[New RTA] Endpoint Rules

[Samirbous]

Rules Summary :

NTDLL Loaded from an Unusual Path 
Suspicious Impersonation as Trusted Installer
Potential Privilege Escalation via Token Impersonation
Privilege Escalation via EXTENDED STARTUPINFO
Security Account Manager (SAM) Registry Access
Suspicious Access to LSA Secrets Registry
Sensitive File Access - Unattended Panther
Sensitive File Access - SSH Saved Keys
Sensitive File Access - System Admin Utilities
Potential Credential Access via Windows Credential History
Failed Attempts to Access Sensitive Files
Potential Discovery of Windows Credential Manager Store 
Potential Discovery of DPAPI Master Keys
Potential Process Creation via ShellCode 
Potential Injection via the Console Window Class
Network Module Loaded from Suspicious Unbacked Memory
Potential Masquerading as Windows Error Manager
Potential DLL SideLoad via a Renamed Signed Binary
Suspicious DNS Query from Mounted Virtual Disk
Suspicious DNS Query to Free SSL Certificate Domains
DNS Query to Suspicious Top Level Domain
Persistence via a Process from a Removable or Mounted ISO Device
Scheduled Task from a Removable or Mounted ISO Device
Suspicious ImageLoad from an ISO Mounted Device
DLL Loaded from an Archive File
Library Loaded via a CallBack Function
Oversized DLL Creation followed by SideLoad
Potential Evasion via Oversized Image Load
Rundll32 or Regsvr32 Executing an OverSized File
DLL Side Loading via a Copied Microsoft Executable
Suspicious Access to Active Directory Database File
Security Account Manager (SAM) File Access
Suspicious Execution via DotNet Remoting
Suspicious ImageLoad via Windows CertOC
Suspicious ImageLoad via ODBC Driver Configuration Program
Potential Evasion via Intel GfxDownloadWrapper
Potential NTDLL Memory Unhooking
Suspicious Image Load via LdrLoadDLL
Process Creation from Modified NTDLL

NTDLL Loaded from an Unusual Path :

Suspicious Impersonation as Trusted Installer :

Potential Privilege Escalation via Token Impersonation :

Privilege Escalation via EXTENDED STARTUPINFO :

Security Account Manager (SAM) Registry Access :

Suspicious Access to LSA Secrets Registry :

Sensitive File Access - Unattended Panther
Potential Discovery of Windows Credential Manager Store
Potential Discovery of DPAPI Master Keys :

Potential Process Creation via ShellCode & Potential Injection via the Console Window Class :

Network Module Loaded from Suspicious Unbacked Memory (Diag) & Potential Masquerading as Windows Error Manager (Diag) (dummy shellcode to load ws2_32.dll from unbacked memory into an instance of WerFault.exe :

Potential DLL SideLoad via a Renamed Signed Binary :

Suspicious DNS Query from Mounted Virtual Disk
Suspicious DNS Query to Free SSL Certificate Domains
Suspicious DNS Query to Free SSL Certificate Domains:

Persistence via a Process from a Removable or Mounted ISO Device
Scheduled Task from a Removable or Mounted ISO Device

Suspicious ImageLoad from an ISO Mounted Device :
DLL Loaded from an Archive File:

Library Loaded via a CallBack Function:

Oversized DLL Creation followed by SideLoad
Potential Evasion via Oversized Image Load
Rundll32 or Regsvr32 Executing an OverSized File
DLL Side Loading via a Copied Microsoft Executable

Security Account Manager (SAM) File Access

Potential NTDLL Memory Unhooking
Suspicious Image Load via LdrLoadDLL
Process Creation from Modified NTDLL:

[Samirbous]

@brokensound77 @Mikaayenson thanks for your reviews.

• moved shared functions to common (getppid, impersonate_system, Inject) - 🟢
• fixed RtaMetadata array (moved rule.ids from siem to endpoint) - 🟢
• moved OS-specific code to common under Windows OS check and inside some other functions - 🟢
• f-strings everywhere instead of + or .format - 🟢
• added cpp source files https://github.com/elastic/detection-rules/pull/2788/files#diff-c3c20c24aa6c6d454e2bed932b856bbe71f8ff8aec3b59b139e4c5f9ee27c3a7R1 - 🟢
• re-run all RTA and confirmed they work after changes - 🟢
• Unit test passes now - 🟢

[Mikaayenson]

🏅 Fantastic

[eric-forte-elastic]

Looks good! 👍

Minor NIT, may want to add new lines to these files.