Thanks for the wait!
Before reviewing the blog, I reviewed the intent of the submitted signature. The provided rule would detect on HTTP Response content if…
- “{71E5B33E-1064-11D2-808F-0000F875A9CE}” is strictly present
- “loadXML(unescape” follows after the previous match
- “CreateObject” follows after the previous match
- a case-insensitive PCRE after the previous match is satisfied. The PCRE attempts to match on WScript and Shell.
- “transformNode” follows after the previous match
Notes on Content Used:
This rule would fire on a very specific sample that contains the GUID. We can loosen this rule by removing the GUID, however does the remaining content reflect GrimResource? No, the remaining content would be too generic.
The rule also does not specify a fast_pattern, or a unique content, that could improve the rules performance. Ideally, rules should have this.
Other Notes:
Outside of the present content, I believe your rule correctly identifies the protocol, source and destination of the activity, the correct Suricata keyword, and the supplies adequate rule details needed for this rule.
Let’s build on your rule with the blog contents.
The blog mentioned that …
The key to the GrimResource technique is using an old XSS flaw present in the apds.dll library. By adding a reference to the vulnerable APDS resource in the appropriate StringTable section of a crafted MSC file, attackers can execute arbitrary javascript in the context of mmc.exe
I reviewed the linked article, From http:// domain to res:// domain xss by using IE Adobe’s PDF ActiveX plugin | by Knownsec 404 team | Medium, and noted that XSS flaw generally appears as
res://apds.dll/redirect.html?target=javascript
The blog provides examples of how this XSS flaw is implemented within .
Also, the blog provides a YARA rule used to detect this activity in files:
rule Windows_GrimResource_MMC {
meta:
author = "Elastic Security"
reference = "https://www.elastic.co/security-labs/GrimResource"
reference_sample = "14bcb7196143fd2b800385e9b32cfacd837007b0face71a73b546b53310258bb"
arch_context = "x86"
scan_context = "file, memory"
license = "Elastic License v2"
os = "windows"
strings:
$xml = "<?xml"
$a = "MMC_ConsoleFile"
$b1 = "apds.dll"
$b2 = "res://"
$b3 = "javascript:eval("
$b4 = ".loadXML("
condition:
$xml at 0 and $a and 2 of ($b*)
}
With this blog information, we could construct a rule that would target similar network activity, such as…
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT GrimResource / Microsoft Management Console (MMC) RCE Vulnerability (CVE-2024-43572)"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"<MMC_ConsoleFile>"; content:"<StringTables>"; distance:0; content:"res://apds.dll/"; distance:0; fast_pattern; content:"=javascript:"; distance:0; content:"</StringTables>"; distance:0; content:"</MMC_ConsoleFile>"; distance:0; reference:url,elastic.co/security-labs/grimresource; reference:url,thehackernews.com/2024/06/new-attack-technique-exploits-microsoft.html; reference:url,nvd.nist.gov/vuln/detail/CVE-2024-43572; reference:cve,2024-43572; classtype:exploit-kit; sid:10000001; rev:1;)
Also, we can create a looser rule to detect on the generic apds.dll vulnerability
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Likely apds.dll XSS Attempt"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"res://apds.dll/"; fast_pattern; content:"=javascript:"; distance:0; reference:url,medium.com/@knownsec404team/from-http-domain-to-res-domain-xss-by-using-ie-adobes-pdf-activex-plugin-ba4f082c8199; classtype:bad-unknown; sid:2; rev:1; metadata: attack_target Client_Endpoint, deployment Perimeter;)
The rules above should be available in tomorrow’s release and I’ll make sure to add you to our Thank You list as well!
Cheers,
.