Untrusted Binary Similar to an Attack Tool

Detection windows tlsh attack.t1588.002

An untrusted process within TLSH distance 50 of a public attack tool. Needs Sysmon process events enriched with tlsh and authenticode_trusted, such as Velociraptor's Windows.EventLogs.SysmonProcessEnriched produces.

Part of: CelesTLSH fuzzy hash hunting
Requires: CelesTLSH attack tool hashes, TLSH index

Add it

In Bifract, open Exchange, find Untrusted Binary Similar to an Attack Tool and click Add. Adds an alert to the fractal, or a draft in your name when the scope reviews alert changes.

File

exchange/detections/untrusted-binary-like-attack-tool.yml

untrusted-binary-like-attack-tool.yml

# Native Bifract alert. tlsh() reads the tlsh_index model, so this rule is validated
# by lint but cannot be tested offline.
name: Untrusted Binary Similar to an Attack Tool
description: >-
  An untrusted process whose TLSH digest is within 50 of a public attack tool or C2
  framework in the CelesTLSH list. TLSH alone is too noisy to alert on; the signing filter
  is what makes it worth an analyst's time. Check Repo_Name for the family, then the
  image's path, parent and how it arrived.
alertType: event
severity: medium
labels:
  - attack.t1588.002
  - tlsh
references:
  - https://github.com/Magonia-Research/CelesTLSH-Hashes
  - https://attack.mitre.org/techniques/T1588/002/
queryString: |-
  event_id=1
  | tlsh=* authenticode_trusted=~"untrusted" user!="NT AUTHORITY\\SYSTEM"
  | NOT image=~"\\WindowsApps\\"
  | tlsh(field=tlsh, dict="celes_tlsh", threshold=50)
  | match(dict="celes_tlsh", field=tlsh_match, column=TLSH_Hash, include=[Repo_Name, File_Name])
  | table(timestamp, computer_name, user, image, tlsh_distance, Repo_Name, File_Name)
enabled: true