Detection rules › Sigma

Sigma rules: 1d

Rule	Severity
Auditing Configuration Changes on Linux Host	`high`
AWS CloudTrail Important Change	`medium`
Certificate Exported Via PowerShell	`medium`
CobaltStrike Service Installations - Security	`high`
Download File To Potentially Suspicious Directory Via Wget	`medium`
Elise Backdoor Activity	`critical`
Firewall Rule Update Via Netsh.EXE	`medium`
Github Self Hosted Runner Changes Detected	`low`
Hacktool Execution - Imphash	`critical`
Linux Base64 Encoded Pipe to Shell	`medium`
Many AccessDenied Errors from Single Source	`high`
Many Failed Logins	`high`
Potential Arbitrary Command Execution Via FTP.EXE	`medium`
Potential Binary Or Script Dropper Via PowerShell	`medium`
Potential CVE-2023-36884 URL Request Pattern Traffic	`high`
Potential Operation Triangulation C2 Beaconing Activity - Proxy	`high`
Potential Persistence Via Notepad++ Plugins	`medium`
Potential Suspicious Activity Using SeCEdit	`medium`
Potentially Suspicious Ping/Copy Command Combination	`medium`
PowerShell Set-Acl On Windows Folder - PsScript	`high`
PowerShell WMI Win32_Product Install MSI	`medium`
PUA - DefenderCheck Execution	`high`
Remote Access Tool - RURAT Execution From Unusual Location	`medium`
Remote Access Tool - ScreenConnect Execution	`medium`
RunDLL32 Spawning Explorer	`high`
Scheduled Task Creation From Potential Suspicious Parent Location	`medium`
Suspicious Printer Driver Empty Manufacturer	`high`
Suspicious Process Execution From Fake Recycle.Bin Folder	`high`
Sysinternals PsService Execution	`medium`
System Language Discovery via Reg.Exe	`medium`
Uncommon Svchost Command Line Parameter	`high`
Vault credentials manager accessed	`high`
VMToolsd Suspicious Child Process	`high`
Whoami.EXE Execution From Privileged Process	`high`
Winlogon Notify Key Logon Persistence	`high`

Auditing Configuration Changes on Linux Host

Status: test
Severity: high
Author: Mikhail Larin, oscd.community
Source: github.com/SigmaHQ/sigma

Detect changes in auditd configuration files

Known False Positives

Legitimate administrative activity

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	`T1685` Disable or Modify Tools

Telemetry Coverage

Platform	Record / event type
Linux	auditd PATH record: Filename path information

Rule Body

title: Auditing Configuration Changes on Linux Host
id: 977ef627-4539-4875-adf4-ed8f780c4922
status: test
description: Detect changes in auditd configuration files
references:
    - https://github.com/Neo23x0/auditd/blob/master/audit.rules
    - Self Experience
author: Mikhail Larin, oscd.community
date: 2019-10-25
modified: 2021-11-27
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: PATH
        name:
            - /etc/audit/*
            - /etc/libaudit.conf
            - /etc/audisp/*
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    type: PATH
    name:
        - /etc/audit/*
        - /etc/libaudit.conf
        - /etc/audisp/*

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`name`	wildcard	`/etc/audisp/` `/etc/audit/` `/etc/libaudit.conf`	`field:"name" kind:wildcard`
`type`	eq	`PATH` corpus 19 (sigma 12, splunk 7)	`field:"type" kind:eq value:"PATH"`

AWS CloudTrail Important Change

Status: test
Severity: medium
Author: vitaliy0x1
Source: github.com/SigmaHQ/sigma

Detects disabling, deleting and updating of a Trail

Known False Positives

Valid change in a Trail

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	`T1685.002` Disable or Modify Tools: Disable or Modify Cloud Log

Telemetry Coverage

Platform	Record / event type
AWS	CloudTrail event `DeleteTrail`: Deletes a CloudTrail trail, permanently stopping the delivery of log files for that trail to its configured S3 bucket.
AWS	CloudTrail event `StopLogging`: Suspends CloudTrail logging for a trail, halting the delivery of new log files while preserving the trail configuration.
AWS	CloudTrail event `UpdateTrail`: Updates the settings of an existing CloudTrail trail, such as its S3 bucket, SNS topic, or log file validation configuration.

Rules Detecting the Same Action

These rules filter on the same operation.

Attempt To Delete A CloudTrail Log (Sigma)
Attempt To Modify CloudTrail Log Settings (Sigma)
Attempt To Stop CloudTrail Logging (Sigma)
AWS CloudTrail Log Deleted (Elastic)
AWS CloudTrail Log Suspended (Elastic)
AWS CloudTrail Log Updated (Elastic)
AWS Defense Evasion Delete Cloudtrail (Splunk)
AWS Defense Evasion Stop Logging Cloudtrail (Splunk)

Rule Body

title: AWS CloudTrail Important Change
id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74
status: test
description: Detects disabling, deleting and updating of a Trail
references:
    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html
author: vitaliy0x1
date: 2020-01-21
modified: 2022-10-09
tags:
    - attack.defense-impairment
    - attack.t1685.002
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_source:
        eventSource: cloudtrail.amazonaws.com
        eventName:
            - StopLogging
            - UpdateTrail
            - DeleteTrail
    condition: selection_source
falsepositives:
    - Valid change in a Trail
level: medium

Stages and Predicates

Stage 0: `condition`

selection_source

Stage 1: `selection_source`

selection_source:
    eventSource: cloudtrail.amazonaws.com
    eventName:
        - StopLogging
        - UpdateTrail
        - DeleteTrail

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`DeleteTrail` corpus 5 (sigma 3, splunk 2) `StopLogging` corpus 5 (sigma 3, splunk 2) `UpdateTrail` corpus 5 (sigma 3, splunk 2)	`field:"aws::eventName" kind:eq`
`eventSource`	eq	`cloudtrail.amazonaws.com` corpus 10 (sigma 7, splunk 3)	`field:"aws::eventSource" kind:eq value:"cloudtrail.amazonaws.com"`

Certificate Exported Via PowerShell

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Known False Positives

Legitimate certificate exports by administrators. Additional filters might be required.

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell
Credential Access	`T1552.004` Unsecured Credentials: Private Keys

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Certificate Exported Via PowerShell
id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
related:
    - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c
      type: similar
status: test
description: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.
references:
    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
    - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
    - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-18
tags:
    - attack.credential-access
    - attack.execution
    - attack.t1552.004
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        CommandLine|contains:
            - 'Export-PfxCertificate '
            - 'Export-Certificate '
    condition: selection
falsepositives:
    - Legitimate certificate exports by administrators. Additional filters might be required.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    CommandLine|contains:
        - 'Export-PfxCertificate '
        - 'Export-Certificate '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Export-Certificate` `Export-PfxCertificate`	`field:"CommandLine" kind:match`

CobaltStrike Service Installations - Security

Status: test
Severity: high
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
Source: github.com/SigmaHQ/sigma

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1569.002` System Services: Service Execution
Persistence	`T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service
Lateral Movement	`T1021.002` Remote Services: SMB/Windows Admin Shares

Telemetry Coverage

Provider	Record / event type
Security-Auditing	Event ID 4697: A service was installed in the system.

Rule Body

title: CobaltStrike Service Installations - Security
id: d7a95147-145f-4678-b85d-d1ff4a3bb3f6
related:
    - id: 5a105d34-05fc-401e-8553-272b45c1522d
      type: derived
status: test
description: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement
references:
    - https://www.sans.org/webcasts/119395
    - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
    - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
author: Florian Roth (Nextron Systems), Wojciech Lesicki
date: 2021-05-26
modified: 2022-11-27
tags:
    - attack.persistence
    - attack.execution
    - attack.privilege-escalation
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1543.003
    - attack.t1569.002
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    event_id:
        EventID: 4697
    selection1:
        ServiceFileName|contains|all:
            - 'ADMIN$'
            - '.exe'
    selection2:
        ServiceFileName|contains|all:
            - '%COMSPEC%'
            - 'start'
            - 'powershell'
    selection3:
        ServiceFileName|contains: 'powershell -nop -w hidden -encodedcommand'
    selection4:
        ServiceFileName|base64offset|contains: "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
    condition: event_id and 1 of selection*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

event_id and 1 of selection*

Stage 1: `event_id`

event_id:
    EventID: 4697

Stage 2: `selection1`

selection1:
    ServiceFileName|contains|all:
        - 'ADMIN$'
        - '.exe'

Stage 3: `selection2`

selection2:
    ServiceFileName|contains|all:
        - '%COMSPEC%'
        - 'start'
        - 'powershell'

Stage 4: `selection3`

selection3:
    ServiceFileName|contains: 'powershell -nop -w hidden -encodedcommand'

Stage 5: `selection4`

selection4:
    ServiceFileName|base64offset|contains: "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ServiceFileName`	match	`%COMSPEC%` corpus 2 (sigma 2) `.exe` `ADMIN$` corpus 2 (sigma 1, elastic 1) `JRVggKE5ldy1PYmplY3QgTmV0LldlYmNsaWVudCkuRG93bmxvYWRTdHJpbmcoJ2h0dHA6Ly8xMjcuMC4wLjE6` `SUVYIChOZXctT2JqZWN0IE5ldC5XZWJjbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vMTI3LjAuMC4xO` `lFWCAoTmV3LU9iamVjdCBOZXQuV2ViY2xpZW50KS5Eb3dubG9hZFN0cmluZygnaHR0cDovLzEyNy4wLjAuMT` `powershell` corpus 4 (sigma 4) `powershell -nop -w hidden -encodedcommand` `start`	`field:"ServiceFileName" kind:match`

Download File To Potentially Suspicious Directory Via Wget

Status: test
Severity: medium
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Source: github.com/SigmaHQ/sigma

Detects the use of wget to download content to a suspicious directory

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1105` Ingress Tool Transfer

Telemetry Coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule Body

title: Download File To Potentially Suspicious Directory Via Wget
id: cf610c15-ed71-46e1-bdf8-2bd1a99de6c4
status: test
description: Detects the use of wget to download content to a suspicious directory
references:
    - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
    - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
    - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
    - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-06-02
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/wget'
    selection_output:
        - CommandLine|re: '\s-O\s' # We use regex to ensure a case sensitive argument detection
        - CommandLine|contains: '--output-document'
    selection_path:
        CommandLine|contains: '/tmp/'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    Image|endswith: '/wget'

Stage 2: `selection_output`

selection_output:
    - CommandLine|re: '\s-O\s'
    - CommandLine|contains: '--output-document'

Stage 3: `selection_path`

selection_path:
    CommandLine|contains: '/tmp/'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`--output-document` corpus 4 (sigma 4) `/tmp/` corpus 10 (sigma 8, elastic 2)	`field:"CommandLine" kind:match`
`CommandLine`	regex_match	`\s-O\s` corpus 4 (sigma 4)	`field:"CommandLine" kind:regex_match value:"\s-O\s"`
`Image`	ends_with	`/wget` corpus 14 (sigma 14)	`field:"Image" kind:ends_with value:"/wget"`

Elise Backdoor Activity

Status: test
Severity: critical
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects Elise backdoor activity used by APT32

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059.003` Command and Scripting Interpreter: Windows Command Shell

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Elise Backdoor Activity
id: e507feb7-5f73-4ef6-a970-91bb6f6d744f
status: test
description: Detects Elise backdoor activity used by APT32
references:
    - https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
    - https://web.archive.org/web/20200302083912/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2018-01-31
modified: 2023-03-09
tags:
    - attack.g0030
    - attack.g0050
    - attack.s0081
    - attack.execution
    - attack.t1059.003
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_other_svchost:
        Image|endswith: '\Microsoft\Network\svchost.exe'
    selection_other_del:
        CommandLine|contains|all:
            - '\Windows\Caches\NavShExt.dll'
            - '/c del'
    selection_dll_path:
        CommandLine|endswith:
            - '\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll'
            - '\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll'
    selection_dll_function:
        CommandLine|contains: ',Setting'
    condition: 1 of selection_other_* or all of selection_dll_*
falsepositives:
    - Unlikely
level: critical

Stages and Predicates

Stage 0: `condition`

1 of selection_other_* or all of selection_dll_*

Stage 1: `selection_other_svchost`

selection_other_svchost:
    Image|endswith: '\Microsoft\Network\svchost.exe'

Stage 2: `selection_other_del`

selection_other_del:
    CommandLine|contains|all:
        - '\Windows\Caches\NavShExt.dll'
        - '/c del'

Stage 3: `selection_dll_path`

selection_dll_path:
    CommandLine|endswith:
        - '\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll'
        - '\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll'

Stage 4: `selection_dll_function`

selection_dll_function:
    CommandLine|contains: ',Setting'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll` `\AppData\Roaming\Microsoft\Windows\Caches\NavShExt.dll`	`field:"CommandLine" kind:ends_with`
`CommandLine`	match	`,Setting` `/c del` `\Windows\Caches\NavShExt.dll`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\Microsoft\Network\svchost.exe`	`field:"Image" kind:ends_with value:"\Microsoft\Network\svchost.exe"`

Firewall Rule Update Via Netsh.EXE

Status: test
Severity: medium
Author: X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

Known False Positives

Legitimate administration activity
Software installations and removal

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Firewall Rule Update Via Netsh.EXE
id: a70dcb37-3bee-453a-99df-d0c683151be6
status: test
description: Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule
references:
    - https://ss64.com/nt/netsh.html
author: X__Junior (Nextron Systems)
date: 2023-07-18
tags:
    - attack.defense-impairment
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\netsh.exe'
        - OriginalFileName: 'netsh.exe'
    selection_cli:
        CommandLine|contains|all:
            # Example 1: netsh advfirewall firewall set rule "group=\"Network Discovery\" " new enable=Yes"
            # Example 2: netsh advfirewall firewall set rule "group=\"File and Printer Sharing\" " new enable=Yes"
            - ' firewall '
            - ' set '
    condition: all of selection_*
falsepositives:
    - Legitimate administration activity
    - Software installations and removal
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\netsh.exe'
    - OriginalFileName: 'netsh.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - ' firewall '
        - ' set '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`firewall` corpus 3 (sigma 2, splunk 1) `set` corpus 4 (sigma 4)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\netsh.exe` corpus 28 (sigma 28)	`field:"Image" kind:ends_with value:"\netsh.exe"`
`OriginalFileName`	eq	`netsh.exe` corpus 21 (sigma 14, splunk 7)	`field:"OriginalFileName" kind:eq value:"netsh.exe"`

Github Self Hosted Runner Changes Detected

Status: test
Severity: low
Author: Muhammad Faisal (@faisalusuf)
Source: github.com/SigmaHQ/sigma

A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context.

Known False Positives

Allowed self-hosted runners changes in the environment.
A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days.
An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day.

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	`T1078.004` Valid Accounts: Cloud Accounts
Persistence	`T1078.004` Valid Accounts: Cloud Accounts
Privilege Escalation	`T1078.004` Valid Accounts: Cloud Accounts
Stealth	`T1078.004` Valid Accounts: Cloud Accounts
Discovery	`T1526` Cloud Service Discovery
Collection	`T1213.003` Data from Information Repositories: Code Repositories

Telemetry Coverage

Platform	Record / event type
GitHub	Audit log action `org.remove_self_hosted_runner`: Self-hosted runner removed
GitHub	Audit log action `org.runner_group_created`: Self-hosted runner group created
GitHub	Audit log action `org.runner_group_removed`: Self-hosted runner group removed
GitHub	Audit log action `org.runner_group_runner_removed`: Self-hosted runner removed from group via REST API
GitHub	Audit log action `org.runner_group_runners_added`: Self-hosted runner added to group
GitHub	Audit log action `org.runner_group_runners_updated`: Runner group member list updated
GitHub	Audit log action `org.runner_group_updated`: Self-hosted runner group configuration changed
GitHub	Audit log action `repo.register_self_hosted_runner`: Self-hosted runner registered
GitHub	Audit log action `repo.remove_self_hosted_runner`: Self-hosted runner removed

Rules Detecting the Same Action

These rules filter on the same operation.

New GitHub Self Hosted Action Runner (Elastic)

Rule Body

title: Github Self Hosted Runner Changes Detected
id: f8ed0e8f-7438-4b79-85eb-f358ef2fbebd
status: test
description: |
    A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com.
    This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected,
    it should be validated from GitHub UI because the log entry may not provide full context.
author: Muhammad Faisal (@faisalusuf)
date: 2023-01-27
references:
    - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners
    - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation
tags:
    - attack.impact
    - attack.discovery
    - attack.collection
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
    - attack.stealth
    - attack.t1526
    - attack.t1213.003
    - attack.t1078.004
logsource:
    product: github
    service: audit
    definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'
detection:
    selection:
        action:
            - 'org.remove_self_hosted_runner'
            - 'org.runner_group_created'
            - 'org.runner_group_removed'
            - 'org.runner_group_runner_removed'
            - 'org.runner_group_runners_added'
            - 'org.runner_group_runners_updated'
            - 'org.runner_group_updated'
            - 'repo.register_self_hosted_runner'
            - 'repo.remove_self_hosted_runner'
    condition: selection
falsepositives:
    - Allowed self-hosted runners changes in the environment.
    - A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days.
    - An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    action:
        - 'org.remove_self_hosted_runner'
        - 'org.runner_group_created'
        - 'org.runner_group_removed'
        - 'org.runner_group_runner_removed'
        - 'org.runner_group_runners_added'
        - 'org.runner_group_runners_updated'
        - 'org.runner_group_updated'
        - 'repo.register_self_hosted_runner'
        - 'repo.remove_self_hosted_runner'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`action`	eq	`org.remove_self_hosted_runner` `org.runner_group_created` `org.runner_group_removed` `org.runner_group_runner_removed` `org.runner_group_runners_added` `org.runner_group_runners_updated` `org.runner_group_updated` `repo.register_self_hosted_runner` `repo.remove_self_hosted_runner`	`field:"action" kind:eq`

Hacktool Execution - Imphash

Status: test
Severity: critical
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Known False Positives

Legitimate use of one of these tools

MITRE ATT&CK Coverage

Tactic	Techniques
Resource Development	`T1588.002` Obtain Capabilities: Tool
Credential Access	`T1003` OS Credential Dumping

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Hacktool Execution - Imphash
id: 24e3e58a-646b-4b50-adef-02ef935b9fc8
status: test
description: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2022-03-04
modified: 2024-11-23
tags:
    - attack.credential-access
    - attack.resource-development
    - attack.t1588.002
    - attack.t1003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Hashes|contains: # Sysmon field hashes contains all types
            - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 # PetitPotam
            - IMPHASH=3A19059BD7688CB88E70005F18EFC439 # PetitPotam
            - IMPHASH=bf6223a49e45d99094406777eb6004ba # PetitPotam
            - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 # JuicyPotato
            - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC # JuicyPotato
            - IMPHASH=F9A28C458284584A93B14216308D31BD # JuicyPotatoNG
            - IMPHASH=6118619783FC175BC7EBECFF0769B46E # RoguePotato
            - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA # RoguePotato
            - IMPHASH=563233BFA169ACC7892451F71AD5850A # RoguePotato
            - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 # RoguePotato
            - IMPHASH=13F08707F759AF6003837A150A371BA1 # Pwdump
            - IMPHASH=1781F06048A7E58B323F0B9259BE798B # Pwdump
            - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 # Pwdump
            - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D # Pwdump
            - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 # Pwdump
            - IMPHASH=713C29B396B907ED71A72482759ED757 # Pwdump
            - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F # Pwdump
            - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E # Pwdump
            - IMPHASH=8B114550386E31895DFAB371E741123D # Pwdump
            - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 # PwDumpX
            - IMPHASH=9D68781980370E00E0BD939EE5E6C141 # Pwdump
            - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE # Pwdump
            - IMPHASH=CB567F9498452721D77A451374955F5F # Pwdump
            - IMPHASH=730073214094CD328547BF1F72289752 # Htran
            - IMPHASH=17B461A082950FC6332228572138B80C # Cobalt Strike beacons
            - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 # Cobalt Strike beacons
            - IMPHASH=819B19D53CA6736448F9325A85736792 # Cobalt Strike beacons
            - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E # Cobalt Strike beacons
            - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 # PPLDump
            - IMPHASH=0588081AB0E63BA785938467E1B10CCA # PPLDump
            - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C # NanoDump
            - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 # NanoDump
            - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 # NanoDump
            - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 # NanoDump
            - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF # NanoDump
            - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE # NanoDump
            - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 # NanoDump
            - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 # NanoDump
            - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E # NanoDump
            - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 # NanoDump
            - IMPHASH=3AD59991CCF1D67339B319B15A41B35D # NanoDump
            - IMPHASH=FFDD59E0318B85A3E480874D9796D872 # NanoDump
            - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 # NanoDump
            - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 # NanoDump
            - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 # NanoDump
            - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 # HandleKatz
            - IMPHASH=0E2216679CA6E1094D63322E3412D650 # HandleKatz
            - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB # DripLoader
            - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 # DripLoader
            - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 # DripLoader
            - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 # DripLoader
            - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F # CreateMiniDump
            - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 # UACMe Akagi
            - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 # UACMe Akagi
            - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC # UACMe Akagi
            - IMPHASH=7D010C6BB6A3726F327F7E239166D127 # UACMe Akagi
            - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 # UACMe Akagi
            - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F # UACMe Akagi
            - IMPHASH=5834ED4291BDEB928270428EBBAF7604 # UACMe Akagi
            - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 # UACMe Akagi
            - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 # UACMe Akagi
            - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 # UACMe Akagi
            - IMPHASH=3DE09703C8E79ED2CA3F01074719906B # UACMe Akagi
            - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F # WCE
            - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 # WCE
            - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 # Sliver Stagers
            - IMPHASH=09D278F9DE118EF09163C6140255C690 # Dumpert
            - IMPHASH=03866661686829d806989e2fc5a72606 # Dumpert
            - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d # Dumpert
            - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE # SysmonEnte
            - IMPHASH=19584675D94829987952432E018D5056 # SysmonQuiet
            - IMPHASH=330768A4F172E10ACB6287B87289D83B # ShaprEvtMute Hook
            - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 # Forkatz
            - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC # PPLKiller
            - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 # PPLKiller
            - IMPHASH=96DF3A3731912449521F6F8D183279B1 # Backstab
            - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 # Backstab
            - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 # Backstab
            - IMPHASH=25CE42B079282632708FC846129E98A5 # Forensia
            - IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20 # EDRSandBlast
            - IMPHASH=59223B5F52D8799D38E0754855CBDF42 # EDRSandBlast
            - IMPHASH=81E75D8F1D276C156653D3D8813E4A43 # EDRSandBlast
            - IMPHASH=17244E8B6B8227E57FE709CCAD421420 # EDRSandBlast
            - IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4 # EDRSandBlast
            - IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C # EDRSandBlast
            - IMPHASH=40445337761D80CF465136FAFB1F63E6 # EDRSandBlast
            - IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6 # EDRSilencer
            - IMPHASH=B50199E952C875241B9CE06C971CE3C1 # EventLogCrasher
    condition: selection
falsepositives:
    - Legitimate use of one of these tools
level: critical

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Hashes|contains:
        - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932
        - IMPHASH=3A19059BD7688CB88E70005F18EFC439
        - IMPHASH=bf6223a49e45d99094406777eb6004ba
        - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1
        - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC
        - IMPHASH=F9A28C458284584A93B14216308D31BD
        - IMPHASH=6118619783FC175BC7EBECFF0769B46E
        - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA
        - IMPHASH=563233BFA169ACC7892451F71AD5850A
        - IMPHASH=87575CB7A0E0700EB37F2E3668671A08
        - IMPHASH=13F08707F759AF6003837A150A371BA1
        - IMPHASH=1781F06048A7E58B323F0B9259BE798B
        - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5
        - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D
        - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2
        - IMPHASH=713C29B396B907ED71A72482759ED757
        - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F
        - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E
        - IMPHASH=8B114550386E31895DFAB371E741123D
        - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793
        - IMPHASH=9D68781980370E00E0BD939EE5E6C141
        - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE
        - IMPHASH=CB567F9498452721D77A451374955F5F
        - IMPHASH=730073214094CD328547BF1F72289752
        - IMPHASH=17B461A082950FC6332228572138B80C
        - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9
        - IMPHASH=819B19D53CA6736448F9325A85736792
        - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E
        - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74
        - IMPHASH=0588081AB0E63BA785938467E1B10CCA
        - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C
        - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29
        - IMPHASH=4DA924CF622D039D58BCE71CDF05D242
        - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66
        - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF
        - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE
        - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4
        - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338
        - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E
        - IMPHASH=E6F9D5152DA699934B30DAAB206471F6
        - IMPHASH=3AD59991CCF1D67339B319B15A41B35D
        - IMPHASH=FFDD59E0318B85A3E480874D9796D872
        - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051
        - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51
        - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1
        - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055
        - IMPHASH=0E2216679CA6E1094D63322E3412D650
        - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB
        - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798
        - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4
        - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80
        - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F
        - IMPHASH=767637C23BB42CD5D7397CF58B0BE688
        - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8
        - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC
        - IMPHASH=7D010C6BB6A3726F327F7E239166D127
        - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3
        - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F
        - IMPHASH=5834ED4291BDEB928270428EBBAF7604
        - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38
        - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894
        - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74
        - IMPHASH=3DE09703C8E79ED2CA3F01074719906B
        - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F
        - IMPHASH=E96A73C7BF33A464C510EDE582318BF2
        - IMPHASH=32089B8851BBF8BC2D014E9F37288C83
        - IMPHASH=09D278F9DE118EF09163C6140255C690
        - IMPHASH=03866661686829d806989e2fc5a72606
        - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d
        - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE
        - IMPHASH=19584675D94829987952432E018D5056
        - IMPHASH=330768A4F172E10ACB6287B87289D83B
        - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313
        - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC
        - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28
        - IMPHASH=96DF3A3731912449521F6F8D183279B1
        - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46
        - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17
        - IMPHASH=25CE42B079282632708FC846129E98A5
        - IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20
        - IMPHASH=59223B5F52D8799D38E0754855CBDF42
        - IMPHASH=81E75D8F1D276C156653D3D8813E4A43
        - IMPHASH=17244E8B6B8227E57FE709CCAD421420
        - IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4
        - IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C
        - IMPHASH=40445337761D80CF465136FAFB1F63E6
        - IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6
        - IMPHASH=B50199E952C875241B9CE06C971CE3C1

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Hashes`	match	`IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20` corpus 2 (sigma 2) `IMPHASH=03866661686829d806989e2fc5a72606` corpus 2 (sigma 2) `IMPHASH=0588081AB0E63BA785938467E1B10CCA` corpus 2 (sigma 2) `IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51` corpus 2 (sigma 2) `IMPHASH=09D278F9DE118EF09163C6140255C690` corpus 2 (sigma 2) `IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4` corpus 2 (sigma 2) `IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338` corpus 2 (sigma 2) `IMPHASH=0CF479628D7CC1EA25EC7998A92F5051` corpus 2 (sigma 2) `IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C` corpus 2 (sigma 2) `IMPHASH=0E2216679CA6E1094D63322E3412D650` corpus 3 (sigma 3) `IMPHASH=11083E75553BAAE21DC89CE8F9A195E4` corpus 2 (sigma 2) `IMPHASH=13F08707F759AF6003837A150A371BA1` corpus 2 (sigma 2) `IMPHASH=14C4E4C72BA075E9069EE67F39188AD8` corpus 3 (sigma 3) `IMPHASH=17244E8B6B8227E57FE709CCAD421420` corpus 2 (sigma 2) `IMPHASH=1781F06048A7E58B323F0B9259BE798B` corpus 2 (sigma 2) `IMPHASH=17B461A082950FC6332228572138B80C` corpus 2 (sigma 2) `IMPHASH=19584675D94829987952432E018D5056` corpus 2 (sigma 2) `IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC` corpus 2 (sigma 2) `IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5` corpus 2 (sigma 2) `IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1` corpus 2 (sigma 2) `IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D` corpus 2 (sigma 2) `IMPHASH=25CE42B079282632708FC846129E98A5` corpus 2 (sigma 2) `IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798` corpus 2 (sigma 2) `IMPHASH=32089B8851BBF8BC2D014E9F37288C83` corpus 2 (sigma 2) `IMPHASH=330768A4F172E10ACB6287B87289D83B` corpus 3 (sigma 3) `IMPHASH=38D9E015591BBFD4929E0D0F47FA0055` corpus 3 (sigma 3) `IMPHASH=3A19059BD7688CB88E70005F18EFC439` corpus 2 (sigma 2) `IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E` corpus 2 (sigma 2) `IMPHASH=3AD59991CCF1D67339B319B15A41B35D` corpus 2 (sigma 2) `IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC` corpus 3 (sigma 3) `IMPHASH=3DE09703C8E79ED2CA3F01074719906B` corpus 3 (sigma 3) `IMPHASH=40445337761D80CF465136FAFB1F63E6` corpus 2 (sigma 2) `IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74` corpus 3 (sigma 3) `IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F` corpus 3 (sigma 3) `IMPHASH=4DA924CF622D039D58BCE71CDF05D242` corpus 2 (sigma 2) `IMPHASH=51791678F351C03A0EB4E2A7B05C6E17` corpus 2 (sigma 2) `IMPHASH=563233BFA169ACC7892451F71AD5850A` corpus 2 (sigma 2) `IMPHASH=5834ED4291BDEB928270428EBBAF7604` corpus 3 (sigma 3) `IMPHASH=59223B5F52D8799D38E0754855CBDF42` corpus 2 (sigma 2) `IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38` corpus 3 (sigma 3) +48 more values (see full rule source)	`field:"Hashes" kind:match`

Linux Base64 Encoded Pipe to Shell

Status: test
Severity: medium
Author: pH-T (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious process command line that uses base64 encoded input for execution with a shell

Known False Positives

Legitimate administration activities

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1140` Deobfuscate/Decode Files or Information

Telemetry Coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule Body

title: Linux Base64 Encoded Pipe to Shell
id: ba592c6d-6888-43c3-b8c6-689b8fe47337
status: test
description: Detects suspicious process command line that uses base64 encoded input for execution with a shell
references:
    - https://github.com/arget13/DDexec
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: pH-T (Nextron Systems)
date: 2022-07-26
modified: 2023-06-16
tags:
    - attack.stealth
    - attack.t1140
logsource:
    product: linux
    category: process_creation
detection:
    selection_base64:
        CommandLine|contains: 'base64 '
    selection_exec:
        - CommandLine|contains:
              - '| bash '
              - '| sh '
              - '|bash '
              - '|sh '
        - CommandLine|endswith:
              - ' |sh'
              - '| bash'
              - '| sh'
              - '|bash'
    condition: all of selection_*
falsepositives:
    - Legitimate administration activities
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_base64`

selection_base64:
    CommandLine|contains: 'base64 '

Stage 2: `selection_exec`

selection_exec:
    - CommandLine|contains:
          - '| bash '
          - '| sh '
          - '|bash '
          - '|sh '
    - CommandLine|endswith:
          - ' |sh'
          - '| bash'
          - '| sh'
          - '|bash'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`\|sh` corpus 2 (sigma 2) `\| bash` corpus 2 (sigma 2) `\| sh` corpus 2 (sigma 2) `\|bash` corpus 2 (sigma 2)	`field:"CommandLine" kind:ends_with`
`CommandLine`	match	`base64` `\| bash` corpus 2 (sigma 2) `\| sh` corpus 2 (sigma 2) `\|bash` corpus 2 (sigma 2) `\|sh` corpus 2 (sigma 2)	`field:"CommandLine" kind:match`

Many AccessDenied Errors from Single Source

Status: test
Severity: high
Time window: 10m
Author: nishikawaakira (@nishikawaakira)
Source: github.com/Yamato-Security/suzaku-rules

Detects multiple authorization failure errors from the same source IP and access key within a short time window. This pattern indicates an attacker probing AWS APIs with stolen credentials that have restricted permissions. Covers both IAM-level AccessDenied and EC2-style Client.UnauthorizedOperation. Attackers who obtain credentials via SSRF, leaked .env files, or code repositories typically enumerate dozens of AWS APIs to discover what they can access.

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1580` Cloud Infrastructure Discovery

Rule Body

title: Many AccessDenied Errors from Single Source
id: 4a6b8c0d-2e3f-5a7b-9c1d-3e4f5a6b7c8d
status: test
description: |
    Detects multiple authorization failure errors from the same source IP and
    access key within a short time window. This pattern indicates an attacker
    probing AWS APIs with stolen credentials that have restricted permissions.
    Covers both IAM-level AccessDenied and EC2-style Client.UnauthorizedOperation.
    Attackers who obtain credentials via SSRF, leaked .env files, or code
    repositories typically enumerate dozens of AWS APIs to discover what they
    can access.
references:
    - https://attack.mitre.org/techniques/T1580/
    - https://hackingthe.cloud/aws/general-knowledge/using_stolen_iam_credentials/
author: nishikawaakira (@nishikawaakira)
date: 2026-05-03
modified: 2026-05-29
tags:
    - attack.discovery
    - attack.t1580
logsource:
    product: aws
    service: cloudtrail
correlation:
    type: event_count
    rules:
        - AccessDenied Error
    group-by:
        - sourceIPAddress
        - userIdentity.accessKeyId
    timespan: 10m
    condition:
        gte: 10
    generate: false
level: high
---
title: AccessDenied Error
id: 4a6b8c0d-2e3f-5a7b-9c1d-3e4f5a6b7c8e
status: test
description: Base rule for AccessDenied correlation.
references:
author: nishikawaakira (@nishikawaakira)
date: 2026-05-03
modified: 2026-05-29
tags:
    - attack.discovery
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        errorCode:
            - AccessDenied
            - Client.UnauthorizedOperation
    condition: selection
level: informational

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    errorCode:
        - AccessDenied
        - Client.UnauthorizedOperation

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`errorCode`	eq	`AccessDenied` `Client.UnauthorizedOperation`	`field:"aws::errorCode" kind:eq`

Many Failed Logins

Status: test
Severity: high
Time window: 5m
Author: Zach Mathis (@yamatosecurity)
Source: github.com/Yamato-Security/suzaku-rules

Detects multiple failed console login attempts, which may indicate an attacker attempting password guessing or password spraying. This rule can be evaded if the attacker uses a different source IP address for each login attempt, so you may want to not group by source IP address to detect that evasion. Also, you may want to group on user agents as well to reduce false positives, however, that will also make it easier to evade detection.

MITRE ATT&CK Coverage

Tactic	Techniques
Initial Access	No specific technique

Telemetry Coverage

Platform	Record / event type
AWS	CloudTrail event `ConsoleLogin`: Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.

Rules Detecting the Same Action

These rules filter on the same operation.

AWS Authentication From CrowdStrike Unmanaged Device (Panther)
AWS Authentication from CrowdStrike Unmanaged Device (Panther)
AWS Authentication from CrowdStrike Unmanaged Device (crowdstrike_fdrevent table) (Panther)
AWS EC2 Instance Console Login via Assumed Role (Elastic)
AWS GetFederationToken Followed by Console Login via Federation Exchange (Elastic)
AWS IAM User Console Login from Multiple Geolocations (Elastic)
AWS IAM User Console Login Without MFA (Elastic)
AWS Management Console Brute Force of Root User Identity (Elastic)

Rule Body


title: Many Failed Logins
id: 68f8de62-97cd-4a9a-afba-7804fddf43d4
status: test
description: |
    Detects multiple failed console login attempts, which may indicate an attacker attempting password guessing or password spraying.
    This rule can be evaded if the attacker uses a different source IP address for each login attempt, so you may want to not group by source IP address to detect that evasion.
    Also, you may want to group on user agents as well to reduce false positives, however, that will also make it easier to evade detection.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.initial_access
logsource:
    product: aws
    service: cloudtrail
correlation:
    type: event_count
    rules:
        - Failed Console Login
    group-by:
        - sourceIPAddress
    timespan: 5m
    condition:
        gte: 3
    generate: false
level: high
---
title: Failed Console Login
id: 978c15f1-3468-42b2-bf0f-bb29ae6168cc
status: test
description: Detects failed console login attempts, which may indicate an attacker attempting to gain access to
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.initial_access
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: signin.amazonaws.com
        eventName: 'ConsoleLogin'
        responseElements.ConsoleLogin: 'Failure'
    condition: selection
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    eventSource: signin.amazonaws.com
    eventName: 'ConsoleLogin'
    responseElements.ConsoleLogin: 'Failure'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`eventName`	eq	`ConsoleLogin` corpus 19 (splunk 10, sigma 6, kusto 3)	`field:"aws::eventName" kind:eq value:"ConsoleLogin"`
`eventSource`	eq	`signin.amazonaws.com` corpus 5 (sigma 5)	`field:"aws::eventSource" kind:eq value:"signin.amazonaws.com"`
`responseElements.ConsoleLogin`	eq	`Failure` corpus 2 (sigma 2)	`field:"responseElements.ConsoleLogin" kind:eq value:"Failure"`

Potential Arbitrary Command Execution Via FTP.EXE

Status: test
Severity: medium
Author: Victor Sergeev, oscd.community
Source: github.com/SigmaHQ/sigma

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter
Stealth	`T1202` Indirect Command Execution

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Potential Arbitrary Command Execution Via FTP.EXE
id: 06b401f4-107c-4ff9-947f-9ec1e7649f1e
status: test
description: Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Ftp/
author: Victor Sergeev, oscd.community
date: 2020-10-09
modified: 2024-04-23
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\ftp.exe'
    selection_child_img:
        - Image|endswith: '\ftp.exe'
        - OriginalFileName: 'ftp.exe'
    selection_child_cli:
        CommandLine|contains|windash: '-s:'
    condition: selection_parent or all of selection_child_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection_parent or all of selection_child_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith: '\ftp.exe'

Stage 2: `selection_child_img`

selection_child_img:
    - Image|endswith: '\ftp.exe'
    - OriginalFileName: 'ftp.exe'

Stage 3: `selection_child_cli`

selection_child_cli:
    CommandLine|contains|windash: '-s:'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-s:` transforms: `windash`	`field:"CommandLine" kind:match value:"-s:"`
`Image`	ends_with	`\ftp.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with value:"\ftp.exe"`
`OriginalFileName`	eq	`ftp.exe` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"ftp.exe"`
`ParentImage`	ends_with	`\ftp.exe`	`field:"ParentImage" kind:ends_with value:"\ftp.exe"`

Potential Binary Or Script Dropper Via PowerShell

Status: test
Severity: medium
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects PowerShell creating a binary executable or a script file.

Known False Positives

False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: Potential Binary Or Script Dropper Via PowerShell
id: 7047d730-036f-4f40-b9d8-1c63e36d5e62
status: test
description: Detects PowerShell creating a binary executable or a script file.
references:
    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-17
modified: 2025-07-04
tags:
    - attack.persistence
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
        TargetFilename|endswith:
            - '.bat'
            - '.chm'
            - '.cmd'
            - '.com'
            - '.dll'
            - '.exe'
            - '.hta'
            - '.jar'
            - '.js'
            - '.ocx'
            - '.scr'
            - '.sys'
            - '.vbe'
            - '.vbs'
            - '.wsf'
    filter_main_user_temp:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\AppData\Local\Temp\'
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
    filter_main_other_temp:
        # Example: C:\Windows\Temp\0DA9758B-4649-4969-9409-5CBDF193FB53\TransmogProvider.dll
        TargetFilename|startswith:
            - 'C:\Windows\Temp\'
            - 'C:\Windows\SystemTemp\'
        TargetFilename|endswith:
            - '.dll'
            - '.exe'
    filter_main_powershell_module:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\WindowsPowerShell\Modules\' # C:\Users\xxxx\Documents\WindowsPowerShell\Modules\powershell-yaml\0.4.12\lib\net47\PowerShellYamlSerializer.dll
        TargetFilename|endswith: '.dll'
    filter_main_nuget:
        TargetFilename|startswith: 'C:\Program Files\PackageManagement\ProviderAssemblies\nuget\'
        TargetFilename|endswith: '\Microsoft.PackageManagement.NuGetProvider.dll'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly.
level: medium
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script/info.yml

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|endswith:
        - '\powershell.exe'
        - '\powershell_ise.exe'
        - '\pwsh.exe'
    TargetFilename|endswith:
        - '.bat'
        - '.chm'
        - '.cmd'
        - '.com'
        - '.dll'
        - '.exe'
        - '.hta'
        - '.jar'
        - '.js'
        - '.ocx'
        - '.scr'
        - '.sys'
        - '.vbe'
        - '.vbs'
        - '.wsf'

Stage 2: `not filter_main_*`

filter_main_user_temp:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains: '\AppData\Local\Temp\'
    TargetFilename|endswith:
        - '.dll'
        - '.exe'
filter_main_other_temp:
    TargetFilename|startswith:
        - 'C:\Windows\Temp\'
        - 'C:\Windows\SystemTemp\'
    TargetFilename|endswith:
        - '.dll'
        - '.exe'
filter_main_powershell_module:
    TargetFilename|startswith: 'C:\Users\'
    TargetFilename|contains: '\WindowsPowerShell\Modules\'
    TargetFilename|endswith: '.dll'
filter_main_nuget:
    TargetFilename|startswith: 'C:\Program Files\PackageManagement\ProviderAssemblies\nuget\'
    TargetFilename|endswith: '\Microsoft.PackageManagement.NuGetProvider.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\powershell.exe` corpus 181 (sigma 180, splunk 1) `\powershell_ise.exe` corpus 41 (sigma 41) `\pwsh.exe` corpus 166 (sigma 166)	`field:"Image" kind:ends_with`
`TargetFilename`	ends_with	`.bat` corpus 17 (sigma 17) `.chm` corpus 4 (sigma 4) `.cmd` corpus 8 (sigma 8) `.com` corpus 4 (sigma 4) `.dll` corpus 24 (sigma 24) `.exe` corpus 21 (sigma 20, splunk 1) `.hta` corpus 14 (sigma 14) `.jar` corpus 3 (sigma 3) `.js` corpus 10 (sigma 10) `.ocx` corpus 3 (sigma 3) `.scr` corpus 8 (sigma 8) `.sys` corpus 6 (sigma 6) `.vbe` corpus 16 (sigma 16) `.vbs` corpus 18 (sigma 18) `.wsf` corpus 7 (sigma 7)	`field:"TargetFilename" kind:ends_with`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetFilename`	ends_with	`.dll`	`excludes:TargetFilename` `field:"TargetFilename" value:".dll"`
`TargetFilename`	ends_with	`.exe`	`excludes:TargetFilename` `field:"TargetFilename" value:".exe"`
`TargetFilename`	starts_with	`C:\Windows\SystemTemp\`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Windows\SystemTemp\"`
`TargetFilename`	starts_with	`C:\Windows\Temp\`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Windows\Temp\"`
`TargetFilename`	match	`\AppData\Local\Temp\`	`excludes:TargetFilename` `field:"TargetFilename" value:"\AppData\Local\Temp\"`
`TargetFilename`	starts_with	`C:\Users\`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Users\"`
`TargetFilename`	match	`\WindowsPowerShell\Modules\`	`excludes:TargetFilename` `field:"TargetFilename" value:"\WindowsPowerShell\Modules\"`
`TargetFilename`	ends_with	`\Microsoft.PackageManagement.NuGetProvider.dll`	`excludes:TargetFilename` `field:"TargetFilename" value:"\Microsoft.PackageManagement.NuGetProvider.dll"`
`TargetFilename`	starts_with	`C:\Program Files\PackageManagement\ProviderAssemblies\nuget\`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Program Files\PackageManagement\ProviderAssemblies\nuget\"`

Potential CVE-2023-36884 URL Request Pattern Traffic

Status: test
Severity: high
Author: X__Junior
Source: github.com/SigmaHQ/sigma

Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	No specific technique

Rule Body

title: Potential CVE-2023-36884 URL Request Pattern Traffic
id: d9365e39-febd-4a4b-8441-3ca91bb9d333
status: test
description: Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884
references:
    - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
author: X__Junior
date: 2023-07-12
modified: 2026-06-14
tags:
    - attack.command-and-control
    - cve.2023-36884
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    # Examples:
    #   hxxp://74.50[.]94[.]156/MSHTML_C7/zip_k.asp?d=99.99.99.99.
    #   104.234[.]239[.]26/share1/MSHTML_C7/1/99.99.99.99_a15fa_file001.htm?d=99.99.99.99_ a15fa_
    selection:
        cs-method: 'GET'
        c-uri|re: '\.(zip|asp|htm|url|xml|chm|mht|vbs|search-ms)\?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    cs-method: 'GET'
    c-uri|re: '\.(zip|asp|htm|url|xml|chm|mht|vbs|search-ms)\?d=[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`c-uri`	regex_match	`.(zip\|asp\|htm\|url\|xml\|chm\|mht\|vbs\|search-ms)?d=[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}`	`field:"c-uri" kind:regex_match value:".(zip\|asp\|htm\|url\|xml\|chm\|mht\|vbs\|search-ms)?d=[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}"`
`cs-method`	eq	`GET`	`field:"cs-method" kind:eq value:"GET"`

Potential Operation Triangulation C2 Beaconing Activity - Proxy

Status: test
Severity: high
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	No specific technique

Rule Body

title: Potential Operation Triangulation C2 Beaconing Activity - Proxy
id: aa03c712-75c6-438b-8d42-de88f2427e09
related:
    - id: 7fc30d63-728d-48d9-ad6f-14d14f4accf7 # DNS C2
      type: similar
status: test
description: Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB
references:
    - https://securelist.com/operation-triangulation/109842/
    - https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
author: Florian Roth (Nextron Systems)
date: 2023-06-01
tags:
    - attack.command-and-control
    - attack.g0020
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        cs-host|contains:
            - 'addatamarket.net'
            - 'ans7tv.net'
            - 'anstv.net'
            - 'backuprabbit.com'
            - 'businessvideonews.com'
            - 'cloudsponcer.com'
            - 'datamarketplace.net'
            - 'growthtransport.com'
            - 'mobilegamerstats.com'
            - 'snoweeanalytics.com'
            - 'tagclick-cdn.com'
            - 'topographyupdates.com'
            - 'unlimitedteacup.com'
            - 'virtuallaughing.com'
            - 'web-trackers.com'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    cs-host|contains:
        - 'addatamarket.net'
        - 'ans7tv.net'
        - 'anstv.net'
        - 'backuprabbit.com'
        - 'businessvideonews.com'
        - 'cloudsponcer.com'
        - 'datamarketplace.net'
        - 'growthtransport.com'
        - 'mobilegamerstats.com'
        - 'snoweeanalytics.com'
        - 'tagclick-cdn.com'
        - 'topographyupdates.com'
        - 'unlimitedteacup.com'
        - 'virtuallaughing.com'
        - 'web-trackers.com'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`cs-host`	match	`addatamarket.net` `ans7tv.net` `anstv.net` `backuprabbit.com` `businessvideonews.com` `cloudsponcer.com` `datamarketplace.net` `growthtransport.com` `mobilegamerstats.com` `snoweeanalytics.com` `tagclick-cdn.com` `topographyupdates.com` `unlimitedteacup.com` `virtuallaughing.com` `web-trackers.com`	`field:"cs-host" kind:match`

Potential Persistence Via Notepad++ Plugins

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Known False Positives

Possible FPs during first installation of Notepad++
Legitimate use of custom plugins by users in order to enhance notepad++ functionalities

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 11: FileCreate

Rule Body

title: Potential Persistence Via Notepad++ Plugins
id: 54127bd4-f541-4ac3-afdb-ea073f63f692
status: test
description: Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence
references:
    - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-10
modified: 2025-09-01
tags:
    - attack.persistence
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '\Notepad++\plugins\'
        TargetFilename|endswith: '.dll'
    filter_gup:
        Image|endswith: '\Notepad++\updater\gup.exe'
    filter_install:
        # This filter is for Sigma dataset you could remove it or change when using the rule in your own env
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith:
            - '\target.exe'
            - 'Installer.x64.exe'
    filter_main_installer:
        Image|contains: '\npp.'
        Image|endswith: '.exe'
        TargetFilename:
            - 'C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll'
            - 'C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll'
            - 'C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll'
            - 'C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll'
    condition: selection and not 1 of filter_*
falsepositives:
    - Possible FPs during first installation of Notepad++
    - Legitimate use of custom plugins by users in order to enhance notepad++ functionalities
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_*

Stage 1: `selection`

selection:
    TargetFilename|contains: '\Notepad++\plugins\'
    TargetFilename|endswith: '.dll'

Stage 2: `not filter_*`

filter_gup:
    Image|endswith: '\Notepad++\updater\gup.exe'
filter_install:
    Image|startswith: 'C:\Users\'
    Image|contains: '\AppData\Local\Temp\'
    Image|endswith:
        - '\target.exe'
        - 'Installer.x64.exe'
filter_main_installer:
    Image|contains: '\npp.'
    Image|endswith: '.exe'
    TargetFilename:
        - 'C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll'
        - 'C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll'
        - 'C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll'
        - 'C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetFilename`	ends_with	`.dll` corpus 24 (sigma 24)	`field:"TargetFilename" kind:ends_with value:".dll"`
`TargetFilename`	match	`\Notepad++\plugins\`	`field:"TargetFilename" kind:match value:"\Notepad++\plugins\"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	ends_with	`Installer.x64.exe`	`excludes:Image` `field:"Image" value:"Installer.x64.exe"`
`Image`	ends_with	`\target.exe`	`excludes:Image` `field:"Image" value:"\target.exe"`
`Image`	match	`\AppData\Local\Temp\`	`excludes:Image` `field:"Image" value:"\AppData\Local\Temp\"`
`Image`	starts_with	`C:\Users\`	`excludes:Image` `field:"Image" value:"C:\Users\"`
`TargetFilename`	eq	`C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll"`
`TargetFilename`	eq	`C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Program Files\Notepad++\plugins\NppConverter\NppConverter.dll"`
`TargetFilename`	eq	`C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Program Files\Notepad++\plugins\NppExport\NppExport.dll"`
`TargetFilename`	eq	`C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll`	`excludes:TargetFilename` `field:"TargetFilename" value:"C:\Program Files\Notepad++\plugins\mimeTools\mimeTools.dll"`
`Image`	ends_with	`.exe`	`excludes:Image` `field:"Image" value:".exe"`
`Image`	match	`\npp.`	`excludes:Image` `field:"Image" value:"\npp."`
`Image`	ends_with	`\Notepad++\updater\gup.exe`	`excludes:Image` `field:"Image" value:"\Notepad++\updater\gup.exe"`

Potential Suspicious Activity Using SeCEdit

Status: test
Severity: medium
Author: Janantha Marasinghe
Source: github.com/SigmaHQ/sigma

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Known False Positives

Legitimate administrative use

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1574.007` Hijack Execution Flow: Path Interception by PATH Environment Variable
Persistence	`T1505.005` Server Software Component: Terminal Services DLL `T1546.007` Event Triggered Execution: Netsh Helper DLL `T1546.008` Event Triggered Execution: Accessibility Features `T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder `T1547.002` Boot or Logon Autostart Execution: Authentication Package `T1547.010` Boot or Logon Autostart Execution: Port Monitors `T1547.014` Boot or Logon Autostart Execution: Active Setup `T1556.002` Modify Authentication Process: Password Filter DLL
Privilege Escalation	`T1546.007` Event Triggered Execution: Netsh Helper DLL `T1546.008` Event Triggered Execution: Accessibility Features `T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder `T1547.002` Boot or Logon Autostart Execution: Authentication Package `T1547.010` Boot or Logon Autostart Execution: Port Monitors `T1547.014` Boot or Logon Autostart Execution: Active Setup
Stealth	`T1564.002` Hide Artifacts: Hidden Users `T1574.007` Hijack Execution Flow: Path Interception by PATH Environment Variable
Defense Impairment	`T1556.002` Modify Authentication Process: Password Filter DLL `T1685.001` Disable or Modify Tools: Disable or Modify Windows Event Log
Credential Access	`T1556.002` Modify Authentication Process: Password Filter DLL `T1557` Adversary-in-the-Middle
Discovery	`T1082` System Information Discovery
Collection	`T1557` Adversary-in-the-Middle

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Potential Suspicious Activity Using SeCEdit
id: c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
status: test
description: Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
references:
    - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
author: Janantha Marasinghe
date: 2022-11-18
modified: 2022-12-30
tags:
    - attack.collection
    - attack.discovery
    - attack.persistence
    - attack.credential-access
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.defense-impairment
    - attack.t1685.001
    - attack.t1547.001
    - attack.t1505.005
    - attack.t1556.002
    - attack.t1685
    - attack.t1574.007
    - attack.t1564.002
    - attack.t1546.008
    - attack.t1546.007
    - attack.t1547.014
    - attack.t1547.010
    - attack.t1547.002
    - attack.t1557
    - attack.t1082
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\secedit.exe'
        - OriginalFileName: 'SeCEdit'
    selection_flags_discovery:
        CommandLine|contains|all:
            - '/export'
            - '/cfg'
    selection_flags_configure:
        CommandLine|contains|all:
            - '/configure'
            - '/db'
    # filter:
    #     SubjectUserName|endswith: '$'  SubjectUserName is from event ID 4719 in the Windows Security log
    condition: selection_img and (1 of selection_flags_*)
falsepositives:
    - Legitimate administrative use
level: medium

Stages and Predicates

Stage 0: `condition`

selection_img and (1 of selection_flags_*)

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\secedit.exe'
    - OriginalFileName: 'SeCEdit'

Stage 2: `selection_flags_discovery`

selection_flags_discovery:
    CommandLine|contains|all:
        - '/export'
        - '/cfg'

Stage 3: `selection_flags_configure`

selection_flags_configure:
    CommandLine|contains|all:
        - '/configure'
        - '/db'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/cfg` `/configure` `/db` `/export`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\secedit.exe`	`field:"Image" kind:ends_with value:"\secedit.exe"`
`OriginalFileName`	eq	`SeCEdit`	`field:"OriginalFileName" kind:eq value:"SeCEdit"`

Potentially Suspicious Ping/Copy Command Combination

Status: test
Severity: medium
Author: X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1070.004` Indicator Removal: File Deletion

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Potentially Suspicious Ping/Copy Command Combination
id: ded2b07a-d12f-4284-9b76-653e37b6c8b0
status: test
description: |
    Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.
references:
    - Internal Research
author: X__Junior (Nextron Systems)
date: 2023-07-18
modified: 2024-03-06
tags:
    - attack.stealth
    - attack.t1070.004
logsource:
    category: process_creation
    product: windows
detection:
    # Note: In the case of sysmon and similar logging utilities, see this discussion https://github.com/SigmaHQ/sigma/discussions/4277
    selection_cmd:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_action:
        CommandLine|contains|all:
            - 'ping' # Covers "ping" and "ping.exe"
            - 'copy '
    selection_cli_1:
        CommandLine|contains|windash: ' -n ' # Count
    selection_cli_2:
        CommandLine|contains|windash: ' -y '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_cmd`

selection_cmd:
    - Image|endswith: '\cmd.exe'
    - OriginalFileName: 'Cmd.Exe'

Stage 2: `selection_action`

selection_action:
    CommandLine|contains|all:
        - 'ping'
        - 'copy '

Stage 3: `selection_cli_1`

selection_cli_1:
    CommandLine|contains|windash: ' -n '

Stage 4: `selection_cli_2`

selection_cli_2:
    CommandLine|contains|windash: ' -y '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-n` corpus 4 (sigma 4) `-y` corpus 2 (sigma 2) `/n` corpus 4 (sigma 4) `/y` corpus 3 (sigma 3) `–n` corpus 3 (sigma 3) `–y` corpus 2 (sigma 2) `—n` corpus 3 (sigma 3) `—y` corpus 2 (sigma 2) `―n` corpus 3 (sigma 3) `―y` corpus 2 (sigma 2) `copy` corpus 11 (sigma 11) `ping` corpus 5 (sigma 4, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\cmd.exe` corpus 132 (sigma 130, splunk 2)	`field:"Image" kind:ends_with value:"\cmd.exe"`
`OriginalFileName`	eq	`Cmd.Exe` corpus 75 (sigma 43, splunk 17, elastic 15)	`field:"OriginalFileName" kind:eq value:"Cmd.Exe"`

PowerShell Set-Acl On Windows Folder - PsScript

Status: test
Severity: high
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects PowerShell scripts to set the ACL to a file in the Windows folder

MITRE ATT&CK Coverage

Tactic	Techniques
Defense Impairment	`T1222` File and Directory Permissions Modification

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule Body

title: PowerShell Set-Acl On Windows Folder - PsScript
id: 3bf1d859-3a7e-44cb-8809-a99e066d3478
related:
    - id: cae80281-ef23-44c5-873b-fd48d2666f49 # PsScript Low
      type: derived
    - id: 0944e002-e3f6-4eb5-bf69-3a3067b53d73 # ProcCreation Susp
      type: derived
    - id: bdeb2cff-af74-4094-8426-724dc937f20a # ProcCreation Low
      type: derived
status: test
description: Detects PowerShell scripts to set the ACL to a file in the Windows folder
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1505.005/T1505.005.md
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-18
tags:
    - attack.defense-impairment
    - attack.t1222
logsource:
    product: windows
    category: ps_script
    definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
    selection_cmdlet:
        ScriptBlockText|contains|all:
            - 'Set-Acl '
            - '-AclObject '
    selection_paths:
        # Note: Add more suspicious paths
        ScriptBlockText|contains:
            - '-Path "C:\Windows'
            - '-Path "C:/Windows'
            - "-Path 'C:\\Windows"
            - "-Path 'C:/Windows"
            - '-Path C:\\Windows'
            - '-Path C:/Windows'
            - '-Path $env:windir'
            - '-Path "$env:windir'
            - "-Path '$env:windir"
    selection_permissions:
        # Note: Add more suspicious permissions
        ScriptBlockText|contains:
            - 'FullControl'
            - 'Allow'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_cmdlet`

selection_cmdlet:
    ScriptBlockText|contains|all:
        - 'Set-Acl '
        - '-AclObject '

Stage 2: `selection_paths`

selection_paths:
    ScriptBlockText|contains:
        - '-Path "C:\Windows'
        - '-Path "C:/Windows'
        - "-Path 'C:\\Windows"
        - "-Path 'C:/Windows"
        - '-Path C:\\Windows'
        - '-Path C:/Windows'
        - '-Path $env:windir'
        - '-Path "$env:windir'
        - "-Path '$env:windir"

Stage 3: `selection_permissions`

selection_permissions:
    ScriptBlockText|contains:
        - 'FullControl'
        - 'Allow'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`-AclObject` corpus 2 (sigma 2) `-Path "$env:windir` `-Path "C:/Windows` `-Path "C:\Windows` `-Path $env:windir` `-Path '$env:windir` `-Path 'C:/Windows` `-Path 'C:\Windows` `-Path C:/Windows` `-Path C:\\Windows` `Allow` corpus 3 (sigma 2, splunk 1) `FullControl` `Set-Acl` corpus 2 (sigma 2)	`field:"ScriptBlockText" kind:match`

PowerShell WMI Win32_Product Install MSI

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1218.007` System Binary Proxy Execution: Msiexec

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule Body

title: PowerShell WMI Win32_Product Install MSI
id: 91109523-17f0-4248-a800-f81d9e7c081d
status: test
description: Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
author: frack113
date: 2022-04-24
tags:
    - attack.stealth
    - attack.t1218.007
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'Invoke-CimMethod '
            - '-ClassName '
            - 'Win32_Product '
            - '-MethodName '
            - '.msi'
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi/info.yml

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ScriptBlockText|contains|all:
        - 'Invoke-CimMethod '
        - '-ClassName '
        - 'Win32_Product '
        - '-MethodName '
        - '.msi'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`-ClassName` `-MethodName` `.msi` `Invoke-CimMethod` `Win32_Product`	`field:"ScriptBlockText" kind:match`

PUA - DefenderCheck Execution

Status: test
Severity: high
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1027.005` Obfuscated Files or Information: Indicator Removal from Tools

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: PUA - DefenderCheck Execution
id: f0ca6c24-3225-47d5-b1f5-352bf07ecfa7
status: test
description: Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.
references:
    - https://github.com/matterpreter/DefenderCheck
author: Florian Roth (Nextron Systems)
date: 2022-08-30
modified: 2023-02-04
tags:
    - attack.stealth
    - attack.t1027.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\DefenderCheck.exe'
        - Description: 'DefenderCheck'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Image|endswith: '\DefenderCheck.exe'
    - Description: 'DefenderCheck'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Description`	eq	`DefenderCheck`	`field:"Description" kind:eq value:"DefenderCheck"`
`Image`	ends_with	`\DefenderCheck.exe`	`field:"Image" kind:ends_with value:"\DefenderCheck.exe"`

Remote Access Tool - RURAT Execution From Unusual Location

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Remote Access Tool - RURAT Execution From Unusual Location
id: e01fa958-6893-41d4-ae03-182477c5e77d
status: test
description: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')
references:
    - https://redcanary.com/blog/misbehaving-rats/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-19
modified: 2023-03-05
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith:
              - '\rutserv.exe'
              - '\rfusclient.exe'
        - Product: 'Remote Utilities'
    filter:
        Image|startswith:
            - 'C:\Program Files\Remote Utilities'
            - 'C:\Program Files (x86)\Remote Utilities'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    - Image|endswith:
          - '\rutserv.exe'
          - '\rfusclient.exe'
    - Product: 'Remote Utilities'

Stage 2: `not filter`

filter:
    Image|startswith:
        - 'C:\Program Files\Remote Utilities'
        - 'C:\Program Files (x86)\Remote Utilities'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\rfusclient.exe` `\rutserv.exe`	`field:"Image" kind:ends_with`
`Product`	eq	`Remote Utilities` corpus 2 (sigma 2)	`field:"Product" kind:eq value:"Remote Utilities"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`Image`	starts_with	`C:\Program Files (x86)\Remote Utilities`	`excludes:Image` `field:"Image" value:"C:\Program Files (x86)\Remote Utilities"`
`Image`	starts_with	`C:\Program Files\Remote Utilities`	`excludes:Image` `field:"Image" value:"C:\Program Files\Remote Utilities"`

Remote Access Tool - ScreenConnect Execution

Status: test
Severity: medium
Author: frack113
Source: github.com/SigmaHQ/sigma

An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)

Known False Positives

Legitimate usage of the tool

MITRE ATT&CK Coverage

Tactic	Techniques
Command & Control	`T1219.002` Remote Access Tools: Remote Desktop Software

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Remote Access Tool - ScreenConnect Execution
id: 57bff678-25d1-4d6c-8211-8ca106d12053
status: test
description: |
    An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
    These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
    Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
author: frack113
date: 2022-02-13
modified: 2023-03-05
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Description: 'ScreenConnect Service'
        - Product: 'ScreenConnect'
        - Company: 'ScreenConnect Software'
    condition: selection
falsepositives:
    - Legitimate usage of the tool
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - Description: 'ScreenConnect Service'
    - Product: 'ScreenConnect'
    - Company: 'ScreenConnect Software'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Company`	eq	`ScreenConnect Software`	`field:"Company" kind:eq value:"ScreenConnect Software"`
`Description`	eq	`ScreenConnect Service`	`field:"Description" kind:eq value:"ScreenConnect Service"`
`Product`	eq	`ScreenConnect`	`field:"Product" kind:eq value:"ScreenConnect"`

RunDLL32 Spawning Explorer

Status: test
Severity: high
Author: elhoim, CD_ROM_
Source: github.com/SigmaHQ/sigma

Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

MITRE ATT&CK Coverage

Tactic	Techniques
Stealth	`T1218.011` System Binary Proxy Execution: Rundll32

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: RunDLL32 Spawning Explorer
id: caa06de8-fdef-4c91-826a-7f9e163eef4b
status: test
description: Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way
references:
    - https://redcanary.com/blog/intelligence-insights-november-2021/
author: elhoim, CD_ROM_
date: 2022-04-27
modified: 2022-05-25
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith: '\explorer.exe'
    filter:
        ParentCommandLine|contains: '\shell32.dll,Control_RunDLL'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    ParentImage|endswith: '\rundll32.exe'
    Image|endswith: '\explorer.exe'

Stage 2: `not filter`

filter:
    ParentCommandLine|contains: '\shell32.dll,Control_RunDLL'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\explorer.exe` corpus 13 (sigma 13)	`field:"Image" kind:ends_with value:"\explorer.exe"`
`ParentImage`	ends_with	`\rundll32.exe` corpus 15 (sigma 15)	`field:"ParentImage" kind:ends_with value:"\rundll32.exe"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`ParentCommandLine`	match	`\shell32.dll,Control_RunDLL`	`excludes:ParentCommandLine` `field:"ParentCommandLine" value:"\shell32.dll,Control_RunDLL"`

Scheduled Task Creation From Potential Suspicious Parent Location

Status: test
Severity: medium
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location. Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.

Known False Positives

Software installers that run from temporary folders and also install scheduled tasks

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Scheduled Task Creation From Potential Suspicious Parent Location
id: 9494479d-d994-40bf-a8b1-eea890237021
status: test
description: |
    Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location.
    Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.
references:
    - https://app.any.run/tasks/649e7b46-9bec-4d05-98a5-dfa9a13eaae5/
author: Florian Roth (Nextron Systems)
date: 2022-02-23
modified: 2024-05-13
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.005
    - detection.threat-hunting
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|contains:
            - ':\Temp\'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
            - '\Temporary Internet'
            - '\Users\Public\'
            - '\Windows\Temp\'
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/Create '
    filter_optional_common:
        CommandLine|contains:
            - 'update_task.xml'
            - 'unattended.ini'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Software installers that run from temporary folders and also install scheduled tasks
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    ParentImage|contains:
        - ':\Temp\'
        - '\AppData\Local\'
        - '\AppData\Roaming\'
        - '\Temporary Internet'
        - '\Users\Public\'
        - '\Windows\Temp\'
    Image|endswith: '\schtasks.exe'
    CommandLine|contains: '/Create '

Stage 2: `not filter_optional_common`

filter_optional_common:
    CommandLine|contains:
        - 'update_task.xml'
        - 'unattended.ini'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/Create` corpus 5 (sigma 3, splunk 2)	`field:"CommandLine" kind:match value:"/Create "`
`Image`	ends_with	`\schtasks.exe` corpus 55 (sigma 55)	`field:"Image" kind:ends_with value:"\schtasks.exe"`
`ParentImage`	match	`:\Temp\` `\AppData\Local\` corpus 2 (sigma 2) `\AppData\Roaming\` corpus 2 (sigma 2) `\Temporary Internet` corpus 2 (sigma 2) `\Users\Public\` corpus 2 (sigma 2) `\Windows\Temp\` corpus 2 (sigma 2)	`field:"ParentImage" kind:match`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`unattended.ini`	`excludes:CommandLine` `field:"CommandLine" value:"unattended.ini"`
`CommandLine`	match	`update_task.xml`	`excludes:CommandLine` `field:"CommandLine" value:"update_task.xml"`

Suspicious Printer Driver Empty Manufacturer

Status: test
Severity: high
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a suspicious printer driver installation with an empty Manufacturer value

Known False Positives

Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1574` Hijack Execution Flow
Stealth	`T1574` Hijack Execution Flow

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule Body

title: Suspicious Printer Driver Empty Manufacturer
id: e0813366-0407-449a-9869-a2db1119dc41
status: test
description: Detects a suspicious printer driver installation with an empty Manufacturer value
references:
    - https://twitter.com/SBousseaden/status/1410545674773467140
author: Florian Roth (Nextron Systems)
date: 2020-07-01
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574
    - cve.2021-1675
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\Control\Print\Environments\Windows x64\Drivers'
            - '\Manufacturer'
        Details: '(Empty)'
    filter_cutepdf:
        TargetObject|contains: '\CutePDF Writer v4.0\'
    filter_vnc:
        TargetObject|contains:
            - '\VNC Printer (PS)\'
            - '\VNC Printer (UD)\'
    filter_pdf24:
        TargetObject|contains: '\Version-3\PDF24\'
    condition: selection and not 1 of filter_*
falsepositives:
    - Alerts on legitimate printer drivers that do not set any more details in the Manufacturer value
level: high

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_*

Stage 1: `selection`

selection:
    TargetObject|contains|all:
        - '\Control\Print\Environments\Windows x64\Drivers'
        - '\Manufacturer'
    Details: '(Empty)'

Stage 2: `not filter_*`

filter_cutepdf:
    TargetObject|contains: '\CutePDF Writer v4.0\'
filter_vnc:
    TargetObject|contains:
        - '\VNC Printer (PS)\'
        - '\VNC Printer (UD)\'
filter_pdf24:
    TargetObject|contains: '\Version-3\PDF24\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	eq	`(Empty)` corpus 2 (sigma 2)	`field:"Details" kind:eq value:"(Empty)"`
`TargetObject`	match	`\Control\Print\Environments\Windows x64\Drivers` `\Manufacturer`	`field:"TargetObject" kind:match`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetObject`	match	`\CutePDF Writer v4.0\`	`excludes:TargetObject` `field:"TargetObject" value:"\CutePDF Writer v4.0\"`
`TargetObject`	match	`\VNC Printer (PS)\`	`excludes:TargetObject` `field:"TargetObject" value:"\VNC Printer (PS)\"`
`TargetObject`	match	`\VNC Printer (UD)\`	`excludes:TargetObject` `field:"TargetObject" value:"\VNC Printer (UD)\"`
`TargetObject`	match	`\Version-3\PDF24\`	`excludes:TargetObject` `field:"TargetObject" value:"\Version-3\PDF24\"`

Suspicious Process Execution From Fake Recycle.Bin Folder

Status: test
Severity: high
Author: X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	No specific technique
Stealth	No specific technique

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Suspicious Process Execution From Fake Recycle.Bin Folder
id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0
related:
    - id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca
      type: derived
status: test
description: Detects process execution from a fake recycle bin folder, often used to avoid security solution.
references:
    - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
    - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
author: X__Junior (Nextron Systems)
date: 2023-07-12
modified: 2023-12-11
tags:
    - attack.persistence
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains:
            # e.g. C:\$RECYCLER.BIN
            - 'RECYCLERS.BIN\'
            - 'RECYCLER.BIN\'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|contains:
        - 'RECYCLERS.BIN\'
        - 'RECYCLER.BIN\'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	match	`RECYCLER.BIN\` corpus 2 (sigma 2) `RECYCLERS.BIN\` corpus 2 (sigma 2)	`field:"Image" kind:match`

Sysinternals PsService Execution

Status: test
Severity: medium
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Known False Positives

Legitimate use of PsService by an administrator

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Sysinternals PsService Execution
id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f
status: test
description: Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-16
modified: 2026-06-29
tags:
    - attack.privilege-escalation
    - attack.discovery
    - attack.persistence
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName: 'psservice.exe'
        - Image|endswith:
              - '\PsService.exe'
              - '\PsService64.exe'
              - '\PsService64a.exe'
    condition: selection
falsepositives:
    - Legitimate use of PsService by an administrator
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    - OriginalFileName: 'psservice.exe'
    - Image|endswith:
          - '\PsService.exe'
          - '\PsService64.exe'
          - '\PsService64a.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\PsService.exe` corpus 3 (sigma 3) `\PsService64.exe` corpus 3 (sigma 3) `\PsService64a.exe` corpus 2 (sigma 2)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`psservice.exe` corpus 2 (sigma 2)	`field:"OriginalFileName" kind:eq value:"psservice.exe"`

System Language Discovery via Reg.Exe

Status: experimental
Severity: medium
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Source: github.com/SigmaHQ/sigma

Detects the usage of Reg.Exe to query system language settings. Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions, or avoid targeting certain locales to evade detection.

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1614.001` System Location Discovery: System Language Discovery

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: System Language Discovery via Reg.Exe
id: c43a5405-e8e1-4221-9ac9-dbe3fa14e886
status: experimental
description: |
    Detects the usage of Reg.Exe to query system language settings.
    Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
    or avoid targeting certain locales to evade detection.
references:
    - https://scythe.io/threat-thursday/threatthursday-darkside-ransomware
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-01-09
tags:
    - attack.discovery
    - attack.t1614.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'query'
            - 'Control\Nls\Language'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_reg_system_language_discovery/info.yml
simulation:
    - type: atomic-red-team
      name: Discover System Language by Registry Query
      technique: T1614.001
      atomic_guid: 631d4cf1-42c9-4209-8fe9-6bd4de9421be

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains|all:
        - 'query'
        - 'Control\Nls\Language'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`Control\Nls\Language` `query` corpus 8 (sigma 7, splunk 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58)	`field:"Image" kind:ends_with value:"\reg.exe"`
`OriginalFileName`	eq	`reg.exe` corpus 41 (sigma 32, splunk 8, elastic 1)	`field:"OriginalFileName" kind:eq value:"reg.exe"`

Uncommon Svchost Command Line Parameter

Status: experimental
Severity: high
Author: Liran Ravich
Source: github.com/SigmaHQ/sigma

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

Known False Positives

Unlikely

MITRE ATT&CK Coverage

Tactic	Techniques
Privilege Escalation	`T1055.012` Process Injection: Process Hollowing
Stealth	`T1036.005` Masquerading: Match Legitimate Resource Name or Location `T1055.012` Process Injection: Process Hollowing

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule Body

title: Uncommon Svchost Command Line Parameter
id: f17211f1-1f24-4d0c-829f-31e28dc93cdd
status: experimental
description: |
    Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
    This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
references:
    - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
    - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
    - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
    - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
author: Liran Ravich
date: 2025-11-14
modified: 2026-03-23
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1036.005
    - attack.t1055
    - attack.t1055.012
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Example of command to simulate: "C:\Windows\System32\svchost.exe" calc.exe
        Image|endswith: '\svchost.exe'
    filter_main_flags:
        CommandLine|re: '-k\s\w{1,64}(?:\s?(?:-p|-s))?'
    filter_main_empty:
        CommandLine: ''
    filter_main_null:
        CommandLine: null
    filter_optional_defender:
        ParentImage|endswith: '\MsMpEng.exe'
        CommandLine|contains: 'svchost.exe'
    filter_optional_mrt:
        ParentImage|endswith: '\MRT.exe'
        CommandLine: 'svchost.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_uncommon_command_line_flags/info.yml

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection`

selection:
    Image|endswith: '\svchost.exe'

Stage 2: `not filter_main_*`

filter_main_flags:
    CommandLine|re: '-k\s\w{1,64}(?:\s?(?:-p|-s))?'
filter_main_empty:
    CommandLine: ''
filter_main_null:
    CommandLine: null

Stage 3: `not filter_optional_*`

filter_optional_defender:
    ParentImage|endswith: '\MsMpEng.exe'
    CommandLine|contains: 'svchost.exe'
filter_optional_mrt:
    ParentImage|endswith: '\MRT.exe'
    CommandLine: 'svchost.exe'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\svchost.exe` corpus 22 (sigma 22)	`field:"Image" kind:ends_with value:"\svchost.exe"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	is_null	(no value, null check)	`excludes:CommandLine`
`CommandLine`	regex_match	`-k\s\w{1,64}(?:\s?(?:-p\|-s))?`	`excludes:CommandLine` `field:"CommandLine" value:"-k\s\w{1,64}(?:\s?(?:-p\|-s))?"`
`CommandLine`	eq	`svchost.exe`	`excludes:CommandLine` `field:"CommandLine" value:"svchost.exe"`
`ParentImage`	ends_with	`\MRT.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\MRT.exe"`
`CommandLine`	match	`svchost.exe`	`excludes:CommandLine` `field:"CommandLine" value:"svchost.exe"`
`ParentImage`	ends_with	`\MsMpEng.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\MsMpEng.exe"`

Vault credentials manager accessed

Status: experimental
Severity: high
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker attempts to access vault credentials.

MITRE ATT&CK Coverage

Tactic	Techniques
Credential Access	`T1555.004` Credentials from Password Stores: Windows Credential Manager

Telemetry Coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800

Rule Body

title: Vault credentials manager accessed
description: Detects scenarios where an attacker attempts to access vault credentials.
correlation: correlate ClientProcessId from ID 5382 with Process PID from event ID 4688 to identify the origin of the access.
references:
- https://twitter.com/SBousseaden/status/1573380065714470912
- https://sites.utexas.edu/glenmark/2019/10/21/using-passwordvault-with-powershell/
- https://vimalshekar.github.io/scriptsamples/Getting-Stored-Web-Credentials-using-PowerShell
- https://gist.github.com/Samirbous/c3c4122493ea5076adea9c895d2340ea
tags:
- attack.credential_access
- attack.t1555.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'Windows.Security.Credentials.PasswordVault'
      - 'Retrieve' # can be "RetrievePassword" or "RetrieveAll"

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - 'Windows.Security.Credentials.PasswordVault'
      - 'Retrieve' # can be "RetrievePassword" or "RetrieveAll"

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'Windows.Security.Credentials.PasswordVault'
      - 'Retrieve' # can be "RetrievePassword" or "RetrieveAll"

  condition: 1 of selection*
falsepositives:
- Unknown
level: high

Stages and Predicates

Stage 0: `condition`

1 of selection*

Stage 1: `selection_powershell_native`

selection_powershell_native:
  EventID: 800
  EventData|contains|all:
    - 'Windows.Security.Credentials.PasswordVault'
    - 'Retrieve'

Stage 2: `selection_powershell_modern`

selection_powershell_modern:
  EventID: 4103
  Payload|contains|all:
    - 'Windows.Security.Credentials.PasswordVault'
    - 'Retrieve'

Stage 3: `selection_powershell_block`

selection_powershell_block:
  EventID: 4104
  ScriptBlockText|contains|all:
    - 'Windows.Security.Credentials.PasswordVault'
    - 'Retrieve'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventData`	match	`Retrieve` `Windows.Security.Credentials.PasswordVault`	`field:"EventData" kind:match`
`Payload`	match	`Retrieve` `Windows.Security.Credentials.PasswordVault`	`field:"Payload" kind:match`
`ScriptBlockText`	match	`Retrieve` `Windows.Security.Credentials.PasswordVault` corpus 2 (sigma 2)	`field:"ScriptBlockText" kind:match`

VMToolsd Suspicious Child Process

Status: test
Severity: high
Author: bohops, Bhabesh Raj
Source: github.com/SigmaHQ/sigma

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Known False Positives

Legitimate use by VM administrator

MITRE ATT&CK Coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: VMToolsd Suspicious Child Process
id: 5687f942-867b-4578-ade7-1e341c46e99a
status: test
description: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
references:
    - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
    - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png
    - https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf
author: bohops, Bhabesh Raj
date: 2021-10-08
modified: 2023-07-25
tags:
    - attack.execution
    - attack.persistence
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\vmtoolsd.exe'
    selection_img:
        - Image|endswith:
              - '\cmd.exe'
              - '\cscript.exe'
              - '\mshta.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
        - OriginalFileName:
              - 'Cmd.Exe'
              - 'cscript.exe'
              - 'MSHTA.EXE'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'REGSVR32.EXE'
              - 'RUNDLL32.EXE'
              - 'wscript.exe'
    filter_main_vmwaretools_script:
        Image|endswith: '\cmd.exe'
        CommandLine|contains:
            - '\VMware\VMware Tools\poweron-vm-default.bat'
            - '\VMware\VMware Tools\poweroff-vm-default.bat'
            - '\VMware\VMware Tools\resume-vm-default.bat'
            - '\VMware\VMware Tools\suspend-vm-default.bat'
    filter_main_empty:
        Image|endswith: '\cmd.exe'
        CommandLine: ''
    filter_main_null:
        Image|endswith: '\cmd.exe'
        CommandLine: null
    condition: all of selection* and not 1 of filter_main_*
falsepositives:
    - Legitimate use by VM administrator
level: high

Stages and Predicates

Stage 0: `condition`

all of selection* and not 1 of filter_main_*

Stage 1: `selection_parent`

selection_parent:
    ParentImage|endswith: '\vmtoolsd.exe'

Stage 2: `selection_img`

selection_img:
    - Image|endswith:
          - '\cmd.exe'
          - '\cscript.exe'
          - '\mshta.exe'
          - '\powershell.exe'
          - '\pwsh.exe'
          - '\regsvr32.exe'
          - '\rundll32.exe'
          - '\wscript.exe'
    - OriginalFileName:
          - 'Cmd.Exe'
          - 'cscript.exe'
          - 'MSHTA.EXE'
          - 'PowerShell.EXE'
          - 'pwsh.dll'
          - 'REGSVR32.EXE'
          - 'RUNDLL32.EXE'
          - 'wscript.exe'

Stage 3: `not filter_main_*`

filter_main_vmwaretools_script:
    Image|endswith: '\cmd.exe'
    CommandLine|contains:
        - '\VMware\VMware Tools\poweron-vm-default.bat'
        - '\VMware\VMware Tools\poweroff-vm-default.bat'
        - '\VMware\VMware Tools\resume-vm-default.bat'
        - '\VMware\VMware Tools\suspend-vm-default.bat'
filter_main_empty:
    Image|endswith: '\cmd.exe'
    CommandLine: ''
filter_main_null:
    Image|endswith: '\cmd.exe'
    CommandLine: null

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\cmd.exe` corpus 132 (sigma 130, splunk 2) `\cscript.exe` corpus 72 (sigma 72) `\mshta.exe` corpus 67 (sigma 66, splunk 1) `\powershell.exe` corpus 181 (sigma 180, splunk 1) `\pwsh.exe` corpus 166 (sigma 166) `\regsvr32.exe` corpus 64 (sigma 64) `\rundll32.exe` corpus 94 (sigma 94) `\wscript.exe` corpus 74 (sigma 74)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`Cmd.Exe` corpus 75 (sigma 43, splunk 17, elastic 15) `MSHTA.EXE` corpus 40 (elastic 21, sigma 13, splunk 6) `PowerShell.EXE` corpus 134 (sigma 86, splunk 30, elastic 18) `REGSVR32.EXE` corpus 37 (sigma 17, elastic 15, splunk 5) `RUNDLL32.EXE` corpus 72 (sigma 35, splunk 21, elastic 16) `cscript.exe` corpus 32 (sigma 17, elastic 15) `pwsh.dll` corpus 115 (sigma 81, splunk 30, elastic 4) `wscript.exe` corpus 37 (elastic 20, sigma 17)	`field:"OriginalFileName" kind:eq`
`ParentImage`	ends_with	`\vmtoolsd.exe`	`field:"ParentImage" kind:ends_with value:"\vmtoolsd.exe"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`\VMware\VMware Tools\poweroff-vm-default.bat`	`excludes:CommandLine` `field:"CommandLine" value:"\VMware\VMware Tools\poweroff-vm-default.bat"`
`CommandLine`	match	`\VMware\VMware Tools\poweron-vm-default.bat`	`excludes:CommandLine` `field:"CommandLine" value:"\VMware\VMware Tools\poweron-vm-default.bat"`
`CommandLine`	match	`\VMware\VMware Tools\resume-vm-default.bat`	`excludes:CommandLine` `field:"CommandLine" value:"\VMware\VMware Tools\resume-vm-default.bat"`
`CommandLine`	match	`\VMware\VMware Tools\suspend-vm-default.bat`	`excludes:CommandLine` `field:"CommandLine" value:"\VMware\VMware Tools\suspend-vm-default.bat"`
`Image`	ends_with	`\cmd.exe`	`excludes:Image` `field:"Image" value:"\cmd.exe"`
`CommandLine`	is_null	(no value, null check)	`excludes:CommandLine`

Whoami.EXE Execution From Privileged Process

Status: test
Severity: high
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov
Source: github.com/SigmaHQ/sigma

Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

MITRE ATT&CK Coverage

Tactic	Techniques
Discovery	`T1033` System Owner/User Discovery

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule Body

title: Whoami.EXE Execution From Privileged Process
id: 79ce34ca-af29-4d0e-b832-fc1b377020db
related:
    - id: 80167ada-7a12-41ed-b8e9-aa47195c66a1
      type: obsolete
status: test
description: Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/
author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov
date: 2022-01-28
modified: 2023-12-04
tags:
    - attack.privilege-escalation
    - attack.discovery
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'whoami.exe'
        - Image|endswith: '\whoami.exe'
    selection_user:
        User|contains:
            - 'AUTHORI'
            - 'AUTORI'
            - 'TrustedInstaller'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - OriginalFileName: 'whoami.exe'
    - Image|endswith: '\whoami.exe'

Stage 2: `selection_user`

selection_user:
    User|contains:
        - 'AUTHORI'
        - 'AUTORI'
        - 'TrustedInstaller'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\whoami.exe` corpus 19 (sigma 19)	`field:"Image" kind:ends_with value:"\whoami.exe"`
`OriginalFileName`	eq	`whoami.exe` corpus 11 (sigma 9, elastic 1, splunk 1)	`field:"OriginalFileName" kind:eq value:"whoami.exe"`
`User`	match	`AUTHORI` corpus 14 (sigma 14) `AUTORI` corpus 14 (sigma 14) `TrustedInstaller`	`field:"user" kind:match`

Winlogon Notify Key Logon Persistence

Status: test
Severity: high
Author: frack113
Source: github.com/SigmaHQ/sigma

Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in. Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

MITRE ATT&CK Coverage

Tactic	Techniques
Persistence	`T1547.004` Boot or Logon Autostart Execution: Winlogon Helper DLL
Privilege Escalation	`T1547.004` Boot or Logon Autostart Execution: Winlogon Helper DLL

Telemetry Coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule Body

title: Winlogon Notify Key Logon Persistence
id: bbf59793-6efb-4fa1-95ca-a7d288e52c88
status: test
description: |
    Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.
    Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md#atomic-test-3---winlogon-notify-key-logon-persistence---powershell
author: frack113
date: 2021-12-30
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.004
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon'
        Details|endswith: '.dll'
    condition: selection
falsepositives:
    - Unknown
level: high
simulation:
    - type: atomic-red-team
      name: Winlogon Notify Key Logon Persistence - PowerShell
      technique: T1547.004
      atomic_guid: d40da266-e073-4e5a-bb8b-2b385023e5f9

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|endswith: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon'
    Details|endswith: '.dll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	ends_with	`.dll` corpus 9 (sigma 4, elastic 4, splunk 1)	`field:"Details" kind:ends_with value:".dll"`
`TargetObject`	ends_with	`\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon`	`field:"TargetObject" kind:ends_with value:"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logon"`

Back to all Sigma rules

Sigma rules: 1d

Auditing Configuration Changes on Linux Host

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

AWS CloudTrail Important Change

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rules Detecting the Same Action

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_source

Indicators

Certificate Exported Via PowerShell

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

CobaltStrike Service Installations - Security

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: event_id

Stage 2: selection1

Stage 3: selection2

Stage 4: selection3

Stage 5: selection4

Indicators

Download File To Potentially Suspicious Directory Via Wget

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_output

Stage 3: selection_path

Indicators

Elise Backdoor Activity

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_other_svchost

Stage 2: selection_other_del

Stage 3: selection_dll_path

Stage 4: selection_dll_function

Indicators

Firewall Rule Update Via Netsh.EXE

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rule Body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Indicators

Github Self Hosted Runner Changes Detected

Known False Positives

MITRE ATT&CK Coverage

Telemetry Coverage

Rules Detecting the Same Action

Rule Body

Stages and Predicates

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_source`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `event_id`

Stage 2: `selection1`

Stage 3: `selection2`

Stage 4: `selection3`

Stage 5: `selection4`

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_output`

Stage 3: `selection_path`

Stage 0: `condition`

Stage 1: `selection_other_svchost`

Stage 2: `selection_other_del`

Stage 3: `selection_dll_path`

Stage 4: `selection_dll_function`

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_base64`

Stage 2: `selection_exec`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection`

Stage 0: `condition`

Stage 1: `selection_parent`

Stage 2: `selection_child_img`

Stage 3: `selection_child_cli`

Stage 0: `condition`

Stage 1: `selection`

Stage 2: `not filter_main_*`

Stage 0: `condition`

Stage 1: `selection`