Crowdstrike FDR LOLBAS

Description

Living off the land binaries and script usage

Query · python

from panther_crowdstrike_fdr_helpers import crowdstrike_process_alert_context

LOLBAS_EXE = {
    "AppInstaller.exe",
    "At.exe",
    "Atbroker.exe",
    "Bash.exe",
    "Bitsadmin.exe",
    "CertOC.exe",
    "CertReq.exe",
    "Certutil.exe",
    "Cmd.exe",
    "Cmdkey.exe",
    "cmdl32.exe",
    "Cmstp.exe",
    "ConfigSecurityPolicy.exe",
    "Conhost.exe",
    "Control.exe",
    "Csc.exe",
    "Cscript.exe",
    "CustomShellHost.exe",
    "DataSvcUtil.exe",
    "Desktopimgdownldr.exe",
    "DeviceCredentialDeployment.exe",
    "Dfsvc.exe",
    "Diantz.exe",
    "Diskshadow.exe",
    "Dnscmd.exe",
    "Esentutl.exe",
    "Eventvwr.exe",
    "Expand.exe",
    "Explorer.exe",
    "Extexport.exe",
    "Extrac32.exe",
    "Findstr.exe",
    "Finger.exe",
    "fltMC.exe",
    "Forfiles.exe",
    "Ftp.exe",
    "Gpscript.exe",
    "Hh.exe",
    "IMEWDBLD.exe",
    "Ie4uinit.exe",
    "Ieexec.exe",
    "Ilasm.exe",
    "Infdefaultinstall.exe",
    "Installutil.exe",
    "Jsc.exe",
    "Ldifde.exe",
    "Makecab.exe",
    "Mavinject.exe",
    "Mmc.exe",
    "MpCmdRun.exe",
    "Msbuild.exe",
    "Msconfig.exe",
    "Msdt.exe",
    "Msedge.exe",
    "Mshta.exe",
    "Msiexec.exe",
    "Netsh.exe",
    "Odbcconf.exe",
    "OfflineScannerShell.exe",
    "OneDriveStandaloneUpdater.exe",
    "Pcalua.exe",
    "Pcwrun.exe",
    "Pktmon.exe",
    "Pnputil.exe",
    "Presentationhost.exe",
    "Print.exe",
    "PrintBrm.exe",
    "Psr.exe",
    "Rasautou.exe",
    "rdrleakdiag.exe",
    "Reg.exe",
    "Regasm.exe",
    "Regedit.exe",
    "Regini.exe",
    "Regsvcs.exe",
    "Regsvr32.exe",
    "Replace.exe",
    "Rpcping.exe",
    "Rundll32.exe",
    "Runexehelper.exe",
    "Runonce.exe",
    "Runscripthelper.exe",
    "Sc.exe",
    "Schtasks.exe",
    "Scriptrunner.exe",
    "Setres.exe",
    "SettingSyncHost.exe",
    "ssh.exe",
    "Stordiag.exe",
    "SyncAppvPublishingServer.exe",
    "Ttdinject.exe",
    "Tttracer.exe",
    "Unregmp2.exe",
    "vbc.exe",
    "Verclsid.exe",
    "Wab.exe",
    "winget.exe",
    "Wlrmdr.exe",
    "Wmic.exe",
    "WorkFolders.exe",
    "Wscript.exe",
    "Wsreset.exe",
    "wuauclt.exe",
    "Xwizard.exe",
    "fsutil.exe",
    "wt.exe",
}


def rule(event):
    if event.deep_get("event", "event_simpleName") == "ProcessRollup2":
        if event.deep_get("event", "event_platform") == "Win":
            exe = event.udm("process_name")
            return bool(exe.lower() in [x.lower() for x in LOLBAS_EXE])
    return False


def title(event):
    exe = event.deep_get("event", "ImageFileName").split("\\")[-1]
    return f'Crowdstrike: LOLBAS execution - [{exe}] - [{event.deep_get("event", "CommandLine")}]'


def dedup(event):
    # dedup string on "{aid}-{exe}"
    exe = event.udm("process_name")
    return f'{event.deep_get("event", "aid")}-{exe}'


def alert_context(event):
    return crowdstrike_process_alert_context(event)

Detection tier

Atomic IOCs
Network & Host Artifacts
Tools
TTPs
Pending classification

Metadata

Source: panther-labs/panther-analysis
License: Apache 2.0
Severity: Informational
Status: Experimental
Query type: python
Created: 2023-05-10
Modified: 2024-04-02
Authored by: panther-labs
Source ID
Upstream: rules/crowdstrike_rules/crowdstrike_lolbas.yml
Type: rule
Version: 1
References: https://lolbas-project.github.io/
Data sources: Crowdstrike.FDREvent