Add act-as-dhcp-server-callout-dll.yml act-as-dns-server-plugin-dll.y…

persistence/act-as-dhcp-server-callout-dll.yml

@@ -0,0 +1,16 @@
+rule:
+  meta:
+    name: act as DHCP server callout DLL
+    namespace: persistence
+    authors:
+      - [email protected]
+    scope: file
+    att&ck:
+      - Persistence::Server Software Component [T1505]
+    references:
+      - https://learn.microsoft.com/en-gb/previous-versions/windows/desktop/dhcp/how-the-dhcp-server-api-operates
+    examples:
+      - 36f506a34b99bf4c199b3c9ec8aa02bd631feafdca20e69e33e714c269ddb8c5
+  features:
+    - or:
+      - export: DhcpServerCalloutEntry

persistence/act-as-dns-server-plugin-dll.yml

@@ -0,0 +1,18 @@
+rule:
+  meta:
+    name: act as DNS server plugin DLL
+    namespace: persistence
+    authors:
+      - [email protected]
+    scope: file
+    att&ck:
+      - Persistence::Server Software Component [T1505]
+    references:
+      - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
+    examples:
+      - 36f506a34b99bf4c199b3c9ec8aa02bd631feafdca20e69e33e714c269ddb8c5
+  features:
+    - or:
+      - export: DnsPluginInitialize
+      - export: DnsPluginCleanup
+      - export: DnsPluginQuery

persistence/authentication-process/act-as-security-support-provider-dll.yml

@@ -0,0 +1,17 @@
+rule:
+  meta:
+    name: act as Security Support Provider DLL
+    namespace: persistence/authentication-process
+    authors:
+      - [email protected]
+    scope: file
+    att&ck:
+      - Persistence::Boot or Logon Autostart Execution::Security Support Provider [T1547.005]
+    references:
+      - https://learn.microsoft.com/en-us/windows/win32/secauthn/lsa-mode-initialization
+      - https://github.com/Hagrid29/DuplicateDump/blob/main/LSAPlugin/LSASSP/dllmain.cpp
+    examples:
+      - 36f506a34b99bf4c199b3c9ec8aa02bd631feafdca20e69e33e714c269ddb8c5
+  features:
+    - or:
+      - export: SpLsaModeInitialize

persistence/authentication-process/act-as-subauthentication-package-dll.yml

@@ -0,0 +1,19 @@
+rule:
+  meta:
+    name: act as SubAuthentication Package DLL
+    namespace: persistence/authentication-process
+    authors:
+      - [email protected]
+    scope: file
+    att&ck:
+      - Persistence::Boot or Logon Autostart Execution::Authentication Package [T1547.002]
+    references:
+      - https://learn.microsoft.com/en-us/windows/win32/secauthn/subauthentication-packages
+    examples:
+      - 36f506a34b99bf4c199b3c9ec8aa02bd631feafdca20e69e33e714c269ddb8c5
+  features:
+    - or:
+      - export: Msv1_0SubAuthenticationFilter
+      - export: Msv1_0SubAuthenticationRoutine
+      - export: Msv1_0SubAuthenticationRoutineEx
+      - export: Msv1_0SubAuthenticationRoutineGeneric