add rules for volume interaction via IOCTLs (#879)

* add rules for volume interaction via IOCTLs

* rename interact with driver

* factor out IOCTL handling

* fix 'set-system-properties' for 'install driver'

* fmt

host-interaction/driver/install-driver.yml

@@ -11,9 +11,16 @@ rule:
  - Persistence::Create or Modify System Process::Windows Service [T1543.003]
  mbc:
  - Hardware::Install Driver [C0037]
+ references:
+ - https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysinfo/set.htm
  examples:
  - af60700383b75727f5256a0000c1476f:0x1127E
  features:
  - or:
  - api: ntdll.NtLoadDriver
  - api: ZwLoadDriver
+ - and:
+ - number: 38 = SystemLoadAndCallImage
+ - or:
+ - api: NtSetSystemInformation
+ - api: ZwSetSystemInformation

host-interaction/driver/interact-with-driver-via-ioctl.yml

@@ -0,0 +1,14 @@
+rule:
+ meta:
+ name: interact with driver via IOCTL
+ namespace: host-interaction/driver
+ authors:
+ - moritz.raabe@mandiant.com
+ scopes:
+ static: basic block
+ dynamic: thread
+ examples:
+ - Practical Malware Analysis Lab 10-03.exe_:0x40108c
+ features:
+ - or:
+ - api: DeviceIoControl

host-interaction/driver/unload-driver.yml

@@ -0,0 +1,17 @@
+rule:
+ meta:
+ name: unload driver
+ namespace: host-interaction/driver
+ authors:
+ - moritz.raabe@mandiant.com
+ scopes:
+ static: basic block
+ dynamic: call
+ att&ck:
+ - Persistence::Create or Modify System Process::Windows Service [T1543.003]
+ examples:
+ - 31cee4f66cf3b537e3d2d37a71f339f4:0x1400044ce
+ features:
+ - or:
+ - api: NtUnloadDriver
+ - api: ZwUnloadDriver

host-interaction/hardware/storage/get-disk-size.yml

@@ -26,11 +26,11 @@ rule:
  - property/read: System.IO.DriveInfo::AvailableFreeSpace
  - basic block:
  - and:
- - api: DeviceIoControl
+ - match: interact with driver via IOCTL
  - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO
  - call:
  - and:
- - api: DeviceIoControl
+ - match: interact with driver via IOCTL
  - number: 0x7405C = IOCTL_DISK_GET_LENGTH_INFO
  - and:
  - or:

impact/wipe-disk/delete-drive-layout-via-ioctl.yml

@@ -6,7 +6,7 @@ rule:
  - william.ballenthin@mandiant.com
  scopes:
  static: basic block
- dynamic: thread
+ dynamic: call
  att&ck:
  - Impact::Disk Wipe::Disk Structure Wipe [T1561.002]
  mbc:
@@ -20,6 +20,6 @@ rule:
  features:
  - and:
  - or:
- - api: DeviceIoControl
+ - match: interact with driver via IOCTL
  - characteristic: indirect call
  - number: 0x7c100 = IOCTL_DISK_DELETE_DRIVE_LAYOUT

nursery/get-disk-information-via-ioctl.yml

@@ -0,0 +1,25 @@
+rule:
+ meta:
+ name: get disk information via IOCTL
+ namespace: host-interaction/hardware/storage
+ authors:
+ - william.ballenthin@mandiant.com
+ scopes:
+ static: basic block
+ dynamic: call
+ att&ck:
+ - Discovery::System Information Discovery [T1082]
+ mbc:
+ - Discovery::System Information Discovery [E1082]
+ references:
+ - https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/
+ - http://www.ioctls.net/
+ features:
+ - and:
+ - or:
+ - match: interact with driver via IOCTL
+ - characteristic: indirect call
+ - or:
+ - number: 0x70050 = IOCTL_DISK_GET_DRIVE_LAYOUT_EX
+ - number: 0x24050 = IOCTL_DISK_GET_DRIVE_GEOMETRY_EX
+ - number: 0x2d1080 = IOCTL_STORAGE_GET_DEVICE_NUMBER

nursery/get-storage-device-properties.yml

@@ -12,7 +12,9 @@ rule:
  - https://docs.microsoft.com/en-us/windows/win32/api/winioctl/ni-winioctl-ioctl_storage_query_property
  features:
  - and:
- - match: interact with driver via control codes
+ - or:
+ - characteristic: indirect call
+ - match: interact with driver via IOCTL
  - number: 0x2D1400 = IOCTL_STORAGE_QUERY_PROPERTY
  - optional:
  - string: "\\\\.\\PhysicalDrive0"

nursery/get-volume-information-via-ioctl.yml

@@ -0,0 +1,21 @@
+rule:
+ meta:
+ name: get volume information via IOCTL
+ namespace: host-interaction/hardware/storage
+ authors:
+ - william.ballenthin@mandiant.com
+ scopes:
+ static: basic block
+ dynamic: call
+ att&ck:
+ - Discovery::System Information Discovery [T1082]
+ mbc:
+ - Discovery::System Information Discovery [E1082]
+ references:
+ - https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/
+ features:
+ - and:
+ - or:
+ - match: interact with driver via IOCTL
+ - characteristic: indirect call
+ - number: 0x90064 = FSCTL_GET_NTFS_VOLUME_DATA

nursery/resize-volume-shadow-copy-storage.yml

@@ -10,5 +10,5 @@ rule:
  dynamic: call
  features:
  - and:
- - api: kernel32.DeviceIoControl
+ - match: interact with driver via IOCTL
  - number: 0x53C028 = IOCTL_VOLSNAP_SET_MAX_DIFF_AREA_SIZE

nursery/unmount-volume-via-ioctl.yml

@@ -0,0 +1,19 @@
+rule:
+ meta:
+ name: unmount volume via IOCTL
+ namespace: host-interaction/hardware/storage
+ authors:
+ - william.ballenthin@mandiant.com
+ scopes:
+ static: function
+ dynamic: call
+ references:
+ - https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/
+ features:
+ - and:
+ - or:
+ - match: interact with driver via IOCTL
+ - characteristic: indirect call
+ - and:
+ - number: 0x90018 = FSCTL_LOCK_VOLUME
+ - number: 0x90020 = FSCTL_DISMOUNT_VOLUME