文件压缩或归档为通用格式

编辑

文件压缩或归档为通用格式

编辑

检测文件是否被压缩或归档为通用格式。这是一种常见的混淆文件以逃避检测或为数据外泄准备数据的技术。

规则类型: eql

规则索引:

logs-endpoint.events.file-*

严重性: 低

风险评分: 21

运行频率: 5分钟

搜索索引的时间范围: now-9m (Date Math 格式，另请参阅 额外回溯时间)

每次执行的最大告警数: 1000

参考:

https://en.wikipedia.org/wiki/List_of_file_signatures

标签:

数据来源: Elastic Defend
域: 端点
操作系统: macOS
操作系统: Windows
策略: 收集
规则类型: BBR

版本: 5

规则作者:

Elastic

规则许可: Elastic License v2

规则查询

编辑

file where host.os.type == "windows" and event.type in ("creation", "change") and process.executable != null and not user.id : ("S-1-5-18", "S-1-5-17") and
 file.Ext.header_bytes : (
                          /* compression formats */
                          "1F9D*",             /* tar zip, tar.z (Lempel-Ziv-Welch algorithm) */
                          "1FA0*",             /* tar zip, tar.z (LZH algorithm) */
                          "425A68*",           /* Bzip2 */
                          "524E4301*",         /* Rob Northen Compression */
                          "524E4302*",         /* Rob Northen Compression */
                          "4C5A4950*",         /* LZIP */
                          "504B0*",            /* ZIP */
                          "526172211A07*",     /* RAR compressed */
                          "44434D0150413330*", /* Windows Update Binary Delta Compression file */
                          "50413330*",         /* Windows Update Binary Delta Compression file */
                          "377ABCAF271C*",     /* 7-Zip */
                          "1F8B*",             /* GZIP */
                          "FD377A585A00*",     /* XZ, tar.xz */
                          "7801*",	           /* zlib: No Compression (no preset dictionary) */
                          "785E*",	           /* zlib: Best speed (no preset dictionary) */
                          "789C*",	           /* zlib: Default Compression (no preset dictionary) */
                          "78DA*", 	           /* zlib: Best Compression (no preset dictionary) */
                          "7820*",	           /* zlib: No Compression (with preset dictionary) */
                          "787D*",	           /* zlib: Best speed (with preset dictionary) */
                          "78BB*",	           /* zlib: Default Compression (with preset dictionary) */
                          "78F9*",	           /* zlib: Best Compression (with preset dictionary) */
                          "62767832*",         /* LZFSE */
                          "28B52FFD*",         /* Zstandard, zst */
                          "5253564B44415441*", /* QuickZip rs compressed archive */
                          "2A2A4143452A2A*",   /* ACE */

                          /* archive formats */
                          "2D686C302D*",       /* lzh */
                          "2D686C352D*",       /* lzh */
                          "303730373037*",     /* cpio */
                          "78617221*",         /* xar */
                          "4F4152*",           /* oar */
                          "49536328*"          /* cab archive */
 ) and
 not (
   (
     process.name : "firefox.exe" and
     process.code_signature.subject_name : "Mozilla Corporation" and process.code_signature.trusted == true
   ) or
   (
     process.name : "wazuh-agent.exe" and
     process.code_signature.subject_name : "Wazuh, Inc" and process.code_signature.trusted == true and
     file.name : ("ossec-*.log.gz", "tmp-entry.gz", "tmp-entry", "last-entry.gz")
   ) or
   (
     process.name : ("excel.exe", "winword.exe", "powerpnt.exe") and
     process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true
   ) or
   (
     process.name : "OneDrive.exe" and
     process.code_signature.subject_name : "Microsoft Corporation" and process.code_signature.trusted == true and
     (
      file.extension : ("xlsx", "docx", "pptx", "xlsm") or
      file.path : "?:\\Users\\*\\AppData\\Local\\Microsoft\\OneDrive\\logs\\*"
     )
   ) or
   (
     process.name : "Dropbox.exe" and
     process.code_signature.subject_name : "Dropbox, Inc" and process.code_signature.trusted == true and
     file.name : "store.bin"
   ) or
   (
     process.name : "DellSupportAssistRemedationService.exe" and
     process.code_signature.subject_name : "Dell Inc" and process.code_signature.trusted == true and
     file.extension : "manifest"
   ) or
   (
     process.name : "w3wp.exe" and
     process.code_signature.subject_name : "Microsoft Windows" and process.code_signature.trusted == true and
     file.path : "?:\\inetpub\\temp\\IIS Temporary Compressed Files\\*"
   )
 )

框架: MITRE ATT&CK^TM

策略
- 名称: 收集
- ID: TA0009
- 参考 URL: https://attack.mitre.org/tactics/TA0009/
技术
- 名称: 数据暂存
- ID: T1074
- 参考 URL: https://attack.mitre.org/techniques/T1074/
子技术
- 名称: 本地数据暂存
- ID: T1074.001
- 参考 URL: https://attack.mitre.org/techniques/T1074/001/
技术
- 名称: 归档收集的数据
- ID: T1560
- 参考 URL: https://attack.mitre.org/techniques/T1560/
子技术
- 名称: 通过实用程序归档
- ID: T1560.001
- 参考 URL: https://attack.mitre.org/techniques/T1560/001/
策略
- 名称: 命令和控制
- ID: TA0011
- 参考 URL: https://attack.mitre.org/tactics/TA0011/
技术
- 名称: 数据编码
- ID: T1132
- 参考 URL: https://attack.mitre.org/techniques/T1132/
子技术
- 名称: 标准编码
- ID: T1132.001
- 参考 URL: https://attack.mitre.org/techniques/T1132/001/
策略
- 名称: 防御规避
- ID: TA0005
- 参考 URL: https://attack.mitre.org/tactics/TA0005/
技术
- 名称: 混淆的文件或信息
- ID: T1027
- 参考 URL: https://attack.mitre.org/techniques/T1027/

« 外部用户被添加到 Google Workspace 群组文件创建时间被更改 »