Skip to content

Commit 5cff350

Browse files
SwiftOnSecuritySwiftOnSecurity
committed
Update z-AlphaVersion.xml
1 parent cdbc451 commit 5cff350

File tree

1 file changed

+79
-34
lines changed

1 file changed

+79
-34
lines changed

‎z-AlphaVersion.xml

Lines changed: 79 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -187,6 +187,8 @@
187187
<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k netsvcs</ParentCommandLine> <!--Microsoft:Windows: Network services: Spawns Consent.exe-->
188188
<ParentCommandLine condition="is">C:\Windows\system32\svchost.exe -k localSystemNetworkRestricted</ParentCommandLine> <!--Microsoft:Windows-->
189189
<CommandLine condition="is">C:\Windows\system32\deviceenroller.exe /c /AutoEnrollMDM</CommandLine> <!--Microsoft:Windows: AzureAD device enrollment agent-->
190+
<!--SECTION: Microsoft:Edge-->
191+
<CommandLine condition="begin with">"C:\Program Files (x86)\Microsoft\Edge Dev\Application\msedge.exe" --type=</CommandLine>
190192
<!--SECTION: Microsoft:dotNet-->
191193
<CommandLine condition="begin with">C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe</CommandLine> <!--Microsoft:DotNet-->
192194
<Image condition="is">C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe</Image> <!--Microsoft:DotNet-->
@@ -837,8 +839,7 @@
837839
<!--SYSMON EVENT ID 22 : DNS QUERY [DnsQuery]-->
838840
<!--EVENT 22: "Dns query"-->
839841

840-
<!--NOTE: Due to the volume of events that DNS queries generate, some orgs may want to remove this section from their configuration to reduce Sysmon log turnover.
841-
If you do not collect events centrally yet, definitely remove this section to preserve other events that are much more important. It's okay to come back later. -->
842+
<!--NOTE: Due to the volume of events that DNS queries generate, some orgs may want to remove this section from their configuration to reduce Sysmon log turnover. -->
842843

843844
<!--COMMENT: DNS logging is a very nuanced challenge in monitoring due to event volume. Legitimate domains can be used to host malware/C2, but lookup itself is not very informative.
844845
It's fine to exclude monitoring these bulk low-value lookups, but at same time, you would not have a full log of how malware communicated, potentially missing C2.
@@ -856,10 +857,7 @@
856857
<!--CONFIG: DNS poisoning is an issue during threat investigations. Try to only exclude ROUTINE system-level queries you know are strongly validated with HTTPS or code signing.-->
857858
<!--CONFIG: If you exclude microsoft.com, someone could register malware-microsoft.com and it wouldn't be logged. Use leading "END WITH" with leading . or "IS" operators.-->
858859
<!--CONFIG: Be very specific in exclusions. Threat actors use legitimate services, too. Dont exclude all of AWS or Azure or Google or CDNs!-->
859-
860-
<!--NOTE: Poisoned ad network resolutions due to DNS configuration changes on client is OUT-OF-SCOPE. Detect that in other ways. It's too much noise to include.
861-
Research: [ https://blogs.cisco.com/security/dnschanger-outbreak-linked-to-adware-install-base ]
862-
Research: [ http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.298.5810&rep=rep1&type=pdf ] -->
860+
<!--CONFIG: Popularity data: [ http://s3-us-west-1.amazonaws.com/umbrella-static/index.html ] [ https://better.fyi/trackers/alexa-top-500-news/ ]
863861
864862
<!--CRITICAL: Do NOT exclude "wpad" lookups. This is a MitM vector routinely used by attackers. Disable WPAD or enforce client-side DNSSEC for AD domain lookups.-->
865863
<!--CRITICAL: Do NOT exclude IPv6 lookups.-->
@@ -872,84 +870,131 @@
872870
<!-- Rejected: .cloudfront.net, customer content -->
873871
<!-- Rejected: .windows.net, customer content -->
874872
<!-- Rejected: *github.com, customer content-->
875-
<!-- Rejected: .zorosrv.com, customer content-->
876873

877874
<RuleGroup name="Dns" groupRelation="or">
878875
<DnsQuery onmatch="exclude">
879876
<!--Network noise-->
880877
<QueryName condition="end with">.arpa.</QueryName> <!--Design decision to not log reverse DNS lookups. You will need to decide.-->
881878
<QueryName condition="end with">.arpa</QueryName> <!--Design decision to not log reverse DNS lookups. You will need to decide.-->
882879
<QueryName condition="end with">.msftncsi.com</QueryName> <!--Microsoft proxy detection | Microsoft default exclusion-->
883-
<QueryResults condition="is">127.0.0.1;<QueryResults> <!--Localhost result. Caused by Nvidia nvcontainer.exe-->
884880
<!--Microsoft-->
885-
<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
886881
<QueryName condition="end with">-pushp.svc.ms</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
887-
<QueryName condition="end with">.ms-acdc.office.com</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
882+
<QueryName condition="end with">.b-msedge.net</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
888883
<QueryName condition="end with">.hotmail.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
889884
<QueryName condition="end with">.live.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
890885
<QueryName condition="end with">.live.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
891886
<QueryName condition="end with">.microsoft.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
892887
<QueryName condition="end with">.microsoftonline.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
893888
<QueryName condition="end with">.microsoftstore.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
889+
<QueryName condition="end with">.ms-acdc.office.com</QueryName> <!--Microsoft: Doesn't appear to host customer content or subdomains-->
890+
<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
894891
<QueryName condition="end with">.skype.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
895892
<QueryName condition="end with">.skype.net</QueryName> <!--Microsoft | Microsoft default exclusion-->
896-
<QueryName condition="end with">.msocdn.com</QueryName> <!--Microsoft-->
897893
<QueryName condition="end with">.windows.com</QueryName> <!--Microsoft-->
898-
<QueryName condition="end with">.windowsupdate.com</QueryName> <!--Microsoft-->
899894
<QueryName condition="end with">.windows.net.nsatc.net</QueryName> <!--Microsoft-->
895+
<QueryName condition="end with">.windowsupdate.com</QueryName> <!--Microsoft-->
900896
<!--Microsoft:Office365/AzureAD-->
897+
<QueryName condition="end with">.activedirectory.windowsazure.com</QueryName> <!--Microsoft: AzureAD-->
898+
<QueryName condition="end with">.aria.microsoft.com</QueryName> <!--Microsoft: OneDrive/SharePoint-->
901899
<QueryName condition="end with">.msauth.net</QueryName>
902900
<QueryName condition="end with">.msftauth.net</QueryName>
903-
<QueryName condition="is">outlook.office365.com</QueryName> <!--Microsoft: Protected by HSTS-->
904-
<QueryName condition="end with">.activedirectory.windowsazure.com</QueryName> <!--Microsoft: AzureAD-->
905901
<QueryName condition="end with">.opinsights.azure.com</QueryName> <!--Microsoft: AzureAD/InTune client event monitoring-->
906-
<QueryName condition="end with">.aria.microsoft.com</QueryName> <!--Microsoft: OneDrive/SharePoint-->
907902
<QueryName condition="is">management.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
903+
<QueryName condition="is">outlook.office365.com</QueryName> <!--Microsoft: Protected by HSTS-->
908904
<QueryName condition="is">portal.azure.com</QueryName> <!--Microsoft: AzureAD/InTune-->
909-
905+
910906
<!--3rd-party applications-->
911907
<QueryName condition="end with">.spotify.com</QueryName>
912908
<!--Goodlist CDN-->
913909
<QueryName condition="is">cdnjs.cloudflare.com</QueryName> <!--Cloudflare: Hosts popular javascript libraries-->
910+
<QueryName condition="end with">.netflix.com</QueryName>
911+
<QueryName condition="is">ajax.googleapis.com</QueryName>
914912
<!--Personal-->
915913
<QueryName condition="end with">.steamcontent.com</QueryName> <!--If you seriously host malware in a Steam game, I give up-->
916914
<!--Misc-->
915+
<QueryName condition="end with">.2mdn.net</QueryName> <!--Ads: Google | Microsoft default exclusion-->
917916
<QueryName condition="end with">.adap.tv</QueryName> <!--Ads:AOL | Microsoft default exclusion [ https://www.crunchbase.com/organization/adap-tv ] -->
918917
<QueryName condition="end with">.addthis.com</QueryName> <!--Ads:Oracle | Microsoft default exclusion [ https://en.wikipedia.org/wiki/AddThis ] -->
918+
<QueryName condition="end with">.adnxs.com</QueryName> <!--Ads: AppNexus | Microsoft default exclusion-->
919919
<QueryName condition="end with">.adsafeprotected.com</QueryName> <!--Advertising-->
920+
<QueryName condition="end with">.adsrvr.org</QueryName> <!--Ads-->
921+
<QueryName condition="end with">.adform.net</QueryName> <!--Ads-->
920922
<QueryName condition="end with">.advertising.com</QueryName> <!--Advertising | Microsoft default exclusion-->
921923
<QueryName condition="end with">.akadns.net</QueryName> <!--AkamaiCDN, extensively used by Microsoft | Microsoft default exclusion-->
922924
<QueryName condition="end with">.aol.com</QueryName> <!--Advertising | Microsoft default exclusion -->
925+
<QueryName condition="end with">.betrad.com</QueryName> <!--Ads | Microsoft default exclusion-->
926+
<QueryName condition="end with">.bidswitch.net</QueryName> <!--Ads-->
927+
<QueryName condition="end with">.bing.com</QueryName> <!-- Microsoft | Microsoft default exclusion -->
928+
<QueryName condition="end with">.casalemedia.com</QueryName> <!--Ads | Microsoft default exclusion-->
929+
<QueryName condition="end with">.chartbeat.net</QueryName> <!--Ads | Microsoft default exclusion [ https://better.fyi/trackers/chartbeat.com/ ]-->
930+
<QueryName condition="end with">.cnn.com</QueryName> <!-- Microsoft default exclusion-->
931+
<QueryName condition="end with">.criteo.com</QueryName> <!--Ads [ https://better.fyi/trackers/criteo.com/ ] -->
932+
<QueryName condition="end with">.crwdcntrl.net</QueryName> <!--Ads: Lotame [ https://better.fyi/trackers/crwdcntrl.net/ ] -->
933+
<QueryName condition="end with">.demdex.net</QueryName> <!--Ads | Microsoft default exclusion-->
934+
<QueryName condition="end with">.disqus.com</QueryName> <!--Microsoft default exclusion-->
935+
<QueryName condition="end with">.dotomi.com</QueryName> <!--Ads | Microsoft default exclusion-->
923936
<QueryName condition="end with">.doubleclick.net</QueryName> <!--Ads:Conversant | Microsoft default exclusion [ https://www.crunchbase.com/organization/dotomi ] -->
924937
<QueryName condition="end with">.doubleverify.com</QueryName> <!--Ads: [ ] -->
938+
<QueryName condition="end with">.fontawesome.com</QueryName>
925939
<QueryName condition="end with">.google-analytics.com</QueryName> <!--Ads:Google | Microsoft default exclusion-->
926940
<QueryName condition="end with">.googlesyndication.com</QueryName> <!--Ads:Google, sometimes called during malicious ads, but not directly responsible | Microsoft default exclusion [ https://www.hackread.com/wp-content/uploads/2018/06/Bitdefender-Whitepaper-Zacinlo.pdf ]-->
941+
<QueryName condition="end with">.googletagmanager.com</QueryName> <!--Google-->
927942
<QueryName condition="end with">.googlevideo.com</QueryName> <!--Google | Microsoft default exclusion-->
928943
<QueryName condition="end with">.gstatic.com</QueryName> <!--Google | Microsoft default exclusion-->
929-
<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
930-
<QueryName condition="end with">.pardot.com</QueryName>
931-
<QueryName condition="end with">.pinterest.com</QueryName> <!--Pinerest-->
932-
<QueryName condition="end with">.outbrain.com</QueryName>
933-
<QueryName condition="end with">.revsci.net</QueryName> <!--Ads:Omniture | Microsoft default exclusion-->
934944
<QueryName condition="end with">.gvt1.com</QueryName> <!--Google-->
935945
<QueryName condition="end with">.gvt2.com</QueryName> <!--Google-->
936-
<QueryName condition="end with">.moatads.com</QueryName> <!--Ads | Microsoft default exclusion-->
937-
<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
938-
<QueryName condition="is">safebrowsing.googleapis.com</QueryName> <!--Google-->
939-
<QueryName condition="is">update.googleapis.com</QueryName> <!--Google-->
940-
<QueryName condition="is">clientservices.googleapis.com</QueryName> <!--Google-->
946+
<QueryName condition="end with">.ib-ibi.com</QueryName> <!--Ads: Offerpath [ https://better.fyi/trackers/ib-ibi.com/ ] -->
941947
<QueryName condition="end with">.jivox.com</QueryName> <!--Ads-->
948+
<QueryName condition="end with">.mathtag.com</QueryName> <!--Microsoft default exclusion-->
949+
<QueryName condition="end with">.moatads.com</QueryName> <!--Ads | Microsoft default exclusion-->
950+
<QueryName condition="end with">.moatpixel.com</QueryName> <!--Ads | Microsoft default exclusion-->
951+
<QueryName condition="end with">.msn.com</QueryName> <!--Microsoft | Microsoft default exclusion-->
942952
<QueryName condition="end with">.myvisualiq.net</QueryName> <!--Ads-->
953+
<QueryName condition="end with">.netmng.com</QueryName> <!--Ads-->
954+
<QueryName condition="end with">.nexac.com</QueryName> <!--Ads | Microsoft default exclusion-->
955+
<QueryName condition="end with">.nexac.com</QueryName> <!--Ads | Microsoft default exclusion-->
956+
<QueryName condition="end with">.outbrain.com</QueryName> <!--Ads-->
957+
<QueryName condition="end with">.pardot.com</QueryName> <!--Ads-->
958+
<QueryName condition="end with">.phx.gbl</QueryName> <!--Ads | Microsoft default exclusion-->
959+
<QueryName condition="end with">.pinterest.com</QueryName> <!--Pinerest-->
960+
<QueryName condition="end with">.pubmatic.com</QueryName> <!--Ads | Microsoft default exclusion-->
961+
<QueryName condition="end with">.quantserve.com</QueryName>
962+
<QueryName condition="end with">.revsci.net</QueryName> <!--Ads:Omniture | Microsoft default exclusion-->
963+
<QueryName condition="end with">.rfihub.net</QueryName> <!--Ads | Microsoft default exclusion-->
964+
<QueryName condition="end with">.rlcdn.com</QueryName> <!--Ads: Rapleaf [ https://better.fyi/trackers/rlcdn.com/ ] -->
965+
<QueryName condition="end with">.rubiconproject.com</QueryName> <!--Ads: Rubicon Project | Microsoft default exclusion [ https://better.fyi/trackers/rubiconproject.com/ ] -->
966+
<QueryName condition="end with">.scdn.co</QueryName> <!--Spotify-->
967+
<QueryName condition="end with">.scorecardresearch.com</QueryName> <!--Ads: Comscore | Microsoft default exclusion-->
968+
<QueryName condition="end with">.serving-sys.com</QueryName> <!--Ads | Microsoft default exclusion-->
969+
<QueryName condition="end with">.sitescout.com</QueryName> <!--Ads-->
943970
<QueryName condition="end with">.smartadserver.com</QueryName> <!--Ads-->
944-
<QueryName condition="end with">.adnxs.com</QueryName> <!--Ads | Microsoft default exclusion-->
945-
<QueryName condition="is">d29x207vrinatv.cloudfront.net</QueryName> <!--Amazon-developed applications-->
946-
<QueryName condition="end with">opps.zorosrv.com</QueryName>
947-
<QueryName condition="end with">wf.zorosrv.com</QueryName>
948-
<QueryName condition="end with">.taboola.map.fastly.net</QueryName>
949-
<QueryName condition="end with">.mathtag.com</QueryName> <!--Microsoft default exclusion-->
971+
<QueryName condition="end with">.snapads.com</QueryName> <!--Ads-->
972+
<QueryName condition="end with">.spotify.map.fastly.net</QueryName> <!--Spotify-->
973+
<QueryName condition="end with">.spotxchange.com</QueryName> <!--Ads-->
974+
<QueryName condition="end with">.taboola.com</QueryName> <!--Ads:Taboola-->
975+
<QueryName condition="end with">.taboola.map.fastly.net</QueryName> <!--Ads:Taboola-->
976+
<QueryName condition="end with">.trafficmanager.net</QueryName> <!--Ads | Microsoft default exclusion-->
977+
<QueryName condition="end with">.tremorhub.com</QueryName> <!--Ads-->
978+
<QueryName condition="end with">.tribalfusion.com</QueryName> <!--Ads: Exponential [ https://better.fyi/trackers/tribalfusion.com/ ] -->
979+
<QueryName condition="end with">.turn.com</QueryName> <!--Ads | Microsoft default exclusion-->
980+
<QueryName condition="end with">.twimg.com</QueryName> <!--Ads | Microsoft default exclusion-->
950981
<QueryName condition="end with">.ytimg.com</QueryName> <!--Google-->
951-
<QueryName condition="end with">.chartbeat.net</QueryName> <!--Microsoft default exclusion-->
952-
982+
<QueryName condition="end with">.zorosrv.com</QueryName> <!--Ads:Taboola-->
983+
<QueryName condition="is">ampcid.google.com</QueryName> <!--Google-->
984+
<QueryName condition="is">clients1.google.com</QueryName> <!--Google-->
985+
<QueryName condition="is">clients2.google.com</QueryName> <!--Google-->
986+
<QueryName condition="is">clients4.google.com</QueryName> <!--Google-->
987+
<QueryName condition="is">clients6.google.com</QueryName> <!--Google-->
988+
<QueryName condition="is">clientservices.googleapis.com</QueryName> <!--Google-->
989+
<QueryName condition="is">d29x207vrinatv.cloudfront.net</QueryName> <!--Amazon-developed applications-->
990+
<QueryName condition="is">fonts.googleapis.com</QueryName> <!--Google fonts-->
991+
<QueryName condition="is">imasdk.googleapis.com</QueryName> <!--Google [ https://developers.google.com/interactive-media-ads/docs/sdks/html5/ ] -->
992+
<QueryName condition="is">l.google.com</QueryName> <!--Google-->
993+
<QueryName condition="is">mtalk.google.com</QueryName> <!--Google-->
994+
<QueryName condition="is">safebrowsing.googleapis.com</QueryName> <!--Google-->
995+
<QueryName condition="is">update.googleapis.com</QueryName> <!--Google-->
996+
<!--OSCP Common-->
997+
<QueryName condition="is">ocsp.digicert.com</QueryName>
953998
</DnsQuery>
954999
</RuleGroup>
9551000

0 commit comments

Comments
 (0)