Skip to content

Daspren Parad

Overview

Daspren is the only Data Detection and Response (DDR) that integrates detection and blocking of cyber attacks. Daspren goes deep, using our patented data-centric AI to meticulously dissect and analyze every data access. It seamlessly intercepts and scrutinizes these access requests, ensuring that only legitimate, authorized applications can access your data, keeping it secure and protected.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Parad is the data protection solution from Daspren. It monitors data activity and use AI to prevent data breaches coming from both the inside and the outside of your organization :

  • File created, opened, deleted, moved or modified,
  • Access rules breach attempts,
  • Malicious processes detected.

Supported events

This integration supports the following events:

  • File monitoring events
  • Malicious detection events

The following Sekoia.io built-in rules match the intake Daspren Parad [BETA]. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x Daspren Parad [BETA] on ATT&CK Navigator

Active Directory Data Export Using Csvde

Detects the use of Csvde, a command-line tool from Windows Server that can be used to export Active Directory data to CSV files. This export doesn't include password hashes, but can be used as a discovery tool to enumerate users, machines and group memberships.

  • Effort: elementary
AdFind Usage

Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects

  • Effort: elementary
Adexplorer Usage

Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.

  • Effort: advanced
AutoIt3 Execution From Suspicious Folder

Detects AutoIt3 execution from an unusual/suspicious folder. Legitimate folders are "Program Files" and "AppData\Local". AutoIt3.exe is a legitimate process used to execute AutoIt program files, which are used by legitimate software, custom scripts, but also malware. Finding AutoIt3 execution from unusual/suspicious folder can help detect malware activities, such as DarkGate execution. The detection rule can be tailored to your environment and your use of AutoIt3 by filtering out folder's execution of legitimate applications or scripts.

  • Effort: advanced
CVE-2021-34527 PrintNightmare Suspicious Actions From Spoolsv

Detects suspicious image loads and file creations from the spoolsv process which could be a sign of an attacker trying to exploit the PrintNightmare vulnerability, CVE-2021-34527. A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. This works as well as a Local Privilege escalation vulnerability. To fully work the rule requires to log for Loaded DLLs and File Creations, which can be done respectively using the Sysmon's event IDs 7 and 11.

  • Effort: master
Certificate Authority Modification

Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.

  • Effort: master
Cobalt Strike Default Beacons Names

Detects the default names of Cobalt Strike beacons / payloads.

  • Effort: intermediate
Exfiltration And Tunneling Tools Execution

Execution of well known tools for data exfiltration and tunneling

  • Effort: advanced
Formbook File Creation DB1

Detects specific file creation (Users*\AppData\Local\Temp\DB1) to store data to exfiltrate (Formbook behavior). Logging for Sysmon event 11 is usually used for this detection.

  • Effort: intermediate
Hijack Legit RDP Session To Move Laterally

Identifies suspicious file creations in the startup folder of a remote system. An adversary could abuse this to move laterally by dropping a malicious script or executable that will be executed after a reboot or user logon.

  • Effort: intermediate
Kernel Module Alteration

Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

  • Effort: advanced
Microsoft Exchange Server Creating Unusual Files

Look for Microsoft Exchange Server’s Unified Messaging service creating non-standard content on disk, which could indicate web shells or other malicious content, suggesting exploitation of CVE-2021-26858 vulnerability

  • Effort: intermediate
Microsoft Office Creating Suspicious File

Detects Microsoft Office process (word, excel, powerpoint) creating a suspicious file which corresponds to a script or an executable. This behavior highly corresponds to an executed macro which loads an installation script or a malware payload. The rule requires to log for File Creations to work properly, which can be done through Sysmon Event ID 11.

  • Effort: master
NTDS.dit File In Suspicious Directory

The file NTDS.dit is supposed to be located mainly in C:\Windows\NTDS. The rule checks whether the file is in a legitimate directory or not (through file creation events). This is usually really suspicious and could indicate an attacker trying copy the file to then look for users password hashes.

  • Effort: advanced
Network Scanning and Discovery

Tools and command lines used for network discovery from current system

  • Effort: advanced
Network Sniffing

List of common tools used for network packages sniffing

  • Effort: advanced
Network Sniffing Windows

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

  • Effort: intermediate
OneNote Embedded File

Detects creation or uses of OneNote embedded files with unusual extensions.

  • Effort: intermediate
PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

  • Effort: elementary
Phorpiex Process Masquerading

Detects specific process executable path used by the Phorpiex botnet to masquerade its system process network activity. It looks for a pattern of a system process executable name that is not legitimate and running from a folder that is created via a random algorithm 13-15 numbers long.

  • Effort: elementary
PsExec Process

Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.

  • Effort: advanced
RDP Session Discovery

Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.

  • Effort: advanced
RTLO Character

Detects RTLO (Right-To-Left character) in file and process names.

  • Effort: elementary
Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

  • Effort: master
Remote Monitoring and Management Software - Atera

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.

  • Effort: master
SolarWinds Suspicious File Creation

Detects SolarWinds process creating a file with a suspicious extension. The process solarwinds.businesslayerhost.exe created an unexpected file whose extension is ".exe", ".ps1", ".jpg", ".png" or ".dll".

  • Effort: intermediate
Suspicious ADSI-Cache Usage By Unknown Tool

Detects the usage of ADSI (LDAP) operations by tools. This may also detect tools like LDAPFragger. It needs file monitoring capabilities (Sysmon Event ID 11 with .sch file creation logging).

  • Effort: advanced
Suspicious Double Extension

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns

  • Effort: advanced
Suspicious desktop.ini Action

Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

  • Effort: advanced
System Info Discovery

System info discovery, attempt to detects basic command use to fingerprint a host.

  • Effort: master
WCE wceaux.dll Creation

Detects wceaux.dll creation while Windows Credentials Editor (WCE) is executed.

  • Effort: intermediate
WMI Persistence Script Event Consumer File Write

Detects file writes through WMI script event consumer.

  • Effort: advanced
Webshell Creation

Detects possible webshell file creation. It requires File Creation monitoring, which can be done using Sysmon's Event ID 11. However the recommended SwiftOnSecurity configuration does not fully cover the needs for this rule, it needs to be updated with the proper file names extensions.

  • Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Data loss prevention Parad detects any malicious activity on data
Kernel drivers Parad detects kernel level operations on data
File monitoring Parad detects any access to files in your filesystem

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "{\"time\":\"2024-05-13T13:02:17.862473900Z\",\"message\":\"File opened\",\"level\":\"INFO\",\"env_id\":\"df643ab3-64ab-4347-b50f-0e07d28c46fb\",\"parad_version\":\"0.7.0\",\"os\":\"Windows 10 Pro\",\"machine_name\":\"DESKTOP-88BEQS0\",\"executable\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"pid\":1632,\"hash\":\"53eb83666795ebe099558a0572423cbbc5a72d3ea863cb22617ca35560751a03\",\"ppid\":0,\"signed\":true,\"executable_basename\":\"svchost.exe\",\"executable_category\":\"System\",\"created_length\":0,\"fullpath\":\"C:\\\\Users\\\\PC\\\\AppData\\\\Local\\\\Temp\",\"basename\":\"Temp\",\"fullpath_category\":\"AppData\"}",
    "event": {
        "action": "File opened"
    },
    "@timestamp": "2024-05-13T13:02:17.862473Z",
    "agent": {
        "id": "df643ab3-64ab-4347-b50f-0e07d28c46fb",
        "version": "0.7.0"
    },
    "daspren": {
        "process": {
            "hash": {
                "blake3": "53eb83666795ebe099558a0572423cbbc5a72d3ea863cb22617ca35560751a03"
            }
        }
    },
    "file": {
        "name": "Temp",
        "path": "C:\\Users\\PC\\AppData\\Local\\Temp"
    },
    "host": {
        "hostname": "DESKTOP-88BEQS0",
        "name": "DESKTOP-88BEQS0",
        "os": {
            "type": "Windows 10 Pro"
        }
    },
    "observer": {
        "product": "Parad",
        "type": "dlp-solution",
        "vendor": "Daspren"
    },
    "process": {
        "code_signature": {
            "exists": true
        },
        "executable": "C:\\Windows\\System32\\svchost.exe",
        "name": "svchost.exe",
        "parent": {
            "pid": 0
        },
        "pid": 1632
    },
    "related": {
        "hosts": [
            "DESKTOP-88BEQS0"
        ]
    }
}
{
    "message": "{\"time\":\"2024-03-07T15:56:49Z\",\"message\":\"A process had a malicious behaviour and was killed.\",\"level\":\"INFO\",\"env_id\":\"7ba0a633-f8a3-410b-ba6f-5974705ced3a\",\"parad_version\":\"0.6.1\",\"os\":\"Windows 10 Pro\",\"machine_name\":\"bloquant\",\"executable\":\"C:\\\\Users\\\\Testeur\\\\Desktop\\\\c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe\",\"pid\":6148,\"hash\":\"e6f84e5080f3cdbf69f92f703d59f8b6e0f5e64f8a87f5b4a108cf913219b37c\",\"ppid\":0,\"signed\":false,\"executable_basename\":\"c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe\",\"executable_category\":\"User\",\"offset\":262144,\"written_length\":131072,\"fullpath\":\"C:\\\\Users\\\\Testeur\\\\Desktop\\\\mom_files\\\\armorials\\\\1T9dlo1.ddbPFTiN9\",\"basename\":\"1T9dlo1.ddbPFTiN9\",\"fullpath_category\":\"User\"}",
    "event": {
        "action": "A process had a malicious behaviour and was killed."
    },
    "@timestamp": "2024-03-07T15:56:49Z",
    "agent": {
        "id": "7ba0a633-f8a3-410b-ba6f-5974705ced3a",
        "version": "0.6.1"
    },
    "daspren": {
        "process": {
            "hash": {
                "blake3": "e6f84e5080f3cdbf69f92f703d59f8b6e0f5e64f8a87f5b4a108cf913219b37c"
            }
        }
    },
    "file": {
        "name": "1T9dlo1.ddbPFTiN9",
        "path": "C:\\Users\\Testeur\\Desktop\\mom_files\\armorials\\1T9dlo1.ddbPFTiN9"
    },
    "host": {
        "hostname": "bloquant",
        "name": "bloquant",
        "os": {
            "type": "Windows 10 Pro"
        }
    },
    "observer": {
        "product": "Parad",
        "type": "dlp-solution",
        "vendor": "Daspren"
    },
    "process": {
        "code_signature": {
            "exists": false
        },
        "executable": "C:\\Users\\Testeur\\Desktop\\c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe",
        "name": "c690148b6baec765c65fe91ea9f282d6a411ae90c08d74d600515b3e075e21b2.exe",
        "parent": {
            "pid": 0
        },
        "pid": 6148
    },
    "related": {
        "hosts": [
            "bloquant"
        ]
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
agent.id keyword Unique identifier of this agent.
agent.version keyword Version of the agent.
daspren.process.hash.blake3 keyword BLAKE3 hash of the process that caused the event.
event.action keyword The action captured by the event.
file.name keyword Name of the file including the extension, without the directory.
file.path keyword Full path to the file, including the file name.
host.hostname keyword Hostname of the host.
host.name keyword Name of the host.
host.os.type keyword Which commercial OS family (one of: linux, macos, unix or windows).
observer.product keyword The product name of the observer.
observer.type keyword The type of the observer the data is coming from.
observer.vendor keyword Vendor name of the observer.
process.code_signature.exists boolean Boolean to capture if a signature is present.
process.executable keyword Absolute path to the process executable.
process.name keyword Process name.
process.parent.pid long Process id.
process.pid long Process id.

Configure

Create the intake

Go to the intake page and create a new intake from the format Daspren - Parad. Copy the intake key.

Setup a Sink

To set up the integration:

  1. Open the Parad CLI
  2. Create a Sink from the CLI
    1. Go to Sinks > Add Sink
    2. Select the Sekoia Sink Variant
    3. Type a name and paste the intake key
  3. Create a Reporter from the CLI with Reporters > Add Reporter
  4. Create a Link between the previously created Sink and Reporter