Initial commit for process tampering

Author: darkoperator

process-tampering.md

@@ -0,0 +1,52 @@
+Process Tampering
+-----------------
+
+Sysmon will log **EventID 25** when a process original image is replaced in memory or on disk. This covers the technique of [Process Hollowing](https://attack.mitre.org/techniques/T1055/012/), this is when a process is launched, then suspended and the memory for the image is unmapped and realigned to another image injected in to memory and then resumed to execute the injected image. [Process Herpaderping](https://jxy-s.github.io/herpaderping/) is another technique that is caught by this event type, this technique works by modifying the content on disk after the image has been mapped. This capability was added in version 13.0 of Sysmon with schema 4.50.
+
+The fields for the event are:
+
+* **ProcessGuid** -- Unique process GUID generated by Sysmon.
+
+* **ProcessId** -- Process ID represented as a integer number.
+
+* **Image** -- Full path of the executable image that was tampered with.
+
+* **Type** -- Type of process tampering (Image is locked for access, Image is replaced)
+
+There are several programs like browsers and code development programs that trigger this event type. Since a attacker can select any process as their target it is reocmended to capture all events and create a exclusion list of known programs. There is a risk that attacker will select this programs for their actions but it limits greatly their capability by norrowly directing them to programs that can then be monitor for other behaviours to detect abuse on the.
+
+Example:
+
+```xml
+Sysmon schemaversion="4.50">
+  <EventFiltering>
+    <RuleGroup name="" groupRelation="or">
+      <ProcessTampering onmatch="exclude">
+      </ProcessTampering>
+    </RuleGroup>
+  </EventFiltering>
+</Sysmon>
+
+```
+
+Collect events and build a exclusion list like:
+
+```xml
+RuleGroup name=“” groupRelation=“or”>
+  <ProcessTampering onmatch=“exclude”>
+    <Image condition=“is”>C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe</Image>
+    <Image condition=“is”>C:\Program Files\Mozilla Firefox\firefox.exe</Image>
+    <Image condition=“is”>C:\Program Files\Mozilla Firefox\updater.exe</Image>
+    <Image condition=“is”>C:\Program Files\Mozilla Firefox\default-browser-agent.exe</Image>
+    <Image condition=“is”>C:\Program Files\Mozilla Firefox\pingsender.exe</Image>
+    <Image condition=“is”>C:\Program Files\Microsoft VS Code\Code.exe</Image>
+    <Image condition=“is”>C:\Program Files\Git\cmd\git.exe</Image>
+    <Image condition=“is”>C:\Program Files\Git\mingw64\bin\git.exe</Image>
+    <Image condition=“contains”>\software_reporter_tool.exe</Image>
+    <Image condition=“contains”>unknown process</Image>
+  </ProcessTampering>
+</RuleGroup>
+```
+
+Seems like Electron based apps like Slack, Mattermost and others also create false positives.
+

sysmon-events.md

@@ -43,6 +43,10 @@ Sysmon Events
 
   * [WMI Events](#wmi-events)
 
+  * [Clipboard Capture](#clipboard-capture.md)
+
+  * [Process Tampering](#process-tampering.md)
+
 Sysmon Operational Events
 -------------------------
 

what-is-sysmon.md

@@ -36,4 +36,5 @@ The table below shows the event types and event ID for each.
 |DNS Query|22
 |File Delete|23
 |Clipboard Capture|24
+|Process Tampering|25
 |Error|255