Chronicle Rule

Question

Hi,

i wrote a Rule, but working the Exclusion "WindowsBackup" not.

Can you help me?

Regards

rule Powershell {

meta:

author = "..."

description = "Powershell Execution Policy Bypass Attack"

severity = "High"

events:

$shell.metadata.log_type = "POWERSHELL" nocase

$shell.metadata.event_type = "PROCESS_LAUNCH"

$shell.target.process.command_line != /WindowsBackup/ nocase and

re.regex ($shell.target.process.command_line, /-ep bypass/) nocase or

re.regex ($shell.target.process.command_line , /-nop/) nocase or

re.regex ($shell.target.process.command_line , /-executionpolicy bypass/) nocase or

re.regex ($shell.target.process.command_line , /-executionpolicy/) nocase

condition:

$shell

}

herrald · Accepted Answer

I would try grouping the four re.regex lines with parentheses like this:

rule Powershell {

meta:

author = "..."

description = "Powershell Execution Policy Bypass Attack"

severity = "High"

events:

$shell.metadata.log_type = "POWERSHELL" nocase

$shell.metadata.event_type = "PROCESS_LAUNCH"

$shell.target.process.command_line != /WindowsBackup/ nocase and

(

re.regex ($shell.target.process.command_line, /-ep bypass/) nocase or

re.regex ($shell.target.process.command_line , /-nop/) nocase or

re.regex ($shell.target.process.command_line , /-executionpolicy bypass/) nocase or

re.regex ($shell.target.process.command_line , /-executionpolicy/) nocase

)

condition:

$shell

}

Mustache · Answer

As another suggestion, you could also leverage a reference list https://cloud.google.com/chronicle/docs/reference/reference-lists

With that, you could make a `not` line for anything in the reference list such as:

rule Powershell {

meta:

author = "..."

description = "Powershell Execution Policy Bypass Attack"

severity = "High"

events:

$shell.metadata.log_type = "POWERSHELL" nocase

$shell.metadata.event_type = "PROCESS_LAUNCH"

//Exclusion List

not ($shell.target.process.command_line in regex %powershell_not )

condition:

$shell

}

Reply

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded