Detection and Response Examples
- 03 Jan 2025
- 7 Minutes to read
- Print
- Dark
Detection and Response Examples
- Updated on 03 Jan 2025
- 7 Minutes to read
- Print
- Dark
Article summary
Did you find this summary helpful?
Thank you for your feedback!
The following are sample detection and response rules can help you get started in crafting efficient rules utilizing LimaCharlie's telemetry. In addition to these rules, we also recommend checking out Sigma Rules for more rules.
Translating Existing Rules
Before listing examples, it's worth mentioning uncoder.io by SOC Prime is a great resource for learning by analogy. If you're already familiar with another platform for rules or search queries (Sigma, Splunk, Kibana, etc.) you can use uncoder to translate to LimaCharlie's D&R rules.
Looking for more?
Check out this video that shows you the power of leveraging community resources with LimaCharlie
Examples
Note that through limacharlie.io, in order to provide an easier to edit format, the same rule configuration is used but is in YAML format instead. For example:
WanaCry
Simple WanaCry detection and mitigation rule:
Classify Users
Tag any Sensor where the CEO logs in with "vip".
SSH from External IP Address
The following example looks for connections to/from sshd involving a non-RFC1918 IP Address. Be mindful that this is only looking for network connections, not actual logons, so this could be noisy on an internet-facing system but still indicative of an exposed service.
The report uses Go Templates to include the offending IP address in the detection name.
RDP from External IP Address
Similar to the above SSH example, this example looks for RDP connections from an external IP address. Be mindful that this is only looking for network connections, not actual logons, so this could be noisy on an internet-facing system but still indicative of an exposed service.
The report uses Go Templates to include the offending IP address in the detection name.
Suspicious Windows Executable Names
Disable an Event at the Source
Turn off the sending of a specific event to the cloud. Useful to limit some verbose data sources when not needed.
Windows Event Logs
A simple example of looking for a specific Event ID in WEL events.
Nested Logic
An example demonstrating nested boolean logic. This detection looks specifically for the following conditions:
((4697 OR 7045) in the System log) OR (4698 in the Security log)
File Integrity Monitoring
Monitoring Sensitive Directories
Make sure the File Integrity Monitoring of some directories is enabled whenever Windows sensors connect.
Similar example for a Linux web server.
FIM Hit Detection
Adding a FIM pattern with fim_add by itself will only cause FIM_HIT events to be generated on the affected system's timeline. To know that we have positive hits on a FIM rule, we want to capture the relevant event and generate a proper Detection.
YARA Scanning
Resource Utilization
Performing CPU intensive actions such as YARA scanning can impact endpoint performance if not optimized. Be sure to always test rules that carry out sensor commands (like the examples below) before deploying at scale in production. Use suppression to prevent runaway conditions.
Here are a few examples of using D&R rules to initiate automatic YARA scans on an endpoint. Note that the defined YARA rule must exist in your org before using it in a D&R rule.
YARA Scan Processes
This example looks for NEW_PROCESS events that meet certain criteria, then initiates a YARA scan against the offending process ID in memory. Note, this or a similar D&R rule will also depend on a companion YARA Detection rule.
Notice the use of suppression to prevent the same PROCESS_ID from being scanned more than once per minute to prevent a resource runaway situation.
YARA Scan Files
This example looks for NEW_DOCUMENT events that meet certain criteria, then initiates a YARA scan against the offending file path. Note, this or a similar D&R rule will also depend on a companion YARA Detection rule.
Notice the use of suppression to prevent the same FILE_PATH from being scanned more than once per minute to prevent a resource runaway situation.
YARA Detections
Running a YARA scan by itself only sends a YARA_DETECTION event to the affected system's timeline. To know that we have positive hits on a YARA scan, we want to capture the relevant event and generate a proper Detection. The following two examples split out a YARA detection on-disk, versus in-memory. Notice we simply check for the presence of event/PROCESS/* fields to determine if it's a file or process detection, which may have different severities to security teams (dormant malware versus running malware).
YARA Detection On-Disk (file)
YARA Detection In-Memory (process)
Both rules will generate a Detection report and add a tag to the system which the detection occurred on.
Mention of an Internal Resource
Look for references to private URLs in proxy logs.
De-duplicate Cloned Sensors
Sometimes users install a sensor on a VM image by mistake. This means every time a new instance of the image gets started the same sensor ID (SID) is used for multiple boxes with different names. When detected, LimaCharlie produces a sensor_clone event.
We can use these events to deduplicate. This example targets Windows clones.
Was this article helpful?
