Add 4 miscellaneous persistence techniques #956
Conversation
jorik-utwente
changed the title
nursery/persist-via-bits-job.yml
Outdated
| - api: ole32.CoCreateInstance | ||
| - com/class: BackgroundCopyManager # 4991d34b-80a1-4291-83b6-3328366b9097 |
There was a problem hiding this comment.
do you think it's enough signal to just see the COM usage?
There was a problem hiding this comment.
There could be false positives here indeed, but from my experience malware mostly uses BITS for persistence. So in this case I would argue the COM usage is enough
There was a problem hiding this comment.
per the reference, BITS could also be used to download a payload, for example
There was a problem hiding this comment.
we could change the rule to detect BITS usage in general here
There was a problem hiding this comment.
I removed the COM part in the latest commit. Now the rule looks for the cmd/powershell commands. This removes the false positives. As you said, we could add a rule in the future to detect BITS usage in general.
| - api: ole32.CoCreateInstance | ||
| - com/class: WbemLocator # 4590F811-1D3A-11D0-891F-00AA004B2E24 |
There was a problem hiding this comment.
do you think it's enough signal to just see the COM usage?
There was a problem hiding this comment.
Malware also uses WMI for information gathering etc.. To reduce false positives we should remove it indeed. I don't see any way in Cape that we can use to reduce the false positives, as we can't match the communication with WMI.
There was a problem hiding this comment.
agreed, for static analysis we could add more details, for dynamic I'd have to do more research myself to see what features are available
There was a problem hiding this comment.
like above we could generalize the rule to detect WMI usage
There was a problem hiding this comment.
I moved this to the rule for WMI usage detection. Let me know what you think.
| - string: /ROOT\\DEFAULT/i | ||
| - or: | ||
| - call: | ||
| - description: dynamic detection rule |
Add 4 miscellaneous persistence techniques.
The BITS Jobs and WMI subscription rules may result in false positives because of the
ole32.CoCreateInstancematching.We might want to remove that part, but that would result in false negatives. Thoughts on this are welcome! :)
This PR requires #952 to be merged.