Techniques
Sample rules
Windows Raw Access To Master Boot Record Drive
- source: splunk
- technicques:
- T1561.002
- T1561
Description
This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record code as part of their impact payload. This detection is a good indicator that there is a process try to read or write on MBR sector.
Detection logic
`sysmon` EventCode=9 Device = \\Device\\Harddisk0\\DR0 NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*"))
| stats count min(_time) as firstTime max(_time) as lastTime by Computer Image Device ProcessGuid ProcessId EventDescription EventCode
| rename Computer as dest
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_raw_access_to_master_boot_record_drive_filter`
Windows Raw Access To Disk Volume Partition
- source: splunk
- technicques:
- T1561.002
- T1561
Description
This analytic is to look for suspicious raw access read to device disk partition of the host machine. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition as part of their impact payload for example the “hermeticwiper” malware. This detection is a good indicator that there is a process try to read or write on boot sector.
Detection logic
`sysmon` EventCode=9 Device = \\Device\\HarddiskVolume* NOT (Image IN("*\\Windows\\System32\\*", "*\\Windows\\SysWOW64\\*"))
| stats count min(_time) as firstTime max(_time) as lastTime by dest signature signature_id process_guid process_name process_path Device
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_raw_access_to_disk_volume_partition_filter`