Potential Persistence Via Security Descriptors - ScriptBlock
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "PowerShell Script Block Logged" AND (SCRIPTEXECUTED contains "win32_Trustee" AND SCRIPTEXECUTED contains "win32_Ace" AND SCRIPTEXECUTED contains ".AccessMask" AND SCRIPTEXECUTED contains ".AceType" AND SCRIPTEXECUTED contains ".SetSecurityDescriptor") AND SCRIPTEXECUTED contains "\Lsa\JD,\Lsa\Skew1,\Lsa\Data,\Lsa\GBG" select Action1.HOSTNAME,Action1.MESSAGE,Action1.SCRIPTEXECUTED
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems)
