Daspren Parad

Overview

Daspren is the only Data Detection and Response (DDR) that integrates detection and blocking of cyber attacks. Daspren goes deep, using our patented data-centric AI to meticulously dissect and analyze every data access. It seamlessly intercepts and scrutinizes these access requests, ensuring that only legitimate, authorized applications can access your data, keeping it secure and protected.

• Vendor: Daspren
• Supported environment: On Premise
• Detection based on: Telemetry
• Supported application or feature: Parad is the data protection solution from Daspren. It monitors data activity and use AI to prevent data breaches coming from both the inside and the outside of your organization:
  • File created, opened, deleted, moved or modified,
  • Access rules breach attempts,
  • Malicious processes detected.

Warning

This format is currently in beta. We highly value your feedback to improve its performance.

High-Level Architecture Diagram

• Type of integration: Outbound (PUSH to Sekoia.io)

Specification

Prerequisites

• Permissions: Administrator or Root access to the Parad CLI

Transport Protocol/Method

• Direct HTTP

Logs details

• Supported functionalities: See section Overview
• Supported type(s) of structure: JSON
• Supported verbosity level: Informational

Note

This is a description of the log level based on the taxonomy of the RFC5424 for standardization purpose. Please adapt to the wording used by the editor.

Step-by-Step Configuration Procedure

Instruction on Sekoia

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

1. Go to the Sekoia Intake page.
2. Click on the + New Intake button at the top right of the page.
3. Search for your Intake by the product name in the search bar.
4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
5. Click on Create.
6. You will be redirected to the Intake listing page, where you will find a new line with the name you gave to the Intake.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Instructions on the 3rd Party Solution

1. Open the Parad CLI:
2. Create a Sink from the CLI:
   • Go to Sinks > Add Sink.
   • Select the Sekoia Sink Variant.
   • Type a Name and paste the Intake key from the previous step.
3. Create a Reporter from the CLI:
   • Go to Reporters > Add Reporter.
4. Create a Link:
   • Link the previously created Sink and Reporter.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

file_openedmalicious_behavior

{
    "time": "2024-05-13T13:02:17.862473900Z",
    "message": "File opened",
    "level": "INFO",
    "env_id": "df643ab3-64ab-4347-b50f-0e07d28c46fb",
    "parad_version": "0.7.0",
    "os": "Windows 10 Pro",
    "machine_name": "DESKTOP-88BEQS0",
    "executable": "C:\\Windows\\System32\\svchost.exe",
    "pid": 1632,
    "hash": "53eb83666795ebe099558a0572423cbbc5a72d3ea863cb22617ca35560751a03",
    "ppid": 0,
    "signed": true,
    "executable_basename": "svchost.exe",
    "executable_category": "System",
    "created_length": 0,
    "fullpath": "C:\\Users\\PC\\AppData\\Local\\Temp",
    "basename": "Temp",
    "fullpath_category": "AppData"
}

{
    "time": "2024-03-07T15:56:49Z",
    "message": "A process had a malicious behaviour and was killed.",
    "level": "INFO",
    "env_id": "7ba0a633-f8a3-410b-ba6f-5974705ced3a",
    "parad_version": "0.6.1",
    "os": "Windows 10 Pro",
    "machine_name": "bloquant",
    "executable": "C:\\Users\\Testeur\\Desktop\\c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe",
    "pid": 6148,
    "hash": "e6f84e5080f3cdbf69f92f703d59f8b6e0f5e64f8a87f5b4a108cf913219b37c",
    "ppid": 0,
    "signed": false,
    "executable_basename": "c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe",
    "executable_category": "User",
    "offset": 262144,
    "written_length": 131072,
    "fullpath": "C:\\Users\\Testeur\\Desktop\\mom_files\\armorials\\1T9dlo1.ddbPFTiN9",
    "basename": "1T9dlo1.ddbPFTiN9",
    "fullpath_category": "User"
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Related Built-in Rules

The following Sekoia.io built-in rules match the intake Daspren Parad [BETA]. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Daspren Parad [BETA] on ATT&CK Navigator

Active Directory Data Export Using Csvde

Detects the use of Csvde, a command-line tool from Windows Server that can be used to export Active Directory data to CSV files. This export doesn't include password hashes, but can be used as a discovery tool to enumerate users, machines and group memberships.

• Effort: elementary

AdFind Usage

Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects

• Effort: elementary

Adexplorer Usage

Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.

• Effort: advanced

Adidnsdump Enumeration

Detects use of the tool adidnsdump for enumeration and discovering DNS records.

• Effort: advanced

Advanced IP Scanner

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

• Effort: master

AutoIt3 Execution From Suspicious Folder

Detects AutoIt3 execution from an unusual/suspicious folder. Legitimate folders are "Program Files" and "AppData\Local". AutoIt3.exe is a legitimate process used to execute AutoIt program files, which are used by legitimate software, custom scripts, but also malware. Finding AutoIt3 execution from unusual/suspicious folder can help detect malware activities, such as DarkGate execution. The detection rule can be tailored to your environment and your use of AutoIt3 by filtering out folder's execution of legitimate applications or scripts.

• Effort: advanced

Bloodhound and Sharphound Tools Usage

Detects default process names and default command line parameters used by Bloodhound and Sharphound tools.

• Effort: intermediate

CVE-2017-11882 Microsoft Office Equation Editor Vulnerability

Detects the exploitation of CVE-2017-11882 vulnerability. The Microsoft Office Equation Editor has no reason to do a network request or drop an executable file. This requires a sysmon configuration with file and network events.

• Effort: master

CVE-2021-34527 PrintNightmare Suspicious Actions From Spoolsv

Detects suspicious image loads and file creations from the spoolsv process which could be a sign of an attacker trying to exploit the PrintNightmare vulnerability, CVE-2021-34527. A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. This works as well as a Local Privilege escalation vulnerability. To fully work the rule requires to log for Loaded DLLs and File Creations, which can be done respectively using the Sysmon's event IDs 7 and 11.

• Effort: master

Certificate Authority Modification

Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.

• Effort: master

Certify Or Certipy

Detects the use of certify and certipy which are two different tools used to enumerate and abuse Active Directory Certificate Services.

• Effort: advanced

Cobalt Strike Default Beacons Names

Detects the default names of Cobalt Strike beacons / payloads.

• Effort: intermediate

Credential Dump Tools Related Files

Detects processes or file names related to credential dumping tools and the dropped files they generate by default.

• Effort: advanced

Daspren Parad Malicious Behavior

Detects when Daspren Parad kills a process with a malicious behavior.

• Effort: master

Exfiltration And Tunneling Tools Execution

Execution of well known tools for data exfiltration and tunneling

• Effort: advanced

Formbook File Creation DB1

Detects specific file creation (Users*\AppData\Local\Temp\DB1) to store data to exfiltrate (Formbook behavior). Logging for Sysmon event 11 is usually used for this detection.

• Effort: intermediate

HTA Infection Chains

Detect the creation of a ZIP file and an HTA file as it is often used in infection chains. Furthermore it also detects the use of suspicious processes launched by explorer.exe combined with the creation of an HTA file, since it is also often used in infection chains (LNK - HTA for instance).

• Effort: intermediate

HackTools Suspicious Names

Quick-win rule to detect the default process names or file names of several HackTools.

• Effort: elementary

Hijack Legit RDP Session To Move Laterally

Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.

• Effort: intermediate

ISO LNK Infection Chain

Detection of an ISO (or any other similar archive file) downloaded file, followed by a child-process of explorer, which is characteristic of an infection using an ISO containing an LNK file. For events with host.name.

• Effort: intermediate

Kernel Module Alteration

Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. The prerequisites are to enable monitoring of the finit_module, init_module, delete_module syscalls using Auditbeat.

• Effort: advanced

Legitimate Process Execution From Unusual Folder

Detects the execution of a legitimate, windows built-in process name from an unusual / suspicious folder. Legitimate folders are c:\windows\system32\, \SystemRoot\system32\, c:\windows\syswow64\ and c:\windows\winsxs. Many malwares/attackers use legitimate names to masquerade but if they are not Administrator yet, they often can't write file into these legitimate folders.

• Effort: advanced

Microsoft Exchange Server Creating Unusual Files

Look for Microsoft Exchange Server’s Unified Messaging service creating non-standard content on disk, which could indicate web shells or other malicious content, suggesting exploitation of CVE-2021-26858 vulnerability

• Effort: intermediate

Microsoft Office Creating Suspicious File

Detects Microsoft Office process (word, excel, powerpoint) creating a suspicious file which corresponds to a script or an executable. This behavior highly corresponds to an executed macro which loads an installation script or a malware payload. The rule requires to log for File Creations to work properly, which can be done through Sysmon Event ID 11.

• Effort: master

NTDS.dit File In Suspicious Directory

The file NTDS.dit is supposed to be located mainly in C:\Windows\NTDS. The rule checks whether the file is in a legitimate directory or not (through file creation events). This is usually really suspicious and could indicate an attacker trying copy the file to then look for users password hashes.

• Effort: advanced

Network Scanning and Discovery

Tools and command lines used for network discovery from current system

• Effort: advanced

Network Sniffing

List of common tools used for network packages sniffing

• Effort: advanced

Network Sniffing Windows

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

• Effort: intermediate

NlTest Usage

Detects attempts to gather information on domain trust relationships that may be used to identify lateral movement opportunities. These command lines were observed in numerous attacks, but also sometimes from legitimate administrators for debugging purposes. The rule does not cover very basics commands but rather the ones that are interesting for attackers to gather information on a domain.

• Effort: advanced

OneNote Embedded File

Detects creation or uses of OneNote embedded files with unusual extensions.

• Effort: intermediate

OneNote Suspicious Children Process

In January 2023, a peak of attacks using .one files was observed in the wild. This rule tries to detect the effect of such attempts using this technique.

• Effort: advanced

PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

• Effort: elementary

Phorpiex Process Masquerading

Detects specific process executable path used by the Phorpiex botnet to masquerade its system process network activity. It looks for a pattern of a system process executable name that is not legitimate and running from a folder that is created via a random algorithm 13-15 numbers long.

• Effort: elementary

Process Trace Alteration

PTrace syscall provides a means by which one process ("tracer") may observe and control the execution of another process ("tracee") and examine and change the tracee's memory and registers. Attacker might want to abuse ptrace functionnality to analyse memory process. It requires to be admin or set ptrace_scope to 0 to allow all user to trace any process.

• Effort: advanced

PsExec Process

Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.

• Effort: advanced

RDP Session Discovery

Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.

• Effort: advanced

RTLO Character

Detects RTLO (Right-To-Left character) in file and process names.

• Effort: elementary

Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

• Effort: master

Remote Monitoring and Management Software - Atera

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.

• Effort: master

Socat Relaying Socket

Socat is a linux tool used to relay local socket or internal network connection, this technics is often used by attacker to bypass security equipment such as firewall

• Effort: advanced

Socat Reverse Shell Detection

Socat is a linux tool used to relay or open reverse shell that is often used by attacker to bypass security equipment.

• Effort: intermediate

SolarWinds Suspicious File Creation

Detects SolarWinds process creating a file with a suspicious extension. The process solarwinds.businesslayerhost.exe created an unexpected file whose extension is ".exe", ".ps1", ".jpg", ".png" or ".dll".

• Effort: intermediate

Suspicious ADSI-Cache Usage By Unknown Tool

Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger. It needs file monitoring capabilities (Sysmon Event ID 11 with .sch file creation logging).

• Effort: advanced

Suspicious Desktopimgdownldr Execution

Detects a suspicious Desktopimgdownldr execution. Desktopimgdownldr.exe is a Windows binary used to configure lockscreen/desktop image and can be abused to download malicious file.

• Effort: intermediate

Suspicious Double Extension

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns

• Effort: advanced

Suspicious PROCEXP152.sys File Created In Tmp

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.

• Effort: advanced

Suspicious desktop.ini Action

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

• Effort: advanced

System Info Discovery

System info discovery, attempt to detects basic command use to fingerprint a host.

• Effort: master

WCE wceaux.dll Creation

Detects wceaux.dll creation while Windows Credentials Editor (WCE) is executed.

• Effort: intermediate

WMI Persistence Script Event Consumer File Write

Detects file writes through WMI script event consumer.

• Effort: advanced

Webshell Creation

Detects possible webshell file creation. It requires File Creation monitoring, which can be done using Sysmon's Event ID 11. However the recommended SwiftOnSecurity configuration does not fully cover the needs for this rule, it needs to be updated with the proper file names extensions.

• Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
Data loss prevention	Parad detects any malicious activity on data
Kernel drivers	Parad detects kernel level operations on data
File monitoring	Parad detects any access to files in your filesystem

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

file_opened.jsonmalicious_behavior.json

{
    "message": "{\"time\":\"2024-05-13T13:02:17.862473900Z\",\"message\":\"File opened\",\"level\":\"INFO\",\"env_id\":\"df643ab3-64ab-4347-b50f-0e07d28c46fb\",\"parad_version\":\"0.7.0\",\"os\":\"Windows 10 Pro\",\"machine_name\":\"DESKTOP-88BEQS0\",\"executable\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"pid\":1632,\"hash\":\"53eb83666795ebe099558a0572423cbbc5a72d3ea863cb22617ca35560751a03\",\"ppid\":0,\"signed\":true,\"executable_basename\":\"svchost.exe\",\"executable_category\":\"System\",\"created_length\":0,\"fullpath\":\"C:\\\\Users\\\\PC\\\\AppData\\\\Local\\\\Temp\",\"basename\":\"Temp\",\"fullpath_category\":\"AppData\"}",
    "event": {
        "action": "File opened"
    },
    "@timestamp": "2024-05-13T13:02:17.862473Z",
    "agent": {
        "id": "df643ab3-64ab-4347-b50f-0e07d28c46fb",
        "version": "0.7.0"
    },
    "daspren": {
        "process": {
            "hash": {
                "blake3": "53eb83666795ebe099558a0572423cbbc5a72d3ea863cb22617ca35560751a03"
            }
        }
    },
    "file": {
        "name": "Temp",
        "path": "C:\\Users\\PC\\AppData\\Local\\Temp"
    },
    "host": {
        "hostname": "DESKTOP-88BEQS0",
        "name": "DESKTOP-88BEQS0",
        "os": {
            "type": "Windows 10 Pro"
        }
    },
    "observer": {
        "product": "Parad",
        "type": "dlp-solution",
        "vendor": "Daspren"
    },
    "process": {
        "code_signature": {
            "exists": true
        },
        "executable": "C:\\Windows\\System32\\svchost.exe",
        "name": "svchost.exe",
        "parent": {
            "pid": 0
        },
        "pid": 1632
    },
    "related": {
        "hosts": [
            "DESKTOP-88BEQS0"
        ]
    }
}

{
    "message": "{\"time\":\"2024-03-07T15:56:49Z\",\"message\":\"A process had a malicious behaviour and was killed.\",\"level\":\"INFO\",\"env_id\":\"7ba0a633-f8a3-410b-ba6f-5974705ced3a\",\"parad_version\":\"0.6.1\",\"os\":\"Windows 10 Pro\",\"machine_name\":\"bloquant\",\"executable\":\"C:\\\\Users\\\\Testeur\\\\Desktop\\\\c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe\",\"pid\":6148,\"hash\":\"e6f84e5080f3cdbf69f92f703d59f8b6e0f5e64f8a87f5b4a108cf913219b37c\",\"ppid\":0,\"signed\":false,\"executable_basename\":\"c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe\",\"executable_category\":\"User\",\"offset\":262144,\"written_length\":131072,\"fullpath\":\"C:\\\\Users\\\\Testeur\\\\Desktop\\\\mom_files\\\\armorials\\\\1T9dlo1.ddbPFTiN9\",\"basename\":\"1T9dlo1.ddbPFTiN9\",\"fullpath_category\":\"User\"}",
    "event": {
        "action": "A process had a malicious behaviour and was killed."
    },
    "@timestamp": "2024-03-07T15:56:49Z",
    "agent": {
        "id": "7ba0a633-f8a3-410b-ba6f-5974705ced3a",
        "version": "0.6.1"
    },
    "daspren": {
        "process": {
            "hash": {
                "blake3": "e6f84e5080f3cdbf69f92f703d59f8b6e0f5e64f8a87f5b4a108cf913219b37c"
            }
        }
    },
    "file": {
        "name": "1T9dlo1.ddbPFTiN9",
        "path": "C:\\Users\\Testeur\\Desktop\\mom_files\\armorials\\1T9dlo1.ddbPFTiN9"
    },
    "host": {
        "hostname": "bloquant",
        "name": "bloquant",
        "os": {
            "type": "Windows 10 Pro"
        }
    },
    "observer": {
        "product": "Parad",
        "type": "dlp-solution",
        "vendor": "Daspren"
    },
    "process": {
        "code_signature": {
            "exists": false
        },
        "executable": "C:\\Users\\Testeur\\Desktop\\c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe",
        "name": "c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe",
        "parent": {
            "pid": 0
        },
        "pid": 6148
    },
    "related": {
        "hosts": [
            "bloquant"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
@timestamp	date	Date/time when the event originated.
agent.id	keyword	Unique identifier of this agent.
agent.version	keyword	Version of the agent.
daspren.process.hash.blake3	keyword	BLAKE3 hash of the process that caused the event.
event.action	keyword	The action captured by the event.
file.name	keyword	Name of the file including the extension, without the directory.
file.path	keyword	Full path to the file, including the file name.
host.hostname	keyword	Hostname of the host.
host.name	keyword	Name of the host.
host.os.type	keyword	Which commercial OS family (one of: linux, macos, unix or windows).
observer.product	keyword	The product name of the observer.
observer.type	keyword	The type of the observer the data is coming from.
observer.vendor	keyword	Vendor name of the observer.
process.code_signature.exists	boolean	Boolean to capture if a signature is present.
process.executable	keyword	Absolute path to the process executable.
process.name	keyword	Process name.
process.parent.pid	long	Process id.
process.pid	long	Process id.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.