Skip to content

Commit 87dda17

Browse files
jdu2600gabriellandau
jdu2600
and
gabriellandau
authored
ETW Threat-Intelligence API events (#427)
* add new API event fields * add generated files * context_flags: keyword -> unsigned_long * update call_stack for test failure * split into multiple files * undo multi-file parameters definition * Add example --------- Co-authored-by: Gabriel Landau <[email protected]>
1 parent 0293e71 commit 87dda17

File tree

9 files changed

+1708
-96
lines changed

9 files changed

+1708
-96
lines changed

‎custom_schemas/custom_api.yml‎

Lines changed: 308 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,311 @@
1818
type: keyword
1919
description: >
2020
The name of the API, usually the name of the function or system call.
21+
example: "VirtualAlloc"
22+
23+
- name: summary
24+
level: custom
25+
type: keyword
26+
description: >
27+
The summary of the API call and its parameters.
28+
example: "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
29+
30+
- name: behaviors
31+
level: custom
32+
type: keyword
33+
short: A list of observed behaviors.
34+
description: |
35+
A list of observed behaviors.
36+
"cross-process" - the observed activity was between two processes
37+
"parent-child" - the observed activity was between a parent process and its child
38+
"native_api" - a call was made directly to the Native API rather than the Win32 API
39+
"direct_syscall" - a syscall instruction originated outside of the Native API layer
40+
"proxy_call" - the call stack may indicate of a proxied API call to mask the true source
41+
"sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API
42+
"shellcode" - suspicious executable non-image memory is calling a sensitive API
43+
"image_hooked" - an entry in the callstack appears to have been hooked
44+
"image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function
45+
"image_rop" - no call instruction preceded an entry in the call stack
46+
"image_rwx" - an entry in the callstack is writable
47+
"unbacked_rwx" - an entry in the callstack is non-image and writable
48+
"allocate_shellcode" - a region of non-image executable memory allocated more executable memory
49+
"execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating
50+
'write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating
51+
"hook_api" - a change to the memory protection of a small executable image memory region was made
52+
"hollow_image" - a change to the memory protection of a large executable image memory region was made
53+
"hook_unbacked" - a change to the memory protection of a small executable non-image memory was made
54+
'hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made
55+
"guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD
56+
"hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS
57+
"execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control
58+
"hardware_breakpoint_set" - a hardware breakpoint was set
59+
example: [ "cross-process", "native_api", "shellcode" ]
60+
61+
- name: metadata
62+
level: custom
63+
type: object
64+
description: >
65+
Information related to the API call.
66+
67+
- name: metadata.target_address_name
68+
level: custom
69+
type: keyword
70+
description: >
71+
The name of the memory region targeted by the API call.
72+
example: "Unbacked"
73+
74+
- name: metadata.target_address_path
75+
level: custom
76+
type: keyword
77+
description: >
78+
The path of the memory region targeted by the API call.
79+
example: "C:\\programdata\\example.dll"
80+
81+
- name: parameters
82+
level: custom
83+
type: object
84+
description: >
85+
Parameter values passed to the API call.
86+
87+
- name: parameters.handle_type
88+
level: custom
89+
type: keyword
90+
description: >
91+
This parameter indicates whether the detected access was attempt against a process or a thread.
92+
example: process
93+
94+
- name: parameters.desired_access_numeric
95+
level: custom
96+
type: long
97+
description: >
98+
This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.
99+
100+
- name: parameters.desired_access
101+
level: custom
102+
type: keyword
103+
description: >
104+
This parameter indicates the string value of the `DesiredAccess` field to `OpenProcess` or `OpenThread`.
105+
106+
- name: parameters.address
107+
level: custom
108+
type: unsigned_long
109+
description: >
110+
The target memory address.
111+
example: 2431737462784
112+
113+
- name: parameters.size
114+
level: custom
115+
type: unsigned_long
116+
description: >
117+
The size.
118+
example: 4096
119+
120+
- name: parameters.protection
121+
level: custom
122+
type: keyword
123+
description: >
124+
The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`
125+
example: "RWX|GUARD"
126+
127+
- name: parameters.protection_old
128+
level: custom
129+
type: keyword
130+
example: "RCX"
131+
description: >
132+
The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`
133+
134+
- name: parameters.allocation_type
135+
level: custom
136+
type: keyword
137+
description: >
138+
The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`
139+
example: "COMMIT|RESERVE"
140+
141+
- name: parameters.procedure
142+
level: custom
143+
type: unsigned_long
144+
description: >
145+
The memory address of the procedure or function.
146+
example: 2431737462784
147+
148+
- name: parameters.argument1
149+
level: custom
150+
type: unsigned_long
151+
description: >
152+
The first argument to the procedure.
153+
example: 1
154+
155+
- name: parameters.argument2
156+
level: custom
157+
type: unsigned_long
158+
description: >
159+
The second argument to the procedure.
160+
example: 2
161+
162+
- name: parameters.argument3
163+
level: custom
164+
type: unsigned_long
165+
description: >
166+
The third argument to the procedure.
167+
example: 3
168+
169+
- name: parameters.context_flags
170+
level: custom
171+
type: unsigned_long
172+
description: >
173+
The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`
174+
example: 1048607
175+
176+
- name: parameters.rip
177+
level: custom
178+
type: unsigned_long
179+
description: >
180+
The x64 RIP instruction pointer register.
181+
example: 140706153693184
182+
183+
- name: parameters.rsp
184+
level: custom
185+
type: unsigned_long
186+
description: >
187+
The x64 RSP stack pointer register.
188+
example: 2431737462784
189+
190+
- name: parameters.rax
191+
level: custom
192+
type: unsigned_long
193+
description: >
194+
The x64 RAX general purpose register. Return value in a __fastcall.
195+
example: 0
196+
197+
- name: parameters.rcx
198+
level: custom
199+
type: unsigned_long
200+
description: >
201+
The x64 RCX general purpose register. First argument in a __fastcall.
202+
example: 1
203+
204+
- name: parameters.rdx
205+
level: custom
206+
type: unsigned_long
207+
description: >
208+
The x64 RDX general purpose register. Second argument in a __fastcall.
209+
example: 2
210+
211+
- name: parameters.r8
212+
level: custom
213+
type: unsigned_long
214+
description: >
215+
The x64 R8 general purpose register. Third argument in a __fastcall.
216+
example: 3
217+
218+
- name: parameters.r9
219+
level: custom
220+
type: unsigned_long
221+
description: >
222+
The x64 R9 general purpose register. Fourth argument in a __fastcall.
223+
example: 4
224+
225+
- name: parameters.rbp
226+
level: custom
227+
type: unsigned_long
228+
description: >
229+
The x64 RBP general purpose register.
230+
example: 0
231+
232+
- name: parameters.rbx
233+
level: custom
234+
type: keyword
235+
description: >
236+
The x64 RBX general purpose register.
237+
example: 0
238+
239+
- name: parameters.rsi
240+
level: custom
241+
type: keyword
242+
description: >
243+
The x64 RSI general purpose register.
244+
example: 0
245+
246+
- name: parameters.rdi
247+
level: custom
248+
type: unsigned_long
249+
description: >
250+
The x64 RDI general purpose register.
251+
example: 0
252+
253+
- name: parameters.eip
254+
level: custom
255+
type: unsigned_long
256+
description: >
257+
The x86 EIP instruction pointer register.
258+
example: 1472790528
259+
260+
- name: parameters.esp
261+
level: custom
262+
type: unsigned_long
263+
description: >
264+
The x86 ESP stack pointer register.
265+
example: 15007744
266+
267+
- name: parameters.ebp
268+
level: custom
269+
type: unsigned_long
270+
description: >
271+
The x86 EBP frame pointer register.
272+
example: 15006644
273+
274+
- name: parameters.eax
275+
level: custom
276+
type: unsigned_long
277+
description: >
278+
The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.
279+
example: 0
280+
281+
- name: parameters.ecx
282+
level: custom
283+
type: unsigned_long
284+
description: >
285+
The x86 ECX general purpose register. First argument in __fastcall and __thiscall.
286+
example: 0
287+
288+
- name: parameters.edx
289+
level: custom
290+
type: unsigned_long
291+
description: >
292+
The x86 EDX general purpose register. Second argument in a __fastcall.
293+
example: 0
294+
295+
- name: parameters.ebx
296+
level: custom
297+
type: unsigned_long
298+
description: >
299+
The x86 EBX general purpose register.
300+
example: 0
301+
302+
- name: parameters.esi
303+
level: custom
304+
type: unsigned_long
305+
description: >
306+
The x86 ESI general purpose register.
307+
example: 0
308+
309+
- name: parameters.edi
310+
level: custom
311+
type: unsigned_long
312+
description: >
313+
The x86 EDI general purpose register.
314+
example: 0
315+
316+
- name: parameters.device
317+
level: custom
318+
type: keyword
319+
description: >
320+
The name of the device object.
321+
example: "\\Device\\NPCAP"
322+
323+
- name: parameters.driver
324+
level: custom
325+
type: keyword
326+
description: >
327+
The name of the driver object.
328+
example: "\\Driver\\npcap"

‎custom_schemas/custom_api_credential_access.yml‎

Lines changed: 0 additions & 39 deletions
This file was deleted.

‎custom_schemas/custom_call_stack.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
order: 1
1111
top_level: false
1212
expected:
13-
- process.thread.Ext
13+
- { at: process.thread.Ext, as: call_stack }
1414
- process.parent.thread.Ext
1515
fields:
1616
- name: module_name
@@ -70,17 +70,22 @@
7070
level: custom
7171
type: keyword
7272
description: Hex opcode bytes preceding the callsite
73-
73+
7474
- name: callsite_trailing_bytes
7575
level: custom
7676
type: keyword
7777
description: Hex opcode bytes after the callsite (where control will return to)
78-
78+
7979
- name: protection
8080
level: custom
8181
type: keyword
8282
description: Protection of the page containing this instruction. This is `R-X' by default if omitted.
83-
83+
84+
- name: protection_provenance
85+
level: custom
86+
type: keyword
87+
description: The name of the memory region that last modified the protection of this page. "Unbacked" can indicate shellcode.
88+
8489
- name: allocation_private_bytes
8590
level: custom
8691
type: unsigned_long

‎custom_schemas/custom_memory_region.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,3 +126,9 @@
126126
index: false
127127
description: >
128128
Array of strings found within the memory region.
129+
130+
- name: hash.sha256
131+
level: custom
132+
type: keyword
133+
description: The sha256 of the memory region.
134+
example: "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"

0 commit comments

Comments
 (0)