Sigma rules: 13

title: AADInternals PowerShell Cmdlets Execution - ProccessCreation
id: c86500e9-a645-4680-98d7-f882c70c1ea3
related:
    - id: 91e69562-2426-42ce-a647-711b8152ced6
      type: similar
status: test
description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.
references:
    - https://o365blog.com/aadinternals/
    - https://github.com/Gerenios/AADInternals
author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2022-12-23
modified: 2025-02-06
tags:
    - attack.execution
    - attack.reconnaissance
    - attack.discovery
    - attack.credential-access
    - attack.impact
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\powershell_ise.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.Exe'
              - 'pwsh.dll'
    selection_cli:
        CommandLine|contains:
            # Since most of the cmdlets use a unique enough string which is "-AADInt" we only used that portion. For a complete list please check the references linked above
            - 'Add-AADInt'
            - 'ConvertTo-AADInt'
            - 'Disable-AADInt'
            - 'Enable-AADInt'
            - 'Export-AADInt'
            - 'Find-AADInt'
            - 'Get-AADInt'
            - 'Grant-AADInt'
            - 'Initialize-AADInt'
            - 'Install-AADInt'
            - 'Invoke-AADInt'
            - 'Join-AADInt'
            - 'New-AADInt'
            - 'Open-AADInt'
            - 'Read-AADInt'
            - 'Register-AADInt'
            - 'Remove-AADInt'
            - 'Reset-AADInt'
            - 'Resolve-AADInt'
            - 'Restore-AADInt'
            - 'Save-AADInt'
            - 'Search-AADInt'
            - 'Send-AADInt'
            - 'Set-AADInt'
            - 'Start-AADInt'
            - 'Unprotect-AADInt'
            - 'Update-AADInt'
    condition: all of selection_*
falsepositives:
    - Legitimate use of the library for administrative activity
level: high

title: Application Uninstalled
id: 570ae5ec-33dc-427c-b815-db86228ad43e
status: test
description: An application has been removed. Check if it is critical.
references:
    - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
    - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
author: frack113
date: 2022-01-28
modified: 2022-09-17
tags:
    - attack.impact
    - attack.t1489
logsource:
    product: windows
    service: application
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1034 # Windows Installer removed the product
            - 11724 # Product Removal Successful
    condition: selection
falsepositives:
    - Unknown
# Level is low as it can be very verbose, you can use the top or less 10 "Product Name" to have a quick overview
level: low

title: Chopper Webshell Process Pattern
id: fa3c117a-bc0d-416e-a31b-0c0e80653efb
status: test
description: Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells
references:
    - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
author: Florian Roth (Nextron Systems), MSTI (query)
date: 2022-10-01
tags:
    - attack.persistence
    - attack.discovery
    - attack.t1505.003
    - attack.t1018
    - attack.t1033
    - attack.t1087
logsource:
    category: process_creation
    product: windows
detection:
    selection_origin:
        - Image|endswith: '\w3wp.exe'
        - ParentImage|endswith: '\w3wp.exe'
    selection_cmdline:
        CommandLine|contains:
            - '&ipconfig&echo'
            - '&quser&echo'
            - '&whoami&echo'
            - '&c:&echo'
            - '&cd&echo'
            - '&dir&echo'
            - '&echo [E]'
            - '&echo [S]'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Directory Removal Via Rmdir
id: 41ca393d-538c-408a-ac27-cf1e038be80c
status: test
description: |
    Detects execution of the builtin "rmdir" command in order to delete directories.
    Adversaries may delete files left behind by the actions of their intrusion activity.
    Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
    Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
author: frack113
date: 2022-01-15
modified: 2023-03-07
tags:
    - attack.stealth
    - attack.t1070.004
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_rmdir:
        CommandLine|contains: 'rmdir'
    selection_flags:
        CommandLine|contains:
            - '/s'
            - '/q'
    condition: all of selection_*
falsepositives:
    - Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_rmdir_execution/info.yml

title: ESXi Account Creation Via ESXCLI
id: b28e4eb3-8bbc-4f0c-819f-edfe8e2f25db
status: test
description: Detects user account creation on ESXi system via esxcli
references:
    - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
author: Cedric Maurugeon
date: 2023-08-22
tags:
    - attack.persistence
    - attack.execution
    - attack.t1136
    - attack.t1059.012
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/esxcli'
        CommandLine|contains|all:
            - 'system '
            - 'account '
            - 'add '
    condition: selection
falsepositives:
    - Legitimate administration activities
level: medium

title: Exploit for CVE-2015-1641
id: 7993792c-5ce2-4475-a3db-a3a5539827ef
status: stable
description: Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641
references:
    - https://www.virustotal.com/en/file/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8/analysis/
    - https://www.hybrid-analysis.com/sample/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8?environmentId=100
author: Florian Roth (Nextron Systems)
date: 2018-02-22
modified: 2021-11-27
tags:
    - attack.stealth
    - attack.t1036.005
    - cve.2015-1641
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\WINWORD.EXE'
        Image|endswith: '\MicroScMgmt.exe'
    condition: selection
falsepositives:
    - Unknown
level: critical

title: FortiGate - Firewall Address Object Added
id: 5c8d7b41-3812-432f-a0bb-4cfb7c31827e
status: experimental
description: Detects the addition of firewall address objects on a Fortinet FortiGate Firewall.
references:
    - https://www.fortiguard.com/psirt/FG-IR-24-535
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
    - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
    - https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2025-11-01
modified: 2026-05-04
tags:
    - attack.defense-impairment
    - attack.t1686.002
logsource:
    product: fortigate
    service: event
detection:
    selection:
        action: 'Add'
        cfgpath: 'firewall.address'
    condition: selection
falsepositives:
    - An address could be added or deleted for legitimate purposes.
level: medium

title: Google Workspace Role Privilege Deleted
id: bf638ef7-4d2d-44bb-a1dc-a238252e6267
status: test
description: Detects when an a role privilege is deleted in Google Workspace.
references:
    - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
author: Austin Songer
date: 2021-08-24
modified: 2023-10-11
tags:
    - attack.impact
logsource:
    product: gcp
    service: google_workspace.admin
detection:
    selection:
        eventService: admin.googleapis.com
        eventName: REMOVE_PRIVILEGE
    condition: selection
falsepositives:
    - Unknown

level: medium

title: Hidden account creation (with fast deletion)
description: Detects scenarios where an attacker creates a hidden local account. See also rule "User account creation disguised in a computer account".
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1136-Create%20account
- https://github.com/wgpsec/CreateHiddenAccount
tags:
- attack.persistence
- attack.t1098 # account manipulation
- attack.t1136 # user creation
- attack.defense_evesion
- attack.t0136 # masquerading
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_create:
    EventID: 4720
  selection_delete:
    EventID: 4726
  filter:
    Computer: '%domain_controllers%'
  condition: selection_create and selection_delete and not filter # requires grouping over 'TargetSid' to not mix different user accounts
  timeframe: 1m
falsepositives:
- IAM account lifecycle software
level: medium

title: IIS WebServer Log Deletion via CommandLine Utilities
id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0
related:
    - id: 3eb8c339-a765-48cc-a150-4364c04652bf
      type: similar
status: experimental
description: |
    Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
    Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.
references:
    - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-09-02
tags:
    - attack.stealth
    - attack.t1070
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'cmd.exe'
              - 'powershell.exe'
              - 'powershell_ise.exe'
              - 'pwsh.dll'
    selection_cli_del:
        CommandLine|contains:
            - 'del '
            - 'erase '
            - 'rm '
            - 'remove-item '
            - 'rmdir '
    selection_cli_iis_dir:
        CommandLine|contains: '\inetpub\logs\'
    condition: all of selection_*
falsepositives:
    - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities.
    - Legitimate schedule tasks or scripts that clean up log files regularly.
    # More Fp cases
    # https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage#02
level: medium

title: Internet Explorer DisableFirstRunCustomize Enabled
id: ab567429-1dfb-4674-b6d2-979fd2f9d125
status: test
description: |
    Detects changes to the Internet Explorer "DisableFirstRunCustomize" value, which prevents Internet Explorer from running the first run wizard the first time a user starts the browser after installing Internet Explorer or Windows.
references:
    - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
    - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
    - https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-16
modified: 2025-10-07
tags:
    - attack.defense-impairment
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize'
        Details:
            - 'DWORD (0x00000001)' # Home Page
            - 'DWORD (0x00000002)' # Welcome To IE
    filter_main_generic:
        Image:
            - 'C:\Windows\explorer.exe'
            - 'C:\Windows\System32\ie4uinit.exe'
    filter_optional_avira:
        Image|contains|all:
            - '\Temp\'
            - '\.cr\avira_'
        Details|contains: 'DWORD (0x00000001)'
    filter_optional_foxit:
        Image:
            - 'C:\Program Files (x86)\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
            - 'C:\Program Files\Foxit Software\Foxit PDF Reader\FoxitPDFReader.exe'
        Details|contains: 'DWORD (0x00000001)'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - As this is controlled by group policy as well as user settings. Some false positives may occur.
level: medium

title: Launch Agent/Daemon Execution Via Launchctl
id: ae9d710f-dcd1-4f75-a0a5-93a73b5dda0e
status: test
description: Detects the execution of programs as Launch Agents or Launch Daemons using launchctl on macOS.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.001/T1569.001.md
    - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
    - https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
    - https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
    - https://www.loobins.io/binaries/launchctl/
author: Pratinav Chandra
date: 2024-05-13
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1569.001
    - attack.t1543.001
    - attack.t1543.004
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/launchctl'
        CommandLine|contains:
            - 'submit'
            - 'load'
            - 'start'
    condition: selection
falsepositives:
    - Legitimate administration activities is expected to trigger false positives. Investigate the command line being passed to determine if the service or launch agent are suspicious.
level: medium

title: macOS MDM Profile Manipulation
id: c3d4e5f6-a7b8-4901-cdef-012345678901
status: experimental
description: |
  Detects manipulation of MDM (Mobile Device Management) configuration profiles.
  Attackers may attempt to install malicious profiles or remove security profiles
  to weaken system defenses.
references:
  - https://attack.mitre.org/techniques/T1484/
  - https://support.apple.com/guide/deployment/intro-to-mdm-profiles-depc0aadd3fe/web
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.ManagedClient
  selection_operations:
    message|contains:
      - 'profile'
      - 'installed'
      - 'removed'
      - 'configuration'
      - 'payload'
  selection_suspicious:
    message|contains:
      - 'unsigned'
      - 'untrusted'
      - 'manual install'
      - 'user install'
  condition: selection_subsystem and selection_operations and selection_suspicious
falsepositives:
  - Legitimate MDM enrollment
  - IT administrator profile deployment
level: high
tags:
  - attack.defense_evasion
  - attack.t1484

title: OpenCanary - RDP New Connection Attempt
id: 598290cf-5932-45cd-9123-be1e05ab4f2e
status: experimental
description: Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
references:
    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
author: Marco Pedrinazzi (@pedrinazziM)
date: 2026-01-06
tags:
    - attack.initial-access
    - attack.lateral-movement
    - attack.persistence
    - attack.t1133
    - attack.t1021.001
logsource:
    category: application
    product: opencanary
detection:
    selection:
        logtype: 14001
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Outgoing Logon with New Credentials
id: def8b624-e08f-4ae1-8612-1ba21190da6b
status: test
description: Detects logon events that specify new credentials
references:
    - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf
author: Max Altgelt (Nextron Systems)
date: 2022-04-06
tags:
    - attack.lateral-movement
    - attack.t1550
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4624
        LogonType: 9
    condition: selection
falsepositives:
    - Legitimate remote administration activity
level: low

title: Path Traversal Exploitation Attempts
id: 7745c2ea-24a5-4290-b680-04359cb84b35
status: test
description: Detects path traversal exploitation attempts
references:
    - https://github.com/projectdiscovery/nuclei-templates
    - https://book.hacktricks.xyz/pentesting-web/file-inclusion
author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems)
date: 2021-09-25
modified: 2023-08-31
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '../../../../../lib/password'
            - '../../../../windows/'
            - '../../../etc/'
            - '..%252f..%252f..%252fetc%252f'
            - '..%c0%af..%c0%af..%c0%afetc%c0%af'
            - '%252e%252e%252fetc%252f'
    condition: selection
falsepositives:
    - Expected to be continuously seen on systems exposed to the Internet
    - Internal vulnerability scanners
level: medium

title: Potential Credential Dumping Via LSASS Process Clone
id: c8da0dfd-4ed0-4b68-962d-13c9c884384e
status: test
description: Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity
references:
    - https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/
    - https://twitter.com/Hexacorn/status/1420053502554951689
    - https://twitter.com/SBousseaden/status/1464566846594691073?s=20
author: Florian Roth (Nextron Systems), Samir Bousseaden
date: 2021-11-27
modified: 2023-03-02
tags:
    - attack.credential-access
    - attack.t1003
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Windows\System32\lsass.exe'
        Image|endswith: '\Windows\System32\lsass.exe'
    condition: selection
falsepositives:
    - Unknown
level: critical

title: Potential CVE-2023-27997 Exploitation Indicators
id: 31e4e649-7394-4fd2-9ae7-dbc61eebb550
status: test
description: |
    Detects indicators of potential exploitation of CVE-2023-27997 in Frotigate weblogs.
    To avoid false positives it is best to look for successive requests to the endpoints mentioned as well as weird values of the "enc" parameter
references:
    - https://blog.lexfo.fr/Forensics-xortigate-notice.html
    - https://blog.lexfo.fr/xortigate-cve-2023-27997.html
    - https://research.kudelskisecurity.com/2023/06/12/cve-2023-27997-fortigate-ssl-vpn/
    - https://labs.watchtowr.com/xortigate-or-cve-2023-27997/
author: Sergio Palacios Dominguez, Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-28
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-27997
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection_uri:
        cs-method:
            - 'GET'
            - 'POST'
        cs-uri-query|contains:
            - '/remote/hostcheck_validate'
            - '/remote/logincheck'
    selection_keywords:
        - 'enc='
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: Potential Memory Dumping Activity Via LiveKD
id: a85f7765-698a-4088-afa0-ecfbf8d01fa4
status: test
description: Detects execution of LiveKD based on PE metadata or image name
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-15
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
              - '\livekd.exe'
              - '\livekd64.exe'
        - OriginalFileName: 'livekd.exe'
    condition: selection
falsepositives:
    - Administration and debugging activity (must be investigated)
level: medium

title: Potential QBot Activity
id: 4fcac6eb-0287-4090-8eea-2602e4c20040
status: stable
description: Detects potential QBot activity by looking for process executions used previously by QBot
references:
    - https://twitter.com/killamjr/status/1179034907932315648
    - https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/
author: Florian Roth (Nextron Systems)
date: 2019-10-01
modified: 2023-02-03
tags:
    - attack.execution
    - attack.t1059.005
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        ParentImage|endswith: '\WinRAR.exe'
        Image|endswith: '\wscript.exe'
    selection2:
        CommandLine|contains: ' /c ping.exe -n 6 127.0.0.1 & type '
    selection3:
        CommandLine|contains|all:
            - 'regsvr32.exe'
            - 'C:\ProgramData'
            - '.tmp'
    condition: 1 of selection*
falsepositives:
    - Unlikely
level: critical

title: PowerShell Called from an Executable Version Mismatch
id: c70e019b-1479-4b65-b0cc-cd0c6093a599
status: test
description: Detects PowerShell called from an executable by the version mismatch method
references:
    - https://adsecurity.org/?p=2921
author: Sean Metcalf (source), Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2023-10-27
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection_engine:
        Data|contains:
            - 'EngineVersion=2.'
            - 'EngineVersion=4.'
            - 'EngineVersion=5.'
    selection_host:
        Data|contains: 'HostVersion=3.'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: PUA - AdvancedRun Execution
id: d2b749ee-4225-417e-b20e-a8d2193cbb84
related:
    - id: fa00b701-44c6-4679-994d-5a18afa8a707
      type: similar
status: test
description: Detects the execution of AdvancedRun utility
references:
    - https://twitter.com/splinter_code/status/1483815103279603714
    - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
    - https://www.elastic.co/security-labs/operation-bleeding-bear
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
author: Florian Roth (Nextron Systems)
date: 2022-01-20
modified: 2023-02-21
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1564.003
    - attack.t1134.002
    - attack.t1059.003
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - OriginalFileName: 'AdvancedRun.exe'
        - CommandLine|contains|all:
              - ' /EXEFilename '
              - ' /Run'
        - CommandLine|contains|all:
              - ' /WindowState 0'
              - ' /RunAs '
              - ' /CommandLine '
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advancedrun/info.yml

title: Service permissions hijacked for privileges abuse (PowerShell)
description: Detects scenarios where an attacker modify the permissions of a service using native PowerShell commands in order to abuse its privileges. Note that it requires PowerShell 7 or higher.
references:
- http://woshub.com/set-permissions-on-windows-service/
- https://www.winhelponline.com/blog/view-edit-service-permissions-windows/
- https://decoder.cloud/2019/02/07/demystifying-windows-service-permissions-configuration/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.1
- https://medium.com/r3d-buck3t/abuse-service-registry-acls-windows-privesc-f88079140509
- https://github.com/rohnedwards/PowerShellAccessControl
tags:
- attack.persistence
- attack.t1543.003
- attack.t1574.010
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - Set-Service
      - SecurityDescriptorSddl

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - Set-Service
      - SecurityDescriptorSddl

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - Set-Service
      - SecurityDescriptorSddl

  condition: 1 of selection*
falsepositives:
- administrator reconfiguring service
level: high

title: Suspicious PowerShell WindowStyle Option
id: 313fbb0a-a341-4682-848d-6d6f8c4fab7c
status: test
description: |
    Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
    In some cases, windows that would typically be displayed when an application carries out an operation can be hidden
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md
author: frack113, Tim Shelton (fp AWS)
date: 2021-10-20
modified: 2023-01-03
tags:
    - attack.stealth
    - attack.t1564.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'powershell'
            - 'WindowStyle'
            - 'Hidden'
    filter:
        ScriptBlockText|contains|all:
            - ':\Program Files\Amazon\WorkSpacesConfig\Scripts\'
            - '$PSScriptRoot\Module\WorkspaceScriptModule\WorkspaceScriptModule'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle/info.yml

title: Suspicious UltraVNC Execution
id: 871b9555-69ca-4993-99d3-35a59f9f3599
status: test
description: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)
references:
    - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
    - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
    - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html
author: Bhabesh Raj
date: 2022-03-04
modified: 2022-03-09
tags:
    - attack.lateral-movement
    - attack.g0047
    - attack.t1021.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - '-autoreconnect '
            - '-connect '
            - '-id:'
    condition: selection
falsepositives:
    - Unknown
level: high

title: System Scripts Autorun Keys Modification
id: e7a2fd40-3ae1-4a85-bf80-15cf624fb1b1
related:
    - id: 17f878b8-9968-4578-b814-c4217fc5768c
      type: obsolete
status: test
description: Detects modification of autostart extensibility point (ASEP) in registry.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
    - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
    - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
date: 2019-10-25
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
logsource:
    category: registry_set
    product: windows
detection:
    scripts_base:
        TargetObject|contains: '\Software\Policies\Microsoft\Windows\System\Scripts'
    scripts:
        TargetObject|contains:
            - '\Startup'
            - '\Shutdown'
            - '\Logon'
            - '\Logoff'
    filter:
        Details: '(Empty)'
    condition: scripts_base and scripts and not filter
falsepositives:
    - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
    - Legitimate administrator sets up autorun keys for legitimate reason
level: medium

title: Windows Firewall Profile Disabled
id: 488b44e7-3781-4a71-888d-c95abfacf44d
related:
    - id: 12f6b752-042d-483e-bf9c-915a6d06ad75
      type: similar
status: test
description: Detects when a user disables the Windows Firewall via a Profile to help evade defense.
references:
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps
    - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
    - https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
    - http://woshub.com/manage-windows-firewall-powershell/
    - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html
author: Austin Songer @austinsonger
date: 2021-10-12
modified: 2022-12-30
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_args:
        ScriptBlockText|contains|all:
            - 'Set-NetFirewallProfile '
            - ' -Enabled '
            - ' False'
    selection_opt:
        ScriptBlockText|contains:
            - ' -All '
            - 'Public'
            - 'Domain'
            - 'Private'
    condition: all of selection*
falsepositives:
    - Unknown
level: medium