Component Object Model Hijacking - Vault7 trick

Back


Id	1aaff41f-4e18-45b1-bb34-de6eb4943cf2
Rulename	Component Object Model Hijacking - Vault7 trick
Description	This detection looks for the very specific value of “Attribute” in the “ShellFolder” CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.
Severity	Medium
Tactics	Persistence PrivilegeEscalation
Techniques	T1546.015
Required data connectors	MicrosoftThreatProtection
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/COMHijacking.yaml
Version	1.0.0
Arm template	1aaff41f-4e18-45b1-bb34-de6eb4943cf2.json

KQL

DeviceRegistryEvents
| where RegistryKey has "ShellFolder"  and ActionType =~ "RegistryValueSet" and RegistryValueName =~ "Attributes" 
// toint automatically converts base10 and base16 strings to int toint("0xFF") == toint("255") == int(0xFF) ==  int(255).
// We are using >= to make sure that if someone adds an additional flag to this field, it doesn't bypass this hunt.
// Removing any flag will bypass this hunt, but more research is needed to understand which of the flag values are relevant.
| where toint(RegistryValueData) >= int(0xf090013d) 
//UPDATE: Flag details are here: https://medium.com/falconforce/introducing-falcon-friday-1f972d65ce1b?source=friends_link&sk=e48d9cb974e216cc4b9b61945a3b177d

YAML

relevantTechniques:
- T1546.015
name: Component Object Model Hijacking - Vault7 trick
triggerThreshold: 0
tactics:
- Persistence
- PrivilegeEscalation
severity: Medium
id: 1aaff41f-4e18-45b1-bb34-de6eb4943cf2
status: Available
requiredDataConnectors:
- dataTypes:
  - DeviceRegistryEvents
  connectorId: MicrosoftThreatProtection
kind: Scheduled
query: |
  DeviceRegistryEvents
  | where RegistryKey has "ShellFolder"  and ActionType =~ "RegistryValueSet" and RegistryValueName =~ "Attributes" 
  // toint automatically converts base10 and base16 strings to int toint("0xFF") == toint("255") == int(0xFF) ==  int(255).
  // We are using >= to make sure that if someone adds an additional flag to this field, it doesn't bypass this hunt.
  // Removing any flag will bypass this hunt, but more research is needed to understand which of the flag values are relevant.
  | where toint(RegistryValueData) >= int(0xf090013d) 
  //UPDATE: Flag details are here: https://medium.com/falconforce/introducing-falcon-friday-1f972d65ce1b?source=friends_link&sk=e48d9cb974e216cc4b9b61945a3b177d  
description: |
  This detection looks for the very specific value of "Attribute" in the "ShellFolder" CLSID of a COM object. This value (0xf090013d) seems to only link back to this specific persistence method. 
  The blog post linked here (https://www.ired.team/offensive-security/code-execution/forcing-iexplore.exe-to-load-a-malicious-dll-via-com-abuse) provides more background on the meaning of this value.   
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/FalconFriday/Analytic Rules/COMHijacking.yaml
triggerOperator: gt
queryPeriod: 1h
queryFrequency: 1h
version: 1.0.0
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: DeviceName
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: AccountSid
    identifier: Sid
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: NTDomain
- entityType: Process
  fieldMappings:
  - columnName: ProcessCommandLine
    identifier: CommandLine

ARM