From e6df4807586a1e69515f948a2d12fa87773220b0 Mon Sep 17 00:00:00 2001 From: "zdw@" Date: Thu, 22 May 2025 14:53:30 -0400 Subject: [PATCH] add first set of exploit detection rules (#1046) * add ntoskrnl.exe loading rule * fix name * add explicit os * add suspicious ntquerysysteinformation detections * ntfscontrolfile wip * fix ntfscontrolfile rule * rename ntquerysysinfo rule * add ntoskrnl gadgets rule * make descs more generic * refactor rules to exploitation namespace * add caveat to ntfscontrolfile rule * tweak rule names * tweak ntfscontrolfile name --- ...spicious-ntquerysysteminformation-call.yml | 23 +++++++++++++ exploitation/gadgets/load-ntoskrnl.yml | 19 +++++++++++ .../gadgets/resolve-ntoskrnl-gadgets.yml | 27 ++++++++++++++++ .../make-suspicious-ntfscontrolfile-call.yml | 32 +++++++++++++++++++ 4 files changed, 101 insertions(+) create mode 100644 exploitation/enumeration/make-suspicious-ntquerysysteminformation-call.yml create mode 100644 exploitation/gadgets/load-ntoskrnl.yml create mode 100644 exploitation/gadgets/resolve-ntoskrnl-gadgets.yml create mode 100644 exploitation/spraying/make-suspicious-ntfscontrolfile-call.yml diff --git a/exploitation/enumeration/make-suspicious-ntquerysysteminformation-call.yml b/exploitation/enumeration/make-suspicious-ntquerysysteminformation-call.yml new file mode 100644 index 00000000..0558c84d --- /dev/null +++ b/exploitation/enumeration/make-suspicious-ntquerysysteminformation-call.yml @@ -0,0 +1,23 @@ +rule: + meta: + name: make suspicious NtQuerySystemInformation call + namespace: exploitation/enumeration + authors: + - zdw@google.com + description: look for suspicious NtQuerySystemInformation calls used to enumerate kernel information in LPEs + scopes: + static: basic block + dynamic: call + references: + - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/query.htm?tx=61 + examples: + - cb0ce85efef94a4f7eacb4571ebf71b12ebbf9fb9faba96e853552822668aa22.exe_:0x140001260 + features: + - and: + - os: windows + - api: NtQuerySystemInformation + - or: + - number: 0xb = SystemModuleInformation + - number: 0x10 = SystemHandleInformation + - number: 0x40 = SystemExtendedHandleInformation + - number: 0x42 = SystemBigPoolInformation diff --git a/exploitation/gadgets/load-ntoskrnl.yml b/exploitation/gadgets/load-ntoskrnl.yml new file mode 100644 index 00000000..e29b8141 --- /dev/null +++ b/exploitation/gadgets/load-ntoskrnl.yml @@ -0,0 +1,19 @@ +rule: + meta: + name: load ntoskrnl + namespace: exploitation/gadgets + authors: + - zdw@google.com + description: look for calls to LoadLibrary* for ntoskrnl.exe, which can be indicative of kernel gadgets being resolved in user-mode for LPEs + scopes: + static: basic block + dynamic: call + examples: + - cb0ce85efef94a4f7eacb4571ebf71b12ebbf9fb9faba96e853552822668aa22.exe_:0x1400013E0 + features: + - and: + - os: windows + - string: "ntoskrnl.exe" + - or: + - api: LoadLibrary + - api: LoadLibraryEx diff --git a/exploitation/gadgets/resolve-ntoskrnl-gadgets.yml b/exploitation/gadgets/resolve-ntoskrnl-gadgets.yml new file mode 100644 index 00000000..6fa3b190 --- /dev/null +++ b/exploitation/gadgets/resolve-ntoskrnl-gadgets.yml @@ -0,0 +1,27 @@ +rule: + meta: + name: resolve ntoskrnl gadgets + namespace: exploitation/gadgets + authors: + - zdw@google.com + description: look for suspicious GetProcAddress calls used to resolve addresses of functions often used for gadgets in LPEs + scopes: + static: basic block + dynamic: call + examples: + - b87b8637121d5e213ca02b45cbaca496bdf1fcc4bfddce48eea6e41637ffedd4.exe_:0x1400021B1 + features: + - and: + - os: windows + - api: GetProcAddress + - or: + - string: "RtlSetAllBits" + - string: "RtlClearAllBits" + - string: "RtlClearBit" + - string: "RtlCopyLuid" + - string: "PsInitialSystemProcess" + - string: "PsReferencePrimaryToken" + - string: "SeQueryInformationToken" + - string: "SeSetAccessStateGenericMapping" + - string: "PoFxProcessorNotification" + - string: "HalDispatchTable" diff --git a/exploitation/spraying/make-suspicious-ntfscontrolfile-call.yml b/exploitation/spraying/make-suspicious-ntfscontrolfile-call.yml new file mode 100644 index 00000000..1c212440 --- /dev/null +++ b/exploitation/spraying/make-suspicious-ntfscontrolfile-call.yml @@ -0,0 +1,32 @@ +rule: + meta: + name: make suspicious NtFsControlFile call + namespace: exploitation/spraying + authors: + - zdw@google.com + description: look for suspicious possible NtFsControlFile calls that may be used for spraying objects into kernel heap pools + scopes: + static: basic block + dynamic: unsupported # requires characteristics, mnemonic features + references: + - https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntfscontrolfile + - https://www.sstic.org/media/SSTIC2020/SSTIC-actes/pool_overflow_exploitation_since_windows_10_19h1/SSTIC2020-Article-pool_overflow_exploitation_since_windows_10_19h1-bayet_fariello.pdf + - https://github.com/vp777/Windows-Non-Paged-Pool-Overflow-Exploitation + - https://gist.github.com/daaximus/e813aa52980fc2a97a8a8a1082338de4 + examples: + - 7d333c9b11b06ef0982b61bfc062631bb6cf9d12d0d4f2cf1b807a25ddf62fbc.exe_:0x140001B99 + - 86a8f267cf0f51c032f7b1777eb1e51f7cd1badf3f3894e2557a3f571fca9f3d.exe_:0x1400BE30B + features: + - and: + - os: windows + - or: + - number: 0x11003c = FSCTL_PIPE_SET_HANDLE_ATTRIBUTE + - number: 0x110038 = FSCTL_PIPE_GET_HANDLE_ATTRIBUTE + - number: 0x119ff8 = FSCTL_PIPE_INTERNAL_WRITE + # TODO(zdw): replace this with count(number(0)): 3 once https://github.com/mandiant/capa/pull/2639 lands + - instruction: + - mnemonic: xor + - instruction: + - mnemonic: call + - not: + - characteristic: nzxor