Sigma rules: 0c

title: Access To Potentially Sensitive Sysvol Files By Uncommon Applications
id: d51694fe-484a-46ac-92d6-969e76d60d10
related:
    - id: 8344c19f-a023-45ff-ad63-a01c5396aea0
      type: derived
status: test
description: Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
references:
    - https://github.com/vletoux/pingcastle
author: frack113
date: 2023-12-21
modified: 2024-07-29
tags:
    - attack.credential-access
    - attack.t1552.006
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        FileName|startswith: '\\'
        FileName|contains|all:
            - '\sysvol\'
            - '\Policies\'
        FileName|endswith:
            - 'audit.csv'
            - 'Files.xml'
            - 'GptTmpl.inf'
            - 'groups.xml'
            - 'Registry.pol'
            - 'Registry.xml'
            - 'scheduledtasks.xml'
            - 'scripts.ini'
            - 'services.xml'
    filter_main_generic:
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_main_explorer:
        Image: 'C:\Windows\explorer.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

title: Amsi.DLL Load By Uncommon Process
id: facd1549-e416-48e0-b8c4-41d7215eedc8
status: test
description: Detects loading of Amsi.dll by uncommon processes
references:
    - https://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9
    - https://github.com/TheD1rkMtr/AMSI_patch
    - https://github.com/surya-dev-singh/AmsiBypass-OpenSession
author: frack113
date: 2023-03-12
modified: 2026-06-29
tags:
    - attack.impact
    - attack.t1490
    - detection.threat-hunting
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\amsi.dll'
    filter_main_exact:
        Image|endswith:
            - ':\Windows\explorer.exe'
            - ':\Windows\Sysmon64.exe'
            - ':\Windows\Sysmon64a.exe'
    filter_main_generic:
        Image|contains:
            - ':\Program Files (x86)\'
            - ':\Program Files\'
            - ':\Windows\System32\'
            - ':\Windows\SysWOW64\'
            - ':\Windows\WinSxS\'
    filter_optional_defender:
        Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
        Image|endswith: '\MsMpEng.exe'
    filter_main_dotnet:
        Image|contains:
            - ':\Windows\Microsoft.NET\Framework\'
            - ':\Windows\Microsoft.NET\Framework64\'
            - ':\Windows\Microsoft.NET\FrameworkArm\'
            - ':\Windows\Microsoft.NET\FrameworkArm64\'
        Image|endswith: '\ngentask.exe'
    filter_main_null:
        Image: null
    filter_main_empty:
        Image: ''
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate third party apps installed in "ProgramData" and "AppData" might generate some false positives. Apply additional filters accordingly
level: low

title: App Assigned To Azure RBAC/Microsoft Entra Role
id: b04934b2-0a68-4845-8a19-bdfed3a68a7a
status: test
description: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'
date: 2022-07-19
modified: 2024-11-04
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        targetResources.type: 'Service Principal'
        properties.message:
            - Add member to role
            - Add eligible member to role
            - Add scoped member to role
    condition: selection
falsepositives:
    - When the permission is legitimately needed for the app
level: medium

title: CobaltStrike Load by Rundll32
id: ae9c6a7c-9521-42a6-915e-5aaa8689d529
status: test
description: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.
references:
    - https://www.cobaltstrike.com/help-windows-executable
    - https://redcanary.com/threat-detection-report/
    - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
author: Wojciech Lesicki
date: 2021-06-01
modified: 2022-09-16
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: RUNDLL32.EXE
        - CommandLine|contains:
              - 'rundll32.exe'
              - 'rundll32 '
    selection_params:
        CommandLine|contains: '.dll'
        CommandLine|endswith:
            - ' StartW'
            - ',StartW'
    condition: all of selection*
falsepositives:
    - Unknown
level: high

title: Defrag Deactivation
id: 958d81aa-8566-4cea-a565-59ccd4df27b0
status: test
description: Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
references:
    - https://securelist.com/apt-slingshot/84312/
author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
date: 2019-03-04
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.s0111
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:
            - '/delete'
            - '/change'
        CommandLine|contains|all:
            - '/TN'
            - '\Microsoft\Windows\Defrag\ScheduledDefrag'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Fsutil Suspicious Invocation
id: add64136-62e5-48ea-807e-88638d02df1e
status: stable
description: |
  Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
  Might be used by ransomwares during the attack (seen by NotPetya and others).
references:
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
    - https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
    - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
    - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
author: Ecco, E.M. Anhaus, oscd.community
date: 2019-09-26
modified: 2023-09-09
tags:
    - attack.impact
    - attack.stealth
    - attack.t1070
    - attack.t1485
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\fsutil.exe'
        - OriginalFileName: 'fsutil.exe'
    selection_cli:
        CommandLine|contains:
            - 'deletejournal'        # usn deletejournal ==> generally ransomware or attacker
            - 'createjournal'        # usn createjournal ==> can modify config to set it to a tiny size
            - 'setZeroData'          # file setZeroData  ==> empties a file with zeroes
    condition: all of selection_*
falsepositives:
    - Admin activity
    - Scripts and administrative tools used in the monitored environment
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_fsutil_usage/info.yml

title: Guest Account Enabled Via Sysadminctl
id: d7329412-13bd-44ba-a072-3387f804a106
status: test
description: Detects attempts to enable the guest account using the sysadminctl utility
references:
    - https://ss64.com/osx/sysadminctl.html
author: Sohan G (D4rkCiph3r)
date: 2023-02-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
    - attack.t1078.001
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/sysadminctl'
        CommandLine|contains|all:
            # By default the guest account is not active
            - ' -guestAccount'
            - ' on'
    condition: selection
falsepositives:
    - Unknown
level: low

title: HackTool - CrackMapExec Process Patterns
id: f26307d8-14cd-47e3-a26b-4b4769f24af6
status: test
description: Detects suspicious process patterns found in logs when CrackMapExec is used
references:
    - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass
author: Florian Roth (Nextron Systems)
date: 2022-03-12
modified: 2023-02-13
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_lsass_dump1:
        CommandLine|contains|all:
            - 'tasklist /fi '
            - 'Imagename eq lsass.exe'
        CommandLine|contains:
            - 'cmd.exe /c '
            - 'cmd.exe /r '
            - 'cmd.exe /k '
            - 'cmd /c '
            - 'cmd /r '
            - 'cmd /k '
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    selection_lsass_dump2:
        CommandLine|contains|all:
            - 'do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump'
            - '\Windows\Temp\'
            - ' full'
            - '%%B'
    selection_procdump:
        CommandLine|contains|all:
            - 'tasklist /v /fo csv'
            - 'findstr /i "lsass"'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

title: HackTool - NetExec File Indicators
id: efc21479-9e83-41da-8cf1-122e06ba8db3
status: experimental
description: |
    Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
    NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
    under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
    extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
    NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
    Active Directory enumeration, credential harvesting, and remote code execution.
references:
    - https://github.com/Pennyw0rth/NetExec
    - https://www.netexec.wiki/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-08
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.discovery
    - attack.t1021.002
    - attack.t1059.005
logsource:
    product: windows
    category: file_event
detection:
    selection:
        - Image|contains: '\nxc-windows-latest\'
        - TargetFilename|contains|all:
              - '\Temp\_MEI'
              - '\nxc\data\'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml

title: HybridConnectionManager Service Installation - Registry
id: ac8866c7-ce44-46fd-8c17-b24acff96ca8
status: test
description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2022-11-27
tags:
    - attack.resource-development
    - attack.t1608
logsource:
    category: registry_event
    product: windows
detection:
    selection1:
        TargetObject|contains: '\Services\HybridConnectionManager'
    selection2:
        EventType: SetValue
        Details|contains: 'Microsoft.HybridConnectionManager.Listener.exe'
    condition: selection1 or selection2
falsepositives:
    - Unknown
level: high

title: Impacket SMBexec service registration (native)
description: Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence. Note that service registration is not always performed and that is recommended to use the related registry SYSMON rule to increase detection reliability.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
- https://nv2lt.github.io/windows/smb-psexec-smbexec-winexe-how-to/
tags:
- attack.defense_evasion
- attack.t1112
- attack.privilege_execution
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: 
    - system
    - security
detection:
  selection:
    EventID:
      - 4697
      - 7045
    ServiceName: BTOBTO # Service name can be changed in the application name
  filter:
  condition: selection
falsepositives:
- None
level: high

title: Kubernetes Potential Enumeration Activity
id: 597a7e84-187d-458b-9e4f-2f5a0e676711
status: experimental
description: |
    Detects potential Kubernetes enumeration or attack activity via the audit log.
    This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
    Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
references:
    - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
    - https://github.com/trufflesecurity/trufflehog
    - https://github.com/corneliusweig/rakkess
author: uniqu3-us3r
date: 2026-04-28
tags:
    - attack.execution
    - attack.discovery
    - attack.t1609
    - attack.t1613
logsource:
    product: kubernetes
    service: audit
detection:
    selection_status:
        responseStatus.code: 'ALLOW'
    selection_request_uri:
        requestURI|contains:
            # Shells Encoded
            - '%2fbin%2fash'
            - '%2fbin%2fbash'
            - '%2fbin%2fbusybox'
            - '%2fbin%2fdash'
            - '%2fbin%2fsh'
            - '%2fbin%2fzsh'
            # Shells Plain
            - '/bin/ash'
            - '/bin/bash'
            - '/bin/busybox'
            - '/bin/dash'
            - '/bin/sh'
            - '/bin/zsh'
            # Tools Encoded
            - '%2fusr%2fbin%2fcurl'
            - '%2fusr%2fbin%2fkubectl'
            - '%2fusr%2fbin%2fperl'
            - '%2fusr%2fbin%2fpython'
            - '%2fusr%2fbin%2fwget'
            # Tools Plain
            - '/usr/bin/curl'
            - '/usr/bin/kubectl'
            - '/usr/bin/perl'
            - '/usr/bin/python'
            - '/usr/bin/wget'
    selection_request_user_agent:
        userAgent|contains:
            - 'access_matrix'  # Rakkess
            - 'trufflehog'     # Secret scanning tool
            - 'azurehound'     # Azure/Cloud discovery
            - 'micro-scanner'  # Vulnerability scanning
    condition: selection_status and 1 of selection_request_*
falsepositives:
    - Authorized administrative maintenance via kubectl
    - Automated internal infrastructure monitoring and certificate rotation
    - Security-approved vulnerability or secret scanning in DevSecOps pipelines
level: medium

title: macOS User Account Manipulation
id: ae07466e-5964-418d-9f2f-dcaf405ac2fc
status: experimental
description: 'Detects creation, deletion, or modification of user accounts via Open
  Directory.

  Attackers often create backdoor accounts for persistence or modify existing

  accounts to maintain access. Monitor for unexpected user management activities.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1136/001/
- https://attack.mitre.org/techniques/T1098/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection:
    esf.event_type:
    - 141  # ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER
    - 142  # ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER
    - 143  # ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER
    - 144  # ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER
    - 148  # ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD
  condition: selection
falsepositives:
- IT administration and user provisioning
- MDM user management
- User self-service password changes
- Automated user lifecycle management
fields:
- event_type
- event_name
- User
- target_user
- ProcessId
tags:
- attack.persistence
- attack.t1136.001
- attack.t1098
level: high

title: Mail Forwarding/Redirecting Activity In O365
id: c726e007-2cd0-4a55-abfb-79730fbedee5
status: test
description: Detects email forwarding or redirecting activity in O365 Audit logs.
references:
    - https://redcanary.com/blog/email-forwarding-rules/
    - https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
author: RedCanary Team (idea), Harjot Singh @cyb3rjy0t
date: 2023-10-11
modified: 2024-11-17
tags:
    - attack.collection
    - attack.stealth
    - attack.t1114.003
    - attack.t1564.008
    - attack.exfiltration
    - attack.t1020
    - detection.threat-hunting
logsource:
    service: audit
    product: m365
    definition: "Requirements: The 'OperationProperties' and 'Parameters' fields are a list of dict. A correct mapping to the 'Value' field inside is recommended to avoid greedy search"
detection:
    # Note: Might require seperation in the future when enough data is gatherd
    selection_updateinbox:
        Operation|contains: 'UpdateInboxRules'
        OperationProperties|contains:
            - 'Forward'
            - 'Recipients'
    selection_setmailbox:
        Operation|contains: 'Set-Mailbox'
        Parameters|contains:
            - 'ForwardingSmtpAddress'
            - 'ForwardingAddress'
    selection_setinbox:
        Operation|contains:
            - 'New-InboxRule'
            - 'Set-InboxRule'
        Parameters|contains:
            - 'ForwardAsAttachmentTo'
            - 'ForwardingAddress'
            - 'ForwardingSmtpAddress'
            - 'ForwardTo'
            - 'RedirectTo'
            - 'RedirectToRecipients'
    condition: 1 of selection_*
falsepositives:
    - False positives are expected from legitimate mail forwarding rules. You need organisation specific knowledge. Filter out the domains that are allowed as forwarding targets as well as any additional metadata that you can use for exclusion from trusted sources/targets in order to promote this to a potential detection rule.
level: medium

title: Mailbox Export to Exchange Webserver
id: 516376b4-05cd-4122-bae0-ad7641c38d48
status: test
description: Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
references:
    - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)
date: 2021-08-09
modified: 2023-04-30
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    service: msexchange-management
    product: windows
detection:
    export_command:
        '|all':
            - 'New-MailboxExportRequest'
            - ' -Mailbox '
    export_params:
        - '-FilePath "\\\\' # We care about any share location.
        - '.aspx'
    role_assignment:
        '|all':
            - 'New-ManagementRoleAssignment'
            - ' -Role "Mailbox Import Export"'
            - ' -User '
    condition: (export_command and export_params) or role_assignment
falsepositives:
    - Unlikely
level: critical

title: Mimikatz malicious Security package (SSP) exfiltrates cleartext passwords in file
description: Detects scenarios where an attacker loaded the Mimikatz SSP "mimilib.dll" into the LSA process in order to exfiltrate clear text passwords into a file.
requirements: SYSMON configuration provided at the following is required - https://github.com/Neo23x0/sysmon-config/pull/22
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet#custom-ssp
tags:
- attack.credential_access
- attack.t1003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: file_event
detection:
  selection:
    EventID: 11 # File creation
    Image|endswith: \Windows\system32\lsass.exe
    TargetFilename|endswith:
      - \Windows\System32\mimilsa.log # recent versions
      - \Windows\System32\kiwissp.log # old versions
  condition: selection
falsepositives:
- None
level: high

title: Multifactor Authentication Interrupted
id: 5496ff55-42ec-4369-81cb-00f417029e25
status: test
description: Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: AlertIQ
date: 2021-10-10
modified: 2022-12-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
    - attack.t1621
logsource:
    product: azure
    service: signinlogs
detection:
    selection_50074:
        ResultType: 50074
        ResultDescription|contains: 'Strong Auth required'
    selection_500121:
        ResultType: 500121
        ResultDescription|contains: 'Authentication failed during strong authentication request'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

title: NTDS.DIT Creation By Uncommon Process
id: 11b1ed55-154d-4e82-8ad7-83739298f720
related:
    - id: 4e7050dd-e548-483f-b7d6-527ab4fa784d
      type: similar
status: test
description: Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory
references:
    - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
    - https://adsecurity.org/?p=2398
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-11
modified: 2022-07-14
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.t1003.003
logsource:
    product: windows
    category: file_event
detection:
    selection_ntds:
        TargetFilename|endswith: '\ntds.dit'
    selection_process_img:
        Image|endswith:
            # Add more suspicious processes as you see fit
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
            - '\wsl.exe'
            - '\wt.exe'
    selection_process_paths:
        Image|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Public\'
            - '\PerfLogs\'
    condition: selection_ntds and 1 of selection_process_*
falsepositives:
    - Unknown
level: high

title: OilRig APT Schedule Task Persistence - System
id: 53ba33fd-3a50-4468-a5ef-c583635cfa92
related:
    - id: c0580559-a6bd-4ef6-b9b7-83703d98b561 # Security
      type: similar
    - id: 7bdf2a7c-3acc-4091-9581-0a77dad1c5b5 # Registry
      type: similar
    - id: ce6e34ca-966d-41c9-8d93-5b06c8b97a06 # ProcessCreation
      type: similar
status: test
description: Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report
references:
    - https://web.archive.org/web/20180402134442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf
author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
date: 2018-03-23
modified: 2023-03-08
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.defense-impairment
    - attack.g0049
    - attack.t1053.005
    - attack.s0111
    - attack.t1543.003
    - attack.t1112
    - attack.command-and-control
    - attack.t1071.004
    - detection.emerging-threats
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ServiceName:
            - 'SC Scheduled Scan'
            - 'UpdatMachine'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: Potential CVE-2021-44228 Exploitation Attempt - VMware Horizon
id: 3eb91f0a-0060-424a-a676-59f5fdd75610
status: test
description: |
    Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable versions of Log4j.
references:
    - https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
    - https://twitter.com/TheDFIRReport/status/1482078434327244805
    - https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
author: '@kostastsale'
date: 2022-01-14
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2021-44228
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\ws_TomcatService.exe'
    filter_main_shells:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential Ke3chang/TidePool Malware Activity
id: 7b544661-69fc-419f-9a59-82ccc328f205
status: test
description: Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
references:
    - https://web.archive.org/web/20200618080300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
    - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
author: Markus Neis, Swisscom
date: 2020-06-18
modified: 2023-03-10
tags:
    - attack.defense-impairment
    - attack.g0004
    - attack.t1685
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Ke3chang and TidePool both modify the IEHarden registry key, as well as the following list of keys.
        # Setting these registry keys is unique to the Ke3chang and TidePool malware families.
        # HKCU\Software\Microsoft\Internet Explorer\Main\Check_Associations
        # HKCU\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
        # HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IEharden
        CommandLine|contains:
            - '-Property DWORD -name DisableFirstRunCustomize -value 2 -Force'
            - '-Property String -name Check_Associations -value'
            - '-Property DWORD -name IEHarden -value 0 -Force'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential LSASS Process Dump Via Procdump
id: 5afee48e-67dd-4e03-a783-f74259dcf998
status: stable
description: |
    Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
    This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
    LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
    Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
    - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
    - https://x.com/wietze/status/1958302556033065292?s=12
author: Florian Roth (Nextron Systems)
date: 2018-10-30
modified: 2025-10-19
tags:
    - attack.stealth
    - attack.t1036
    - attack.credential-access
    - attack.t1003.001
    - car.2013-05-009
logsource:
    category: process_creation
    product: windows
detection:
    selection_flags:
        CommandLine|contains|windash:
            - ' -ma '
            - ' -mm ' # Mini dump
            - ' -mp ' # Miniplus dump
    selection_process:
        CommandLine|contains:
            - ' ls' # Short for lsass
            - ' keyiso'
            - ' samss'
    condition: all of selection_*
falsepositives:
    - Unlikely, because no one should dump an lsass process memory
    - Another tool that uses command line flags similar to ProcDump
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_sysinternals_procdump_lsass/info.yml

title: PUA - AdFind Suspicious Execution
id: 9a132afa-654e-11eb-ae93-0242ac130002
related:
    - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
      type: similar
    - id: 75df3b17-8bcc-4565-b89b-c9898acef911
      type: obsolete
status: test
description: Detects AdFind execution with common flags seen used during attacks
references:
    - https://www.joeware.net/freetools/tools/adfind/
    - https://thedfirreport.com/2020/05/08/adfind-recon/
    - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
    - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
    - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects
author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community
date: 2021-02-02
modified: 2025-10-24
tags:
    - attack.discovery
    - attack.t1018
    - attack.t1087.002
    - attack.t1482
    - attack.t1069.002
    - stp.1u
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'domainlist'
            - 'trustdmp'
            - 'dcmodes'
            - 'adinfo'
            - '-sc dclist'
            - 'computer_pwdnotreqd'
            - 'objectcategory='
            - '-subnets -f'
            - 'name="Domain Admins"'
            - '-sc u:'
            - 'domainncs'
            - 'dompol'
            - ' oudmp '
            - 'subnetdmp'
            - 'gpodmp'
            - 'fspdmp'
            - 'users_noexpire'
            - 'computers_active'
            - 'computers_pwdnotreqd'
    condition: selection
falsepositives:
    - Legitimate admin activity
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage/info.yml
simulation:
    - type: atomic-red-team
      name: Adfind - Enumerate Active Directory Computer Objects
      technique: T1018
      atomic_guid: a889f5be-2d54-4050-bd05-884578748bb4
    - type: atomic-red-team
      name: Adfind - Enumerate Active Directory Domain Controller Objects
      technique: T1018
      atomic_guid: 5838c31e-a0e2-4b9f-b60a-d79d2cb7995e

title: PUA - Nmap/Zenmap Execution
id: f6ecd1cf-19b8-4488-97f6-00f0924991a3
status: test
description: Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation
references:
    - https://nmap.org/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows
author: frack113
date: 2021-12-10
modified: 2023-12-11
tags:
    - attack.discovery
    - attack.t1046
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
              - '\nmap.exe'
              - '\zennmap.exe'
        - OriginalFileName:
              - 'nmap.exe'
              - 'zennmap.exe'
    condition: selection
falsepositives:
    - Legitimate administrator activity
level: medium

title: PUA - TruffleHog Execution - Linux
id: d7a650c4-226c-451e-948f-cc490db506aa
related:
    - id: 44030449-b0df-4c94-aae1-502359ab28ee
      type: similar
status: experimental
description: |
    Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
    While it is a legitimate tool, intended for use in CI pipelines and security assessments,
    It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
references:
    - https://github.com/trufflesecurity/trufflehog
    - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-09-24
tags:
    - attack.discovery
    - attack.credential-access
    - attack.t1083
    - attack.t1552.001
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/trufflehog'
    selection_cli_platform:
        CommandLine|contains:
            - ' docker --image '
            - ' Git '
            - ' GitHub '
            - ' Jira '
            - ' Slack '
            - ' Confluence '
            - ' SharePoint '
            - ' s3 '
            - ' gcs '
    selection_cli_verified:
        CommandLine|contains: ' --results=verified'
    condition: selection_img or all of selection_cli_*
falsepositives:
    - Legitimate use of TruffleHog by security teams or developers.
level: medium

title: Registry Tampering by Potentially Suspicious Processes
id: 7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2
related:
    - id: 2a0a169d-cc66-43ce-9ae2-6e678e54e46a
      type: similar
    - id: 921aa10f-2e74-4cca-9498-98f9ca4d6fdf
      type: similar
status: experimental
description: |
    Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.
    These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry
    without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.
references:
    - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
    - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-13
modified: 2026-04-14
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - attack.t1059.005
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        Image|endswith:
            # Add more suspicious processes
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    filter_main_binary_data:
        Details: 'Binary Data'
    filter_main_null:
        Details: null
    filter_main_wscript_legit_1:
        Image|endswith: '\wscript.exe'
        TargetObject|contains:
            - 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\Notifications\Data\'
            - '\Services\bam\State\UserSettings\S-1-'
            - 'Software\Microsoft\Windows Script\Settings\Telemetry\wscript.exe\'
            - 'Software\Microsoft\Windows\CurrentVersion\Internet Settings\'
    filter_main_wscript_legit_2:
        Image|endswith: '\wscript.exe'
        TargetObject|contains: '\wscript.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some legitimate admin or install scripts may use these processes for registry modifications.
level: medium

title: Remote Access Tool - LogMeIn Execution
id: d85873ef-a0f8-4c48-a53a-6b621f11729d
status: test
description: |
    An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
    These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
    Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
author: frack113
date: 2022-02-11
modified: 2023-03-05
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Description: LMIGuardianSvc
        - Product: LMIGuardianSvc
        - Company: LogMeIn, Inc.
    condition: selection
falsepositives:
    - Legitimate use
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein/info.yml

title: Remote service creation via named pipes
description: Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\IPC$'
    RelativeTargetName: svcctl
    AccessList|contains: '%%4417' # WriteData
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Administrator activity, backup solutions
level: medium