Skip to content

Commit a87f5f2

Browse files
MHaggisMHaggis
committed
fixing regex
Thank you @nterl0k
1 parent 87dface commit a87f5f2

File tree

1 file changed

+35
-35
lines changed

1 file changed

+35
-35
lines changed

‎detections/endpoint/windows_sqlcmd_execution.yml‎

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -27,76 +27,76 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
2727
has_parameters=if(match(process, "-[A-Za-z]"), 1, 0),
2828
has_query=case(
2929
match(process, "-[Qq]\\s+"), 1,
30-
match(process_lower, "(?i)--query\\s+"), 1,
31-
match(process_lower, "(?i)--initial-query\\s+"), 1,
30+
match(process_lower, "--query\\s+"), 1,
31+
match(process_lower, "--initial-query\\s+"), 1,
3232
true(), 0
3333
),
3434
has_output=case(
3535
match(process, "-[oO]\\s+"), 1,
36-
match(process_lower, "(?i)--output-file\\s+"), 1,
36+
match(process_lower, "--output-file\\s+"), 1,
3737
true(), 0
3838
),
3939
has_input=case(
4040
match(process, "-[iI]\\s+"), 1,
41-
match(process_lower, "(?i)--input-file\\s+"), 1,
41+
match(process_lower, "--input-file\\s+"), 1,
4242
true(), 0
4343
),
4444
has_url_input=case(
4545
match(process, "-[iI]\\s+https?://"), 1,
46-
match(process_lower, "(?i)--input-file\\s+https?://"), 1,
46+
match(process_lower, "--input-file\\s+https?://"), 1,
4747
match(process, "-[iI]\\s+ftp://"), 1,
48-
match(process_lower, "(?i)--input-file\\s+ftp://"), 1,
48+
match(process_lower, "--input-file\\s+ftp://"), 1,
4949
true(), 0
5050
),
5151
has_admin_conn=case(
5252
match(process, "-A"), 1,
53-
match(process_lower, "(?i)--dedicated-admin-connection"), 1,
53+
match(process_lower, "--dedicated-admin-connection"), 1,
5454
true(), 0
5555
),
5656
has_suspicious_auth=case(
5757
match(process, "-U\\s+sa\\b"), 1,
58-
match(process_lower, "(?i)--user-name\\s+sa\\b"), 1,
58+
match(process_lower, "--user-name\\s+sa\\b"), 1,
5959
match(process, "-U\\s+admin\\b"), 1,
60-
match(process_lower, "(?i)--user-name\\s+admin\\b"), 1,
60+
match(process_lower, "--user-name\\s+admin\\b"), 1,
6161
match(process, "-E\\b"), 1,
62-
match(process_lower, "(?i)--use-trusted-connection"), 1,
62+
match(process_lower, "--use-trusted-connection"), 1,
6363
true(), 0
6464
),
6565
has_local_server=case(
6666
match(process, "-S\\s+127\\.0\\.0\\.1"), 1,
67-
match(process_lower, "(?i)--server\\s+127\\.0\\.0\\.1"), 1,
67+
match(process_lower, "--server\\s+127\\.0\\.0\\.1"), 1,
6868
match(process, "-S\\s+localhost"), 1,
69-
match(process_lower, "(?i)--server\\s+localhost"), 1,
69+
match(process_lower, "--server\\s+localhost"), 1,
7070
true(), 0
7171
),
7272
has_suspicious_output=case(
73-
match(process_lower, "(?i)-o\\s+.*\\.(txt|csv|dat)"), 1,
74-
match(process_lower, "(?i)--output-file\\s+.*\\.(txt|csv|dat)"), 1,
73+
match(process_lower, "-o\\s+.*\\.(txt|csv|dat)"), 1,
74+
match(process_lower, "--output-file\\s+.*\\.(txt|csv|dat)"), 1,
7575
true(), 0
7676
),
7777
has_cert_bypass=case(
7878
match(process, "-C"), 1,
79-
match(process_lower, "(?i)--trust-server-certificate"), 1,
79+
match(process_lower, "--trust-server-certificate"), 1,
8080
true(), 0
8181
),
8282
has_suspicious_query=case(
83-
match(process_lower, "(?i)(xp_cmdshell|sp_oacreate|sp_execute_external|openrowset|bulk\\s+insert)"), 1,
84-
match(process_lower, "(?i)(master\\.\\.\\.sysdatabases|msdb\\.\\.\\.backuphistory|sysadmin|securityadmin)"), 1,
85-
match(process_lower, "(?i)(select.*from.*sys\\.|select.*password|dump\\s+database)"), 1,
86-
match(process_lower, "(?i)(sp_addextendedproc|sp_makewebtask|sp_addsrvrolemember)"), 1,
87-
match(process_lower, "(?i)(sp_configure.*show\\s+advanced|reconfigure|enable_xp_cmdshell)"), 1,
88-
match(process_lower, "(?i)(exec.*master\\.dbo\\.|exec.*msdb\\.dbo\\.)"), 1,
89-
match(process_lower, "(?i)(sp_password|sp_control_dbmasterkey_password|sp_dropextendedproc)"), 1,
90-
match(process_lower, "(?i)(powershell|cmd\\.exe|rundll32|regsvr32|certutil)"), 1,
83+
match(process_lower, "(xp_cmdshell|sp_oacreate|sp_execute_external|openrowset|bulk\\s+insert)"), 1,
84+
match(process_lower, "(master\\.\\.\\.sysdatabases|msdb\\.\\.\\.backuphistory|sysadmin|securityadmin)"), 1,
85+
match(process_lower, "(select.*from.*sys\\.|select.*password|dump\\s+database)"), 1,
86+
match(process_lower, "(sp_addextendedproc|sp_makewebtask|sp_addsrvrolemember)"), 1,
87+
match(process_lower, "(sp_configure.*show\\s+advanced|reconfigure|enable_xp_cmdshell)"), 1,
88+
match(process_lower, "(exec.*master\\.dbo\\.|exec.*msdb\\.dbo\\.)"), 1,
89+
match(process_lower, "(sp_password|sp_control_dbmasterkey_password|sp_dropextendedproc)"), 1,
90+
match(process_lower, "(powershell|cmd\\.exe|rundll32|regsvr32|certutil)"), 1,
9191
true(), 0
9292
),
9393
has_suspicious_path=case(
94-
match(process_lower, "(?i)(\\\\temp\\\\|\\\\windows\\\\|\\\\public\\\\|\\\\users\\\\public\\\\|\\\\programdata\\\\)"), 1,
95-
match(process_lower, "(?i)(\\\\desktop\\\\.*\\.(zip|rar|7z|tar|gz))"), 1,
96-
match(process_lower, "(?i)(\\\\downloads\\\\.*\\.(dat|bin|tmp))"), 1,
97-
match(process_lower, "(?i)(\\\\appdata\\\\local\\\\temp\\\\|\\\\windows\\\\tasks\\\\)"), 1,
98-
match(process_lower, "(?i)(\\\\recycler\\\\|\\\\system32\\\\|\\\\system volume information\\\\)"), 1,
99-
match(process_lower, "(?i)(\\.vbs|\\.ps1|\\.bat|\\.cmd|\\.exe)$"), 1,
94+
match(process_lower, "(\\\\temp\\\\|\\\\windows\\\\|\\\\public\\\\|\\\\users\\\\public\\\\|\\\\programdata\\\\)"), 1,
95+
match(process_lower, "(\\\\desktop\\\\.*\\.(zip|rar|7z|tar|gz))"), 1,
96+
match(process_lower, "(\\\\downloads\\\\.*\\.(dat|bin|tmp))"), 1,
97+
match(process_lower, "(\\\\appdata\\\\local\\\\temp\\\\|\\\\windows\\\\tasks\\\\)"), 1,
98+
match(process_lower, "(\\\\recycler\\\\|\\\\system32\\\\|\\\\system volume information\\\\)"), 1,
99+
match(process_lower, "(\\.vbs|\\.ps1|\\.bat|\\.cmd|\\.exe)$"), 1,
100100
true(), 0
101101
),
102102
has_suspicious_combo=case(
@@ -106,17 +106,17 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
106106
true(), 0
107107
),
108108
has_obfuscation=case(
109-
match(process_lower, "(?i)(char\\(|convert\\(|cast\\(|declare\\s+@)"), 1,
110-
match(process_lower, "(?i)(exec\\s+\\(|exec\\s+@|;\\s*exec)"), 1,
109+
match(process_lower, "(char\\(|convert\\(|cast\\(|declare\\s+@)"), 1,
110+
match(process_lower, "(exec\\s+\\(|exec\\s+@|;\\s*exec)"), 1,
111111
match(process, "\\^|\\%|\\+\\+|\\-\\-"), 1,
112112
len(process) > 500, 1,
113113
true(), 0
114114
),
115115
has_data_exfil=case(
116-
match(process_lower, "(?i)(for\\s+xml|for\\s+json)"), 1,
117-
match(process_lower, "(?i)(bulk\\s+insert.*from)"), 1,
118-
match(process_lower, "(?i)(bcp.*queryout|bcp.*out)"), 1,
119-
match(process_lower, "(?i)(select.*into.*from|select.*into.*outfile)"), 1,
116+
match(process_lower, "(for\\s+xml|for\\s+json)"), 1,
117+
match(process_lower, "(bulk\\s+insert.*from)"), 1,
118+
match(process_lower, "(bcp.*queryout|bcp.*out)"), 1,
119+
match(process_lower, "(select.*into.*from|select.*into.*outfile)"), 1,
120120
true(), 0
121121
)
122122

0 commit comments

Comments
 (0)