Merge PR SigmaHQ#4477 from @Neo23x0 - CoercedPotato activity

new: HackTool - CoercedPotato Named Pipe Creation new: HackTool - CoercedPotato Execution update: Renamed CURL.EXE Execution - Extended filter --------- Co-authored-by: Nasreddine Bencherchali <[email protected]>
SavinSpring · Oct 12, 2023 · 61e8d42 · 61e8d42
1 parent 2f9b905
commit 61e8d42
Show file tree

Hide file tree

Showing 4 changed files with 61 additions and 2 deletions.
diff --git a/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml b/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml
@@ -0,0 +1,24 @@
+title: HackTool - CoercedPotato Named Pipe Creation
+id: 4d0083b3-580b-40da-9bba-626c19fe4033
+status: experimental
+description: Detects the pattern of a pipe name as used by the hack tool CoercedPotato
+references:
+    - https://blog.hackvens.fr/articles/CoercedPotato.html
+    - https://github.com/hackvens/CoercedPotato
+author: Florian Roth (Nextron Systems)
+date: 2023/10/11
+tags:
+    - attack.defense_evasion
+    - attack.privilege_escalation
+    - attack.t1055
+logsource:
+    product: windows
+    category: pipe_created
+    definition: 'Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575'
+detection:
+    selection:
+        PipeName|contains: '\coerced\'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high
diff --git a/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml b/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml
@@ -1,7 +1,7 @@
 title: HackTool - EfsPotato Named Pipe Creation
 id: 637f689e-b4a5-4a86-be0e-0100a0a33ba2
 status: experimental
-description: Detects the pattern of a pipe name as used by the hacktool EfsPotato
+description: Detects the pattern of a pipe name as used by the hack tool EfsPotato
 references:
     - https://twitter.com/SBousseaden/status/1429530155291193354?s=20
     - https://github.com/zcgonvh/EfsPotato

diff --git a/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml b/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml
@@ -0,0 +1,34 @@
+title: HackTool - CoercedPotato Execution
+id: e8d34729-86a4-4140-adfd-0a29c2106307
+status: experimental
+description: Detects the use of CoercedPotato, a tool for privilege escalation
+references:
+    - https://github.com/hackvens/CoercedPotato
+    - https://blog.hackvens.fr/articles/CoercedPotato.html
+author: Florian Roth (Nextron Systems)
+date: 2023/10/11
+tags:
+    - attack.defense_evasion
+    - attack.privilege_escalation
+    - attack.t1055
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection_loader_img:
+        Image|endswith: '\CoercedPotato.exe'
+    selection_params:
+        CommandLine|contains: ' --exploitId '
+    selection_loader_imphash:
+        - Imphash:
+            - 'a75d7669db6b2e107a44c4057ff7f7d6'
+            - 'f91624350e2c678c5dcbe5e1f24e22c9'
+            - '14c81850a079a87e83d50ca41c709a15'
+        - Hashes:
+            - 'IMPHASH=A75D7669DB6B2E107A44C4057FF7F7D6'
+            - 'IMPHASH=F91624350E2C678C5DCBE5E1F24E22C9'
+            - 'IMPHASH=14C81850A079A87E83D50CA41C709A15'
+    condition: 1 of selection_*
+falsepositives:
+    - Unknown
+level: high
diff --git a/rules/windows/process_creation/proc_creation_win_renamed_curl.yml b/rules/windows/process_creation/proc_creation_win_renamed_curl.yml
@@ -6,6 +6,7 @@ references:
     - https://twitter.com/Kostastsale/status/1700965142828290260
 author: X__Junior (Nextron Systems)
 date: 2023/09/11
+modified: 2023/10/12
 tags:
     - attack.execution
     - attack.t1059
@@ -19,7 +20,7 @@ detection:
         - OriginalFileName: 'curl.exe'
         - Description: 'The curl executable'
     filter_main_img:
-        Image|endswith: '\curl.exe'
+        Image|contains: '\curl'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown