Sigma rules: 0z

title: Access To Browser Credential Files By Uncommon Applications
id: 91cb43db-302a-47e3-b3c8-7ede481e27bf
related:
    - id: 4b60e527-ec73-4b47-8cb3-f02ad927ca65
      type: similar
status: test
description: |
    Detects file access requests to browser credential stores by uncommon processes.
    Could indicate potential attempt of credential stealing.
    Requires heavy baselining before usage
references:
    - https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users
    - https://github.com/lclevy/firepwd
author: frack113, X__Junior (Nextron Systems)
date: 2022-04-09
modified: 2024-07-29
tags:
    - attack.t1003
    - attack.credential-access
    - detection.threat-hunting
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection_ie:
        FileName|endswith: '\Appdata\Local\Microsoft\Windows\WebCache\WebCacheV01.dat'
    selection_firefox:
        FileName|endswith:
            - '\cookies.sqlite'
            - '\places.sqlite'
            - 'release\key3.db'  # Firefox
            - 'release\key4.db'  # Firefox
            - 'release\logins.json' # Firefox
    selection_chromium:
        FileName|contains:
            - '\User Data\Default\Login Data'
            - '\User Data\Local State'
    filter_main_system:
        Image: System
    filter_main_generic:
        # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_defender:
        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
        Image|endswith:
            - '\MpCopyAccelerator.exe'
            - '\MsMpEng.exe'
    filter_optional_thor:
        Image|endswith:
            - '\thor.exe'
            - '\thor64.exe'
    condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Antivirus, Anti-Spyware, Anti-Malware Software
    - Backup software
    - Legitimate software installed on partitions other than "C:\"
    - Searching software such as "everything.exe"
level: low

title: AWS Bedrock Guardrail Updated
id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f
status: experimental
description: |
    Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken
    model safety controls and allow unsafe or unauthorized model responses.
references:
    - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-07-10
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventName: 'UpdateGuardrail'
        eventSource: 'bedrock.amazonaws.com'
    condition: selection
falsepositives:
    - Legitimate guardrail updates by authorized identities.
level: medium

title: Azure AD Account Credential Leaked
id: 19128e5e-4743-48dc-bd97-52e5775af817
status: test
description: Indicates that the user's valid credentials have been leaked.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#leaked-credentials
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.t1589
    - attack.reconnaissance
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'leakedCredentials'
    condition: selection
falsepositives:
    - A rare hash collision.
level: high

title: BlueSky Ransomware Artefacts
id: eee8311f-a752-44f0-bf2f-6b007db16300
status: test
description: Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.
references:
    - https://unit42.paloaltonetworks.com/bluesky-ransomware/
author: j4son
date: 2023-05-23
tags:
    - attack.impact
    - attack.t1486
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection_access_eid:
        EventID:
            - 4663
            - 4656
    selection_access_data:
        - ObjectName|endswith: '.bluesky'
        - ObjectName|contains: 'DECRYPT FILES BLUESKY'
    selection_share_eid:
        EventID: 5145
    selection_share_data:
        - RelativeTargetName|endswith: '.bluesky'
        - RelativeTargetName|contains: 'DECRYPT FILES BLUESKY'
    condition: all of selection_access_* or all of selection_share_*
falsepositives:
    - Unknown
level: high

title: BPFDoor Abnormal Process ID or Lock File Accessed
id: 808146b2-9332-4d78-9416-d7e47012d83d
status: test
description: detects BPFDoor .lock and .pid files access in temporary file storage facility
references:
    - https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/
    - https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
    - https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/
    - https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh
author: Rafal Piasecki
date: 2022-08-10
modified: 2026-03-30
tags:
    - attack.execution
    - attack.t1106
    - attack.t1059
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'PATH'
        name:
            - /var/run/aepmonend.pid
            - /var/run/auditd.lock
            - /var/run/cma.lock
            - /var/run/console-kit.pid
            - /var/run/consolekit.pid
            - /var/run/daemon.pid
            - /var/run/hald-addon.pid
            - /var/run/hald-smartd.pid
            - /var/run/haldrund.pid
            - /var/run/hp-health.pid
            - /var/run/hpasmlit.lock
            - /var/run/hpasmlited.pid
            - /var/run/kdevrund.pid
            - /var/run/lldpad.lock
            - /var/run/mcelog.pid
            - /var/run/system.pid
            - /var/run/uvp-srv.pid
            - /var/run/vmtoolagt.pid
            - /var/run/xinetd.lock
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Disable Exploit Guard Network Protection on Windows Defender
id: bf9e1387-b040-4393-9851-1598f8ecfae9
status: test
description: Detects disabling Windows Defender Exploit Guard Network Protection
references:
    - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html
author: Austin Songer @austinsonger
date: 2021-08-04
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'SOFTWARE\Policies\Microsoft\Windows Defender Security Center\App and Browser protection\DisallowExploitProtectionOverride'
        Details: 'DWORD (00000001)'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: DMSA Service Account Created in Specific OUs - PowerShell
id: 02122374-b74e-495c-b285-9e4da973f3d6
related:
    - id: e15bc294-ae2a-45ad-b7d6-637b33868bde # Windows Security Creation of New MsDS-DelegatedManagedServiceAccount (DMSA) Object
      type: similar
    - id: 0ea8db81-2ff6-4525-9448-33bbe7effc13 # Process Creation Detection
      type: similar
status: experimental
description: |
    Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
    The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
    It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
    On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
    it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
references:
    - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-05-24
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078.002
    - attack.t1098
logsource:
    category: ps_script
    product: windows
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'New-ADServiceAccount'
            - '-CreateDelegatedServiceAccount'
            - '-path'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: File Download with Headless Browser
id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e
related:
    - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c
      type: derived
status: test
description: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files
references:
    - https://twitter.com/mrd0x/status/1478234484881436672?s=12
    - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
author: Sreeman, Florian Roth (Nextron Systems)
date: 2022-01-04
modified: 2025-10-07
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1105
    - attack.t1564.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\brave.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
        CommandLine|contains|all:
            - '--headless'
            - 'dump-dom'
            - 'http'
    filter_optional_edge_1:
        Image|startswith:
            - 'C:\Program Files (x86)\Microsoft\Edge\Application\'
            - 'C:\Program Files (x86)\Microsoft\EdgeCore\'
            - 'C:\Program Files (x86)\Microsoft\EdgeWebView\'
            - 'C:\Program Files\Microsoft\Edge\Application\'
            - 'C:\Program Files\Microsoft\EdgeCore\'
            - 'C:\Program Files\Microsoft\EdgeWebView\'
            - 'C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge'
        Image|endswith:
            - '\msedge.exe'
            - '\msedgewebview2.exe'
            - '\MicrosoftEdge.exe'
        CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
    filter_optional_edge_2:
        Image|contains:
            - '\AppData\Local\Microsoft\WindowsApps\'
            - '\Windows\SystemApps\Microsoft.MicrosoftEdge'
        Image|endswith:
            - '\msedge.exe'
            - '\MicrosoftEdge.exe'
        CommandLine|contains: '--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml

title: FlowCloud Registry Markers
id: 5118765f-6657-4ddb-a487-d7bd673abbf1
status: test
description: |
    Detects FlowCloud malware registry markers from threat group TA410.
    The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.
references:
    - https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new
author: NVISO
date: 2020-06-09
modified: 2024-03-20
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_event
detection:
    selection:
        TargetObject|contains:
            - '\HARDWARE\{2DB80286-1784-48b5-A751-B6ED1F490303}'
            - '\HARDWARE\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}'
            - '\HARDWARE\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}'
            - '\SYSTEM\Setup\PrintResponsor\'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: Forest Blizzard APT - Process Creation Activity
id: 07db928c-8632-488e-ac7d-3db847489175
status: experimental
description: |
    Detects the execution of specific processes and command line combination.
    These were seen being created by Forest Blizzard as described by MSFT.
references:
    - https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-04-23
modified: 2025-01-22
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_hashes:
        Hashes|contains:
            - 'SHA256=6b311c0a977d21e772ac4e99762234da852bbf84293386fbe78622a96c0b052f'
            - 'SHA256=c60ead92cd376b689d1b4450f2578b36ea0bf64f3963cfa5546279fa4424c2a5'
    selection_schtasks_create:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - 'Create'
            - '/RU'
            - 'SYSTEM'
            - '\Microsoft\Windows\WinSrv'
        CommandLine|contains:
            - 'servtask.bat'
            - 'execute.bat'
            - 'doit.bat'
    selection_schtasks_delete:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - 'Delete'
            - '/F '
            - '\Microsoft\Windows\WinSrv'
    selection_powershell:
        CommandLine|contains|all:
            - 'Get-ChildItem'
            - '.save'
            - 'Compress-Archive -DestinationPath C:\ProgramData\'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: HackTool - Doppelanger LSASS Dumper Execution
id: d474c8fe-bb69-4ea0-b7d9-f682b56d52d3
status: experimental
description: Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods
references:
    - https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/
    - https://github.com/vari-sh/RedTeamGrimoire/tree/668e0357072546065729ad623f8c02f7be21bb08/Doppelganger
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-01
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\Doppelganger.exe'
        - Hashes|contains:
              - 'IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB'
              - 'IMPHASH=65F0EA61156EE0C2A35421926F0C7F78'
    condition: selection
falsepositives:
    - Unknown
level: high

title: HackTool - Dumpert Process Dumper Default File
id: 93d94efc-d7ad-4161-ad7d-1638c4f908d8
related:
    - id: 2704ab9e-afe2-4854-a3b1-0c0706d03578
      type: derived
status: test
description: Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory
references:
    - https://github.com/outflanknl/Dumpert
    - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/
author: Florian Roth (Nextron Systems)
date: 2020-02-04
modified: 2023-05-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: 'dumpert.dmp'
    condition: selection
falsepositives:
    - Very unlikely
level: critical

title: IIS Application Pool credential dumping 
description: Detects scenarios where an attacker 
references:
- https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-1/
- https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/
- https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html
- https://tdm.socprime.com/tdm/info/3n7KrfogcqRG/#sigma
- https://twitter.com/0gtweet/status/1588815661085917186
tags:
- attack.credential_access
- attack.t1003
author: mdecrevoisier (adapted from Tim Rauch and Grzegorz Tworek feedback)
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    - Image|endswith: '\appcmd.exe'
    - OriginalFilename: 'appcmd.exe'
  selection_arg:
    CommandLine|contains|all:
      - 'list'
      - 'apppool' # can also be 'apppools'
    #CommandLine|contains: # use in case of too many false positives
      #- '/@'
      #- text
      #- password
      #- config
  condition: selection_name and selection_arg
falsepositives:
- Unknown
level: high

title: Import LDAP Data Interchange Format File Via Ldifde.EXE
id: 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f
status: test
description: |
    Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
references:
    - https://twitter.com/0gtweet/status/1564968845726580736
    - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
author: '@gott_cyber'
date: 2022-09-02
modified: 2023-03-14
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1218
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\ldifde.exe'
        - OriginalFileName: 'ldifde.exe'
    selection_cli:
        CommandLine|contains|all:
            - '-i'
            - '-f'
    condition: all of selection_*
falsepositives:
    - Since the content of the files are unknown, false positives are expected
level: medium

title: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
id: e54f5149-6ba3-49cf-b153-070d24679126
status: test
description: Detects Obfuscated Powershell via VAR++ LAUNCHER
references:
    - https://github.com/SigmaHQ/sigma/issues/1009 # (Task27)
author: Timur Zinniatullin, oscd.community
date: 2020-10-13
modified: 2024-04-05
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_4104:
        ScriptBlockText|re: '(?i)&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c' # FPs with |\/r
    condition: selection_4104
falsepositives:
    - Unknown
level: high

title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure
id: 352a918a-34d8-4882-8470-44830c507aa3
status: test
description: |
    Detects when an instance identity has taken an action that isn't inside SSM.
    This can indicate that a compromised EC2 instance is being used as a pivot point.
references:
    - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
    - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/
    - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things
author: jamesc-grafana
date: 2024-07-11
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.persistence
    - attack.stealth
    - attack.t1078
    - attack.t1078.002
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        userIdentity.arn|re: '.+:assumed-role/aws:.+'
    filter_main_generic:
        - eventSource: 'ssm.amazonaws.com'
        - eventName: 'RegisterManagedInstance'
        - sourceIPAddress: 'AWS Internal'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services
level: high

title: Password Dumper Remote Thread in LSASS
id: f239b326-2f41-4d6b-9dfa-c846a60ef505
status: stable
description: |
    Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
    The process in field Process is the malicious program. A single execution can lead to hundreds of events.
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
author: Thomas Patzke
date: 2017-02-19
modified: 2021-06-21
tags:
    - attack.credential-access
    - attack.s0005
    - attack.t1003.001
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        StartModule: ''
    condition: selection
falsepositives:
    - Antivirus products
level: high

title: Potential Discovery Activity Using Find - Linux
id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
related:
    - id: 85de3a19-b675-4a51-bfc6-b11a5186c971
      type: similar
status: test
description: Detects usage of "find" binary in a suspicious manner to perform discovery
references:
    - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-28
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/find'
        CommandLine|contains:
            - '-perm -4000'
            - '-perm -2000'
            - '-perm 0777'
            - '-perm -222'
            - '-perm -o w'
            - '-perm -o x'
            - '-perm -u=s'
            - '-perm -g=s'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Potential Persistence Using DebugPath
id: df4dc653-1029-47ba-8231-3c44238cc0ae
status: test
description: Detects potential persistence using Appx DebugPath
references:
    - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
    - https://github.com/rootm0s/WinPwnage
author: frack113
date: 2022-07-27
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection_debug:
        TargetObject|contains: 'Classes\ActivatableClasses\Package\Microsoft.'
        TargetObject|endswith: '\DebugPath'
    selection_default:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft.'
        TargetObject|endswith: '\(Default)'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

title: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
id: 48bfd177-7cf2-412b-ad77-baf923489e82
related:
    - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 # vss_ps.dll
      type: similar
    - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 # vssapi.dll
      type: similar
status: test
description: Detects the image load of VSS DLL by uncommon executables
references:
    - https://github.com/ORCx41/DeleteShadowCopies
author: frack113
date: 2023-02-17
modified: 2026-08-27
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\vsstrace.dll'
    filter_main_windows:
        - Image:
              - 'C:\Windows\explorer.exe'
              - 'C:\Windows\ImmersiveControlPanel\SystemSettings.exe'
              - 'C:\Windows\servicing\TrustedInstaller.exe'
        - Image|startswith:
              - 'C:\Windows\System32\'
              - 'C:\Windows\SysWOW64\'
              - 'C:\Windows\Temp\{' # Installers
              - 'C:\Windows\WinSxS\'
              - 'C:\ProgramData\Package Cache\{'  # Microsoft Visual Redistributable installer  VC_redist/vcredist EXE
    filter_main_program_files:
        # When using this rule in your environment replace the "Program Files" folder by the exact applications you know use this. Examples would be software such as backup solutions
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_optional_recovery:
        Image|startswith: 'C:\$WinREAgent\Scratch\'
    filter_main_null_image:
        Image: null # Observed through Aurora
    filter_optional_avira:
        Image|contains|all:
            - '\temp\is-'
            - '\avira_system_speedup.tmp'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

title: PowerShell ADRecon Execution
id: bf72941a-cba0-41ea-b18c-9aca3925690d
status: test
description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7
references:
    - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1
    - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
author: Bhabesh Raj
date: 2021-07-16
modified: 2022-09-06
tags:
    - attack.discovery
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Function Get-ADRExcelComOb'
            - 'Get-ADRGPO'
            - 'Get-ADRDomainController'
            - 'ADRecon-Report.xlsx' # Default
    condition: selection
falsepositives:
    - Unknown
level: high

title: ProxyLogon Reset Virtual Directories Based On IIS Log
id: effee1f6-a932-4297-a81f-acb44064fa3a
status: test
description: When exploiting this vulnerability with CVE-2021-26858, an SSRF attack is used to manipulate virtual directories
references:
    - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
author: frack113
date: 2021-08-10
modified: 2023-05-08
tags:
    - cve.2021-26858
    - detection.emerging-threats
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
    definition: 'Requirements: The POST request body data must be collected in order to make use of this detection'
detection:
    selection:
        cs-method: 'POST'
        sc-status: 200
        cs-uri-stem: '/ecp/DDI/DDIService.svc/SetObject'
        cs-uri-query|contains|all:
            - 'schema=Reset'
            - 'VirtualDirectory'
        cs-username|endswith: '$'
    keywords:
        '|all':
            - 'POST'
            - 200
            - '/ecp/DDI/DDIService.svc/SetObject'
            - 'schema=Reset'
            - 'VirtualDirectory'
            - '$'
    condition: selection or keywords
falsepositives:
    - Unlikely
level: critical

title: Raspberry Robin Initial Execution From External Drive
id: 2c6bea3a-ef58-4f2e-a775-4928f6b7c58a
related:
    - id: d52d2e87-eb03-4fac-961d-eb616da79788
      type: similar
status: test
description: Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".
references:
    - https://redcanary.com/blog/raspberry-robin/
author: '@kostastsale'
date: 2022-05-06
tags:
    - attack.execution
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\cmd.exe'
        ParentCommandLine|contains: '/r'
        ParentCommandLine|endswith:
            - '.bin'
            - '.ico'
            - '.lnk'
            - '.lo'
            - '.sv'
            - '.usb'
    selection_child_img:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains|windash: '/q'
    selection_child_http:
        CommandLine|contains:
            - 'http:'
            - 'https:'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

title: Register New IFiltre For Persistence
id: b23818c7-e575-4d13-8012-332075ec0a2b
status: test
description: |
    Detects when an attacker registers a new IFilter for an extension. Microsoft Windows Search uses filters to extract the content of items for inclusion in a full-text index.
    You can extend Windows Search to index new or proprietary file types by writing filters to extract the content, and property handlers to extract the properties of files.
references:
    - https://persistence-info.github.io/Data/ifilters.html
    - https://twitter.com/0gtweet/status/1468548924600459267
    - https://github.com/gtworek/PSBits/tree/master/IFilter
    - https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2024-03-26
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection_ext:
        TargetObject|contains|all:
            - '\SOFTWARE\Classes\.'
            - '\PersistentHandler'
    selection_clsid:
        TargetObject|contains|all:
            - '\SOFTWARE\Classes\CLSID'
            - '\PersistentAddinsRegistered\{89BCB740-6119-101A-BCB7-00DD010655AF}'
    filter_default_targets:
        TargetObject|contains:
            # TODO: Add the default extension PersistentHandler.
            # Note this could also offer blindspot as the attacker could use on of these and hijack them
            - '\CLSID\{4F46F75F-199F-4C63-8B7D-86D48FE7970C}\' # Office Open XML Format PowerPoint Persistent Handler
            - '\CLSID\{4887767F-7ADC-4983-B576-88FB643D6F79}\' # Office Open XML Format Excel Persistent Handler
            - '\CLSID\{D3B41FA1-01E3-49AF-AA25-1D0D824275AE}\' # Office Open XML Format Word Persistent Handler
            - '\CLSID\{72773E1A-B711-4d8d-81FA-B9A43B0650DD}\' # Microsoft OneNote Windows Desktop Search IFilter Persistent handler
            - '\CLSID\{098f2470-bae0-11cd-b579-08002b30bfeb}\' # Null persistent handler
            - '\CLSID\{1AA9BF05-9A97-48c1-BA28-D9DCE795E93C}\' # PDF Persistent Handler
            - '\CLSID\{2e2294a9-50d7-4fe7-a09f-e6492e185884}\' # rtf persistent handler
            - '\CLSID\{34CEAC8D-CBC0-4f77-B7B1-8A60CB6DA0F7}\' # Open Document Format ODT Persistent Handler
            - '\CLSID\{3B224B11-9363-407e-850F-C9E1FFACD8FB}\' # Zip Persistent Handler
            - '\CLSID\{3DDEB7A4-8ABF-4D82-B9EE-E1F4552E95BE}\' # Open Document Format ODS Persistent Handler
            - '\CLSID\{5645C8C1-E277-11CF-8FDA-00AA00A14F93}\' # Related to MIME Filter
            - '\CLSID\{5645C8C4-E277-11CF-8FDA-00AA00A14F93}\' # Related to MIME Filter
            - '\CLSID\{58A9EBF6-5755-4554-A67E-A2467AD1447B}\' # Setting Content File Persistent Handler
            - '\CLSID\{5e941d80-bf96-11cd-b579-08002b30bfeb}\' # Plain Text persistent handler
            - '\CLSID\{698A4FFC-63A3-4E70-8F00-376AD29363FB}\' # Wordpad OOXML Document Filter
            - '\CLSID\{7E9D8D44-6926-426F-AA2B-217A819A5CCE}\' # XML File Persistent Handler
            - '\CLSID\{8CD34779-9F10-4f9b-ADFB-B3FAEABDAB5A}\' # .url File Persistent Handler
            - '\CLSID\{9694E38A-E081-46ac-99A0-8743C909ACB6}\' # html persistent handler for mapi email
            - '\CLSID\{98de59a0-d175-11cd-a7bd-00006b827d94}\' # Microsoft Office Persistent Handler
            - '\CLSID\{AA10385A-F5AA-4EFF-B3DF-71B701E25E18}\' # Wordpad ODT Document Filter
            - '\CLSID\{B4132098-7A03-423D-9463-163CB07C151F}\' # Office Open XML Format Excel Persistent Handler
            - '\CLSID\{d044309b-5da6-4633-b085-4ed02522e5a5}\' # App Content File Persistent Handler
            - '\CLSID\{D169C14A-5148-4322-92C8-754FC9D018D8}\' # rtf persistent handler for mapi email
            - '\CLSID\{DD75716E-B42E-4978-BB60-1497B92E30C4}\' # text persistent handler for mapi email
            - '\CLSID\{E2F83EED-62DE-4A9F-9CD0-A1D40DCD13B6}\' # Open Document Format ODP Persistent Handler
            - '\CLSID\{E772CEB3-E203-4828-ADF1-765713D981B8}\' # Microsoft OneNote Section persistent handler
            - '\CLSID\{eec97550-47a9-11cf-b952-00aa0051fe20}' # HTML File persistent handler
            # - '\CLSID\{F6F00E65-9CAF-43BB-809A-38AA4621BCF2}' # XMind Persistent Handler (not present by default)
            - '\CLSID\{FB10BD80-A331-4e9e-9EB7-00279903AD99}\' # Office Outlook MSG Persistent Handler
    filter_generic_paths:
        Image|startswith:
            # Note: We assume if an attacker has access to one of these directories. Then he already has admin.
            - 'C:\Windows\System32\'
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
    condition: 1 of selection_* and not 1 of filter_*
falsepositives:
    - Legitimate registration of IFilters by the OS or software
level: medium

title: Remote Code Execute via Winrm.vbs
id: 9df0dd3a-1a5c-47e3-a2bc-30ed177646a0
status: test
description: Detects an attempt to execute code or create service on remote host via winrm.vbs.
references:
    - https://twitter.com/bohops/status/994405551751815170
    - https://redcanary.com/blog/lateral-movement-winrm-wmi/
    - https://lolbas-project.github.io/lolbas/Scripts/Winrm/
author: Julia Fomina, oscd.community
date: 2020-10-07
modified: 2023-03-03
tags:
    - attack.stealth
    - attack.t1216
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        # Note: winrm.vbs can only be run by a process named cscript (see "IsCScriptEnv" function)
        - Image|endswith: '\cscript.exe'
        - OriginalFileName: 'cscript.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'winrm'
            - 'invoke Create wmicimv2/Win32_'
            - '-r:http'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium

title: Renamed BrowserCore.EXE Execution
id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559
status: test
description: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
references:
    - https://twitter.com/mariuszbit/status/1531631015139102720
author: Max Altgelt (Nextron Systems)
date: 2022-06-02
modified: 2023-02-03
tags:
    - attack.credential-access
    - attack.stealth
    - attack.t1528
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName: BrowserCore.exe
    filter_realbrowsercore:
        Image|endswith: '\BrowserCore.exe'
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: high

title: Root Account Enable Via Dsenableroot
id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11
status: test
description: Detects attempts to enable the root account via "dsenableroot"
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md
    - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml
    - https://ss64.com/osx/dsenableroot.html
author: Sohan G (D4rkCiph3r)
date: 2023-08-22
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1078
    - attack.t1078.001
    - attack.t1078.003
    - attack.initial-access
    - attack.persistence
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/dsenableroot'
    filter_main_disable:
        CommandLine|contains: ' -d '
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

title: Sticky key sethc file failed replacement
description: Detects scenarios where an attacker failed to replace the original sethc.exe file by cmd.exe.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1546-Image%20File%20Execution%20Options%20Injection
- https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
- https://www.mandiant.com/resources/apt29-domain-frontin
- https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
tags:
- attack.privilege_escalation
- attack.t1546.008
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection: # No ID 4688 will be triggered if access is denied
    EventID: 4656
    ObjectServer: Security
    ObjectType: File
    ObjectName|endswith: 'sethc.exe'
    ProcessName|endswith: 'cmd.exe'
    EventType: AUDIT_FAILURE
    AccessReason|contains: '%4417: %%1805' # WriteData (or AddFile):  Not granted
  condition: selection
falsepositives:
- None
level: high