Skip to content

Commit 9eb48e8

Browse files
darkoperatordarkoperator
authored
Create Exchange_CVE_2021_26855.xml
1 parent 0192fd1 commit 9eb48e8

1 file changed

Lines changed: 102 additions & 0 deletions

File tree

‎examples/Exchange_CVE_2021_26855.xml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
<!--
2+
Version: 1.0
3+
4+
Created: 3/5/2021
5+
6+
Updated: 3/5/2021
7+
8+
Description: Track malicious activity in Exchange server based on IOCs for CVE-2021-26855, CVE-2021-2685, CVE-2021-26858
9+
and CVE-2021- based on exploitation from UNC2639, UNC2640, and UNC2643
10+
11+
Changelog:
12+
13+
* 1.0 - Initial version.
14+
15+
Authors: Carlos Perez, carlos.perez@trustedsec.com
16+
17+
-->
18+
<Sysmon schemaversion="4.50">
19+
<HashAlgorithms>sha256</HashAlgorithms>
20+
<CheckRevocation/>
21+
<EventFiltering>
22+
<RuleGroup name="File Creation" groupRelation="or">
23+
<FileCreate onmatch="include">
24+
<!--Capture file creation by known processes dropping webshells-->
25+
<Image name="w3wp.exe File Creation" condition="contains">w3wp.exe</Image>
26+
<Image name="UMWorkerProcess.exe File Creation" condition="contains">UMWorkerProcess.exe</Image>
27+
</FileCreate>
28+
</RuleGroup>
29+
<RuleGroup name="" groupRelation="or">
30+
<!--Capture all process creation-->
31+
<ProcessCreate onmatch="include">
32+
<Image name="w3wp.exe Process Creation" condition="contains">w3wp.exe</Image>
33+
<Image name="UMWorkerProcess.exe Process Creation" condition="contains">UMWorkerProcess.exe</Image>
34+
<!--use filter process order to capture all other processes and only tag with rule name the suspicious ones-->
35+
<CommandLine condition="contains">.exe</CommandLine>
36+
</ProcessCreate>
37+
</RuleGroup>
38+
<RuleGroup name="Process Access Include" groupRelation="or">
39+
<ProcessAccess onmatch="include">
40+
<!--Log suspicious access of lsass-->
41+
<TargetImage name="LSASS Access" condition="contains">lsass.exe</TargetImage>
42+
</ProcessAccess>
43+
</RuleGroup>
44+
<RuleGroup name="Process Access Exclude" groupRelation="or">
45+
<ProcessAccess onmatch="exclude">
46+
<!-- Exclude processes and their masks that access LSASS to reduce false positives-->
47+
<Rule groupRelation="and">
48+
<SourceImage condition='is'>C:\Windows\system32\svchost.exe</SourceImage>
49+
<GrantedAccess condition='is'>0x1000</GrantedAccess>
50+
</Rule>
51+
<Rule groupRelation="and">
52+
<SourceImage condition='is'>C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
53+
<GrantedAccess condition='is'>0x1400</GrantedAccess>
54+
</Rule>
55+
<Rule groupRelation="and">
56+
<SourceImage condition='is'>C:\Windows\System32\svchost.exe</SourceImage>
57+
<GrantedAccess condition='is'>0x3000</GrantedAccess>
58+
</Rule>
59+
<Rule groupRelation="and">
60+
<SourceImage condition='is'>C:\Windows\system32\wbem\wmiprvse.exe</SourceImage>
61+
<GrantedAccess condition='is'>0x1000</GrantedAccess>
62+
</Rule>
63+
<Rule groupRelation="and">
64+
<SourceImage condition='is'>C:\Windows\System32\svchost.exe</SourceImage>
65+
<GrantedAccess condition='is'>0x1000</GrantedAccess>
66+
</Rule>
67+
<Rule groupRelation="and">
68+
<SourceImage condition='is'>C:\Windows\system32\services.exe</SourceImage>
69+
<GrantedAccess condition='is'>0x1000</GrantedAccess>
70+
</Rule>
71+
<Rule groupRelation="and">
72+
<SourceImage condition='is'>C:\Windows\system32\wininit.exe</SourceImage>
73+
<GrantedAccess condition='is'>0x1000000</GrantedAccess>
74+
</Rule>
75+
<Rule groupRelation="and">
76+
<SourceImage condition='is'>C:\Windows\system32\csrss.exe</SourceImage>
77+
<GrantedAccess condition='is'>0x1fffff</GrantedAccess>
78+
</Rule>
79+
<Rule groupRelation="and">
80+
<SourceImage condition='is'>C:\Windows\system32\wininit.exe</SourceImage>
81+
<GrantedAccess condition='is'>0x1fffff</GrantedAccess>
82+
</Rule>
83+
</ProcessAccess>
84+
</RuleGroup>
85+
<RuleGroup name="Image Load Include" groupRelation="or">
86+
<ImageLoad onmatch="include">
87+
<!--Detect if PowerShell is being loaded by a process-->
88+
<Rule name="Possible PowerShell Sideload" groupRelation="and">
89+
<Image name="" condition="excludes any">powershell.exe;powershell_ise.exe</Image>
90+
<ImageLoaded condition="contains">System.Management.Automation</ImageLoaded>
91+
</Rule>
92+
</ImageLoad>
93+
</RuleGroup>
94+
<RuleGroup name="Image Load Exclude" groupRelation="or">
95+
<ImageLoad onmatch="exclude">
96+
<!--Exclude processes that load the powershell engibe-->
97+
<Image condition='is'>C:\Windows\System32\ServerManager.exe</Image>
98+
<Image condition='is'>C:\Windows\System32\RemoteFXvGPUDisablement.exe</Image>
99+
</ImageLoad>
100+
</RuleGroup>
101+
</EventFiltering>
102+
</Sysmon>

0 commit comments

Comments
 (0)