From 92987eb42a7723be890e1c5873759072b44c10b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jos=C3=A9=20Miguel?= Date: Mon, 24 Jun 2019 20:42:05 +0200 Subject: [PATCH 1/2] Panda-PAPS new decoders and rules --- decoders/0206-panda-paps_decoders.xml | 689 ++++++++++++++++++++++++++ rules/0675-panda-paps_rules.xml | 62 +++ tools/rules-testing/panda_paps.ini | 55 ++ 3 files changed, 806 insertions(+) create mode 100644 decoders/0206-panda-paps_decoders.xml create mode 100644 rules/0675-panda-paps_rules.xml create mode 100644 tools/rules-testing/panda_paps.ini diff --git a/decoders/0206-panda-paps_decoders.xml b/decoders/0206-panda-paps_decoders.xml new file mode 100644 index 000000000..ae48d1242 --- /dev/null +++ b/decoders/0206-panda-paps_decoders.xml @@ -0,0 +1,689 @@ + + + + + + ^LEEF:\.*\|Panda Security\|paps\|\.*\|\.*\| + + + + paps + ^LEEF:(\.*)\|(\.*)\|(\.*)\|(\.*)\|(\.*)\|sev=(\d+) + LEEFversion,Vendor,Product,ProductVersion,EventID,Severity + + + + paps + devTime=(\.*)\t|(\.*)$ + devTime + + + + paps + devTimeFormat=(\.*)\t|(\.*)$ + devTimeFormat + + + + paps + usrName=(\.*)\t|(\.*)$ + usrName + + + + paps + domain=(\.*)\t|(\.*)$ + domain + + + + paps + src=(\.*)\t|(\.*)$ + src + + + + paps + identSrc=(\.*)\t|(\.*)$ + identSrc + + + + paps + identHostName=(\.*)\t|(\.*)$ + identHostName + + + + paps + 1NFI=(\.*)\t|(\.*)$ + 1NFI + + + + paps + 1NMW=(\.*)\t|(\.*)$ + 1NMW + + + + paps + AVDets=(\.*)\t|(\.*)$ + AVDets + + + + paps + Action=(\.*)\t|(\.*)$ + Action + + + + paps + Broken=(\.*)\t|(\.*)$ + Broken + + + + paps + BytesReceived=(\.*)\t|(\.*)$ + BytesReceived + + + + paps + BytesSent=(\.*)\t|(\.*)$ + BytesSent + + + + paps + Cat=(\.*)\t|(\.*)$ + Cat + + + + paps + CfgSvcLevel=(\.*)\t|(\.*)$ + CfgSvcLevel + + + + paps + Parent1NFI=(\.*)\t|(\.*)$ + Parent1NFI + + + + paps + Parent1NMW=(\.*)\t|(\.*)$ + Parent1NMW + + + + paps + ParentAVDets=(\.*)\t|(\.*)$ + ParentAVDets + + + + paps + ParentBroken=(\.*)\t|(\.*)$ + ParentBroken + + + + paps + ParentCat=(\.*)\t|(\.*)$ + ParentCat + + + + paps + ParentClass=(\.*)\t|(\.*)$ + ParentClass + + + + paps + ParentCompany=(\.*)\t|(\.*)$ + ParentCompany + + + + paps + ParentDriveType=(\.*)\t|(\.*)$ + ParentDriveType + + + + paps + ParentExeType=(\.*)\t|(\.*)$ + ParentExeType + + + + paps + ParentFlags=(\.*)\t|(\.*)$ + ParentFlags + + + + paps + ParentHash=(\.*)\t|(\.*)$ + ParentHash + + + + paps + ParentHeurFI=(\.*)\t|(\.*)$ + ParentHeurFI + + + + paps + ParentImageType=(\.*)\t|(\.*)$ + ParentImageType + + + + paps + ParentJIDFI=(\.*)\t|(\.*)$ + ParentJIDFI + + + + paps + ParentJIDMW=(\.*)\t|(\.*)$ + ParentJIDMW + + + + paps + ParentMWName=(\.*)\t|(\.*)$ + ParentMWName + + + + paps + ParentPID=(\.*)\t|(\.*)$ + ParentPID + + + + paps + ParentPath=(\.*)\t|(\.*)$ + ParentPath + + + + paps + ParentPrevLastDay=(\.*)\t|(\.*)$ + ParentPrevLastDay + + + + paps + ParentPrevalence=(\.*)\t|(\.*)$ + ParentPrevalence + + + + paps + ParentSkeptic=(\.*)\t|(\.*)$ + ParentSkeptic + + + + paps + ParentStatus=(\.*)\t|(\.*)$ + ParentStatus + + + + paps + ParentValidSig=(\.*)\t|(\.*)$ + ParentValidSig + + + + paps + Child1NFI=(\.*)\t|(\.*)$ + Child1NFI + + + + paps + Child1NMW=(\.*)\t|(\.*)$ + Child1NMW + + + + paps + ChildAVDets=(\.*)\t|(\.*)$ + ChildAVDets + + + + paps + ChildBroken=(\.*)\t|(\.*)$ + ChildBroken + + + + paps + ChildCat=(\.*)\t|(\.*)$ + ChildCat + + + + paps + ChildClass=(\.*)\t|(\.*)$ + ChildClass + + + + paps + ChildCompany=(\.*)\t|(\.*)$ + ChildCompany + + + + paps + ChildDriveType=(\.*)\t|(\.*)$ + ChildDriveType + + + + paps + ChildExeType=(\.*)\t|(\.*)$ + ChildExeType + + + + paps + ChildFlags=(\.*)\t|(\.*)$ + ChildFlags + + + + paps + ChildHash=(\.*)\t|(\.*)$ + ChildHash + + + + paps + ChildHeurFI=(\.*)\t|(\.*)$ + ChildHeurFI + + + + paps + ChildImageType=(\.*)\t|(\.*)$ + ChildImageType + + + + paps + ChildJIDFI=(\.*)\t|(\.*)$ + ChildJIDFI + + + + paps + ChildJIDMW=(\.*)\t|(\.*)$ + ChildJIDMW + + + + paps + ChildMWName=(\.*)\t|(\.*)$ + ChildMWName + + + + paps + ChildPath=(\.*)\t|(\.*)$ + ChildPath + + + + paps + ChildPrevLastDay=(\.*)\t|(\.*)$ + ChildPrevLastDay + + + + paps + ChildPrevalence=(\.*)\t|(\.*)$ + ChildPrevalence + + + + paps + ChildSkeptic=(\.*)\t|(\.*)$ + ChildSkeptic + + + + paps + ChildStatus=(\.*)\t|(\.*)$ + ChildStatus + + + + paps + ChildValidSig=(\.*)\t|(\.*)$ + ChildValidSig + + + + paps + Class=(\.*)\t|(\.*)$ + Class + + + + paps + ClientCat=(\.*)\t|(\.*)$ + ClientCat + + + + paps + Company=(\.*)\t|(\.*)$ + Company + + + + paps + DetId=(\.*)\t|(\.*)$ + DetId + + + + paps + Direction=(\.*)\t|(\.*)$ + Direction + + + + paps + DriveType=(\.*)\t|(\.*)$ + DriveType + + + + paps + ExeType=(\.*)\t|(\.*)$ + ExeType + + + + paps + Hash=(\.*)\t|(\.*)$ + Hash + + + + paps + HeurFI=(\.*)\t|(\.*)$ + HeurFI + + + + paps + HostName=(\.*)\t|(\.*)$ + HostName + + + + paps + IP=(\.*)\t|(\.*)$ + IP + + + + paps + ImageType=(\.*)\t|(\.*)$ + ImageType + + + + paps + JIDFI=(\.*)\t|(\.*)$ + JIDFI + + + + paps + JIDMW=(\.*)\t|(\.*)$ + JIDMW + + + + paps + Key=(\.*)\t|(\.*)$ + Key + + + + paps + LocalIp=(\.*)\t|(\.*)$ + LocalIp + + + + paps + LocalPort=(\.*)\t|(\.*)$ + LocalPort + + + + paps + LoggedUser=(\.*)\t|(\.*)$ + LoggedUser + + + + paps + MUID=(\.*)\t|(\.*)$ + MUID + + + + paps + MWName=\t*(\.*)\t|(\.*)$ + MWName + + + + paps + RegKey=(\.*)\t|(\.*)$ + RegKey + + + + paps + NumCacheClassifiedElements=(\.*)\t|(\.*)$ + NumCacheClassifiedElements + + + + paps + OCS_Exec=(\.*)\t|(\.*)$ + OCS_Exec + + + + paps + OCS_Name=(\.*)\t|(\.*)$ + OCS_Name + + + + paps + OCS_Version=(\.*)\t|(\.*)$ + OCS_Version + + + + paps + Op=(\.*)\t|(\.*)$ + Op + + + + paps + OperationFlags=(\.*)\t|(\.*)$ + OperationFlags + + + + paps + PECreationSource=(\.*)\t|(\.*)$ + PECreationSource + + + + paps + PID=(\.*)\t|(\.*)$ + PID + + + + paps + Params=(\.*)\t|(\.*)$ + Params + + + + paps + Path=(\.*)\t|(\.*)$ + Path + + + + paps + Port=(\.*)\t|(\.*)$ + Port + + + + paps + PrevLastDay=(\.*)\t|(\.*)$ + PrevLastDay + + + + paps + Prevalence=(\.*)\t|(\.*)$ + Prevalence + + + + paps + Protocol=(\.*)\t|(\.*)$ + Protocol + + + + paps + RealSvcLevel=(\.*)\t|(\.*)$ + RealSvcLevel + + + + paps + RegAction=(\.*)\t|(\.*)$ + RegAction + + + + paps + ResolutionTime=(\.*)\t|(\.*)$ + ResolutionTime + + + + paps + ResponseCat=(\.*)\t|(\.*)$ + ResponseCat + + + + paps + ResponseError=(\.*)\t|(\.*)$ + ResponseError + + + + paps + ServiceLevel=(\.*)\t|(\.*)$ + ServiceLevel + + + + paps + Skeptic=(\.*)\t|(\.*)$ + Skeptic + + + + paps + TargetPath=(\.*)\t|(\.*)$ + TargetPath + + + + paps + Timeout=(\.*)\t|(\.*)$ + Timeout + + + + paps + ToastResult=(\.*)\t|(\.*)$ + ToastResult + + + + paps + URL=(\.*)\t|(\.*)$ + URL + + + + paps + ValidSig=(\.*)\t|(\.*)$ + ValidSig + + + + paps + Value=(\.*)\t|(\.*)$ + Value + + + + paps + ValueData=(\.*)\t|(\.*)$ + ValueData + + + + paps + WinningTech=(\.*)\t|(\.*)$ + WinningTech + \ No newline at end of file diff --git a/rules/0675-panda-paps_rules.xml b/rules/0675-panda-paps_rules.xml new file mode 100644 index 000000000..31c17885d --- /dev/null +++ b/rules/0675-panda-paps_rules.xml @@ -0,0 +1,62 @@ + + + + + paps + PANDA Antivirus event. + + + + 64200 + Alert + Panda: Alert message received. + + + + 64200 + 3|4 + Panda Security: Low severity event detected. Category: $(Cat) + + + + 64200 + 5|6 + Panda Security: Medium severity event detected. Category: $(Cat) + + + + 64200 + 7|8 + Panda Security: High severity alert detected. Category: $(Cat) + + + + 64200 + 9|10 + Panda Security: Very high severity alert detected! Category: $(Cat) + + + + 64200 + true + Panda Security: The child process is corrupted or defective. + + + + 64200 + true + Panda Security: The parent process is corrupted or defective. + + + + 64200 + true + Panda Security: The file is corrupted or defective. + + + \ No newline at end of file diff --git a/tools/rules-testing/panda_paps.ini b/tools/rules-testing/panda_paps.ini new file mode 100644 index 000000000..64fae4219 --- /dev/null +++ b/tools/rules-testing/panda_paps.ini @@ -0,0 +1,55 @@ +[panda paps: alert message received] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=1 devTime=2019-05-09 22:03:58.692466 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=192.168.0.8 identSrc=192.168.0.8 identHostName=13_2595_43 HostName=13_2595_43 MUID=6C6A0D57714FE5B6D72BA0EC0E46D71B Op=ModifyExeKey Hash=E60A27AAEB184AABD9C92C513B27F98A DriveType=Fixed Path=PROGRAM_FILES_COMMONX86|\Quest\Privilege Manager\Client\CSEHost.exe ValidSig=true Company=Quest Software Inc. Broken=false ImageType=EXE 32 ExeType=Unknown Prevalence=Medium PrevLastDay=Low Cat=Goodware MWName= TargetPath=3|PROGRAM_FILES_COMMONX86|\Quest\Privilege Manager\Client\GPEEventMsgFile.dll RegKey=\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\GPE Alert?EventMessageFile + +rule = 64201 +alert = 7 +decoder = paps + +[panda paps: low severity event detected] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=3 devTime=2019-05-09 22:01:23.255825 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=10.255.44.11 identSrc=10.255.44.11 identHostName=44_CCO_11 HostName=44_CCO_11 MUID=D877F2C4C4000A9BF39F1710CA787291 Op=ModifyExeKey Hash=F6494E7C35B6514A3AD74E27435F3141 DriveType=Fixed Path=PROGRAM_FILESX86|\LANDesk\LDClient\hips\LDSecSvc64.EXE ValidSig=true Company=LANDESK Software, Inc. and its affiliates. Broken=false ImageType=EXE 64 ExeType=Unknown Prevalence=Low PrevLastDay=Low Cat=Goodware MWName= TargetPath=3|PROGRAM_FILESX86|\LANDesk\LDClient\LDdrives.exe + +rule = 64202 +alert = 4 +decoder = paps + +[panda paps: medium severity event detected] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=5 devTime=2019-05-09 22:01:23.255825 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=10.255.44.11 identSrc=10.255.44.11 identHostName=44_CCO_11 HostName=44_CCO_11 MUID=D877F2C4C4000A9BF39F1710CA787291 Op=ModifyExeKey Hash=F6494E7C35B6514A3AD74E27435F3141 DriveType=Fixed Path=PROGRAM_FILESX86|\LANDesk\LDClient\hips\LDSecSvc64.EXE ValidSig=true Company=LANDESK Software, Inc. and its affiliates. Broken=false ImageType=EXE 64 ExeType=Unknown Prevalence=Low PrevLastDay=Low Cat=Goodware MWName= TargetPath=3|PROGRAM_FILESX86|\LANDesk\LDClient\LDdrives.exe + +rule = 64203 +alert = 4 +decoder = paps + +[panda paps: high severity event detected] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=7 devTime=2019-05-09 22:01:23.255825 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=10.255.44.11 identSrc=10.255.44.11 identHostName=44_CCO_11 HostName=44_CCO_11 MUID=D877F2C4C4000A9BF39F1710CA787291 Op=ModifyExeKey Hash=F6494E7C35B6514A3AD74E27435F3141 DriveType=Fixed Path=PROGRAM_FILESX86|\LANDesk\LDClient\hips\LDSecSvc64.EXE ValidSig=true Company=LANDESK Software, Inc. and its affiliates. Broken=true ImageType=EXE 64 ExeType=Unknown Prevalence=Low PrevLastDay=Low Cat=Goodware MWName= TargetPath=3|PROGRAM_FILESX86|\LANDesk\LDClient\LDdrives.exe + +rule = 64204 +alert = 12 +decoder = paps + +[panda paps: very high severity event detected] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=9 devTime=2019-05-09 22:01:23.255825 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=10.255.44.11 identSrc=10.255.44.11 identHostName=44_CCO_11 HostName=44_CCO_11 MUID=D877F2C4C4000A9BF39F1710CA787291 Op=ModifyExeKey Hash=F6494E7C35B6514A3AD74E27435F3141 DriveType=Fixed Path=PROGRAM_FILESX86|\LANDesk\LDClient\hips\LDSecSvc64.EXE ValidSig=true Company=LANDESK Software, Inc. and its affiliates. Broken=true ImageType=EXE 64 ExeType=Unknown Prevalence=Low PrevLastDay=Low Cat=Goodware MWName= TargetPath=3|PROGRAM_FILESX86|\LANDesk\LDClient\LDdrives.exe + +rule = 64205 +alert = 14 +decoder = paps + +[panda paps: the child process is corrupted or defective] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|exec|sev=1 devTime=2019-05-09 22:07:36.130735 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=hsmartin domain=PROSAMX src=10.255.16.21 identSrc=10.255.16.21 identHostName=16_2470_21 HostName=16_2470_21 MUID=577C98BB9DC2523C1AEDE584FCAF1615 Op=Exec ParentHash=7E160844D950765356C84BCBCFBF1DEE ParentDriveType=Fixed ParentPath=PROGRAM_FILESX86|\Google\Chrome\Application\chrome.exe ParentValidSig=true ParentCompany=Google Inc. ParentBroken=false ParentImageType=EXE 64 ParentExeType=Unknown ParentPrevalence=High ParentPrevLastDay=Low ParentCat=Goodware ParentMWName= ChildHash=7E160844D950765356C84BCBCFBF1DEE ChildDriveType=Fixed ChildPath=PROGRAM_FILESX86|\Google\Chrome\Application\chrome.exe ChildValidSig=true ChildCompany=Google Inc. ChildBroken=true ChildImageType=EXE 64 ChildExeType=Unknown ChildPrevalence=High ChildPrevLastDay=Low ChildCat=Goodware ChildMWName= OCS_Exec=true OCS_Name=Google Chrome OCS_Version=71.0.3578.80 Params="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --type\=renderer --field-trial-handle\=1716,6504423765877186287,9579056321151338165,131072 --service-pipe-token\=11343697476573359606 --lang\=es --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor\=1 --num-raster-threads\=4 --enable-main-frame-before-activation --service-request-channel-token\=11343697476573359606 --renderer-client-id\=629 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle\=17588 /prefetch:1 ToastResult= Action=Allow ServiceLevel=Learning WinningTech=Cloud DetId=0 + +rule = 64206 +alert = 7 +decoder = paps + +[panda paps: the parent process is corrupted or defective] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|createdir|sev=1 devTime=2019-05-09 21:59:51.410364 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=10.255.16.21 identSrc=10.255.16.21 identHostName=16_2470_21 HostName=16_2470_21 MUID=577C98BB9DC2523C1AEDE584FCAF1615 Op=CreateDir ParentHash=C05A19A38D7D203B738771FD1854656F ParentDriveType=Fixed ParentPath=SYSTEM|\spoolsv.exe ParentValidSig= ParentCompany=Microsoft Corporation ParentBroken=true ParentImageType=EXE 64 ParentExeType=Unknown ParentPrevalence=High ParentPrevLastDay=Low ParentCat=Goodware ParentMWName= ChildHash= ChildDriveType=Fixed ChildPath=SYSTEM|\spool\V4Dirs\5F1D9A23-55FC-420A-84EC-E78F46C362E2 ChildValidSig= ChildCompany= ChildBroken= ChildImageType= ChildExeType= ChildPrevalence= ChildPrevLastDay= ChildCat=Unknown ChildMWName= OCS_Exec=false OCS_Name= OCS_Version= Params= ToastResult= Action=Allow ServiceLevel=Learning WinningTech=Unknown DetId=0 + +rule = 64207 +alert = 7 +decoder = paps + +[panda paps: a file is corrupted or defective] +log 1 pass = LEEF:1.0|Panda Security|paps|02.47.00.0000|registrym|sev=1 devTime=2019-05-09 22:01:23.255825 devTimeFormat=yyyy-MM-dd HH:mm:ss.SSS usrName=SYSTEM domain=NT AUTHORITY src=10.255.44.11 identSrc=10.255.44.11 identHostName=44_CCO_11 HostName=44_CCO_11 MUID=D877F2C4C4000A9BF39F1710CA787291 Op=ModifyExeKey Hash=F6494E7C35B6514A3AD74E27435F3141 DriveType=Fixed Path=PROGRAM_FILESX86|\LANDesk\LDClient\hips\LDSecSvc64.EXE ValidSig=true Company=LANDESK Software, Inc. and its affiliates. Broken=true ImageType=EXE 64 ExeType=Unknown Prevalence=Low PrevLastDay=Low Cat=Goodware MWName= TargetPath=3|PROGRAM_FILESX86|\LANDesk\LDClient\LDdrives.exe + +rule = 64208 +alert = 7 +decoder = paps From 6a21c59d03a45d6314f50320fea53e7036d826d0 Mon Sep 17 00:00:00 2001 From: Elwali karkoub Date: Mon, 26 Aug 2019 16:13:34 +0200 Subject: [PATCH 2/2] Rename 0206-panda-paps_decoders.xml to 0470-panda-paps_decoders.xml --- ...206-panda-paps_decoders.xml => 0470-panda-paps_decoders.xml} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename decoders/{0206-panda-paps_decoders.xml => 0470-panda-paps_decoders.xml} (99%) diff --git a/decoders/0206-panda-paps_decoders.xml b/decoders/0470-panda-paps_decoders.xml similarity index 99% rename from decoders/0206-panda-paps_decoders.xml rename to decoders/0470-panda-paps_decoders.xml index ae48d1242..325f3116b 100644 --- a/decoders/0206-panda-paps_decoders.xml +++ b/decoders/0470-panda-paps_decoders.xml @@ -686,4 +686,4 @@ LEEF:1.0|Panda Security|paps|02.47.00.0000|exec|sev=4 devTime=2019-05-09 22:00:5 paps WinningTech=(\.*)\t|(\.*)$ WinningTech - \ No newline at end of file +