Sigma rules: 19

title: Account set with Kerberos DES encryption activated (weakness introduction)
description: Detects scenarios where an attacker set an account with DES Kerberos encryption to perform ticket brutforce.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://docs.microsoft.com/en-us/services-hub/health/remediation-steps-ad/remove-the-highly-insecure-des-encryption-from-user-accounts
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4738
    UserAccountControl: '%%2095' # Use only Kerberos DES encryption types - TRUE
  condition: selection
falsepositives:
- None
level: high

title: Anonymous access performed to multiple targets
description: Detects scenarios where an attacker would attempt to enumerate hosts and collect relevant information using anonymous access. Vulnerability scanners, enumeration software or tool like CrackMapexec may generate such behavior.
references:
- https://medium.com/@Shorty420/enumerating-ad-98e0821c4c78
- https://book.hacktricks.xyz/pentesting/pentesting-smb
- https://0xdf.gitlab.io/2018/12/02/pwk-notes-smb-enumeration-checklist-update1.html
tags:
- attack.discovery
- attack.t1046
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4624
    TargetUserSid: S-1-5-7 # ANONYMOUS LOGON
    LogonType: 3
    #AuthenticationPackageName: NTLM
  filter:
    IpAddress:
      - '%vulnerability_scanners%'
      - '127.0.0.1'
      - '::1'
  condition: selection and not filter | count(Computer) by IpAddress > 20 # Count of many computer are reporting connection attemps from a single source IP
  timeframe: 15m
falsepositives:
- VAS scanners, pentest
level: high

title: Bypass UAC via CMSTP
id: e66779cc-383e-4224-a3a4-267eeb585c40
status: test
description: Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files
references:
    - https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md
    - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
date: 2019-10-24
modified: 2022-08-30
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1548.002
    - attack.t1218.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmstp.exe'
        - OriginalFileName: 'CMSTP.EXE'
    selection_cli:
        CommandLine|contains:
            - '/s'
            - '-s'
            - '/au'
            - '-au'
            - '/ni'
            - '-ni'
    condition: all of selection*
falsepositives:
    - Legitimate use of cmstp.exe utility by legitimate user
level: high

title: Dfsvc.EXE Network Connection To Non-Local IPs
id: 3c21219b-49b5-4268-bce6-c914ed50f09c
status: test
description: Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
references:
    - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-12
modified: 2024-03-12
tags:
    - attack.execution
    - attack.t1203
    - detection.threat-hunting
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\dfsvc.exe'
        Initiated: 'true'
    filter_main_local_ip:
        DestinationIp|cidr: # Ranges excluded based on https://github.com/SigmaHQ/sigma/blob/0f176092326ab9d1e19384d30224e5f29f760d82/rules/windows/network_connection/net_connection_win_dllhost_net_connections.yml
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '169.254.0.0/16'  # link-local address
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '::1/128'  # IPv6 loopback
            - 'fe80::/10'  # IPv6 link-local addresses
            - 'fc00::/7'  # IPv6 private addresses
    condition: selection and not 1 of filter_main_*
falsepositives:
    - False positives are expected from ClickOnce manifests hosted on public IPs and domains. Apply additional filters for the accepted IPs in your environement as necessary
level: medium

title: Google Cloud Firewall Modified or Deleted
id: fe513c69-734c-4d4a-8548-ac5f609be82b
status: test
description: Detects  when a firewall rule is modified or deleted in Google Cloud Platform (GCP).
references:
    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
    - https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html
author: Austin Songer @austinsonger
date: 2021-08-13
modified: 2022-10-09
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - v*.Compute.Firewalls.Delete
            - v*.Compute.Firewalls.Patch
            - v*.Compute.Firewalls.Update
            - v*.Compute.Firewalls.Insert
    condition: selection
falsepositives:
    - Firewall rules being modified or deleted may be performed by a system administrator. Verify that the firewall configuration change was expected.
    - Exceptions can be added to this rule to filter expected behavior.
level: medium

title: IAM Policy Attachment Attempt
id: 0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5e
status: test
description: |
    Detects a failed attempt to attach an IAM policy to a user, group, or role.
    Even though the attempt was denied, it indicates the attacker has valid
    credentials and is attempting privilege escalation. This is commonly
    observed when attackers use stolen credentials that lack IAM write
    permissions.
    Note: AccessDenied events may have empty requestParameters, so this rule
    does not filter by policy name to avoid missing detections.
references:
    - https://attack.mitre.org/techniques/T1098/003/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_AttachUserPolicy.html
    - https://hackingthe.cloud/aws/exploitation/iam_privilege_escalation/
author: nishikawaakira (@nishikawaakira)
date: 2026-05-28
modified: 2026-05-29
tags:
    - attack.privilege-escalation
    - attack.t1098.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName:
            - AttachUserPolicy
            - AttachGroupPolicy
            - AttachRolePolicy
        errorCode: AccessDenied
    condition: selection
falsepositives:
level: medium

title: Insecure OAuth2.x flows have been enabled for some applications
id: 7b4ec6f9-fdae-4e35-8c5c-8daaf473220c
status: experimental
description: |
    Detect when applications' configurations have been updated with insecure grant types, e.g. implicit and resource owner password grant.
    According to the recent update OAuth2.1 and RFC 9700, these flows shall be avoided.
author: Okta
date: 2025-07-11
modified: 2025-09-17
logsource:
    product: auth0
detection:
    selection:
        data.type: sapi
        data.description:
            - Update a client
        data.details.response.statusCode: 200
    filter:
        data.details.response.body.grant_types{}:
            - 'implicit'
            - 'password'
    condition: selection and filter
explanation: >
    The query collects log records issued when any of the configurations for an application are updated.
    It filters for grant types if it contains implicit and/or password (Resource Owner Password Grant).
    The Splunk query below takes the last update of settings for each application/client.
    It alerts those where implicit and/or resource owner grants are present in the last modification, thus active settings.
    The query displays modifying IP and modified client_id where insecure grants have been enabled.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=sapi data.description="Update a client"
    data.details.response.statusCode=200
    ```Limiting to critical appllications```
    ```data.details.response.body.client_id IN ('{critical-client_id-1}', '{critical-client_id-2}')```
    | fields _time, data.ip, data.details.response.body.client_id, data.details.response.body.grant_types{}
    ```Take only the last change of configurations that reflects the current settings```
    | sort -_time, data.details.response.body.client_id
    | dedup data.details.response.body.client_id
    | spath path=data.details.response.body.grant_types{} output=allowed_grants
    | where allowed_grants IN ("implicit", "password")
    ```Display the information in a table```
    | table _time, data.ip, data.details.response.body.client_id, data.details.response.body.grant_types{}
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name.
    - Limit this detection to monitoring a critical set of applications.
    - This Splunk query can be adjusted to report the actual configurations for all applications by removing the "where" clauses.
tenant_logs: |
    type:"sapi" AND description: "Update a client"
prevention:
    - Control tenant admins, i.e. "Admin", as this role has permissions to modify any application.
    - Control Management API scopes that allow modification of client's settings - update:clients.
    - Control usage of Management API from only trusted IPs by applying Network ACL scoped to "management".
    - If you have an edge case where the implicit flow is necessary, use a better version of it - request a token via the form_post
      response mode; request only ID token in combination with a code (Hybrid); request access token in a combination with an ID token
      protected from reply attacks by nonce for matching the at_hash attribute.
    - Default to the Authorization Code grant with PKCE even for regular web applications enforcing PKCE with a post-login action.
falsepositives:
    - Legitimate updates by an administrator. This rule is designed for threat hunting and to be a starting point for further investigation.
    - An exempted application has been updated with insecure grant types. It is still not recommended to use these flows.
level: medium
tags:
    - attack.defense-evasion
    - attack.t1562
    - attack.t1562.007

title: Local domain group enumeration
description: Detects scenarios where an attacker attempts to enumerate domain local groups with tools like CME (--local-groups).
correlation: correlate TargetLogonId from ID 4624 with SubjectLogonId from ID 4661 to identify the source of the enumeration.
requirements: extended rights auditing enabled (https://www.manageengine.com/products/active-directory-audit/active-directory-auditing-configuration-guide-configure-object-level-auditing-manually.html)
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1069-Permission%20Groups%20Discovery
- https://hideandsec.sh/books/cheatsheets/page/crackmapexec
- https://www.infosecmatter.com/crackmapexec-module-library/
- https://docs.microsoft.com/en-us/windows/win32/adschema/extended-rights?redirectedfrom=MSDN
tags:
- attack.discovery
- attack.t1069.001
- attack.t1087.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4661
    ProcessName|endswith: '\lsass.exe'
    ObjectServer: 'Security Account Manager'
    ObjectType: SAM_ALIAS
    ObjectName|startswith:
      - S-1-5-32- # refers to builtin domain local groups
      - S-1-5-21- # refers to others domain local groups
  filter:
    SubjectUserName|endswith: '$'
  condition: selection and not filter | count(Computer) by IpAddress > 30
  timeframe: 15m
falsepositives:
- Administrator activity
level: high

title: MpiExec Lolbin
id: 729ce0ea-5d8f-4769-9762-e35de441586d
status: test
description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
references:
    - https://twitter.com/mrd0x/status/1465058133303246867
    - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps
author: Florian Roth (Nextron Systems)
date: 2022-01-11
modified: 2024-11-23
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_binary:
        - Image|endswith: '\mpiexec.exe'
        - Hashes|contains: 'IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217'
    selection_flags:
        CommandLine|contains:
            - ' /n 1 '
            - ' -n 1 '
    condition: all of selection*
falsepositives:
    - Unknown
level: high

title: OMIGOD SCX RunAsProvider ExecuteScript
id: 6eea1bf6-f8d2-488a-a742-e6ef6c1b67db
status: test
description: |
    Rule to detect the use of the SCX RunAsProvider ExecuteScript to execute any UNIX/Linux script using the /bin/sh shell.
    Script being executed gets created as a temp file in /tmp folder with a scx* prefix.
    Then it is invoked from the following directory /etc/opt/microsoft/scx/conf/tmpdir/.
    The file in that directory has the same prefix scx*. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
    Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
references:
    - https://www.wiz.io/blog/omigod-critical-vulnerabilities-in-omi-azure
    - https://github.com/Azure/Azure-Sentinel/pull/3059
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2022-10-05
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.execution
    - attack.t1068
    - attack.t1190
    - attack.t1203
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        User: root
        LogonId: 0
        CurrentDirectory: '/var/opt/microsoft/scx/tmp'
        CommandLine|contains: '/etc/opt/microsoft/scx/conf/tmpdir/scx'
    condition: selection
falsepositives:
    - Legitimate use of SCX RunAsProvider ExecuteScript.
level: high

title: Pingback Backdoor File Indicators
id: 2bd63d53-84d4-4210-80ff-bf0658f1bf78
related:
    - id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b # DLL Load
      type: similar
    - id: b2400ffb-7680-47c0-b08a-098a7de7e7a9 # Process Creation
      type: similar
status: test
description: Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
    - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
author: Bhabesh Raj
date: 2021-05-05
modified: 2023-02-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: 'updata.exe'
        TargetFilename: 'C:\Windows\oci.dll'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential PlugX Activity
id: aeab5ec5-be14-471a-80e8-e344418305c2
status: test
description: Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
references:
    - http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
    - https://countuponsecurity.com/2017/06/07/threat-hunting-in-the-enterprise-with-appcompatprocessor/
author: Florian Roth (Nextron Systems)
date: 2017-06-12
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.s0013
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_cammute:
        Image|endswith: '\CamMute.exe'
    filter_cammute:
        Image|contains:
            - '\Lenovo\Communication Utility\'
            - '\Lenovo\Communications Utility\'
    selection_chrome_frame:
        Image|endswith: '\chrome_frame_helper.exe'
    filter_chrome_frame:
        Image|contains: '\Google\Chrome\application\'
    selection_devemu:
        Image|endswith: '\dvcemumanager.exe'
    filter_devemu:
        Image|contains: '\Microsoft Device Emulator\'
    selection_gadget:
        Image|endswith: '\Gadget.exe'
    filter_gadget:
        Image|contains: '\Windows Media Player\'
    selection_hcc:
        Image|endswith: '\hcc.exe'
    filter_hcc:
        Image|contains: '\HTML Help Workshop\'
    selection_hkcmd:
        Image|endswith: '\hkcmd.exe'
    filter_hkcmd:
        Image|contains:
            - '\System32\'
            - '\SysNative\'
            - '\SysWow64\'
    selection_mc:
        Image|endswith: '\Mc.exe'
    filter_mc:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
    selection_msmpeng:
        Image|endswith: '\MsMpEng.exe'
    filter_msmpeng:
        Image|contains:
            - '\Microsoft Security Client\'
            - '\Windows Defender\'
            - '\AntiMalware\'
    selection_msseces:
        Image|endswith: '\msseces.exe'
    filter_msseces:
        Image|contains:
            - '\Microsoft Security Center\'
            - '\Microsoft Security Client\'
            - '\Microsoft Security Essentials\'
    selection_oinfo:
        Image|endswith: '\OInfoP11.exe'
    filter_oinfo:
        Image|contains: '\Common Files\Microsoft Shared\'
    selection_oleview:
        Image|endswith: '\OleView.exe'
    filter_oleview:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
            - '\Windows Resource Kit\'
    selection_rc:
        Image|endswith: '\rc.exe'
    filter_rc:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
            - '\Windows Resource Kit\'
            - '\Microsoft.NET\'
    condition: ( selection_cammute and not filter_cammute ) or ( selection_chrome_frame and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc ) or ( selection_msmpeng and not filter_msmpeng ) or ( selection_msseces and not filter_msseces ) or ( selection_oinfo and not filter_oinfo ) or ( selection_oleview and not filter_oleview ) or ( selection_rc and not filter_rc )
falsepositives:
    - Unknown
level: high

title: Potential PowerShell Execution Policy Tampering
id: fad91067-08c5-4d1a-8d8c-d96a21b37814
related:
    - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f # Registry
      type: similar
    - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 # ProcCreation Cmdlet
      type: similar
    - id: 61d0475c-173f-4844-86f7-f3eebae1c66b # PowerShell ScriptBlock
      type: similar
status: test
description: Detects changes to the PowerShell execution policy in order to bypass signing requirements for script execution
references:
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-11
modified: 2023-12-14
tags:
    - attack.defense-impairment
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith:
            # Note for future readers: For PowerShell 7+ the ExecutionPolicy is handled via a setting file due to the fact that PWSH7 is available for mac and linux
            # Attackers can create a per-user setting file (powershell.config.json) and set the execution policy there
            # Learn more here: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_config?view=powershell-7.3
            - '\ShellIds\Microsoft.PowerShell\ExecutionPolicy'
            - '\Policies\Microsoft\Windows\PowerShell\ExecutionPolicy'
        Details|contains:
            - 'Bypass'
            - 'Unrestricted'
    filter_main_svchost:
        # Note: We filter out "svchost" to avoid FP with changes using "gpedit" for example.
        Image|contains:
            - ':\Windows\System32\'
            - ':\Windows\SysWOW64\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

title: Proxy Execution via Vshadow
id: d7c75059-2901-4578-b209-8837fd31c6a8
status: experimental
description: |
    Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits.
    VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag,
    attackers can leverage this parameter to proxy the execution of malware.
author: David Faiss
date: 2025-05-26
references:
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
    - https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
tags:
    - attack.stealth
    - attack.t1202
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\vshadow.exe'
        - OriginalFileName: 'vshadow.exe'
    selection_cli:
        CommandLine|contains: '-exec'
    condition: all of selection_*
falsepositives:
    - System backup or administrator tools
    - Legitimate administrative scripts
level: medium

title: Python WebServer Execution - Linux
id: 3f0f5957-04f8-4792-ad89-192b0303bde6
status: experimental
description: |
    Detects the execution of Python web servers via command line interface (CLI).
    After gaining access to target systems, adversaries may use Python's built-in HTTP server modules to quickly establish a web server without requiring additional software.
    This technique is commonly used in post-exploitation scenarios as it provides a simple method for transferring files between the compromised host and attacker-controlled systems.
references:
    - https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
    - https://docs.python.org/3/library/http.server.html
    - https://docs.python.org/2/library/simplehttpserver.html
author: Mohamed LAKRI
date: 2025-10-17
tags:
    - attack.exfiltration
    - attack.t1048.003
logsource:
    product: linux
    category: process_creation
detection:
    selection_img:
        - Image|endswith:
              - '/python'
              - '/python2'
              - '/python3'
        - Image|contains:
              - '/python2.'  # python image is always of the form ../python3.10; ../python is just a symlink
              - '/python3.'
    selection_module:
        CommandLine|contains:
            - 'http.server'
            - 'SimpleHTTPServer'
    condition: all of selection_*
falsepositives:
    - Testing or development activity
level: medium

title: Query Tor Onion Address - DNS Client
id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2
related:
    - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544
      type: similar
    - id: a8322756-015c-42e7-afb1-436e85ed3ff5
      type: similar
status: test
description: Detects DNS resolution of an .onion address related to Tor routing networks
references:
    - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
    - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-02-20
modified: 2025-09-12
tags:
    - attack.command-and-control
    - attack.t1090.003
logsource:
    product: windows
    service: dns-client
    definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.'
detection:
    selection:
        EventID: 3008
        QueryName|endswith:
            - '.hiddenservice.net'
            - '.onion.ca'
            - '.onion.cab'
            - '.onion.casa'
            - '.onion.city'
            - '.onion.direct'
            - '.onion.dog'
            - '.onion.glass'
            - '.onion.gq'
            - '.onion.guide'
            - '.onion.in.net'
            - '.onion.ink'
            - '.onion.it'
            - '.onion.link'
            - '.onion.lt'
            - '.onion.lu'
            - '.onion.ly'
            - '.onion.mn'
            - '.onion.network'
            - '.onion.nu'
            - '.onion.pet'
            - '.onion.plus'
            - '.onion.pt'
            - '.onion.pw'
            - '.onion.rip'
            - '.onion.sh'
            - '.onion.si'
            - '.onion.to'
            - '.onion.top'
            - '.onion.ws'
            - '.onion'
            - '.s1.tor-gateways.de'
            - '.s2.tor-gateways.de'
            - '.s3.tor-gateways.de'
            - '.s4.tor-gateways.de'
            - '.s5.tor-gateways.de'
            - '.t2w.pw'
            - '.tor2web.ae.org'
            - '.tor2web.blutmagie.de'
            - '.tor2web.com'
            - '.tor2web.fi'
            - '.tor2web.io'
            - '.tor2web.org'
            - '.tor2web.xyz'
            - '.torlink.co'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Refresh Token Reuse Detection
id: a7b2e75c-7171-11f0-aa28-723487b9527c
name: selected_events
status: experimental
description: |
    This detection alerts when a refresh token is reused in an unsuccessful exchange attempt.
    Reusing refresh tokens can indicate an attempt to exploit the token or a misconfiguration in the application.
    This detection requires that the token rotation is enabled for an application.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
detection:
    selection:
        data.type: ferrt
        data.description: "Unsuccessful Refresh Token exchange, reused refresh token detected"
    condition: selection
explanation: >
    The query collects events issued when reuse is detected, i.e. ferrt.
    The Splunk query below also collects the number of affected users and total amount of violations.
    The alert is triggered when two criteria are met - 1. excessive number of violations is observed; 2. reuse is detected for too many users.
    It displays affected users.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=ferrt
    data.description="Unsuccessful Refresh Token exchange, reused refresh token detected"
    | fields data.user_id data.type
    | stats count(data.type) as detected_reuse_counter by data.user_id
    | where detected_reuse_counter > {excessive_reuse_threshold}
    | eventstats dc(data.user_id) as affected_users_total_count
    | where affected_users_total_count > {effected_users_threshold}
    ```Show the affected users in a table```
    | table data.user_id detected_reuse_counter
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name, and two thresholds.
    - The excessive_reuse_threshold is the number of reuse events for a single user that should trigger an alert.
    - The effected_users_threshold is the number of users that should be affected by the reuse to trigger an alert.
tenant_logs: |
    type: "ferrt" AND description: "Unsuccessful Refresh Token exchange, reused refresh token detected"
prevention:
    - Ensure that the application uses refresh tokens correctly to exclude misconfiguration as a cause of the reuse.
    - When tokens are requested by a frontend application, i.e. SPA, ensure that the application is not vulnerable to XSS that leads to token theft.
    - Terminate sessions and revoke tokens for affected users to pause the attack, however, it might come back when the user logs in again.
    - Deploy a post-login action that will compare IP/ASN of initial issuing of a refresh token and IP/ASN of the current refresh token.
      If they are different, terminate the session and revoke all refresh tokens.
    - This measure can help to prevent sophisticated forms of refresh token hijacking attacks, when an adversary times when the application will
      be shut down and thus avoiding a risk of rotation policy violation.
    - Consider to add additional layers to protect access tokens - sender-constrained flows (DPoP or mTLS) to address the possesion issue,
      back-channel logout to be able to revoke tokens, externalized authorization, e.g. with FGA, to avoid relying on permissions written in access tokens.
falsepositives:
    - Misconfigured applications that are caching refresh tokens.
    - Configured rotation overlap period is not adequate for application needs.
level: medium
tags:
    - attack.credential-access
    - attack.persistence
    - attack.t1550.001
    - attack.t1078
---
title: Refresh Token Reuse Detection - Correlation
id: a76f1e80-7208-4fe7-8aea-46cee74d1292
correlation:
    type: event_count
    rules:
        - selected_events # Referenced here
    group-by:
        - data.user_id
    timespan: 1d
    condition:
        gte: 1
        field: data.type

title: Remote Access Tool - ScreenConnect Installation Execution
id: 75bfe6e6-cd8e-429e-91d3-03921e1d7962
status: test
description: Detects ScreenConnect program starts that establish a remote access to a system.
references:
    - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
author: Florian Roth (Nextron Systems)
date: 2021-02-11
modified: 2024-02-26
tags:
    - attack.persistence
    - attack.initial-access
    - attack.t1133
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'e=Access&'
            - 'y=Guest&'
            - '&p='
            - '&c='
            - '&k='
    condition: selection
falsepositives:
    - Legitimate use by administrative staff
level: medium

title: Service permissions hijacked for privileges abuse (Reg via PowerShell)
description: Detects scenarios where an attacker modify the permissions of a service using native PowerShell commands in order to abuse its privileges. Note that it requires PowerShell 7 or higher.
references:
- http://woshub.com/set-permissions-on-windows-service/
- https://www.winhelponline.com/blog/view-edit-service-permissions-windows/
- https://decoder.cloud/2019/02/07/demystifying-windows-service-permissions-configuration/
- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.1
- https://medium.com/r3d-buck3t/abuse-service-registry-acls-windows-privesc-f88079140509
- https://github.com/rohnedwards/PowerShellAccessControl
tags:
- attack.persistence
- attack.t1543.003
- attack.t1574.010
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|re: '\\SYSTEM\\CurrentControlSet\\Services\\.*\\Security'
    EventData|contains|all:
      - '-ItemProperty' # Can be New-* or Set-*
      - Security

  selection_powershell_modern:
    EventID: 4103
    Payload|re: '\\SYSTEM\\CurrentControlSet\\Services\\.*\\Security'
    Payload|contains|all:
      - '-ItemProperty' # Can be New-* or Set-*
      - Security

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|re: '\\SYSTEM\\CurrentControlSet\\Services\\.*\\Security'
    ScriptBlockText|contains|all:
      - '-ItemProperty' # Can be New-* or Set-*
      - Security

  condition: 1 of selection*
falsepositives:
- administrator reconfiguring service
level: high

title: Silenttrinity Stager Msbuild Activity
id: 50e54b8d-ad73-43f8-96a1-5191685b17a4
status: test
description: Detects a possible remote connections to Silenttrinity c2
references:
    - https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
author: Kiran kumar s, oscd.community
date: 2020-10-11
modified: 2022-10-05
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\msbuild.exe'
    filter:
        DestinationPort:
            - 80
            - 443
        Initiated: 'true'
    condition: selection and filter
falsepositives:
    - Unknown
level: high

title: smbexec.py Service Installation
id: 52a85084-6989-40c3-8f32-091e12e13f09
status: test
description: Detects the use of smbexec.py tool by detecting a specific service installation
references:
    - https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/
    - https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296
    - https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60 # Old service name
author: Omer Faruk Celik
date: 2018-03-20
modified: 2023-11-09
tags:
    - attack.lateral-movement
    - attack.execution
    - attack.t1021.002
    - attack.t1569.002
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service_name:
        ServiceName: 'BTOBTO'
    selection_service_image:
        ImagePath|contains:
            - '.bat & del '
            - '__output 2^>^&1 >'
    condition: selection_eid and 1 of selection_service_*
falsepositives:
    - Unknown
level: high

title: Suspicious Eventlog Clearing or Configuration Change Activity
id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
status: stable
description: |
    Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
    This technique were seen used by threat actors and ransomware strains in order to evade defenses.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
    - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
    - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee
    - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/
    - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc
    - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
    - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
    - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2019-09-26
modified: 2026-06-01
tags:
    - attack.defense-impairment
    - attack.t1685.005
    - attack.t1685.001
    - car.2016-04-002
logsource:
    category: process_creation
    product: windows
detection:
    selection_wevtutil_img:
        - Image|endswith: '\wevtutil.exe'
        - OriginalFileName: 'wevtutil.exe'
    selection_wevtutil_cmd:
        CommandLine|contains:
            - 'clear-log '          # clears specified log
            - ' cl '                # short version of 'clear-log'
            - 'set-log '            # modifies config of specified log. could be used to set it to a tiny size
            - ' sl '                # short version of 'set-log'
            - 'lfn:'                # change log file location and name
    selection_other_ps_img:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
    selection_other_ps_cmd:
        - CommandLine|contains:
              - 'Clear-EventLog '
              - 'Remove-EventLog '
              - 'Limit-EventLog '
              - 'Clear-WinEvent '
        - CommandLine|contains|all:
              - 'Eventing.Reader.EventLogSession' # [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.ClearLog($_.LogName)
              - 'ClearLog'
        - CommandLine|contains|all:
              - 'Diagnostics.EventLog'
              - 'Clear'
    selection_other_wmi:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
            - '\wmic.exe'
        CommandLine|contains: 'ClearEventLog'
    filter_main_msiexec:
        # Example seen during office update/installation:
        #   ParentImage: C:\Windows\SysWOW64\msiexec.exe
        #   CommandLine: "C:\WINDOWS\system32\wevtutil.exe" sl Microsoft-RMS-MSIPC/Debug /q:true /e:true /l:4 /rt:false
        ParentImage:
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\System32\msiexec.exe'
        CommandLine|contains: ' sl '
    condition: ((all of selection_wevtutil_*) or (all of selection_other_ps_*) or selection_other_wmi) and not 1 of filter_main_*
falsepositives:
    - Admin activity
    - Scripts and administrative tools used in the monitored environment
    - Maintenance activity
level: high

title: Suspicious Git Clone - Linux
id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446
status: test
description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
references:
    - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-03
modified: 2023-01-05
tags:
    - attack.reconnaissance
    - attack.t1593.003
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/git'
        CommandLine|contains: ' clone '
    selection_keyword:
        CommandLine|contains:
            # Add more suspicious keywords
            - 'exploit'
            - 'Vulns'
            - 'vulnerability'
            - 'RCE'
            - 'RemoteCodeExecution'
            - 'Invoke-'
            - 'CVE-'
            - 'poc-'
            - 'ProofOfConcept'
            # Add more vuln names
            - 'proxyshell'
            - 'log4shell'
            - 'eternalblue'
            - 'eternal-blue'
            - 'MS17-'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: Suspicious Userinit Child Process
id: b655a06a-31c0-477a-95c2-3726b83d649d
status: test
description: Detects a suspicious child process of userinit
references:
    - https://twitter.com/SBousseaden/status/1139811587760562176
author: Florian Roth (Nextron Systems), Samir Bousseaden (idea)
date: 2019-06-17
modified: 2025-10-17
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\userinit.exe'
    filter_main_netlogon:
        CommandLine|contains: '\netlogon\'
    filter_main_explorer:
        - Image|endswith: '\explorer.exe'
        - OriginalFileName: 'explorer.exe'
        - CommandLine: 'C:\Windows\Explorer.EXE'
    filter_main_null:
        Image: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Administrative scripts
level: medium

title: User files dump via network share (DonPapi, Lazagne)
description: Detects scenarios where an attacker attempt to dump user profile information via network share.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1555-Credentials%20from%20Password%20Stores
- https://github.com/login-securite/DonPAPI
tags:
- attack.credential_access
- attack.t1555
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5145
    ShareName: '\\*\C$'
    RelativeTargetName|re:
      - Users\\.*\\Desktop.*
      - Users\\.*\\Recent.*
      - Users\\.*\\Downloads.*
      #- Users\\.* # More broader filter
  filter:
    - RelativeTargetName|re: Users\\.*\\AppData\\.* # handled in another rule
    - IpAddress:
      - '%vulnerability_scanners%'
      - '%admin_netork_administration%'
  condition: selection and not filter | count(RelativeTargetName) by Computer > 15 # Counting over different user names in the path can also decrease false positives
  timeframe: 5m
falsepositives:
- Roaming user profile, vulnerability scanners
level: high