] Update antiav_regsvr_bypass.py --- modules/signatures/windows/antiav_regsvr_bypass.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/signatures/windows/antiav_regsvr_bypass.py b/modules/signatures/windows/antiav_regsvr_bypass.py index b2b51656a..e2692edb3 100644 --- a/modules/signatures/windows/antiav_regsvr_bypass.py +++ b/modules/signatures/windows/antiav_regsvr_bypass.py @@ -32,7 +32,7 @@ def on_complete(self): class AntiAVRegsvrScriptLaunch(Signature): name = "antiav_regsrv_script_launch" - description = "Regsrv32 launching script module" + description = "Regsrv32 launched a scripting module" severity = 3 categories = ["bypass"] authors = ["Kevin Ross"] From ebcabfe7be7aa54fbb2468e77002144ef7d03bf5 Mon Sep 17 00:00:00 2001 From: kevross33 Date: Mon, 16 Jul 2018 11:57:26 +0100 Subject: [PATCH 3/4] Add in signature for storing regsvr in registry --- .../windows/antiav_regsvr_bypass.py | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/modules/signatures/windows/antiav_regsvr_bypass.py b/modules/signatures/windows/antiav_regsvr_bypass.py index e2692edb3..1d172b845 100644 --- a/modules/signatures/windows/antiav_regsvr_bypass.py +++ b/modules/signatures/windows/antiav_regsvr_bypass.py @@ -59,3 +59,24 @@ def on_complete(self): self.mark_ioc("cmdline", cmdline) return self.has_marks() + + class RegistryRegsvrBypass(Signature): + name = "registry_regsvr_bypass" + description = "Stores a regsrv32 command in registry containing potential AV/Application Whitelist bypass attempt" + severity = 3 + categories = ["bypass", "persistence"] + authors = ["Kevin Ross"] + minimum = "2.0" + evented = True + + filter_apinames = set(["RegSetValueExA", "RegSetValueExW", "NtSetValueKey"]) + + def on_call(self, call, process): + value = call["arguments"]["value"] + if not isinstance(value, basestring): + return + if value and "regsvr32" in value.lower() and ("scrobj.dll" in value.lower() or "jscript.dll" in value.lower() or "vbscript.dll" in value.lower()): + self.mark_call() + + def on_complete(self): + return self.has_marks() From bb86a0dcb1012027be27101390d47396f5b9a68e Mon Sep 17 00:00:00 2001 From: kevross33 Date: Mon, 16 Jul 2018 11:58:05 +0100 Subject: [PATCH 4/4] Update antiav_regsvr_bypass.py --- modules/signatures/windows/antiav_regsvr_bypass.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/signatures/windows/antiav_regsvr_bypass.py b/modules/signatures/windows/antiav_regsvr_bypass.py index 1d172b845..827a1ddb8 100644 --- a/modules/signatures/windows/antiav_regsvr_bypass.py +++ b/modules/signatures/windows/antiav_regsvr_bypass.py @@ -62,7 +62,7 @@ def on_complete(self): class RegistryRegsvrBypass(Signature): name = "registry_regsvr_bypass" - description = "Stores a regsrv32 command in registry containing potential AV/Application Whitelist bypass attempt" + description = "Stores a regsrv32 command in registry containing an AV/Application Whitelist bypass attempt" severity = 3 categories = ["bypass", "persistence"] authors = ["Kevin Ross"]