Skip to content

Commit f1a0b29

Browse files
mthchtmthcht
committed
add tools
1 parent 22ff801 commit f1a0b29

28 files changed

+29418
-27677
lines changed

‎_utils/threathunting-keywords.csv

Lines changed: 27411 additions & 27012 deletions
Large diffs are not rendered by default.

‎yara_rules/greyware_tool_keyword/E-H/guerrillamail.yara

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
rule guerrillamail
2+
{
3+
meta:
4+
description = "Detection patterns for the tool 'guerrillamail' taken from the ThreatHunting-Keywords github project"
5+
author = "@mthcht"
6+
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
7+
tool = "guerrillamail"
8+
rule_category = "greyware_tool_keyword"
9+
10+
strings:
11+
// Description: using the API of a disposable email address to use anytime - could be abused by malicious actors
12+
// Reference: https://www.guerrillamail.com
13+
$string1 = /http\:\/\/api\.guerrillamail\.com\/ajax\.php\?/ nocase ascii wide
14+
// Description: disposable email address to use anytime.
15+
// Reference: https://www.guerrillamail.com
16+
$string2 = /https\:\/\/www\.guerrillamail\.com\/compose/ nocase ascii wide
17+
// Description: disposable email address to use anytime.
18+
// Reference: https://www.guerrillamail.com
19+
$string3 = /https\:\/\/www\.guerrillamail\.com\/inbox/ nocase ascii wide
20+
21+
condition:
22+
any of them
23+
}

‎yara_rules/greyware_tool_keyword/L-N/MpCmdRun.yara

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,12 @@ rule MpCmdRun
88
rule_category = "greyware_tool_keyword"
99

1010
strings:
11-
// Description: Wipe currently stored definitions
12-
// Reference: N/A
13-
$string1 = /MpCmdRun\.exe\s\-RemoveDefinitions\s\-All/ nocase ascii wide
1411
// Description: Defense evasion technique disable windows defender
1512
// Reference: N/A
16-
$string2 = /MpCmdRun\.exe.{0,1000}\s\-disable/ nocase ascii wide
13+
$string1 = /MpCmdRun\.exe.{0,1000}\s\-disable/ nocase ascii wide
14+
// Description: Wipe currently stored definitions
15+
// Reference: N/A
16+
$string2 = /MpCmdRun\.exe.{0,1000}\s\-RemoveDefinitions\s\-All/ nocase ascii wide
1717
1818
condition:
1919
any of them

‎yara_rules/greyware_tool_keyword/L-N/ldap queries.yara

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -65,72 +65,75 @@ rule ldap_queries
6565
// Description: Enumerate all of the domain controllers for all domains in a forest
6666
// Reference: N/A
6767
$string19 = /\(Get\-ADForest\)\.Domains\s\|\s\%\{\sGet\-ADDomainController\s\-Filter\s.{0,1000}\s\-Server\s\$_\s\}/ nocase ascii wide
68+
// Description: used by Rubeus and S4UTomato tools
69+
// Reference: N/A
70+
$string20 = /\(msds\-supportedencryptiontypes\=0\)\(msds\-supportedencryptiontypes\:1\.2\.840\.113556\.1\.4\.803\:\=4\)\)\)/ nocase ascii wide
6871
// Description: Query to find service accounts which are typically high-privileged and targeted for privilege escalation
6972
// Reference: https://github.com/mthcht/ThreatHunting-Keywords
70-
$string20 = /\(objectCategory\=person\)\(objectClass\=user\)\(serviceAccount\=TRUE\)/ nocase ascii wide
73+
$string21 = /\(objectCategory\=person\)\(objectClass\=user\)\(serviceAccount\=TRUE\)/ nocase ascii wide
7174
// Description: Enumerate Domain Admins
7275
// Reference: https://gist.github.com/jsecurity101/9c7e94f95b8d90f9252d64949562ba5d
73-
$string21 = /\(objectclass\=group\)\(samaccountname\=domain\sadmins\)/ nocase ascii wide
76+
$string22 = /\(objectclass\=group\)\(samaccountname\=domain\sadmins\)/ nocase ascii wide
7477
// Description: Accounts Trusted for Delegation
7578
// Reference: https://gist.github.com/jsecurity101/9c7e94f95b8d90f9252d64949562ba5d
76-
$string22 = /\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=524288\)/ nocase ascii wide
79+
$string23 = /\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=524288\)/ nocase ascii wide
7780
// Description: enumeration of Domain Password Policies
7881
// Reference: https://github.com/swarleysez/AD-common-queries
79-
$string23 = /\[ADSI\].{0,1000}\s\|\sSelect\-Object\s\-Property\s.{0,1000}lockoutDuration/ nocase ascii wide
82+
$string24 = /\[ADSI\].{0,1000}\s\|\sSelect\-Object\s\-Property\s.{0,1000}lockoutDuration/ nocase ascii wide
8083
// Description: enumeration of Domain Password Policies
8184
// Reference: https://github.com/swarleysez/AD-common-queries
82-
$string24 = /\[ADSI\].{0,1000}\s\|\sSelect\-Object\s\-Property\s.{0,1000}lockoutThreshold/ nocase ascii wide
85+
$string25 = /\[ADSI\].{0,1000}\s\|\sSelect\-Object\s\-Property\s.{0,1000}lockoutThreshold/ nocase ascii wide
8386
// Description: enumeration of Domain Password Policies
8487
// Reference: https://github.com/swarleysez/AD-common-queries
85-
$string25 = /\[ADSI\].{0,1000}\s\|\sSelect\-Object\s\-Property\s.{0,1000}minPwdLength/ nocase ascii wide
88+
$string26 = /\[ADSI\].{0,1000}\s\|\sSelect\-Object\s\-Property\s.{0,1000}minPwdLength/ nocase ascii wide
8689
// Description: enumeration of Domain Admins group members
8790
// Reference: https://github.com/swarleysez/AD-common-queries
88-
$string26 = /\[ADSI\].{0,1000}LDAP\:\/\/CN\=Domain\sAdmins.{0,1000}\|\sForEach\-Object\s\{\[adsi\]\"LDAP\:\/\/\$_\"\}\;\s.{0,1000}\.distinguishedname/ nocase ascii wide
91+
$string27 = /\[ADSI\].{0,1000}LDAP\:\/\/CN\=Domain\sAdmins.{0,1000}\|\sForEach\-Object\s\{\[adsi\]\"LDAP\:\/\/\$_\"\}\;\s.{0,1000}\.distinguishedname/ nocase ascii wide
8992
// Description: get LDAP properties for password settings directly
9093
// Reference: https://github.com/swarleysez/AD-common-queries
91-
$string27 = /\[ADSI\].{0,1000}LDAP\:\/\/dc\=.{0,1000}\s\|\sSelect\s\-Property\spwdProperties/ nocase ascii wide
94+
$string28 = /\[ADSI\].{0,1000}LDAP\:\/\/dc\=.{0,1000}\s\|\sSelect\s\-Property\spwdProperties/ nocase ascii wide
9295
// Description: find user descriptions in Active Directory:
9396
// Reference: https://github.com/swarleysez/AD-common-queries
94-
$string28 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\)\"\;\s\$users\s\=\s\$searchUsers\.FindAll\(\)\;\s\$userProps\s\=\s\$users\.Properties\;\s\$userProps\s\|\sWhere\-Object\s\{\$_\.description\}/ nocase ascii wide
97+
$string29 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\)\"\;\s\$users\s\=\s\$searchUsers\.FindAll\(\)\;\s\$userProps\s\=\s\$users\.Properties\;\s\$userProps\s\|\sWhere\-Object\s\{\$_\.description\}/ nocase ascii wide
9598
// Description: find all disabled user accounts
9699
// Reference: https://github.com/swarleysez/AD-common-queries
97-
$string29 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\"/ nocase ascii wide
100+
$string30 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\"/ nocase ascii wide
98101
// Description: get a count of all inter domain trust accounts
99102
// Reference: https://github.com/swarleysez/AD-common-queries
100-
$string30 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2560\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\)\"/ nocase ascii wide
103+
$string31 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2560\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\)\"/ nocase ascii wide
101104
// Description: Detection of all accounts with 'Password Not Required'
102105
// Reference: https://github.com/swarleysez/AD-common-queries
103-
$string31 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=32\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\)/ nocase ascii wide
106+
$string32 = /\[adsisearcher\]\"\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=32\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)\)/ nocase ascii wide
104107
// Description: Enumerate all Domain Controllers
105108
// Reference: https://web.archive.org/web/20240109000256/https://cyberdom.blog/2024/01/07/defender-for-identity-hunting-for-ldap/
106-
$string32 = /\[adsisearcher\]\'\(\&\(objectCategory\=computer\)\(primaryGroupID\=516\)\)\'\)\.FindAll\(\)/ nocase ascii wide
109+
$string33 = /\[adsisearcher\]\'\(\&\(objectCategory\=computer\)\(primaryGroupID\=516\)\)\'\)\.FindAll\(\)/ nocase ascii wide
107110
// Description: Enumerate all accounts that do not require a password
108111
// Reference: https://jsecurity101.medium.com/uncovering-adversarial-ldap-tradecraft-658b2deca384
109-
$string33 = /\[adsisearcher\]\'\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=32\)\)\'\)\.FindAll\(\)/ nocase ascii wide
112+
$string34 = /\[adsisearcher\]\'\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=32\)\)\'\)\.FindAll\(\)/ nocase ascii wide
110113
// Description: ADSI query to retrieve all active user accounts with non-expiring passwords
111114
// Reference: https://github.com/swarleysez/AD-common-queries
112-
$string34 = /\[adsisearcher\].{0,1000}\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=66048\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)/ nocase ascii wide
115+
$string35 = /\[adsisearcher\].{0,1000}\(\&\(objectCategory\=person\)\(objectClass\=user\)\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=66048\)\(\!\(userAccountControl\:1\.2\.840\.113556\.1\.4\.803\:\=2\)\)/ nocase ascii wide
113116
// Description: Discover all Domain Controller in the domain using ADSI
114117
// Reference: https://adsecurity.org/?p=299
115-
$string35 = /\[System\.DirectoryServices\.ActiveDirectory\.Domain\]\:\:GetCurrentDomain\(\)\.DomainControllers/ nocase ascii wide
118+
$string36 = /\[System\.DirectoryServices\.ActiveDirectory\.Domain\]\:\:GetCurrentDomain\(\)\.DomainControllers/ nocase ascii wide
116119
// Description: Discover all Global Catalogs in the forest using ADSI
117120
// Reference: https://adsecurity.org/?p=299
118-
$string36 = /\[System\.DirectoryServices\.ActiveDirectory\.Forest\]\:\:GetCurrentForest\(\)\.GlobalCatalogs/ nocase ascii wide
121+
$string37 = /\[System\.DirectoryServices\.ActiveDirectory\.Forest\]\:\:GetCurrentForest\(\)\.GlobalCatalogs/ nocase ascii wide
119122
// Description: query for the primary domain controller within the forest
120123
// Reference: https://github.com/swarleysez/AD-common-queries
121-
$string37 = /\[System\.DirectoryServices\.ActiveDirectory\.Forest\]\:\:GetCurrentForest\(\)\.RootDomain\.PDCRoleOwner\.Name/ nocase ascii wide
124+
$string38 = /\[System\.DirectoryServices\.ActiveDirectory\.Forest\]\:\:GetCurrentForest\(\)\.RootDomain\.PDCRoleOwner\.Name/ nocase ascii wide
122125
// Description: cmdlets to get computer information about Domain Controllers
123126
// Reference: https://adsecurity.org/?p=299
124-
$string38 = /get\-ADComputer\s\-filter\s\{\sPrimaryGroupID\s\-eq\s\"516\"\s\}\s\-properties\sPrimaryGroupID/ nocase ascii wide
127+
$string39 = /get\-ADComputer\s\-filter\s\{\sPrimaryGroupID\s\-eq\s\"516\"\s\}\s\-properties\sPrimaryGroupID/ nocase ascii wide
125128
// Description: identifying accounts with 'Password Not Required
126129
// Reference: https://github.com/swarleysez/AD-common-queries
127-
$string39 = /Get\-ADUser\s\-filter\s.{0,1000}\s\-Properties\sSamAccountName\,\sPasswordNotRequired\s\|\swhere\s\{\s\$_\.passwordnotrequired\s\-eq\s\"true\"\s\}\s\|\swhere\s\{\$_\.enabled\s\-eq\s\"true\"\}/ nocase ascii wide
130+
$string40 = /Get\-ADUser\s\-filter\s.{0,1000}\s\-Properties\sSamAccountName\,\sPasswordNotRequired\s\|\swhere\s\{\s\$_\.passwordnotrequired\s\-eq\s\"true\"\s\}\s\|\swhere\s\{\$_\.enabled\s\-eq\s\"true\"\}/ nocase ascii wide
128131
// Description: querying accounts that have not been logged into for over 90 days
129132
// Reference: https://github.com/swarleysez/AD-common-queries
130-
$string40 = /Get\-ADUser\s\-properties\s.{0,1000}\s\-filter\s\{\(lastlogondate\s\-notlike\s\".{0,1000}\"\s\-OR\slastlogondate\s\-le\s\$90days\)\s\-AND\s\(passwordlastset\s\-le\s\$90days\)\s\-AND\s\(enabled\s\-eq\s\$True\)\s\-and\s\(PasswordNeverExpires\s\-eq\s\$false\)\s\-and\s\(whencreated\s\-le\s\$90days\)\}/ nocase ascii wide
133+
$string41 = /Get\-ADUser\s\-properties\s.{0,1000}\s\-filter\s\{\(lastlogondate\s\-notlike\s\".{0,1000}\"\s\-OR\slastlogondate\s\-le\s\$90days\)\s\-AND\s\(passwordlastset\s\-le\s\$90days\)\s\-AND\s\(enabled\s\-eq\s\$True\)\s\-and\s\(PasswordNeverExpires\s\-eq\s\$false\)\s\-and\s\(whencreated\s\-le\s\$90days\)\}/ nocase ascii wide
131134
// Description: Red Teams and adversaries may leverage [Adsisearcher] to enumerate domain groups for situational awareness and Active Directory Discovery
132135
// Reference: https://research.splunk.com/endpoint/089c862f-5f83-49b5-b1c8-7e4ff66560c7/
133-
$string41 = /powershell.{0,1000}\[adsisearcher\].{0,1000}\(objectcategory\=group\).{0,1000}findAll\(\)/ nocase ascii wide
136+
$string42 = /powershell.{0,1000}\[adsisearcher\].{0,1000}\(objectcategory\=group\).{0,1000}findAll\(\)/ nocase ascii wide
134137
135138
condition:
136139
any of them

‎yara_rules/greyware_tool_keyword/L-N/maildrop.yara

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
rule maildrop
2+
{
3+
meta:
4+
description = "Detection patterns for the tool 'maildrop' taken from the ThreatHunting-Keywords github project"
5+
author = "@mthcht"
6+
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
7+
tool = "maildrop"
8+
rule_category = "greyware_tool_keyword"
9+
10+
strings:
11+
// Description: disposable email address to use anytime.
12+
// Reference: https://maildrop.cc/
13+
$string1 = /https\:\/\/maildrop\.cc\/inbox\/\?mailbox\=/ nocase ascii wide
14+
15+
condition:
16+
any of them
17+
}

‎yara_rules/greyware_tool_keyword/O-Q/pyinstaller.yara

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,16 @@ rule pyinstaller
2222
$string4 = /pyinstaller\s.{0,1000}\.py/ nocase ascii wide
2323
// Description: PyInstaller bundles a Python application and all its dependencies into a single package executable.
2424
// Reference: https://www.pyinstaller.org/
25-
$string5 = /pyinstaller\.exe/ nocase ascii wide
25+
$string5 = /pyinstaller.{0,1000}\s\-\-onefile\s\-\-add\-data\s/ nocase ascii wide
2626
// Description: PyInstaller bundles a Python application and all its dependencies into a single package executable.
2727
// Reference: https://www.pyinstaller.org/
28-
$string6 = /pyinstaller\/tarball/ nocase ascii wide
28+
$string6 = /pyinstaller\.exe/ nocase ascii wide
2929
// Description: PyInstaller bundles a Python application and all its dependencies into a single package executable.
3030
// Reference: https://www.pyinstaller.org/
31-
$string7 = /pyinstaller\-script\.py/ nocase ascii wide
31+
$string7 = /pyinstaller\/tarball/ nocase ascii wide
32+
// Description: PyInstaller bundles a Python application and all its dependencies into a single package executable.
33+
// Reference: https://www.pyinstaller.org/
34+
$string8 = /pyinstaller\-script\.py/ nocase ascii wide
3235
3336
condition:
3437
any of them

‎yara_rules/greyware_tool_keyword/O-Q/python.yara

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,15 +8,18 @@ rule python
88
rule_category = "greyware_tool_keyword"
99

1010
strings:
11+
// Description: suspicious way of exeuting code
12+
// Reference: https://x.com/Ax_Sharma/status/1795813203500322953/photo/4
13+
$string1 = /\s\,exec\(__import__\(\'base64\'\)\.b64decode\(\"/ nocase ascii wide
1114
// Description: interactive shell
1215
// Reference: N/A
13-
$string1 = /\s\-c\s\'import\spty\;pty\.spawn\(\"\/bin\/bash/ nocase ascii wide
16+
$string2 = /\s\-c\s\'import\spty\;pty\.spawn\(\"\/bin\/bash/ nocase ascii wide
1417
// Description: interactive shell
1518
// Reference: N/A
16-
$string2 = /\s\-c\s\'import\spty\;pty\.spawn\(\"\/bin\/sh/ nocase ascii wide
19+
$string3 = /\s\-c\s\'import\spty\;pty\.spawn\(\"\/bin\/sh/ nocase ascii wide
1720
// Description: interactive shell
1821
// Reference: N/A
19-
$string3 = /\s\-c\s\'import\spty\;pty\.spawn\(\\\"\/bin\/sh/ nocase ascii wide
22+
$string4 = /\s\-c\s\'import\spty\;pty\.spawn\(\\\"\/bin\/sh/ nocase ascii wide
2023
2124
condition:
2225
any of them

0 commit comments

Comments
 (0)