SecureBug Capture the Flag Competition (Chapter Three: Loki) Swedish CTF participants arrive in Loki’s territory on 19 July 2021. The trickster Loki has changed the rules of the game, so not everyone can achieve his great treasury. Based on Loki’s “static point” rule, only the first hunter who solves each challenge gets the full points.…
Detect Modify Registry with this “Free Splunk” Rule Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution. Access to specific areas of the Registry depends on account permissions, some requiring administrator-level…
Detect Network Share Connection Removal with this Free Splunk Rule Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed. Net is an example utility that can be used to remove network share connections with…
Detect Indirect Command Execution With this Free Splunk Rule Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd. For example, For files, the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem…
Install Root Certificate With this Free Splunk Rule Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary-controlled web servers. Root certificates are used in public-key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in…
Detect Indicator Removal on Host Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however, standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*. These actions may…
Detect Deobfuscate/Decode Files or Information Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from the analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware, Scripting, PowerShell, or by using utilities…
Detect Indicator Blocking free Splunk Detection Rules An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting or even disabling host-based sensors, such as Event Tracing for Windows (ETW), by tampering settings that control the collection and flow of event telemetry. These…
Detect Hidden Windows with this Detection Rule Adversaries may implement hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden. This may be utilized by system administrators to avoid disrupting user work environments when…
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces behind as to what was done within a network and how it was executed. Adversaries may remove these files over the course of an intrusion to keep their footprint low or remove them at the end as…
