- macro: spawn_process
  expr: kevt.name = 'CreateProcess'

- macro: create_thread
  expr: kevt.name = 'CreateThread'

- macro: create_remote_thread
  expr: create_thread and kevt.pid != 4 and kevt.pid != thread.pid

- macro: open_process
  expr: kevt.name = 'OpenProcess' and ps.access.status = 'Success'

- macro: open_thread
  expr: kevt.name = 'OpenThread' and thread.access.status = 'Success'

- macro: open_remote_thread
  expr: open_thread and kevt.pid != 4 and kevt.pid != kevt.arg[pid]

- macro: write_file
  expr: kevt.name = 'WriteFile'

- macro: open_file
  expr: kevt.name = 'CreateFile' and file.operation = 'OPEN' and file.status = 'Success'

- macro: create_file
  expr: kevt.name = 'CreateFile' and file.operation != 'OPEN' and file.status = 'Success'

- macro: delete_file
  expr: kevt.name = 'DeleteFile'

- macro: set_file_information
  expr: kevt.name = 'SetFileInformation'

- macro: query_registry
  expr: kevt.name in ('RegQueryKey', 'RegQueryValue') and registry.status = 'Success'

- macro: open_registry
  expr: kevt.name = 'RegOpenKey' and registry.status = 'Success'

- macro: load_module
  expr: kevt.name = 'LoadImage'

- macro: unload_module
  expr: kevt.name = 'UnloadImage'

- macro: set_value
  expr: kevt.name = 'RegSetValue' and registry.status = 'Success'

- macro: create_key
  expr: kevt.name = 'RegCreateKey' and registry.status = 'Success'

- macro: modify_registry
  expr: (set_value or create_key)

- macro: send_socket
  expr: kevt.name = 'Send'

- macro: recv_socket
  expr: kevt.name = 'Recv'

- macro: connect_socket
  expr: kevt.name = 'Connect'

- macro: accept_socket
  expr: kevt.name = 'Accept'

- macro: set_thread_context
  expr: kevt.name = 'SetThreadContext' and kevt.arg[status] = 'Success'

- macro: virtual_alloc
  expr: kevt.name = 'VirtualAlloc'

- macro: virtual_free
  expr: kevt.name = 'VirtualFree'

- macro: map_view_file
  expr: kevt.name = 'MapViewFile'

- macro: unmap_view_file
  expr: kevt.name = 'UnmapViewFile'

- macro: map_view_of_section
  expr: map_view_file and file.view.type in ('IMAGE', 'IMAGE_NO_EXECUTE', 'PAGEFILE')

- macro: unmap_view_of_section
  expr: unmap_view_file and file.view.type in ('IMAGE', 'IMAGE_NO_EXECUTE')

- macro: duplicate_handle
  expr: kevt.name = 'DuplicateHandle'

- macro: create_handle
  expr: kevt.name = 'CreateHandle'

- macro: query_dns
  expr: kevt.name = 'QueryDns'

- macro: reply_dns
  expr: kevt.name = 'ReplyDns'

- macro: inbound_network
  expr: >
    (recv_socket or accept_socket)
        and
    ((net.sip != 0.0.0.0 or net.dip != 0.0.0.0) and (net.sip not in ('0:0:0:0:0:0:0:1', '::1') or net.dip not in ('0:0:0:0:0:0:0:1', '::1')) and not (cidr_contains(net.sip, '127.0.0.0/8') or cidr_contains(net.dip, '127.0.0.0/8')))
  description: |
    Detects inbound network traffic excluding source/destination loopback addresses/address spaces.

- macro: outbound_network
  expr: >
    (send_socket or connect_socket)
        and
    (net.dip != 0.0.0.0 and net.dip not in ('0:0:0:0:0:0:0:1', '::1') and not cidr_contains(net.dip, '127.0.0.0/8', '10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'))
  description: |
    Detects outbound network traffic excluding unspecified destination IP addresses,
    loopback addresses, and IP addresses pertaining to the RFC1918 address space.

- macro: load_driver
  expr: >
    (load_module and (image.name iendswith '.sys' or image.is_driver))
      or
    (create_handle and handle.type = 'Driver')
  description: |
    Detects the loading of the kernel driver. Image load events are published when
    executable images, DLLs, or driver PE objects are loaded. On the contrary, we can
    also detect loading of kernel driver by observing the object manager events and
    watching for driver objects being created.

- macro: unload_driver
  expr: unload_image and (image.name iendswith '.sys' or image.is_driver)

- macro: load_unsigned_module
  expr: >
    load_module and image.signature.type = 'NONE'
  description: |
    Detects when unsigned executable or DLL is loaded into process address space.
    The module is considered as unsigned if it lacks the cert in the PE security
    directory or the Authenticode hash is not present in any of the catalogs.

- macro: load_executable
  expr: >
    load_module and (image.name iendswith '.exe' or image.is_exec)

- macro: load_dll
  expr: >
    load_module and (image.name iendswith '.dll' or image.is_dll)

- macro: load_untrusted_executable
  expr: >
    load_executable
      and
    (image.signature.level = 'UNCHECKED' or image.signature.level = 'UNSIGNED')
  description:
    Detects when untrusted executable is loaded into process address space.

- macro: load_untrusted_dll
  expr: >
    load_dll
      and
    (image.signature.level = 'UNCHECKED' or image.signature.level = 'UNSIGNED')
  description:
    Detects when untrusted DLL is loaded into process address space.

- macro: load_unsigned_module
  expr: >
    load_module and image.signature.type = 'NONE'
  description: |
    Detects when unsigned executable or DLL is loaded into process address space.
    The module is considered as unsigned if it lacks the cert in the PE security
    directory or the Authenticode hash is not present in any of the catalogs.

- macro: load_unsigned_dll
  expr: >
    load_dll and image.signature.type = 'NONE'
  description: |
    Detects when unsigned executable DLL is loaded into process address space.

- macro: load_untrusted_module
  expr: >
    load_module
      and
    (image.signature.level = 'UNCHECKED' or image.signature.level = 'UNSIGNED')
  description: |
    Detects when untrusted executable or DLL is loaded into process address space.
    Windows must verify the trust chain by following the certificates to a trusted
    root certificate. If the trust chain is not satisfied, the module is considered
    untrusted.

- macro: load_unsigned_or_untrusted_module
  expr: (load_unsigned_module) or (load_untrusted_module)
  description: >
    Detects when either unsigned or untrusted module is loaded into process address space.

- macro: load_unsigned_or_untrusted_dll
  expr: (load_unsigned_dll) or (load_untrusted_dll)
  description: >
    Detects when either unsigned or untrusted DLL is loaded into process address space.

- macro: write_minidump_file
  expr: >
    create_file
      and
    (
      file.extension iin
      (
        '.dmp',
        '.mdmp',
        '.dump'
      )
        or
      is_minidump(file.name)
    )
  description: |
    Detects a process writing the minidump file. Minidump files are used for crash
    reporting as they contain a snapshot of the process' memory such as local variables
    or heap objects. Processes can create minidump files by calling into the MiniDumpWriteDump()
    function. This macro checks the well-known extensions of the minidump files as well as
    the minidump signature.

- macro: msoffice_binaries
  list: [EXCEL.EXE, WINWORD.EXE, MSACCESS.EXE, POWERPNT.EXE, visio.exe, mspub.exe, fltldr.exe, eqnedt32.exe]

- macro: web_browser_binaries
  list: [
    chrome.exe, firefox.exe, msedge.exe, iexplore.exe, opera.exe,
    brave.exe, microsoftedge.exe, chromium.exe, safari.exe
    ]

- macro: web_browser_cred_stores
  list: [
    "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network\\Cookies",
    "?:\\Users\\*\\AppData\\Local\\Chrome\\User Data\\Default\\Login Data",
    "?:\\Users\\*\\AppData\\Local\\Google\\Chrome\\User Data\\Local State",
    "?:\\Users\\*\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV0?.dat",
    "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\cookies.sqlite",
    "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\sigons.sqlite",
    "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\logins.json",
    "?:\\Users\\*\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*\\key?.db",
    ]

- macro: executable_extensions
  list: [.exe, .com, .scr]

- macro: module_extensions
  list: [.dll, .ocx, .cpl]

- macro: vault_extensions
  list: [.vcrd, .vpol]

- macro: startup_locations
  list: [
    "?:\\Users\\*\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*",
    "?:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\*",
    ]
  description: |
    Contains default Startup folder paths. Adversaries exploit the Startup folder
    to maintain persistence on the endpoint.

- macro: registry_run_keys
  list: [
    "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\*",
    "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\*",
    "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\\*",
    "*\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\\*",
    "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\*",
    "*\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
    "*\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\*",
    ]
  description: |
    Contains wildcard patterns of commonly abused registry run keys.

- macro: registry_persistence_keys
  list: [
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Load",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\Run",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
    "HKEY_USERS\\*\\Environment\\UserInitMprLogonScript",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
    "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
    "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
    "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
    "HKEY_USERS\\*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
    "HKEY_USERS\\*\\SOFTWARE\\Microsoft\\Command Processor\\Autorun",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
    "HKEY_CURRENT_USER\\Environment\\UserInitMprLogonScript",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\Shell",
    "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logoff\\Script",
    "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Logon\\Script",
    "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Shutdown\\Script",
    "HKEY_CURRENT_USER\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\Scripts\\Startup\\Script",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Ctf\\LangBarAddin\\*\\FilePath",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Internet Explorer\\Extensions\\*\\Exec",
    "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Command Processor\\Autorun"
   ]
  description: |
    Contains the patterns for the registry keys which are commonly abused for
    gaining persistence on the compromised endpoint.

- macro: script_interpreters
  list: ["powershell.exe", "pwsh.exe", "cscript.exe", "wscript.exe", "mshta.exe"]

- macro: startup_shell_folder_registry_keys
  list: [
    "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Startup",
    "HKEY_USERS\\*\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
    "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Startup",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Common Startup"
   ]
  description: |
    Registry keys that permit setting up alternative Startup folder locations.
