Skip to content

Commit 0704ecc

Browse files
darkoperatordarkoperator
authored
Update file-blockshredding.md
1 parent f7dd4f2 commit 0704ecc

1 file changed

Lines changed: 81 additions & 23 deletions

File tree

‎chapters/file-blockshredding.md‎

Lines changed: 81 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,88 @@ On version 14.1 of Sysmon the capability to log and block when a process is dele
66

77
![minifilter](./media/image36.png)
88

9-
The minidriver inspect the action that is being taken to see if it is a file block overwrite and if the header of the file for the MZ DOS Executable header. Some common processes on system that perform actions that may generate some false positives are:
9+
The minidriver inspect the action that is being taken to see if it is a file block overwrite and if the header of the file for the MZ DOS Executable header. Some common processes on system that perform actions that may generate some false positives if all instances of the action is blocked. If this approach is follower a exclusion list should be used. An example of these are:
1010

11-
* svchost.exe
12-
* dllhost.exe
11+
```xml
12+
<FileBlockShredding onmatch="exclude">
13+
<Rule groupRelation="and">
14+
<Image condition="is">C:\WINDOWS\System32\svchost.exe</Image>
15+
<User condition="is">NT AUTHORITY\LOCAL SERVICE</User>
16+
</Rule>
17+
<Rule groupRelation="and">
18+
<Image condition="is">C:\WINDOWS\System32\svchost.exe</Image>
19+
<User condition='is'>NT AUTHORITY\SYSTEM</User>
20+
</Rule>
21+
<Rule groupRelation="and">
22+
<Image condition='is'>C:\WINDOWS\system32\SearchIndexer.exe</Image>
23+
<User condition='is'>NT AUTHORITY\SYSTEM</User>
24+
</Rule>
25+
<Rule groupRelation="and">
26+
<Image condition='is'>C:\WINDOWS\system32\lsass.exe</Image>
27+
<User condition='is'>NT AUTHORITY\SYSTEM</User>
28+
</Rule>
29+
<Rule groupRelation="and">
30+
<Image condition='end with'>\MsMpEng.exe</Image>
31+
<User condition='is'>NT AUTHORITY\SYSTEM</User>
32+
</Rule>
33+
<Rule groupRelation="or">
34+
<Image condition='is'>C:\WINDOWS\system32\DllHost.exe</Image>
35+
<Image condition='end with'>\Dropbox\Client\Dropbox.exe</Image>
36+
<Image condition='is'>C:\WINDOWS\system32\backgroundTaskHost.exe</Image>
37+
<Image condition='end with'>\AppData\Local\Programs\Microsoft VS Code\Code.exe</Image>
38+
<Image condition='is'>C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe</Image>
39+
<Image condition='end with'>\Microsoft\Edge\Application\msedge.exe</Image>
40+
<Image condition='end with'>\1Password.exe</Image>
41+
<Image condition='is'>C:\Windows\ImmersiveControlPanel\SystemSettings.exe</Image>
42+
<Image condition='is'>C:\WINDOWS\system32\taskhostw.exe</Image>
43+
</Rule>
44+
</FileBlockShredding>
45+
```
46+
It is recommended to better block those files that an attacket would like to delete so as to hide their tracks that where part of a compromise at several stages.
47+
48+
```XML
49+
<RuleGroup name="" groupRelation="or">
50+
<FileBlockShredding onmatch="include">
51+
<TargetFilename condition="end with">.sys</TargetFilename> <!--Driver file.-->
52+
<TargetFilename condition="end with">.rft</TargetFilename>
53+
<TargetFilename condition="end with">.jsp</TargetFilename>
54+
<TargetFilename condition="end with">.jspx</TargetFilename>
55+
<TargetFilename condition="end with">.asp</TargetFilename>
56+
<TargetFilename condition="end with">.aspx</TargetFilename>
57+
<TargetFilename condition="end with">.php</TargetFilename>
58+
<TargetFilename condition="end with">.war</TargetFilename>
59+
<TargetFilename condition="end with">.ace</TargetFilename>
60+
<TargetFilename condition="end with">.iqy</TargetFilename>
61+
<TargetFilename condition="end with">.slk</TargetFilename>
62+
<TargetFilename condition="end with">.docm</TargetFilename> <!--Microsoft:Office:Word: With Macro-->
63+
<TargetFilename condition="end with">.pptm</TargetFilename> <!--Microsoft:Office:PowerPoint: With Macro-->
64+
<TargetFilename condition="end with">.xlsm</TargetFilename> <!--Microsoft:Office:Excel: With Macro-->
65+
<TargetFilename condition="end with">.xlm</TargetFilename> <!--Microsoft:Office:Excel: Legacy Excel With Macro-->
66+
<TargetFilename condition="end with">.dotm</TargetFilename> <!--Microsoft:Office:Word: Template With Macro-->
67+
<TargetFilename condition="end with">.xltm</TargetFilename> <!--Microsoft:Office:Excel: Template With Macro-->
68+
<TargetFilename condition="end with">.potm</TargetFilename> <!--Microsoft:Office:PowerPoint: Template With Macro-->
69+
<TargetFilename condition="end with">.ppsm</TargetFilename> <!--Microsoft:Office:PowerPoint: Slideshow With Macro-->
70+
<TargetFilename condition="end with">.sldm</TargetFilename> <!--Microsoft:Office:PowerPoint: Slide With Macro-->
71+
<TargetFilename condition="end with">.xlam</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
72+
<TargetFilename condition="end with">.xla</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
73+
<TargetFilename condition="end with">.xll</TargetFilename> <!--Microsoft:Office:Excel: Add-in Possibly With Macro-->
74+
<TargetFilename condition="end with">.settingcontent-ms</TargetFilename> <!--Microsoft:Windows:SettingContent-MS (https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39)-->
75+
<TargetFilename condition="end with">.application</TargetFilename> <!--Microsoft:ClickOnce: [ https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ ] -->
76+
<TargetFilename condition="end with">.appref-ms</TargetFilename> <!--Microsoft:ClickOnce application | Credit @ion-storm -->
77+
<TargetFilename condition="end with">.kirbi</TargetFilename> <!--Mimikatz or kekeo default kerberos ticket file extention-->
78+
<TargetFilename condition="end with">.iso</TargetFilename> <!--often ignored by AV/EDR but opens like a zip file in windows-->
79+
<TargetFilename condition="end with">.img</TargetFilename> <!--often ignored by AV/EDR but opens like a zip file in windows-->
80+
<TargetFilename condition="end with">.hta</TargetFilename> <!--HTA Scripting-->
81+
<TargetFilename condition="end with">.exe</TargetFilename> <!--Executable-->
82+
<TargetFilename condition="end with">.dll</TargetFilename> <!--Executable-->
83+
<TargetFilename condition="end with">.ps1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
84+
<TargetFilename condition="end with">.ps2</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
85+
<TargetFilename condition="end with">.psm1</TargetFilename> <!--PowerShell [ More information: http://www.hexacorn.com/blog/2014/08/27/beyond-good-ol-run-key-part-16/ ] -->
86+
<TargetFilename condition="end with">.bat</TargetFilename> <!--Batch scripting-->
87+
<TargetFilename condition="end with">.cmd</TargetFilename> <!--Batch scripting: Batch scripts can also use the .cmd extension | Credit: @mmazanec -->
88+
</FileBlockShredding>
89+
</RuleGroup>
90+
```
1391

1492
Sysmon will not generate any alert on screen for the user once it takes the action.
1593

@@ -34,23 +112,3 @@ The file delete event fields are:
34112

35113
* **IsExecutable**: If the file has a MZ header saying the file is an executable.
36114

37-
38-
39-
Here is a sample rule that removes some of thje false positives using full path and using a compound rule to make it harder to spoof by an attacker.
40-
41-
```XML
42-
<Sysmon schemaversion="4.83">
43-
<HashAlgorithms>sha1</HashAlgorithms>
44-
<CheckRevocation/>
45-
<EventFiltering>
46-
<RuleGroup name="" groupRelation="or">
47-
<FileBlockShredding onmatch="include">
48-
<Rule name="Wipe Action" groupRelation="and">
49-
<Image condition="is not">C:\WINDOWS\System32\svchost.exe</Image>
50-
<User condition="is not">NT AUTHORITY\LOCAL SERVICE</User>
51-
</Rule>
52-
</FileBlockShredding>
53-
</RuleGroup>
54-
</EventFiltering>
55-
</Sysmon>
56-
```

0 commit comments

Comments
 (0)