mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-06 19:00:17 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
71 lines
2.3 KiB
Markdown
71 lines
2.3 KiB
Markdown
# API Reference: Detecting Living Off the Land Attacks
|
|
|
|
## LOLBAS Project
|
|
- Website: https://lolbas-project.github.io/
|
|
- API: https://lolbas-project.github.io/api/lolbas.json
|
|
- GitHub: https://github.com/LOLBAS-Project/LOLBAS
|
|
|
|
## Key LOLBins and MITRE Mappings
|
|
| Binary | MITRE ATT&CK | Abuse Type |
|
|
|--------|-------------|------------|
|
|
| certutil.exe | T1140, T1105 | File download, decode |
|
|
| mshta.exe | T1218.005 | Script execution via HTA |
|
|
| rundll32.exe | T1218.011 | Proxy execution |
|
|
| regsvr32.exe | T1218.010 | COM scriptlet execution |
|
|
| msbuild.exe | T1127.001 | Code compilation |
|
|
| bitsadmin.exe | T1197, T1105 | File download, persistence |
|
|
| wmic.exe | T1047 | WMI execution |
|
|
| cscript.exe | T1059.005 | VBS/JS script execution |
|
|
| installutil.exe | T1218.004 | .NET install bypass |
|
|
| powershell.exe | T1059.001 | Script execution |
|
|
|
|
## Sysmon Event IDs for Detection
|
|
| Event ID | Description |
|
|
|----------|------------|
|
|
| 1 | Process Create (CommandLine, ParentImage) |
|
|
| 3 | Network Connection (detect downloads) |
|
|
| 7 | Image Loaded (DLL side-loading) |
|
|
| 11 | File Create (dropped payloads) |
|
|
| 15 | FileCreateStreamHash (ADS abuse) |
|
|
|
|
## Sigma Rules for LOLBin Detection
|
|
```yaml
|
|
title: Certutil File Download
|
|
logsource:
|
|
category: process_creation
|
|
product: windows
|
|
detection:
|
|
selection:
|
|
Image|endswith: '\\certutil.exe'
|
|
CommandLine|contains|all:
|
|
- 'urlcache'
|
|
- 'split'
|
|
- 'http'
|
|
condition: selection
|
|
level: high
|
|
tags:
|
|
- attack.defense_evasion
|
|
- attack.t1140
|
|
```
|
|
|
|
## Splunk SPL Detection
|
|
```spl
|
|
index=sysmon EventCode=1
|
|
| where match(Image, "(?i)(certutil|mshta|rundll32|regsvr32|bitsadmin)\\.exe$")
|
|
| eval suspicious=case(
|
|
like(CommandLine, "%urlcache%"), "certutil download",
|
|
like(CommandLine, "%javascript:%"), "script execution",
|
|
like(CommandLine, "%-enc %"), "encoded command",
|
|
true(), "review")
|
|
| where suspicious!="review"
|
|
| table _time Computer User Image CommandLine ParentImage suspicious
|
|
```
|
|
|
|
## Suspicious Parent-Child Relationships
|
|
| Parent | Suspicious Child |
|
|
|--------|-----------------|
|
|
| winword.exe | cmd.exe, powershell.exe, mshta.exe |
|
|
| excel.exe | cmd.exe, powershell.exe, wmic.exe |
|
|
| outlook.exe | powershell.exe, cmd.exe |
|
|
| wmiprvse.exe | powershell.exe, cmd.exe |
|