有时，攻击者可以将恶意代码注入合法运行的进程中。不幸的是，许多合法软件也使用类似的代码注入技术，例如供视障人士使用的屏幕阅读器。
为每个 CodeInjection 事件创建检测将生成过多误报。为解决此问题，我们可以在 ESET Inspect 中使用 Compromised 标记。
规则
首先，我们创建一个规则，其中包含 TriggerDetection 操作，但不包含 MarkAsCompromised 操作。MarkAsCompromised 将向位于代码注入接收端的进程添加一个标记。
<?xml version='1.0' encoding='UTF-8'?>
<rule>
<description>
<name>Common Injection Targets</name>
<category>Special</category>
<os>Windows</os>
<severity>90</severity>
</description>
<definition>
<operations>
<operation type="CodeInjection">
<operator type="AND">
<condition component="CodeInjectionType" condition="is" property="CodeInjectionType" value="SetThreadContext"/>
<operator type="OR">
<condition component="FileItem" property="FileName" condition="is" value="msedge.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="ComSvcConfig.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="explorer.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="DevicePairingWizard.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="EhStorAuthn.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="Locator.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="WUAUCLT.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="WWAHost.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="WerFault.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="bootcfg.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="conhost.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="dllhost.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="getmac.exe"/>
<condition component="FileItem" property="FileName" condition="is" value="systray.exe"/>
</operator>
</operator>
</operation>
</operations>
</definition>
<maliciousTarget name="none"/>
<actions>
<action name="StoreEvent"/>
<action name="MarkAsCompromised"/>
</actions>
</rule>
|
现已设置了 compromised 标记，当发生其他可疑操作（例如访问 LSASS 进程）时，我们便可在另一个规则中引用它。
<?xml version='1.0' encoding='UTF-8'?>
<rule>
<description>
<name>Credential Dumping From Compromised Process</name>
<category>Suspicious process creation and process manipulation</category>
<os>Windows</os>
<severity>90</severity>
<mitreattackid>T1003.001</mitreattackid>
<explanation>A process has accessed the LSASS process in a way that is typical for Mimikatz. LSASS contains sensitive information such as credentials.</explanation>
<benignCauses>Legitimate applications that access other running processes in an improper way (e.g., certain installers).</benignCauses>
<maliciousCauses>Adversary may access LSASS process in order to retrieve credentials - passwords and hashes.</maliciousCauses>
<recommendedActions>1. Initiate Incident Response procedure.</recommendedActions>
</description>
<definition>
<process>
<condition component="ProcessInfo" condition="is" property="Compromised" value="1"/>
</process>
<operations>
<operation type="OpenProcess">
<operator type="AND">
<condition component="FileItem" property="FileName" condition="is" value="lsass.exe"/>
<condition component="FileItem" property="Path" condition="is" value="%SYSTEM%"/>
<condition component="OpenProcess" property="AccessRight" condition="is" value="4112"/>
</operator>
</operation>
</operations>
</definition>
<maliciousTarget name="current"/>
<actions>
<action name="TriggerDetection"/>
<action name="StoreEvent"/>
</actions>
</rule>
|
