Sigma rules: 1m

title: AWS Glue Development Endpoint Activity
id: 4990c2e3-f4b8-45e3-bc3c-30b14ff0ed26
status: test
description: Detects possible suspicious glue development endpoint activity.
references:
    - https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
    - https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html
author: Austin Songer @austinsonger
date: 2021-10-03
modified: 2022-12-18
tags:
    - attack.privilege-escalation
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'glue.amazonaws.com'
        eventName:
            - 'CreateDevEndpoint'
            - 'DeleteDevEndpoint'
            - 'UpdateDevEndpoint'
    condition: selection
falsepositives:
    - Glue Development Endpoint Activity may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - If known behavior is causing false positives, it can be exempted from the rule.
level: low

title: Changes to Device Registration Policy
id: 9494bff8-959f-4440-bbce-fb87a208d517
status: test
description: Monitor and alert for changes to the device registration policy.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
author: Michael Epping, '@mepples21'
date: 2022-06-28
tags:
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        Category: 'Policy'
        ActivityDisplayName: 'Set device registration policies'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Clear or Disable Kernel Ring Buffer Logs via Syslog Syscall
id: eca5e022-d368-4043-98e5-9736fb01f72f
status: experimental
description: |
    Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),
    (4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel
    ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation
    or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.
references:
    - https://man7.org/linux/man-pages/man2/syslog.2.html
    - https://man7.org/linux/man-pages/man1/dmesg.1.html
author: Milad Cheraghi
date: 2025-05-27
modified: 2025-12-05
tags:
    - attack.defense-impairment
    - attack.t1685.006
logsource:
    product: linux
    service: auditd
    definition: |
        Required auditd configuration:
        -a always,exit -F arch=b64 -S syslog -F a0=4 -k clear_dmesg_logs
        -a always,exit -F arch=b64 -S syslog -F a0=5 -k clear_dmesg_logs
        -a always,exit -F arch=b64 -S syslog -F a0=6 -k disable_dmesg_logs
        -a always,exit -F arch=b32 -S syslog -F a0=4 -k clear_dmesg_logs
        -a always,exit -F arch=b32 -S syslog -F a0=5 -k clear_dmesg_logs
        -a always,exit -F arch=b32 -S syslog -F a0=6 -k disable_dmesg_logs
detection:
    selection:
        type: 'SYSCALL'
        SYSCALL: 'syslog'
        a0:
            - 4 # SYSLOG_ACTION_READ_CLEAR : Read and clear log
            - 5 # SYSLOG_ACTION_CLEAR: Clear kernel ring buffer (without reading)
            - 6 # SYSLOG_ACTION_CONSOLE_OFF: Disable logging to console
    condition: selection
falsepositives:
    - System administrators or scripts that intentionally clear logs
    - Debugging scripts
level: medium

title: CodeIntegrity - Blocked Image Load With Revoked Certificate
id: 6f156c48-3894-4952-baf0-16193e9067d2
status: test
description: Detects blocked image load events with revoked certificates by code integrity.
references:
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
    - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-06
tags:
    - attack.privilege-escalation
logsource:
    product: windows
    service: codeintegrity-operational
detection:
    selection:
        EventID: 3036 # Windows is unable to verify the integrity of the file %2 because the signing certificate has been revoked.  Check with the publisher to see if a new signed version of the kernel module is available.
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Communication To LocaltoNet Tunneling Service Initiated - Linux
id: c4568f5d-131f-4e78-83d4-45b2da0ec4f1
status: test
description: |
    Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
    LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
    Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
references:
    - https://localtonet.com/documents/supported-tunnels
    - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
author: Andreas Braathen (mnemonic.io)
date: 2024-06-17
tags:
    - attack.command-and-control
    - attack.t1572
    - attack.t1090
    - attack.t1102
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        DestinationHostname|endswith:
            - '.localto.net'
            - '.localtonet.com'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate use of the LocaltoNet service.
level: high

title: CosmicDuke Service Installation
id: cb062102-587e-4414-8efa-dbe3c7bf19c6
related:
    - id: 2cfe636e-317a-4bee-9f2c-1066d9f54d1a
      type: derived
status: test
description: |
    Detects the installation of a service named "javamtsup" on the system.
    The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.
references:
    - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
date: 2017-03-27
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1543.003
    - attack.t1569.002
    - detection.emerging-threats
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceName: 'javamtsup'
    condition: selection
falsepositives:
    - Unlikely
level: critical

title: Detection of PowerShell Execution via Sqlps.exe
id: 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
status: test
description: |
  This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
  Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
references:
    - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/
    - https://twitter.com/bryon_/status/975835709587075072
author: 'Agro (@agro_sev) oscd.community'
date: 2020-10-10
modified: 2022-12-09
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1127
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\sqlps.exe'
    selection_image:
        - Image|endswith: '\sqlps.exe'
        - OriginalFileName: 'sqlps.exe'
    filter_image:
        ParentImage|endswith: '\sqlagent.exe'
    condition: selection_parent or (selection_image and not filter_image)
falsepositives:
    - Direct PS command execution through SQLPS.exe is uncommon, childprocess sqlps.exe spawned by sqlagent.exe is a legitimate action.
level: medium

title: Devcon Execution Disabling VMware VMCI Device
id: 85f520e7-6f5e-43ca-874c-222e5bf9c0de
status: experimental
description: |
    Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.
    This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.
    This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.
references:
    - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
    - https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
    - https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
    - https://huntress.com/blog/esxi-vm-escape-exploit
author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
date: 2026-01-02
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1543.003
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\devcon.exe'
        - OriginalFileName: 'DevCon.exe'
    selection_action:
        CommandLine|contains: ' disable '
    selection_vmci_pci:
        CommandLine|contains:
            - '15AD&DEV_0740' # VMware VMCI PCI device (Vendor 0x15AD = VMware, Device 0x0740 = VMCI)
            - 'VMWVMCIHOSTDEV' # VMware VMCI root host device driver name
    condition: all of selection_*
falsepositives:
    - Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts.
    - Automated scripts in virtualized environments for device cleanup.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml

title: Diskshadow Script Mode - Execution From Potential Suspicious Location
id: fa1a7e52-3d02-435b-81b8-00da14dd66c1
related:
    - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f # Diskshadow Script Mode - Uncommon Script Extension Execution
      type: similar
    - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 # Potentially Suspicious Child Process Of DiskShadow.EXE
      type: similar
    - id: 56b1dde8-b274-435f-a73a-fb75eb81262a # Diskshadow Child Process Spawned
      type: similar
    - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 # Diskshadow Script Mode Execution
      type: similar
status: test
description: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.
references:
    - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
    - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
    - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
    - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware
    - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-15
modified: 2024-03-05
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'diskshadow.exe'
        - Image|endswith: '\diskshadow.exe'
    selection_cli:
        CommandLine|contains|windash: '-s '
    selection_paths:
        CommandLine|contains:
            # Note: Add additional susp paths based on your org needs
            - ':\Temp\'
            - ':\Windows\Temp\'
            - '\AppData\Local\'
            - '\AppData\Roaming\'
            - '\ProgramData\'
            - '\Users\Public\'
    condition: all of selection_*
falsepositives:
    - False positives may occur if you execute the script from one of the paths mentioned in the rule. Apply additional filters that fits your org needs.
level: medium

title: Failed MSExchange Transport Agent Installation
id: c7d16cae-aaf3-42e5-9c1c-fb8553faa6fa
status: test
description: Detects a failed installation of a Exchange Transport Agent
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8
author: Tobias Michalski (Nextron Systems)
date: 2021-06-08
modified: 2022-07-12
tags:
    - attack.persistence
    - attack.t1505.002
logsource:
    service: msexchange-management
    product: windows
    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
    selection:
        EventID: 6
        Data|contains: 'Install-TransportAgent'
    condition: selection
falsepositives:
    - Legitimate installations of exchange TransportAgents. AssemblyPath is a good indicator for this.
level: high

title: HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
id: 6e2a900a-ced9-4e4a-a9c2-13e706f9518a
status: test
description: Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.
references:
    - https://github.com/Porchetta-Industries/CrackMapExec
    - https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py
author: SecurityAura
date: 2022-11-16
modified: 2024-06-27
tags:
    - attack.credential-access
    - attack.t1003
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\svchost.exe'
        # CommandLine|contains: 'RemoteRegistry' # Uncomment this line if you collect CommandLine data for files events from more accuracy
        TargetFilename|re: '\\Windows\\System32\\[a-zA-Z0-9]{8}\.tmp$'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Logged-On User Password Change Via Ksetup.EXE
id: c9783e20-4793-4164-ba96-d9ee483992c4
status: test
description: Detects password change for the logged-on user's via "ksetup.exe"
references:
    - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-06
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\ksetup.exe'
        - OriginalFileName: 'ksetup.exe'
    selection_cli:
        CommandLine|contains: ' /ChangePassword '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: macOS ESF Sensitive File Access
id: 3c9e1ec5-6f6c-4c9d-bb3a-1b7cf0b9a1df
status: experimental
description: Detect access to sensitive system files via ESF OPEN notifications. More suspicious when non-root users access these files.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: endpointsecurity
level: high
detection:
  selection_event:
    esf.event_type: 10
    event.action: open
  selection_path:
    TargetFilename|startswith:
    - /etc/hosts
    - /etc/sudoers
    - /Library/Preferences/com.apple.TCC.plist
  selection_root:
    UserId: 0
  condition: selection_event and selection_path and not selection_root
falsepositives:
- legitimate administrative tasks (e.g., configuration management)
- root user administrative access
tags:
- attack.discovery
modified: 2025/01/15

title: macOS Service Disruption Activity
id: e673e584-70d1-4b1e-9bdf-48f7eb0064d9
status: experimental
description: 'Detects execution of service control tools (launchctl, killall, pkill)
  with

  parameters targeting system services or multiple processes. May indicate service

  disruption for impact or denial of service attacks.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1489/
- https://attack.mitre.org/techniques/T1529/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_launchctl:
    Image|endswith: /launchctl
    CommandLine|contains:
    - unload
    - remove
    - disable
    - stop
  selection_kill:
    Image|endswith:
    - killall
    - pkill
    CommandLine|contains:
    - '-9'
    - SIGKILL
    - -KILL
  selection_root:
    UserId: 0
  condition: selection_event and (selection_launchctl or selection_kill) and not selection_root
falsepositives:
- System administration and service management
- Software updates requiring service restarts
- Legitimate process termination
- Troubleshooting and maintenance activities
- Root user administrative actions
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.impact
- attack.t1489
- attack.t1529
level: medium

title: Modifying Crontab
id: af202fd3-7bff-4212-a25a-fb34606cfcbe
status: test
description: Detects suspicious modification of crontab file.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
author: Pawel Mazur
date: 2022-04-16
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.003
logsource:
    product: linux
    service: cron
detection:
    keywords:
        - 'REPLACE'
    condition: keywords
falsepositives:
    - Legitimate modification of crontab
level: medium

title: New Cron File Created
id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05
status: experimental
description: |
    Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker.
    Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files.
    This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job.
    Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes.
    Additionally, it is recommended to review the contents of the newly created cron files to assess their intent.
    Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment.
references:
    - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml
    - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/
    - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
    - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2026-04-28
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.003
logsource:
    product: linux
    category: file_event
detection:
    selection_cron_dirs:
        TargetFilename|startswith:
            - '/etc/cron.d/'
            - '/etc/cron.daily/'
            - '/etc/cron.hourly/'
            - '/etc/cron.monthly/'
            - '/etc/cron.weekly/'
            - '/var/spool/cron/crontabs/'
            - '/var/spool/cron/root'
    selection_cron_special_files:
        TargetFilename|contains:
            - '/etc/cron.allow'
            - '/etc/cron.deny'
            - '/etc/crontab'
    filter_optional_legit_cron:
        # Note: FPs on docker images: golang, postgres, python, redis, ruby
        TargetFilename:
            - '/etc/cron.daily/apt'
            - '/etc/cron.daily/dpkg'
            - '/etc/cron.daily/passwd'
            - '/etc/crontabs/root'
    condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment.
level: low

title: Potential Data Exfiltration Via Audio File
id: e4f93c99-396f-47c8-bb0f-201b1fa69034
status: test
description: Detects potential exfiltration attempt via audio file using PowerShell
references:
    - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-16
tags:
    - attack.exfiltration
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_main:
        ScriptBlockText|contains|all:
            - '[System.Math]::'
            - '[IO.FileMode]::'
            - 'BinaryWriter'
    selection_header_wav:
        ScriptBlockText|contains|all:
            # Byte chunks from the WAV header used in the example POC
            # You can extend this for different audio formats by adding different selections
            - '0x52'
            - '0x49'
            - '0x46'
            - '0x57'
            - '0x41'
            - '0x56'
            - '0x45'
            - '0xAC'
    condition: selection_main and 1 of selection_header_*
falsepositives:
    - Unknown
level: medium

title: Potential Persistence Via Outlook Home Page
id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
related:
    - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
      type: similar
status: test
description: |
    Detects potential persistence activity via outlook home page.
    An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70
    - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us
    - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
date: 2021-06-09
modified: 2024-08-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains|all:
            - '\Software\Microsoft\Office\'
            - '\Outlook\WebView\'
        TargetObject|endswith: '\URL'
    condition: selection
falsepositives:
    - Unknown
level: high
simulation:
    - type: atomic-red-team
      name: Install Outlook Home Page Persistence
      technique: T1137.004
      atomic_guid: 7a91ad51-e6d2-4d43-9471-f26362f5738e

title: Potential Persistence Via Shim Database In Uncommon Location
id: 6b6976a3-b0e6-4723-ac24-ae38a737af41
status: test
description: Detects the installation of a new shim database where the file is located in a non-default location
references:
    - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
    - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
    - https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-01
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.011
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\'
            - '\DatabasePath'
    filter_main_known_locations:
        Details|contains: ':\Windows\AppPatch\Custom'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potential PowerShell Obfuscation Using Character Join
id: e8314f79-564d-4f79-bc13-fbc0bf2660d8
related:
    - id: 96cd126d-f970-49c4-848a-da3a09f55c55
      type: derived
status: test
description: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-09
tags:
    - attack.execution
    - attack.stealth
    - attack.t1027
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        # Example:
        #   Set-Alias -Name Y -Value (-join("Ne","w-O","bje","ct"))
        #   Set-Alias -Name X -Value (-join("Inv","oke","-","Exp","ression"))
        ScriptBlockText|contains|all:
            - '-Alias' # For both "New-Alias" and "Set-Alias"
            - ' -Value (-join('
    condition: selection
falsepositives:
    - Unknown
level: low

title: Potential SystemNightmare Exploitation Attempt
id: c01f7bd6-0c1d-47aa-9c61-187b91273a16
status: test
description: Detects an exploitation attempt of SystemNightmare in order to obtain a shell as LOCAL_SYSTEM
references:
    - https://github.com/GossiTheDog/SystemNightmare
author: Florian Roth (Nextron Systems)
date: 2021-08-11
modified: 2023-02-04
tags:
    - attack.privilege-escalation
    - attack.t1068
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'printnightmare.gentilkiwi.com'
            - ' /user:gentilguest '
            - 'Kiwi Legit Printer'
    condition: selection
falsepositives:
    - Unknown
level: critical

title: Powershell LocalAccount Manipulation
id: 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
status: test
description: |
    Adversaries may manipulate accounts to maintain access to victim systems.
    Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
author: frack113
date: 2021-12-28
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Disable-LocalUser'
            - 'Enable-LocalUser'
            - 'Get-LocalUser'
            - 'Set-LocalUser'
            - 'New-LocalUser'
            - 'Rename-LocalUser'
            - 'Remove-LocalUser'
    condition: selection
falsepositives:
    - Legitimate administrative script
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_localuser/info.yml

title: Privilege SeMachineAccountPrivilege abuse
description: Detects scenarios where an attacker abuse the SeMachineAccountPrivilege which allows per default any authenticated user to join a computer to the domain. Later on, this computer account can be manipulated in order to elevate privileges.
requirements: despite of this event marked as a "sensitive privilege", I was only able to trigger it by having the audit for "non sensitive privileges" activated.
correlation: correlate with ID 4741 (computer created) using field SubjectLogonId. See rule "Computer account created with privileges" for advance correlation.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1068-Exploitation%20for%20Privilege%20Escalation
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
- https://www.thehacker.recipes/ad/movement/kerberos/samaccountname-spoofing
- https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
- https://github.com/WazeHell/sam-the-admin
- https://github.com/cube0x0/noPac
- https://github.com/ly4k/Pachine
- https://cloudbrothers.info/en/exploit-kerberos-samaccountname-spoofing/
tags:
- attack.privilege_escalation
- attack.t1068
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4673
    PrivilegeList: SeMachineAccountPrivilege
    #ProcessName|endswith: \Windows\System32\lsass.exe
  filter:
    - SubjectUserSid: "S-1-5-18"
    - SubjectUserName: '%admin_acounts%'
  condition: selection and not filter
falsepositives:
- Users (shouldn't) or administrators joining a computer to the domain, server provisionning software
level: medium

title: RDP Connection Allowed Via Netsh.EXE
id: 01aeb693-138d-49d2-9403-c4f52d7d3d62
status: test
description: Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware
references:
    - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/
author: Sander Wiebing
date: 2020-05-23
modified: 2023-12-11
tags:
    - attack.defense-impairment
    - attack.t1686.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\netsh.exe'
        - OriginalFileName: 'netsh.exe'
    selection_cli:
        # Example:
        #   Old: netsh firewall add portopening TCP 3389 "Open Port 3389"
        #   New: netsh advfirewall firewall add rule name= "Open Port 3389" dir=in action=allow protocol=TCP localport=3389
        CommandLine|contains|all:
            - 'firewall '
            - 'add '
            - 'tcp '
            - '3389'
        CommandLine|contains:
            - 'portopening'
            - 'allow'
    condition: all of selection_*
falsepositives:
    - Legitimate administration activity
level: high

title: RDP tunneling via ngrok detected
description: Detects scenarios where an attacker uses RDP tunneling to redirect traffic to a C&C target.
references:
- https://twitter.com/malmoeb/status/1519710302820089857
- https://twitter.com/Purp1eW0lf/status/1624073100420677633
- https://www.mandiant.com/resources/blog/bypassing-network-restrictions-through-rdp-tunneling
- https://www.huntress.com/blog/abusing-ngrok-hackers-at-the-end-of-the-tunnel
- https://www.logpoint.com/en/blog/a-deep-look-at-the-darkside-ransomware-operators-and-their-affiliates/#
- https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial
tags:
- attack.command_and_control
- attack.t1572 # Protocol Tunneling 
- attack.lateral_movement
- attack.t1021.001 # Remote Services: Remote Desktop Protocol 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: rdp
detection: # suspicious paramter in the IP field should be : "::%16777216"
  selection1:
    EventID: 
      - 21 # session logon succeeded
      - 24 # session has been disconnected
      - 25 # session reconnection successed
    Channel: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational
    EventXML.Address|startswith: '::%' # IP address is provided in "EventXML.Address"

  selection2:
    EventID: 1149 # 'User authentication succeeded': DOES NOT indicate a successful user authentication !!!
    Channel: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational
    EventXML.Param3|startswith: '::%' # IP address is provided in "EventXML.Param3"

  condition: selection1 or selection2
falsepositives:
- Nested RDP session on the same host using ::1 as destination IP
level: high

title: SC.EXE Query Execution
id: 57712d7a-679c-4a41-a913-87e7175ae429
status: test
description: Detects execution of "sc.exe" to query information about registered services on the system
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-1---system-service-discovery
author: frack113
date: 2021-12-06
modified: 2024-02-08
tags:
    - attack.discovery
    - attack.t1007
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\sc.exe'
        OriginalFileName: 'sc.exe'
    selection_cli:
        CommandLine|contains: ' query'
    filter_optional_keybase:
        CommandLine: 'sc query dokan1'
    condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate query of a service by an administrator to get more information such as the state or PID
    - Keybase process "kbfsdokan.exe" query the dokan1 service with the following commandline "sc query dokan1"
level: low

title: Serv-U Exploitation CVE-2021-35211 by DEV-0322
id: 75578840-9526-4b2a-9462-af469a45e767
status: test
description: Detects patterns as noticed in exploitation of Serv-U CVE-2021-35211 vulnerability by threat group DEV-0322
references:
    - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
author: Florian Roth (Nextron Systems)
date: 2021-07-14
modified: 2022-12-18
tags:
    - attack.persistence
    - attack.t1136.001
    - cve.2021-35211
    - detection.emerging-threats
    # - threat_group.DEV-0322
logsource:
    category: process_creation
    product: windows
detection:
    selection_whoami:
        CommandLine|contains: 'whoami'
    selection_cmd_1:
        CommandLine|contains:
            - './Client/Common/'
            - '.\Client\Common\'
    selection_cmd_2:
        CommandLine|contains: 'C:\Windows\Temp\Serv-U.bat'
    condition: selection_whoami and 1 of selection_cmd*
falsepositives:
    - Unlikely
level: critical

title: Service abuse with backdoored "command failure" (Reg via command)
description: Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://twitter.com/JohnLaTwC/status/1432689635122159623?s=09
- https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742019(v=ws.11)
- https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/
tags:
- attack.persistence
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: \reg.exe
    CommandLine|contains|all: # Full command: REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time" /v FailureCommand /t REG_SZ /d "C:\tmp\pentestlab.exe"
      - REG ADD
      - '\SYSTEM\CurrentControlSet\Services\'
      - FailureCommand
  condition: selection
falsepositives:
- administrator reconfiguring service
level: high

title: Shadow Copies Deletion Using Operating Systems Utilities
id: c947b146-0abc-4c87-9c64-b17e9d7274a2
status: stable
description: Shadow Copies deletion using operating systems utilities
references:
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
    - https://blog.talosintelligence.com/2017/05/wannacry.html
    - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
    - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
    - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
    - https://github.com/Neo23x0/Raccine#the-process
    - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar
    - https://redcanary.com/blog/intelligence-insights-october-2021/
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)
date: 2019-10-22
modified: 2022-11-03
tags:
    - attack.impact
    - attack.stealth
    - attack.t1070
    - attack.t1490
logsource:
    category: process_creation
    product: windows
detection:
    selection1_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\wmic.exe'
              - '\vssadmin.exe'
              - '\diskshadow.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'wmic.exe'
              - 'VSSADMIN.EXE'
              - 'diskshadow.exe'
    selection1_cli:
        CommandLine|contains|all:
            - 'shadow'  # will match "delete shadows" and "shadowcopy delete" and "shadowstorage"
            - 'delete'
    selection2_img:
        - Image|endswith: '\wbadmin.exe'
        - OriginalFileName: 'WBADMIN.EXE'
    selection2_cli:
        CommandLine|contains|all:
            - 'delete'
            - 'catalog'
            - 'quiet' # will match -quiet or /quiet
    selection3_img:
        - Image|endswith: '\vssadmin.exe'
        - OriginalFileName: 'VSSADMIN.EXE'
    selection3_cli:
        CommandLine|contains|all:
            - 'resize'
            - 'shadowstorage'
        CommandLine|contains:
            - 'unbounded'
            - '/MaxSize='
    condition: (all of selection1*) or (all of selection2*) or (all of selection3*)
falsepositives:
    - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason
    - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand)
level: high

title: Shellshock Expression
id: c67e0c98-4d39-46ee-8f6b-437ebf6b950e
status: test
description: Detects shellshock expressions in log files
references:
    - https://owasp.org/www-pdf-archive/Shellshock_-_Tudor_Enache.pdf
author: Florian Roth (Nextron Systems)
date: 2017-03-14
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1505.003
logsource:
    product: linux
detection:
    keywords:
        - '(){:;};'
        - '() {:;};'
        - '() { :;};'
        - '() { :; };'
    condition: keywords
falsepositives:
    - Unknown
level: high

title: Suspicious Encoded PowerShell Command Line
id: ca2092a1-c273-4878-9b4b-0d60115bf5ea
status: test
description: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
references:
    - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community
date: 2018-09-03
modified: 2023-04-06
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli_enc:
        CommandLine|contains: ' -e' # covers -en and -enc
    selection_cli_content:
        CommandLine|contains:
            - ' JAB'
            - ' SUVYI'
            - ' SQBFAFgA'
            - ' aQBlAHgA'
            - ' aWV4I'
            - ' IAA'
            - ' IAB'
            - ' UwB'
            - ' cwB'
    selection_standalone:
        CommandLine|contains:
            - '.exe -ENCOD '
            - ' BA^J e-' # Reversed
    filter_optional_remote_signed:
        CommandLine|contains: ' -ExecutionPolicy remotesigned '
    condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd/info.yml

title: UEFI Persistence Via Wpbbin - FileCreation
id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f
status: test
description: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method
references:
    - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
    - https://persistence-info.github.io/Data/wpbbin.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-18
tags:
    - attack.persistence
    - attack.stealth
    - attack.t1542.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename: 'C:\Windows\System32\wpbbin.exe'
    condition: selection
falsepositives:
    - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)
level: high

title: Unusual File Download From File Sharing Websites - File Stream
id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
related:
    - id: 8b48ad89-10d8-4382-a546-50588c410f0d
      type: similar
    - id: d635249d-86b5-4dad-a8c7-d7272b788586
      type: similar
    - id: 52182dfb-afb7-41db-b4bc-5336cb29b464
      type: similar
    - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
      type: similar
    - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
      type: similar
    - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
      type: similar
    - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
      type: similar
    - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
      type: similar
    - id: b6e04788-29e1-4557-bb14-77f761848ab8
      type: similar
    - id: a0d7e4d2-bede-4141-8896-bc6e237e977c
      type: similar
    - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
      type: similar
status: test
description: Detects the download of suspicious file type from a well-known file and paste sharing domain
references:
    - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
    - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
    - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
author: Florian Roth (Nextron Systems)
date: 2022-08-24
modified: 2026-03-29
tags:
    - attack.stealth
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
detection:
    selection_domain:
        Contents|contains:
            - '.githubusercontent.com'       # Includes both gists and github repositories / Michael Haag (idea)
            - '0x0.st'
            - 'anonfiles.com'
            - 'bashupload.com'
            - 'cdn.discordapp.com'
            - 'chunk.io'
            - 'ddns.net'
            - 'dl.dropboxusercontent.com'
            - 'ghostbin.co'
            - 'github.com'
            - 'glitch.me'
            - 'gofile.io'
            - 'hastebin.com'
            - 'mediafire.com'
            - 'mega.nz'
            - 'onrender.com'
            - 'pages.dev'
            - 'paste.ee'
            - 'pastebin.com'
            - 'pastebin.pl'
            - 'pastetext.net'
            - 'pixeldrain.com'
            - 'privatlab.com'
            - 'privatlab.net'
            - 'send.exploit.in'
            - 'sendspace.com'
            - 'storage.googleapis.com'
            - 'storjshare.io'
            - 'supabase.co'
            - 'temp.sh'
            - 'transfer.sh'
            - 'trycloudflare.com'
            - 'ufile.io'
            - 'w3spaces.com'
            - 'workers.dev'
            - 'x0.at'
    selection_extension:
        TargetFilename|contains:
            - '.bat:Zone'
            - '.cmd:Zone'
            - '.ps1:Zone'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium