Detection proposal: Windows ssh-keygen loading an unsigned PKCS#11 provider DLL

オープン
  • 何か問題がありますか？
#4,382 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
30/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
活発
領域
security

調査の方向性

Start by checking the existing Sysmon Event ID 7 analytics in the detections folder to see which conditions they already cover and where a new Anomaly analytic would sit. The proposal depends on whether maintainers accept it, so confirm that before building. Done means a new experimental analytic that fires on the 13 provider loads and none of the 2 negative controls in the attached dataset, and that contentctl-ng build passes.

索引モデルが issue の本文から書いたものです。

説明

enhancement

Is your feature request related to a problem? Please describe.
Windows OpenSSH ssh-keygen -D <provider> passes the provider path straight to LoadLibraryW, so the DLL's code runs inside the trusted ssh-keygen.exe process with no child shell. The technique is publicly documented (Sean Pesce, 2023; LOLBAS lists the related ssh.exe/scp.exe PKCS11Provider variant), but nothing in security_content mentions ssh-keygen or PKCS11. The existing Event ID 7 analytics need a Temp, UNC, same-directory or known-DLL-name condition, so they miss a provider loaded from a user's Downloads folder.

Describe the solution you'd like
A new experimental Anomaly analytic using Sysmon EID 7: ssh-keygen.exe loading a module from outside the Windows and Program Files directories that is unsigned or not validly signed. The command line from EID 1 is attached by process GUID for context. Detection does not depend on parsing -D: on native Windows, relative paths, bare file names, missing .dll extensions, forward slashes, .. segments and -qD/-vvvD clusters all executed the provider while logging the same canonical module path.

Describe alternatives you've considered
Matching the -D argument against the loaded path. I built and tested that version first, and it caught only 2 of 9 working variants. The image-load approach caught 9 of 9.

Additional context
Validated on Windows x64, OpenSSH 9.5.6.2, Sysmon 15.22, with a benign marker provider. The test data has 15 process runs (488 anonymized events): 13 provider loads, including a self-signed DLL, which Sysmon reports as Signed=false, plus 2 negative controls. Results: 13/13 detected, 0 false hits on the negatives. contentctl-ng build passes on develop. Proposed mapping: Living Off The Land, T1129 / T1218. No new OpenSSH vulnerability is claimed.

Would this fit as a new analytic? If so, I'll open the PR and publish the dataset to attack_data.

主要言語
Python
スター
1.7k
フォーク
505
平均マージ
3日 10時間
マージ済み PR（30日）
50

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

splunk/security_content のほかの issue

splunk/security_content の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。