Sigma rules: 1h

title: Anomalous Token
id: 6555754e-5e7f-4a67-ad1c-4041c413a007
status: test
description: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow'
date: 2023-08-07
tags:
    - attack.t1528
    - attack.credential-access
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'anomalousToken'
    condition: selection
falsepositives:
    - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high

title: Antivirus - Remote Access Tools Signature
id: 97233998-3838-4581-88c6-f1d19d3993fb
status: experimental
description: |
    Detects a highly relevant Antivirus alert that reports a remote access tool.
    This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
references:
    - https://www.nextron-systems.com/?s=antivirus
    - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466
author: Arnim Rupp (Nextron Systems)
date: 2026-06-15
tags:
    - attack.execution
    - attack.t1203
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: antivirus
detection:
    selection:
        Signature|contains:
            - 'AgentB'
            - 'AgentTesla'
            - 'AMRat'
            - 'Ammyy'
            - 'AsyncRAT'
            - 'Bandook'
            - 'Bitrat'
            - 'Bladabindi'
            - 'Connectwise'
            - 'CyberGate'
            - 'DarkComet'
            - 'DCrat'
            - 'Delf'
            - 'DokStorm'
            - 'Egairtigado'
            - 'Gh0st'
            - 'Gorat'
            - 'GodRat'
            - 'Jalapeno'
            - 'LummaC2'
            - 'Minirat'
            - 'Netwire'
            - 'NanoCore'
            - 'NJRat'
            - 'Paralax'
            - 'PlugX'
            - 'Pulsar'
            - 'Quasar'
            - 'Remcos'
            - 'Ravartar'
            - 'RemoteAdmin'
            - 'RemoteTool'
            - 'revengeRAT'
            - 'rokRAT'
            - 'salatstealer'
            - 'Salgorea'
            - 'SmokedHam'
            - 'TigerRat'
            - 'Tzeebot'
            - 'WarZone'
            - 'VenomRAT'
            - 'Vidar'
            - 'Wirenet'
            - 'XWorm'
            - 'Zapchast'
            - 'Zegost'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: C# IL Code Compilation Via Ilasm.EXE
id: 850d55f9-6eeb-4492-ad69-a72338f65ba4
status: test
description: Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/
    - https://www.echotrail.io/insights/search/ilasm.exe
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2022-05-07
modified: 2022-05-16
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\ilasm.exe'
        - OriginalFileName: 'ilasm.exe'
    selection_cli:
        CommandLine|contains:
            - ' /dll'
            - ' /exe'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: ClickOnce Trust Prompt Tampering
id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb
status: test
description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet.
references:
    - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
    - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior
author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)'
date: 2023-06-12
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\'
        TargetObject|endswith:
            - '\Internet'
            - '\LocalIntranet'
            - '\MyComputer'
            - '\TrustedSites'
            - '\UntrustedSites'
        Details: 'Enabled'
    condition: selection
falsepositives:
    - Legitimate internal requirements.
level: medium

title: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
id: 99cf1e02-00fb-4c0d-8375-563f978dfd37
related:
    - id: 98c5aeef-32d5-492f-b174-64a691896d25 # Generic SD tampering
      type: similar
    - id: a537cfc3-4297-4789-92b5-345bfd845ad0 # Specific Technique
      type: similar
status: test
description: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.
references:
    - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
    - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
    - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
author: Jonhnathan Ribeiro, oscd.community
date: 2020-10-16
modified: 2023-02-28
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_sc:
        - Image|endswith: '\sc.exe'
        - OriginalFileName: 'sc.exe'
    selection_sdset:
        CommandLine|contains|all:
            - 'sdset'
            - 'D;' # Deny Access
    selection_trustee:
        CommandLine|contains:
            - ';IU' # Interactively logged-on user
            - ';SU' # Service logon user
            - ';BA' # Built-in administrators
            - ';SY' # Local system
            - ';WD' # Everyone
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: File Time Attribute Change - Linux
id: b3cec4e7-6901-4b0d-a02d-8ab2d8eb818b
status: test
description: Detect file time attribute change to hide new or changes to existing files.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
author: 'Igor Fits, oscd.community'
date: 2020-10-15
modified: 2022-11-28
tags:
    - attack.stealth
    - attack.t1070.006
logsource:
    product: linux
    service: auditd
detection:
    execve:
        type: 'EXECVE'
    touch:
        - 'touch'
    selection2:
        - '-t'
        - '-acmr'
        - '-d'
        - '-r'
    condition: execve and touch and selection2
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: Set a file's access timestamp
      technique: T1070.006
      atomic_guid: 5f9113d5-ed75-47ed-ba23-ea3573d05810
    - type: atomic-red-team
      name: Set a file's modification timestamp
      technique: T1070.006
      atomic_guid: 20ef1523-8758-4898-b5a2-d026cc3d2c52
    - type: atomic-red-team
      name: Modify file timestamps using reference file
      technique: T1070.006
      atomic_guid: 631ea661-d661-44b0-abdb-7a7f3fc08e50

title: Google Cloud VPN Tunnel Modified or Deleted
id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1
status: test
description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.
references:
    - https://any-api.com/googleapis_com/compute/docs/vpnTunnels
author: Austin Songer @austinsonger
date: 2021-08-16
modified: 2022-10-09
tags:
    - attack.impact
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - compute.vpnTunnels.insert
            - compute.vpnTunnels.delete
    condition: selection
falsepositives:
    - VPN Tunnel being modified or deleted may be performed by a system administrator.
    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

title: HackTool - SharpLdapWhoami Execution
id: d9367cbb-c2e0-47ce-bdc0-128cb6da898d
status: test
description: Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller
references:
    - https://github.com/bugch3ck/SharpLdapWhoami
author: Florian Roth (Nextron Systems)
date: 2022-08-29
modified: 2023-02-04
tags:
    - attack.discovery
    - attack.t1033
    - car.2016-03-001
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith: '\SharpLdapWhoami.exe'
    selection_pe: # in case the file has been renamed after compilation
        - OriginalFileName|contains: 'SharpLdapWhoami'
        - Product: 'SharpLdapWhoami'
    selection_flags1:
        CommandLine|endswith:
            - ' /method:ntlm'
            - ' /method:kerb'
            - ' /method:nego'
            - ' /m:nego'
            - ' /m:ntlm'
            - ' /m:kerb'
    condition: 1 of selection*
falsepositives:
    - Programs that use the same command line flags
level: high

title: IAM User Creation Attempt
id: 8f3a7b2c-1d4e-5f6a-9b0c-2e3d4f5a6b7d
status: test
description: |
    Detects a failed attempt to create an IAM user (AccessDenied).
    Even though the attempt failed, it indicates the attacker has valid
    credentials and is attempting persistence via IAM user creation.
references:
    - https://attack.mitre.org/techniques/T1136/003/
    - https://docs.aws.amazon.com/IAM/latest/APIReference/API_CreateUser.html
author: nishikawaakira (@nishikawaakira)
date: 2026-05-03
modified: 2026-05-29
tags:
    - attack.persistence
    - attack.t1136.003
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: iam.amazonaws.com
        eventName: CreateUser
        errorCode: AccessDenied
    condition: selection
falsepositives:
level: medium

title: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
id: 9ac8b09b-45de-4a07-9da1-0de8c09304a3
related:
    - id: 779c8c12-0eb1-11eb-adc1-0242ac120002
      type: derived
status: test
description: Detects Obfuscated use of stdin to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 25)
author: Jonathan Cheong, oscd.community
date: 2020-10-15
modified: 2024-04-05
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_4103:
        Payload|re: 'cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+"'
    condition: selection_4103
falsepositives:
    - Unknown
level: high

title: Network Connection Initiated By IMEWDBLD.EXE
id: 8d7e392e-9b28-49e1-831d-5949c6281228
related:
    - id: 863218bd-c7d0-4c52-80cd-0a96c09f54af
      type: derived
status: test
description: |
    Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download
    - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/
author: frack113
date: 2022-01-22
modified: 2023-11-09
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        Image|endswith: '\IMEWDBLD.exe'
    condition: selection
falsepositives:
    - Unknown
# Note: Please reduce this to medium if you find legitimate connections
level: high

title: NtdllPipe Like Activity Execution
id: bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2
status: test
description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe
references:
    - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe
author: Florian Roth (Nextron Systems)
date: 2022-03-05
modified: 2023-03-07
tags:
    - attack.defense-impairment
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'type %windir%\system32\ntdll.dll'
            - 'type %systemroot%\system32\ntdll.dll'
            - 'type c:\windows\system32\ntdll.dll'
            - '\\ntdll.dll > \\\\.\\pipe\\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: NTFS Alternate Data Stream
id: 8c521530-5169-495d-a199-0a3a881ad24e
status: test
description: Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
references:
    - https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
author: Sami Ruohonen
date: 2018-07-24
modified: 2022-12-25
tags:
    - attack.stealth
    - attack.t1564.004
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_content:
        ScriptBlockText|contains:
            - set-content
            - add-content
    selection_stream:
        ScriptBlockText|contains: '-stream'
    condition: all of selection*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access/info.yml

title: OpenCanary - MSSQL Login Attempt Via SQLAuth
id: 3ec9a16d-0b4f-4967-9542-ebf38ceac7dd
status: test
description: |
    Detects instances where an MSSQL service on an OpenCanary node has had a login attempt using SQLAuth.
references:
    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
author: Security Onion Solutions
date: 2024-03-08
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1003
    - attack.t1213
logsource:
    category: application
    product: opencanary
detection:
    selection:
        logtype: 9001
    condition: selection
falsepositives:
    - Unlikely
level: high

title: OpenCanary - NMAP FIN Scan
id: eae8c0c8-e5da-450a-9d7d-66aa56cd26b6
status: experimental
description: Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
references:
    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
author: Marco Pedrinazzi (@pedrinazziM)
date: 2026-01-06
tags:
    - attack.discovery
    - attack.t1046
logsource:
    category: application
    product: opencanary
detection:
    selection:
        logtype: 5005
    condition: selection
falsepositives:
    - Unlikely
level: high

title: OpenCanary - NMAP NULL Scan
id: 68b8547b-107f-43f3-97fb-900a7d63c190
status: experimental
description: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
references:
    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
author: Marco Pedrinazzi (@pedrinazziM)
date: 2026-01-06
tags:
    - attack.discovery
    - attack.t1046
logsource:
    category: application
    product: opencanary
detection:
    selection:
        logtype: 5003
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Permission Misconfiguration Reconnaissance Via Findstr.EXE
id: 47e4bab7-c626-47dc-967b-255608c9a920
status: test
description: |
    Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
    This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.
references:
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-12
modified: 2023-11-11
tags:
    - attack.credential-access
    - attack.t1552.006
logsource:
    category: process_creation
    product: windows
detection:
    selection_findstr_img:
        - Image|endswith:
              - '\find.exe'
              - '\findstr.exe'
        - OriginalFileName:
              - 'FIND.EXE'
              - 'FINDSTR.EXE'
    selection_findstr_cli:
        CommandLine|contains:
            - '"Everyone"'
            - "'Everyone'"
            - '"BUILTIN\\"'
            - "'BUILTIN\\'"
    selection_special:
        CommandLine|contains|all:
            # Example CLI would be: icacls "C:\Program Files\*" 2>nul | findstr "(M)" | findstr "Everyone"
            # You could extend it for other groups and users
            #   Example: icacls "C:\Program Files\*" 2>nul | findstr "(M)" | findstr "BUILTIN\Users"
            # Note: This selection only detects the command when executed from a handler such as a "cmd /c" or "powershell -c"
            - 'icacls '
            - 'findstr '
            - 'Everyone'
    condition: all of selection_findstr_* or selection_special
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_everyone/info.yml

title: Potential Dridex Activity
id: e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
status: stable
description: Detects potential Dridex acitvity via specific process patterns
references:
    - https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3
    - https://redcanary.com/threat-detection-report/threats/dridex/
author: Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
date: 2019-01-10
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - attack.discovery
    - attack.t1135
    - attack.t1033
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_svchost:
        Image|endswith: '\svchost.exe'
        CommandLine|contains|all:
            - 'C:\Users\'
            - '\Desktop\'
    filter_svchost:
        ParentImage|startswith: 'C:\Windows\System32\'
    selection_regsvr:
        ParentImage|endswith: '\excel.exe'
        Image|endswith: '\regsvr32.exe'
        CommandLine|contains:
            - ' -s '
            - '\AppData\Local\Temp\'
    filter_regsvr:
        CommandLine|contains: '.dll'
    selection_anomaly_parent:
        ParentImage|endswith: '\svchost.exe'
    selection_anomaly_child_1:
        Image|endswith: '\whoami.exe'
        CommandLine|contains: ' /all'
    selection_anomaly_child_2:
        Image|endswith:
            - '\net.exe'
            - '\net1.exe'
        CommandLine|contains: ' view'
    condition: (selection_svchost and not filter_svchost) or (selection_regsvr and not filter_regsvr) or (selection_anomaly_parent and 1 of selection_anomaly_child_*)
falsepositives:
    - Unlikely
level: critical

title: Potential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Group
id: c408acfe-2870-41df-8d2f-9f4daa4555ed
status: test
description: |
    Detects execution of the "net.exe" command in order to add a group named "ESX Admins".
    This could indicates a potential exploitation attempt of CVE-2024-37085, which allows an attacker to elevate their privileges to full administrative access on an domain-joined ESXi hypervisor.
    VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named "ESX Admins" to have full administrative access by default.
references:
    - https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
author: frack113
date: 2024-07-29
tags:
    - attack.execution
    - cve.2024-37085
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_net_img:
        - Image|endswith:
              - '\net.exe'
              - '\net1.exe'
        - OriginalFileName:
              - 'net.exe'
              - 'net1.exe'
    selection_net_cmd:
        CommandLine|contains|all:
            - '/add'
            - '/domain'
            - 'ESX Admins'
            - 'group'
    selection_powershell_img:
        - Image|endswith:
              - '\PowerShell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.exe'
              - 'pwsh.dll'
    selection_powershell_cli:
        CommandLine|contains|all:
            - 'New-ADGroup'
            - 'ESX Admins'
    condition: all of selection_net_* or all of selection_powershell_*
falsepositives:
    - Unknown
level: high

title: Potential Suspicious Windows Feature Enabled
id: 55c925c1-7195-426b-a136-a9396800e29b
related:
    - id: c740d4cf-a1e9-41de-bb16-8a46a4f57918
      type: similar
status: test
description: |
    Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool.
    Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images
references:
    - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
    - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
    - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
author: frack113
date: 2022-09-10
modified: 2022-12-29
tags:
    - attack.stealth
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmd:
        ScriptBlockText|contains|all:
            - 'Enable-WindowsOptionalFeature'
            - '-Online'
            - '-FeatureName'
    selection_feature:
        # Add any insecure/unusual windows features to your env
        ScriptBlockText|contains:
            - 'TelnetServer'
            - 'Internet-Explorer-Optional-amd64'
            - 'TFTP'
            - 'SMB1Protocol'
            - 'Client-ProjFS'
            - 'Microsoft-Windows-Subsystem-Linux'
    condition: all of selection_*
falsepositives:
    - Legitimate usage of the features listed in the rule.
level: medium

title: Process Signal from Suspicious Parent Process
id: f21b167a-1111-4b33-bff4-b1e4bd4459a8
status: experimental
description: Detects signals sent from processes that don't typically manage other
  processes
references:
- https://attack.mitre.org/techniques/T1059/
author: Eric Brown - Nebulock, Inc.
date: 2025/10/29
tags:
- attack.execution
- attack.t1059
logsource:
  product: macos
  service: endpointsecurity
  category: process_signal
detection:
  selection_signal:
    esf.event_type: 27
    event.action: signal
  selection_suspicious:
    Image|endswith:
    - /curl
    - /wget
    - python
    - ruby
    - perl
    - osascript
  condition: selection_signal and selection_suspicious
falsepositives:
- Scripts and automation tools
- Development activities
level: medium
modified: 2025/01/15

title: PUA - DIT Snapshot Viewer
id: d3b70aad-097e-409c-9df2-450f80dc476b
status: test
description: Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.
references:
    - https://thedfirreport.com/2020/06/21/snatch-ransomware/
    - https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap
author: Furkan Caliskan (@caliskanfurkan_)
date: 2020-07-04
modified: 2023-02-21
tags:
    - attack.credential-access
    - attack.t1003.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\ditsnap.exe'
        - CommandLine|contains: 'ditsnap.exe'
    condition: selection
falsepositives:
    - Legitimate admin usage
level: high

title: Python Function Execution Security Warning Disabled In Excel - Registry
id: 17e53739-a1fc-4a62-b1b9-87711c2d5e44
related:
    - id: 023c654f-8f16-44d9-bb2b-00ff36a62af9
      type: similar
status: test
description: |
    Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
    Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.
references:
    - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
author: Nasreddine Bencherchali (Nextron Systems), @Kostastsale
date: 2024-08-23
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Office\'
        TargetObject|endswith: '\Excel\Security\PythonFunctionWarnings'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Remote Access Tool - Renamed MeshAgent Execution - Windows
id: b471f462-eb0d-4832-be35-28d94bdb4780
related:
    - id: bd3b5eaa-439d-4a42-8f35-a49f5c8a2582
      type: similar
    - id: 2fbbe9ff-0afc-470b-bdc0-592198339968
      type: derived
status: experimental
description: |
    Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
    RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
    However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.
references:
    - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
    - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
    - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
    - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
author: Norbert Jaśniewicz (AlphaSOC)
date: 2025-05-19
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1219.002
    - attack.t1036.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_meshagent:
        - CommandLine|contains: '--meshServiceName'
        - OriginalFileName|contains: 'meshagent'
    filter_main_legitimate:
        Image|endswith: '\meshagent.exe'
    condition: selection_meshagent and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Scheduled task created and deleted fastly (ATexec.py)
description: Detects scenarios where an attacker abuse task scheduler capacities to execute commands or elevate privileges.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1053.005-Scheduled%20Task
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py
- https://u0041.co/blog/post/1
- https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
tags:
- attack.execution
- attack.t1053.005 # Scheduled Task/Job: Scheduled Task 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection_create:
    EventID: 4698
  selection_delete:
    EventID: 4699
  #filter:
  #  SubjectUserSid: 'S-1-5-18'
  condition: selection_create > selection_delete | group(Computer, TaskName)
  timeframe: 5m
falsepositives:
- Rare application activity
level: high

title: Scheduled Task Executing Encoded Payload from Registry
id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78
status: test
description: Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.
references:
    - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-02-12
modified: 2023-02-04
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        # schtasks.exe /Create /F /TN "{97F2F70B-10D1-4447-A2F3-9B070C86E261}" /TR "cmd /c start /min \"\" powershell.exe -Command IEX([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String((Get-ItemProperty -Path HKCU:\SOFTWARE\Pvoeooxf).yzbbvhhdypa))) " /SC MINUTE /MO 30
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli_create:
        CommandLine|contains: '/Create'
    selection_cli_encoding:
        CommandLine|contains:
            - 'FromBase64String'
            - 'encodedcommand'
    selection_cli_get:
        CommandLine|contains:
            - 'Get-ItemProperty'
            - ' gp ' # Alias
    selection_cli_hive:
        CommandLine|contains:
            - 'HKCU:'
            - 'HKLM:'
            - 'registry::'
            - 'HKEY_'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded/info.yml

title: Suspicious New Instance Of An Office COM Object
id: 9bdaf1e9-fdef-443b-8081-4341b74a7e28
status: test
description: |
    Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.
    This can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)
references:
    - https://learn.microsoft.com/en-us/previous-versions/office/troubleshoot/office-developer/automate-word-create-file-using-visual-basic
    - https://github.com/med0x2e/vba2clr
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-13
modified: 2023-12-19
tags:
    - attack.execution
    - detection.threat-hunting
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith:
            - '\eqnedt32.exe'
            - '\excel.exe'
            - '\msaccess.exe'
            - '\mspub.exe'
            - '\powerpnt.exe'
            - '\visio.exe'
            - '\winword.exe'
    condition: selection
falsepositives:
    - Legitimate usage of office automation via scripting
level: medium

title: Terminal Service Process Spawn
id: 1012f107-b8f1-4271-af30-5aed2de89b39
status: test
description: Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
references:
    - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
author: Florian Roth (Nextron Systems)
date: 2019-05-22
modified: 2023-01-25
tags:
    - attack.initial-access
    - attack.t1190
    - attack.lateral-movement
    - attack.t1210
    - car.2013-07-002
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentCommandLine|contains|all:
            - '\svchost.exe'
            - 'termsvcs'
    filter_img:
        Image|endswith:
            - '\rdpclip.exe'
            - ':\Windows\System32\csrss.exe'
            - ':\Windows\System32\wininit.exe'
            - ':\Windows\System32\winlogon.exe'
    filter_null:
        Image: null
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: high

title: Whoami.EXE Execution Anomaly
id: 8de1cbe8-d6f5-496d-8237-5f44a721c7a0
status: test
description: Detects the execution of whoami.exe with suspicious parent processes.
references:
    - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
    - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
    - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s
author: Florian Roth (Nextron Systems)
date: 2021-08-12
modified: 2025-03-06
tags:
    - attack.discovery
    - attack.t1033
    - car.2016-03-001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\whoami.exe'
        - OriginalFileName: 'whoami.exe'
    filter_main_known_parents:
        # This list can be any legitimate shell or application that you expect whoami to run from
        ParentImage|endswith:
            - '\cmd.exe'
            - '\powershell_ise.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    filter_optional_ms_monitoring_agent:
        ParentImage|endswith: ':\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe'
    filter_main_parent_null:
        ParentImage: null
    filter_main_parent_empty:
        ParentImage:
            - ''
            - '-'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Admin activity
    - Scripts and administrative tools used in the monitored environment
    - Monitoring activity
level: medium

title: Windows Recall Feature Enabled - Registry
id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4
related:
    - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62
      type: similar
    - id: 817f252c-5143-4dae-b418-48c3e9f63728
      type: similar
status: test
description: |
    Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0".
    Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
    This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
references:
    - https://learn.microsoft.com/en-us/windows/client-management/manage-recall
    - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
author: Sajid Nawaz Khan
date: 2024-06-02
tags:
    - attack.collection
    - attack.t1113
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        # HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis
        # HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis
        TargetObject|endswith: '\Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Legitimate use/activation of Windows Recall
level: medium

title: Windows Subsystem for Linux (WSL) package turned on (native)
description: Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1564-Hide%20artifacts
- https://learn.microsoft.com/en-us/windows/wsl/install-manual
- https://learn.microsoft.com/en-us/windows/wsl/install
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
- https://blog.f-secure.com/hunting-for-windows-subsystem-for-linux/
- https://blog.lumen.com/no-longer-just-theory-black-lotus-labs-uncovers-linux-executables-deployed-as-stealth-windows-loaders/
tags:
- attack.defense_evasion
- attack.t1564.006 # Hide Artifacts: Run Virtual Instance 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: setup
detection:
  selection:
    Channel: Setup
    Provider: Microsoft-Windows-Servicing
    EventID: 9 # "Selectable update Microsoft-Windows-Subsystem-Linux of package Microsoft-Windows-Lxss-Optional was successfully turned on."
    UpdateName: 
      - Microsoft-Windows-Subsystem-Linux
      - VirtualMachinePlatform 
  condition: selection
falsepositives:
- developer computer (with Visual Studio Code)
- administrator activity
level: medium

title: WMI registration (PowerShell)
description: Detects scenarios where an attacker createsan instance of a WMI class using tools like WMImplant or PowerLurk.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1546-Event%20Triggered%20Execution
- https://github.com/Sw4mpf0x/PowerLurk
- https://github.com/FortyNorthSecurity/WMImplant
- https://www.netspi.com/blog/technical/adversary-simulation/getting-started-wmi-weaponization-part-5/
- https://www.darkoperator.com/blog/2017/10/14/basics-of-tracking-wmi-activity
tags:
- attack.persistence
- attack.t1546.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script

detection:
  selection1_powershell_native:
    EventID: 800
    EventData|contains:
      - Set-WmiInstance
      - Swmi
    EventData|contains:
      - Class
      - Namespace
      - Arguments

  selection2_powershell_modern:
    EventID: 4103
    Payload|contains:
      - Set-WmiInstance
      - Swmi
    Payload|contains:
      - Class
      - Namespace
      - Arguments

  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains:
      - Set-WmiInstance
      - Swmi
    ScriptBlockText|contains:
      - Class
      - Namespace
      - Arguments

  condition: 1 of selection*
falsepositives:
- legitimate WMI class registration
- monitoring products
- Microsoft System Center or security products
level: high