markdown Tanium狩猎问题

Posted 2021-05-06

# Tanium Hunting Questions

## Initial Infection

New Scripts in Webroot Paths  

```
Get "Trace File Operations[unlimited, 1488479715768|1488483314768, 1, 0, 0, 10, .*\\wwwroot\\.*\.(asp|aspx|cfm|jsp|php), CreateNewFile, , , ]" from all machines
```

Command Shell Spawned by Unusual Parent  

```
Get "Trace Executed Processes[unlimited, 1488479676718|1488483275718, 1, 0, 10, 0, (?i).*cmd\.exe, (?i).*(office|adobe|java|iexplore|firefox|chrome|svchost|w3wp).*, , , , ]" from all machines
```

## Persistence 

Registry Run Key Changes

```
Get "Trace Registry Keys or Values[unlimited, 1488479754121|1488483353121, 1, 0, 10, 0, (?i).*\\CurrentVersion\\Run, , SetValueKey, , , ]" from all machines
```

Autoruns in User Directories without Publisher Data 

```
Get AutoRun Program Details containing ":|:|c:\users" from all machines
```


## Lateral Movement

Domain Reconnaissance with Net.exe  

```
Get "Trace Executed Processes[unlimited, 1488479819205|1488483418205, 1, 0, 10, 0, (?i).*\\net\.exe, , (?i).*(localgroup administrators|group "domain admins"|view /domain).*, , , ]" from all machines
```

Mount Remote Root Share  

```
Get "Trace Executed Processes[unlimited, 1488479895047|1488483494047, 1, 0, 10, 0, (?i).*\\net\.exe, , (?i).*use.*\\\\.*\\(ADMIN|C)\$.*, , , ]" from all machines
```

## Office Attacks

Suspicious processes launched by Office  

```
Get "Trace Executed Processes[unlimited, 1488480102075|1488483701075, 1, 0, 10, 0, (?i).*\\AppData\\.*, (?i).*(winword|excel|outlook)\.exe, , , , ]" from all machines
```

Decoding malware payload with Certutil  

```
Get "Trace Executed Processes[unlimited, 1488480143929|1488483742929, 1, 0, 10, 0, , (?i).*(winword|excel|powerpnt).*, (?i).*certutil.*-decode.*, , , ]" from all machines
```

Process Trees  

```
Get "Trace Executed Process Trees[(winword.exe|outlook.exe|excel.exe), 1, 0, 0, As Parent, 10000]" from all machines
```

## PowerShell Attacks
 
Process Trees  

```
Get Trace Executed Process Trees[powershell.exe, 0, 0, 0, As Child, 10000] from all machines
```

Suspicious Command Lines  

```
Get "Trace Executed Processes[unlimited, 1488479986508|1488483585508, 1, 0, 10, 0, (?i).*powershell\.exe$, , (?i).*(-enc|-encodedcommand|iex|webclient|invoke-expression|new-object|downloadfile|downloadstring|frombase64string|deflatestream|createobject|uploadfile).*, , , ]" from all machines
```