Skip to content

Commit 1943a54

Browse files
Samirboustradebot-elastic
Samirbous
authored and
tradebot-elastic
committed
[New] Potential System Tampering via File Modification (#5043)
* [New] Potential System Tampering via File Modification * Update impact_mod_critical_os_files.toml * Update rules/windows/impact_mod_critical_os_files.toml * Create defense_evasion_modify_ownership_os_files.toml * Update defense_evasion_modify_ownership_os_files.toml * Update defense_evasion_modify_ownership_os_files.toml * Update defense_evasion_modify_ownership_os_files.toml * Update defense_evasion_modify_ownership_os_files.toml --------- Co-authored-by: Jonhnathan <[email protected]> (cherry picked from commit 61af3e8)
1 parent 7d7ac5a commit 1943a54

File tree

2 files changed

+211
-0
lines changed

2 files changed

+211
-0
lines changed

‎rules/windows/defense_evasion_modify_ownership_os_files.toml‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
[metadata]
2+
creation_date = "2025/09/01"
3+
integration = ["endpoint", "windows", "system", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
4+
maturity = "production"
5+
updated_date = "2025/09/01"
6+
7+
8+
[rule]
9+
author = ["Elastic"]
10+
description = "Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files."
11+
from = "now-9m"
12+
index = [
13+
"endgame-*",
14+
"logs-crowdstrike.fdr*",
15+
"logs-endpoint.events.process-*",
16+
"logs-m365_defender.event-*",
17+
"logs-sentinel_one_cloud_funnel.*",
18+
"logs-system.security*",
19+
"logs-windows.forwarded*",
20+
"logs-windows.sysmon_operational-*",
21+
"winlogbeat-*",
22+
]
23+
language = "eql"
24+
license = "Elastic License v2"
25+
name = "System File Onwership Change"
26+
note = """## Triage and analysis
27+
28+
### Investigating System File Onwership Change
29+
30+
Adversaries may modify file or directory ownership to evade access control lists (ACLs) and access protected files.
31+
32+
#### Possible investigation steps
33+
34+
- Assess the ownership target file or directory and identify if it's a system critical file.
35+
- Identify the user account that performed the action and whether it should perform this kind of action.
36+
- Investigate the process execution chain (parent process tree) for unknown processes. Examine their executable files for prevalence, whether they are located in expected locations, and if they are signed with valid digital signatures.
37+
- Investigate other alerts associated with the user/host during the past 48 hours.
38+
39+
### False positive analysis
40+
41+
- System updates, backup software and uninstallers tend to modify files ownership.
42+
43+
### Response and remediation
44+
45+
- Initiate the incident response process based on the outcome of the triage.
46+
- Isolate the involved host to prevent further post-compromise behavior.
47+
- If the triage identified malware, search the environment for additional compromised hosts.
48+
- Implement temporary network rules, procedures, and segmentation to contain the malware.
49+
- Stop suspicious processes.
50+
- Immediately block the identified indicators of compromise (IoCs).
51+
- Inspect the affected systems for additional malware backdoors like reverse shells, reverse proxies, or droppers that attackers could use to reinfect the system.
52+
- Remove and block malicious artifacts identified during triage.
53+
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
54+
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
55+
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
56+
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
57+
"""
58+
risk_score = 47
59+
rule_id = "7eb54028-ca72-4eb7-8185-b6864572347db"
60+
severity = "medium"
61+
tags = [
62+
"Domain: Endpoint",
63+
"OS: Windows",
64+
"Use Case: Threat Detection",
65+
"Tactic: Defense Evasion",
66+
"Tactic: Persistence",
67+
"Data Source: Elastic Endgame",
68+
"Resources: Investigation Guide",
69+
"Data Source: Elastic Defend",
70+
"Data Source: Windows Security Event Logs",
71+
"Data Source: Microsoft Defender for Endpoint",
72+
"Data Source: Sysmon",
73+
"Data Source: SentinelOne",
74+
"Data Source: Crowdstrike",
75+
]
76+
timeline_id = "e70679c2-6cde-4510-9764-4823df18f7db"
77+
timeline_title = "Comprehensive Process Timeline"
78+
timestamp_override = "event.ingested"
79+
type = "eql"
80+
81+
query = '''
82+
process where host.os.type == "windows" and event.type == "start" and
83+
(
84+
(process.name : "icacls.exe" and process.args : "/reset") or
85+
(process.name : "takeown.exe" and process.args : "/f") or
86+
(process.name : "/grant" and process.args : "grant" and process.args : "Everyone:F")
87+
) and
88+
process.command_line : "*.exe *C:\\Windows\\*"
89+
'''
90+
91+
92+
[[rule.threat]]
93+
framework = "MITRE ATT&CK"
94+
[[rule.threat.technique]]
95+
id = "T1222"
96+
name = "File and Directory Permissions Modification"
97+
reference = "https://attack.mitre.org/techniques/T1222/"
98+
[[rule.threat.technique.subtechnique]]
99+
id = "T1222.001"
100+
name = "Windows File and Directory Permissions Modification"
101+
reference = "https://attack.mitre.org/techniques/T1222/001/"
102+
103+
104+
105+
[rule.threat.tactic]
106+
id = "TA0005"
107+
name = "Defense Evasion"
108+
reference = "https://attack.mitre.org/tactics/TA0005/"
109+
110+
111+

‎rules/windows/impact_mod_critical_os_files.toml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
[metadata]
2+
creation_date = "2025/09/01"
3+
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel", "crowdstrike"]
4+
maturity = "production"
5+
updated_date = "2025/09/01"
6+
7+
[rule]
8+
author = ["Elastic"]
9+
description = """
10+
Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting.
11+
This may indicate a destructive attack behavior.
12+
"""
13+
from = "now-9m"
14+
index = [
15+
"winlogbeat-*",
16+
"logs-endpoint.events.file-*",
17+
"logs-windows.sysmon_operational-*",
18+
"endgame-*",
19+
"logs-m365_defender.event-*",
20+
"logs-sentinel_one_cloud_funnel.*",
21+
"logs-crowdstrike.fdr*",
22+
]
23+
language = "eql"
24+
license = "Elastic License v2"
25+
name = "Potential System Tampering via File Modification"
26+
note = """## Triage and analysis
27+
28+
### Investigating Potential System Tampering via File Modification
29+
30+
This rule identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting.
31+
32+
#### Possible investigation steps
33+
34+
- Investigate the process execution chain (parent process tree) for unknown processes.
35+
- Assess all deleted or modified system critical files and perform a complete recovery of those files to prevent system booting issues.
36+
- Investigate other alerts associated with the user/host during the past 48 hours.
37+
- Identify the user account that performed the action and whether it should perform this kind of action, if not immedialy disable the account.
38+
39+
### False positive analysis
40+
41+
- Analysts can dismiss the alert if the administrator is aware of the activity, no other suspicious activity was identified, and there are justifications for the execution.
42+
43+
### Response and remediation
44+
45+
- Initiate the incident response process based on the outcome of the triage.
46+
- Prioritize cases involving critical servers and users.
47+
- Isolate the involved hosts to prevent further post-compromise behavior.
48+
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are identified. Reset passwords for these accounts and other potentially compromised credentials, such as email, business systems, and web services.
49+
- If important data was encrypted, deleted, or modified, activate your data recovery plan.
50+
- Perform data recovery locally or restore the backups from replicated copies (cloud, other servers, etc.).
51+
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and malware components.
52+
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
53+
- Review the privileges assigned to the user to ensure that the least privilege principle is being followed.
54+
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the mean time to respond (MTTR).
55+
"""
56+
risk_score = 73
57+
rule_id = "1a3f2a4c-12d0-4b88-961a-2711ee295637"
58+
severity = "high"
59+
tags = [
60+
"Domain: Endpoint",
61+
"OS: Windows",
62+
"Use Case: Threat Detection",
63+
"Tactic: Defense Evasion",
64+
"Tactic: Impact",
65+
"Data Source: Elastic Endgame",
66+
"Resources: Investigation Guide",
67+
"Data Source: Elastic Defend",
68+
"Data Source: Sysmon",
69+
"Data Source: Microsoft Defender for Endpoint",
70+
"Data Source: SentinelOne",
71+
"Data Source: Crowdstrike",
72+
]
73+
timestamp_override = "event.ingested"
74+
type = "eql"
75+
76+
query = '''
77+
file where host.os.type == "windows" and event.type in ("change", "deletion") and
78+
file.name : ("winload.exe", "winlod.efi", "ntoskrnl.exe", "bootmgr") and
79+
file.path : ("?:\\Windows\\*", "\\Device\\HarddiskVolume*\\Windows\\*") and
80+
not process.executable : ("?:\\Windows\\System32\\poqexec.exe", "?\\Device\\HarddiskVolume*\\Windows\\System32\\poqexec.exe")
81+
'''
82+
83+
84+
[[rule.threat]]
85+
framework = "MITRE ATT&CK"
86+
[[rule.threat.technique]]
87+
id = "T1485"
88+
name = "Data Destruction"
89+
reference = "https://attack.mitre.org/techniques/T1485/"
90+
[[rule.threat.technique]]
91+
id = "T1490"
92+
name = "Inhibit System Recovery"
93+
reference = "https://attack.mitre.org/techniques/T1490/"
94+
95+
96+
[rule.threat.tactic]
97+
id = "TA0040"
98+
name = "Impact"
99+
reference = "https://attack.mitre.org/tactics/TA0040/"
100+

0 commit comments

Comments
 (0)