Detection rules › Sigma
Sigma rules: 1t
AWS Bedrock Guardrail Deleted
#Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove model safety controls and allow unsafe or unauthorized model responses.
Known False Positives
- Legitimate guardrail deletion by authorized identities.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry Coverage
Rules Detecting the Same Action
These rules filter on the same operation.
Rule Body
title: AWS Bedrock Guardrail Deleted
id: 59b70e4d-dd17-44a9-b740-acf07ae3eb6a
status: experimental
description: |
Detects deletion of an Amazon Bedrock guardrail, which may indicate attempts to remove
model safety controls and allow unsafe or unauthorized model responses.
references:
- https://docs.aws.amazon.com/bedrock/latest/APIReference/API_DeleteGuardrail.html
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-07-10
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventName: 'DeleteGuardrail'
eventSource: 'bedrock.amazonaws.com'
condition: selection
falsepositives:
- Legitimate guardrail deletion by authorized identities.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventName: 'DeleteGuardrail'
eventSource: 'bedrock.amazonaws.com'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"DeleteGuardrail" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"bedrock.amazonaws.com" |
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
#Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 7: Image loaded |
Rule Body
title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
status: experimental
description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
references:
- https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
- https://x.com/Threatlabz/status/1879956781360976155
author: X__Junior
date: 2025-01-20
tags:
- attack.execution
- attack.t1059
logsource:
category: image_load
product: windows
detection:
selection_dll:
ImageLoaded|endswith: '\clfs.sys'
selection_folders_1:
Image|contains:
- ':\Perflogs\'
- ':\Users\Public\'
- '\Temporary Internet'
- '\Windows\Temp\'
selection_folders_2:
- Image|contains|all:
- ':\Users\'
- '\Favorites\'
- Image|contains|all:
- ':\Users\'
- '\Favourites\'
- Image|contains|all:
- ':\Users\'
- '\Contacts\'
- Image|contains|all:
- ':\Users\'
- '\Pictures\'
condition: selection_dll and 1 of selection_folders_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection_dll and 1 of selection_folders_*Stage 1: selection_dll
selection_dll:
ImageLoaded|endswith: '\clfs.sys'
Stage 2: selection_folders_1
selection_folders_1:
Image|contains:
- ':\Perflogs\'
- ':\Users\Public\'
- '\Temporary Internet'
- '\Windows\Temp\'
Stage 3: selection_folders_2
selection_folders_2:
- Image|contains|all:
- ':\Users\'
- '\Favorites\'
- Image|contains|all:
- ':\Users\'
- '\Favourites\'
- Image|contains|all:
- ':\Users\'
- '\Contacts\'
- Image|contains|all:
- ':\Users\'
- '\Pictures\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | match |
| field:"Image" kind:match |
ImageLoaded | ends_with |
| field:"ImageLoaded" kind:ends_with value:"\clfs.sys" |
CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit
#Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence |
Rule Body
title: CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploit
id: fcbb4a77-f368-4945-b046-4499a1da69d1
status: test
description: Detects an authentication bypass vulnerability affecting the REST API URLs in ADSelfService Plus (CVE-2021-40539).
references:
- https://therecord.media/cisa-warns-of-zoho-server-zero-day-exploited-in-the-wild/
- https://www.manageengine.com/products/self-service-password/kb/how-to-fix-authentication-bypass-vulnerability-in-REST-API.html
- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
author: Sittikorn S, Nuttakorn Tungpoonsup
date: 2021-09-10
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- attack.persistence
- attack.t1505.003
- cve.2021-40539
- detection.emerging-threats
logsource:
category: webserver
definition: 'Must be collect log from \ManageEngine\ADSelfService Plus\logs'
detection:
selection:
cs-uri-query|contains:
- '/help/admin-guide/Reports/ReportGenerate.jsp'
- '/RestAPI/LogonCustomization'
- '/RestAPI/Connection'
condition: selection
falsepositives:
- Unknown
level: critical
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
cs-uri-query|contains:
- '/help/admin-guide/Reports/ReportGenerate.jsp'
- '/RestAPI/LogonCustomization'
- '/RestAPI/Connection'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-uri-query | match |
| field:"cs-uri-query" kind:match |
CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
#Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
related:
- id: e4556676-fc5c-4e95-8c39-5ef27791541f
type: similar
status: test
description: Detects exploitation attempt of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries.
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
author: Nasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
date: 2023-08-30
modified: 2024-01-22
tags:
- detection.emerging-threats
- attack.execution
- attack.t1203
- cve.2023-38331
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\WinRAR.exe'
selection_folder:
CommandLine|contains: '\AppData\Local\Temp\Rar$'
selection_double_ext:
CommandLine|re: '\.[a-zA-Z0-9]{1,4} \.'
selection_binaries:
# Note: add additional binaries that the attacker might use
- Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- OriginalFileName:
- 'Cmd.Exe'
- 'cscript.exe'
- 'PowerShell.EXE'
- 'pwsh.dll'
- 'wscript.exe'
condition: all of selection_*
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_parent
selection_parent:
ParentImage|endswith: '\WinRAR.exe'
Stage 2: selection_folder
selection_folder:
CommandLine|contains: '\AppData\Local\Temp\Rar$'
Stage 3: selection_double_ext
selection_double_ext:
CommandLine|re: '\.[a-zA-Z0-9]{1,4} \.'
Stage 4: selection_binaries
selection_binaries:
- Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- OriginalFileName:
- 'Cmd.Exe'
- 'cscript.exe'
- 'PowerShell.EXE'
- 'pwsh.dll'
- 'wscript.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:"\AppData\Local\Temp\Rar$" |
CommandLine | regex_match |
| field:"CommandLine" kind:regex_match value:".[a-zA-Z0-9]{1,4} ." |
Image | ends_with |
| field:"Image" kind:ends_with |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\WinRAR.exe" |
Deleted Data Overwritten Via Cipher.EXE
#Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Impact |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Deleted Data Overwritten Via Cipher.EXE
id: 4b046706-5789-4673-b111-66f25fe99534
status: test
description: |
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive
author: frack113
date: 2021-12-26
modified: 2023-02-21
tags:
- attack.impact
- attack.t1485
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: 'CIPHER.EXE'
- Image|endswith: '\cipher.exe'
selection_cli:
CommandLine|contains: ' /w:'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml
simulation:
- type: atomic-red-team
name: Overwrite deleted data on C drive
technique: T1485
atomic_guid: 321fd25e-0007-417f-adec-33232252be19
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- OriginalFileName: 'CIPHER.EXE'
- Image|endswith: '\cipher.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains: ' /w:'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:" /w:" |
Image | ends_with |
| field:"Image" kind:ends_with value:"\cipher.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"CIPHER.EXE" |
File Deleted Via Sysinternals SDelete
#Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
Known False Positives
- Legitimate usage
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry Coverage
Rule Body
title: File Deleted Via Sysinternals SDelete
id: 6ddab845-b1b8-49c2-bbf7-1a11967f64bc
status: test
description: Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.
references:
- https://github.com/OTRF/detection-hackathon-apt29/issues/9
- https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2020-05-02
modified: 2023-02-15
tags:
- attack.stealth
- attack.t1070.004
logsource:
product: windows
category: file_delete
detection:
selection:
TargetFilename|endswith:
- '.AAA'
- '.ZZZ'
filter_wireshark:
TargetFilename|endswith: '\Wireshark\radius\dictionary.alcatel-lucent.aaa'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate usage
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
TargetFilename|endswith:
- '.AAA'
- '.ZZZ'
Stage 2: not filter_wireshark
filter_wireshark:
TargetFilename|endswith: '\Wireshark\radius\dictionary.alcatel-lucent.aaa'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
TargetFilename | ends_with | \Wireshark\radius\dictionary.alcatel-lucent.aaa | excludes:TargetFilename field:"TargetFilename" value:"\Wireshark\radius\dictionary.alcatel-lucent.aaa" |
Firewall deactivation (modern command)
#Detects scenarios where an attacker disabled the Windows Firewall to evade defense.
Known False Positives
- Administrator activity
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Firewall deactivation (modern command)
description: Detects scenarios where an attacker disabled the Windows Firewall to evade defense.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.004-Impair%20Defenses-Disable%20or%20Modify%20System%20Firewall
- https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
- https://research.checkpoint.com/2022/check-point-research-detects-crypto-miner-malware-disguised-as-google-translate-desktop-and-other-legitimate-applications/
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection_event:
EventID: 4688
NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
selection_command:
Commandline|contains|all: # full command 'netsh advfirewall set <privateprofile/publicprofile/domainprofile> state off'
- netsh
- advfirewall
- set
- state
- 'off'
selection_obfuscated:
Commandline|contains|all: # full command 'netsh a s <profile> state off'
- netsh
- ' a*' # advfirewall
- ' s*' # set
- state
- 'off'
condition: selection_event and (selection_command or selection_obfuscated)
falsepositives:
- Administrator activity
level: high
Stages and Predicates
Stage 0: condition
selection_event and (selection_command or selection_obfuscated)Stage 1: selection_event
selection_event:
EventID: 4688
NewProcessName|endswith: '\netsh.exe'
Stage 2: selection_command
selection_command:
Commandline|contains|all:
- netsh
- advfirewall
- set
- state
- 'off'
Stage 3: selection_obfuscated
selection_obfuscated:
Commandline|contains|all:
- netsh
- ' a*'
- ' s*'
- state
- 'off'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Commandline | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\netsh.exe" |
IAM Login Profile Created
#Establishes persistence by creating a Login Profile on an existing IAM user. This allows an attacker to access an IAM user intended to be used programmatically through the AWS console usual login process. This can also be detected with UpdateLoginProfile events. If an account is meant to be used only programmatically, it should not have a login profile.
Known False Positives
- Legitimate creation of a login profile by an administrator.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Telemetry Coverage
Rules Detecting the Same Action
These rules filter on the same operation.
- AWS IAM Credentials Added to a Bedrock API Key Phantom User (Elastic)
- AWS IAM Login Profile Added for Root (Elastic)
- AWS IAM Login Profile Added to User (Elastic)
- AWS IAM Login Profile Created or Modified for an IAM User (Elastic)
- AWS IAM S3Browser LoginProfile Creation (Sigma)
- AWS User Login Profile Created or Modified (Panther)
Rule Body
title: IAM Login Profile Created
id: 2070cb71-0958-4504-906f-f8d4163d7505
status: test
description: |
Establishes persistence by creating a Login Profile on an existing IAM user.
This allows an attacker to access an IAM user intended to be used programmatically through the AWS console usual login process.
This can also be detected with UpdateLoginProfile events.
If an account is meant to be used only programmatically, it should not have a login profile.
references:
- https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1098.001.html
- https://stratus-red-team.cloud/attack-techniques/AWS/aws.persistence.iam-create-user-login-profile/
- https://securitylabs.datadoghq.com/articles/tales-from-the-cloud-trenches-ecs-crypto-mining/
- https://permiso.io/blog/s/approach-to-detection-androxgh0st-greenbot-persistence/
- https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor/
- https://blog.darklab.hk/2021/07/06/trouble-in-paradise/
- https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/
- https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
- attack.persistence
- attack.t1098.001 # Account Manipulation: Additional Cloud Credentials
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'CreateLoginProfile'
condition: selection
falsepositives:
- Legitimate creation of a login profile by an administrator.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'CreateLoginProfile'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"CreateLoginProfile" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"iam.amazonaws.com" |
Kubernetes Admission Controller Modification
#Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
Known False Positives
- Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
- Automated processes may need to take these actions and may need to be filtered.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth | |
| Credential Access |
Telemetry Coverage
Rules Detecting the Same Action
These rules filter on the same operation.
- GKE Admission Webhook Created or Modified (Elastic)
- Kubernetes Admission Controller Webhook Created (Panther)
- Kubernetes Admission Webhook Created or Modified (Elastic)
- New Admission Controller Created (Panther)
- New Admission Controller Created (Panther)
Rule Body
title: Kubernetes Admission Controller Modification
id: eed82177-38f5-4299-8a76-098d50d225ab
related:
- id: 6ad91e31-53df-4826-bd27-0166171c8040
type: similar
status: test
description: |
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.
references:
- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
- https://security.padok.fr/en/blog/kubernetes-webhook-attackers
author: kelnage
date: 2024-07-11
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.persistence
- attack.stealth
- attack.t1078
- attack.credential-access
- attack.t1552
- attack.t1552.007
logsource:
product: kubernetes
service: audit
detection:
selection:
objectRef.apiGroup: 'admissionregistration.k8s.io'
objectRef.resource:
- 'mutatingwebhookconfigurations'
- 'validatingwebhookconfigurations'
verb:
- 'create'
- 'delete'
- 'patch'
- 'replace'
- 'update'
condition: selection
falsepositives:
- Modifying the Kubernetes Admission Controller may need to be done by a system administrator.
- Automated processes may need to take these actions and may need to be filtered.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
objectRef.apiGroup: 'admissionregistration.k8s.io'
objectRef.resource:
- 'mutatingwebhookconfigurations'
- 'validatingwebhookconfigurations'
verb:
- 'create'
- 'delete'
- 'patch'
- 'replace'
- 'update'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
objectRef.apiGroup | eq |
| field:"objectRef.apiGroup" kind:eq value:"admissionregistration.k8s.io" |
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq |
verb | eq |
| field:"verb" kind:eq |
New DNS ServerLevelPluginDll Installed
#Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Stealth | |
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule Body
title: New DNS ServerLevelPluginDll Installed
id: e61e8a88-59a9-451c-874e-70fcc9740d67
related:
- id: cbe51394-cd93-4473-b555-edf0144952d9
type: derived
- id: f63b56ee-3f79-4b8a-97fb-5c48007e8573
type: derived
status: test
description: Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
references:
- https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
- https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
author: Florian Roth (Nextron Systems)
date: 2017-05-08
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.defense-impairment
- attack.t1574.001
- attack.t1112
logsource:
product: windows
category: registry_set
detection:
selection:
TargetObject|endswith: '\services\DNS\Parameters\ServerLevelPluginDll'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetObject|endswith: '\services\DNS\Parameters\ServerLevelPluginDll'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | ends_with |
| field:"TargetObject" kind:ends_with value:"\services\DNS\Parameters\ServerLevelPluginDll" |
NTDS.DIT Created
#Detects creation of a file named "ntds.dit" (Active Directory Database)
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule Body
title: NTDS.DIT Created
id: 0b8baa3f-575c-46ee-8715-d6f28cc7d33c
status: test
description: Detects creation of a file named "ntds.dit" (Active Directory Database)
references:
- Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-05
tags:
- attack.credential-access
- attack.t1003.003
logsource:
product: windows
category: file_event
detection:
selection:
TargetFilename|endswith: 'ntds.dit'
condition: selection
falsepositives:
- Unknown
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetFilename|endswith: 'ntds.dit'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with value:"ntds.dit" |
Potential AMSI Bypass Via .NET Reflection
#Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential AMSI Bypass Via .NET Reflection
id: 30edb182-aa75-42c0-b0a9-e998bb29067c
related:
- id: 4f927692-68b5-4267-871b-073c45f4f6fe
type: obsolete
status: test
description: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
references:
- https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
- https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
author: Markus Neis, @Kostastsale
date: 2018-08-17
modified: 2023-02-03
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection:
- CommandLine|contains|all:
- 'System.Management.Automation.AmsiUtils'
- 'amsiInitFailed'
- CommandLine|contains|all:
- '[Ref].Assembly.GetType'
- 'SetValue($null,$true)'
- 'NonPublic,Static'
condition: selection
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
- CommandLine|contains|all:
- 'System.Management.Automation.AmsiUtils'
- 'amsiInitFailed'
- CommandLine|contains|all:
- '[Ref].Assembly.GetType'
- 'SetValue($null,$true)'
- 'NonPublic,Static'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Potential AVKkid.DLL Sideloading
#Detects potential DLL sideloading of "AVKkid.dll"
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 7: Image loaded |
Rule Body
title: Potential AVKkid.DLL Sideloading
id: 952ed57c-8f99-453d-aee0-53a49c22f95d
status: test
description: Detects potential DLL sideloading of "AVKkid.dll"
references:
- https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
author: X__Junior (Nextron Systems)
date: 2023-08-03
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith: '\AVKkid.dll'
filter_main_legit_path:
Image|contains:
- 'C:\Program Files (x86)\G DATA\'
- 'C:\Program Files\G DATA\'
Image|endswith: '\AVKKid.exe'
ImageLoaded|startswith:
- 'C:\Program Files (x86)\G DATA\'
- 'C:\Program Files\G DATA\'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
ImageLoaded|endswith: '\AVKkid.dll'
Stage 2: not filter_main_legit_path
filter_main_legit_path:
Image|contains:
- 'C:\Program Files (x86)\G DATA\'
- 'C:\Program Files\G DATA\'
Image|endswith: '\AVKKid.exe'
ImageLoaded|startswith:
- 'C:\Program Files (x86)\G DATA\'
- 'C:\Program Files\G DATA\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ImageLoaded | ends_with |
| field:"ImageLoaded" kind:ends_with value:"\AVKkid.dll" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | match | C:\Program Files (x86)\G DATA\ | excludes:Image field:"Image" value:"C:\Program Files (x86)\G DATA\" |
Image | match | C:\Program Files\G DATA\ | excludes:Image field:"Image" value:"C:\Program Files\G DATA\" |
ImageLoaded | starts_with | C:\Program Files (x86)\G DATA\ | excludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files (x86)\G DATA\" |
ImageLoaded | starts_with | C:\Program Files\G DATA\ | excludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files\G DATA\" |
Image | ends_with | \AVKKid.exe | excludes:Image field:"Image" value:"\AVKKid.exe" |
Potential Credential Dumping Attempt Via PowerShell Remote Thread
#Detects remote thread creation by PowerShell processes into "lsass.exe"
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 8: CreateRemoteThread |
Rule Body
title: Potential Credential Dumping Attempt Via PowerShell Remote Thread
id: fb656378-f909-47c1-8747-278bf09f4f4f
related:
- id: 3f07b9d1-2082-4c56-9277-613a621983cc
type: obsolete
- id: 0f920ebe-7aea-4c54-b202-9aa0c609cfe5
type: similar
status: test
description: Detects remote thread creation by PowerShell processes into "lsass.exe"
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
author: oscd.community, Natalia Shornikova
date: 2020-10-06
modified: 2022-12-18
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: create_remote_thread
detection:
selection:
SourceImage|endswith:
- '\powershell.exe'
- '\pwsh.exe'
TargetImage|endswith: '\lsass.exe'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
SourceImage|endswith:
- '\powershell.exe'
- '\pwsh.exe'
TargetImage|endswith: '\lsass.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
SourceImage | ends_with |
| field:"SourceImage" kind:ends_with |
TargetImage | ends_with |
| field:"TargetImage" kind:ends_with value:"\lsass.exe" |
Potential CVE-2023-25157 Exploitation Attempt
#Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer
Known False Positives
- Vulnerability scanners
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | No specific technique |
Rule Body
title: Potential CVE-2023-25157 Exploitation Attempt
id: c0341543-5ed0-4475-aabc-7eea8c52aa66
status: test
description: Detects a potential exploitation attempt of CVE-2023-25157 a SQL injection in GeoServer
references:
- https://github.com/win3zz/CVE-2023-25157
- https://twitter.com/parzel2/status/1665726454489915395
- https://github.com/advisories/GHSA-7g5f-wrx8-5ccf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-14
tags:
- attack.initial-access
- cve.2023-25157
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_url:
cs-method: 'GET'
cs-uri-query|contains|all:
- '/geoserver/ows'
- 'CQL_FILTER='
cs-uri-query|contains:
# Abusable Filters/Function as reported in the Advisory
- 'PropertyIsLike'
- 'strEndsWith'
- 'strStartsWith'
- 'FeatureId'
- 'jsonArrayContains'
- 'DWithin'
selection_payload:
cs-uri-query|contains:
- '+--'
- '+AS+'
- '+OR+'
- 'FROM'
- 'ORDER+BY'
- 'SELECT'
- 'sleep%28'
- 'substring%28'
- 'UNION'
- 'WHERE'
condition: all of selection_*
falsepositives:
- Vulnerability scanners
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_url
selection_url:
cs-method: 'GET'
cs-uri-query|contains|all:
- '/geoserver/ows'
- 'CQL_FILTER='
cs-uri-query|contains:
- 'PropertyIsLike'
- 'strEndsWith'
- 'strStartsWith'
- 'FeatureId'
- 'jsonArrayContains'
- 'DWithin'
Stage 2: selection_payload
selection_payload:
cs-uri-query|contains:
- '+--'
- '+AS+'
- '+OR+'
- 'FROM'
- 'ORDER+BY'
- 'SELECT'
- 'sleep%28'
- 'substring%28'
- 'UNION'
- 'WHERE'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-method | eq |
| field:"cs-method" kind:eq value:"GET" |
cs-uri-query | match |
| field:"cs-uri-query" kind:match |
Potential Dropper Script Execution Via WScript/CScript/MSHTA
#Detects wscript/cscript/mshta executions of scripts located in user directories
Known False Positives
- Some installers might generate a similar behavior. An initial baseline is required
MITRE ATT&CK Coverage
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential Dropper Script Execution Via WScript/CScript/MSHTA
id: cea72823-df4d-4567-950c-0b579eaf0846
related:
- id: 1e33157c-53b1-41ad-bbcc-780b80b58288
type: similar
status: test
description: Detects wscript/cscript/mshta executions of scripts located in user directories
references:
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
- https://redcanary.com/blog/gootloader/
- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
date: 2019-01-16
modified: 2026-02-17
tags:
- attack.execution
- attack.t1059.005
- attack.t1059.007
logsource:
category: process_creation
product: windows
detection:
selection_exec:
Image|endswith:
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
selection_paths:
CommandLine|contains:
- ':\Perflogs\'
- ':\Temp\'
- ':\Tmp\'
- ':\Users\Public\'
- ':\Windows\Temp\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\Temp\'
- '\Start Menu\Programs\Startup\'
- '\Temporary Internet'
- '\Windows\Temp'
- '%LocalAppData%\Temp\'
- '%TEMP%'
- '%TMP%'
selection_ext:
CommandLine|contains:
- '.hta'
- '.js'
- '.jse'
- '.vba'
- '.vbe'
- '.vbs'
- '.wsf'
- '.wsh'
condition: all of selection_*
falsepositives:
- Some installers might generate a similar behavior. An initial baseline is required
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_exec
selection_exec:
Image|endswith:
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
Stage 2: selection_paths
selection_paths:
CommandLine|contains:
- ':\Perflogs\'
- ':\Temp\'
- ':\Tmp\'
- ':\Users\Public\'
- ':\Windows\Temp\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\Temp\'
- '\Start Menu\Programs\Startup\'
- '\Temporary Internet'
- '\Windows\Temp'
- '%LocalAppData%\Temp\'
- '%TEMP%'
- '%TMP%'
Stage 3: selection_ext
selection_ext:
CommandLine|contains:
- '.hta'
- '.js'
- '.jse'
- '.vba'
- '.vbe'
- '.vbs'
- '.wsf'
- '.wsh'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |
Potential Password Reconnaissance Via Findstr.EXE
#Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Potential Password Reconnaissance Via Findstr.EXE
id: 1a0f6f16-2099-4753-9a02-43b6ac7a1fa5
status: test
description: Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages
references:
- https://steflan-security.com/windows-privilege-escalation-credential-harvesting/
- https://adsecurity.org/?p=2288
author: Josh Nickels
date: 2023-05-18
tags:
- attack.credential-access
- attack.t1552.001
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\findstr.exe'
- OriginalFileName: 'FINDSTR.EXE'
selection_cli:
CommandLine|contains:
- 'contraseña' # Spanish
- 'hasło' # Polish
- 'heslo' # Czech
- 'parola' # Italian
- 'passe' # French
- 'passw' # German, English
- 'senha' # Portuguese
- 'senord' # Swedish
- '密碼' # Cantonese
condition: all of selection_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith: '\findstr.exe'
- OriginalFileName: 'FINDSTR.EXE'
Stage 2: selection_cli
selection_cli:
CommandLine|contains:
- 'contraseña'
- 'hasło'
- 'heslo'
- 'parola'
- 'passe'
- 'passw'
- 'senha'
- 'senord'
- '密碼'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\findstr.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"FINDSTR.EXE" |
Potential Persistence Via Microsoft Office Add-In
#Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
Known False Positives
- Legitimate add-ins
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule Body
title: Potential Persistence Via Microsoft Office Add-In
id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936
status: test
description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
references:
- Internal Research
- https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
- https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
author: NVISO
date: 2020-05-11
modified: 2023-02-08
tags:
- attack.persistence
- attack.t1137.006
logsource:
category: file_event
product: windows
detection:
selection_wlldropped:
TargetFilename|contains: '\Microsoft\Word\Startup\'
TargetFilename|endswith: '.wll'
selection_xlldropped:
TargetFilename|contains: '\Microsoft\Excel\Startup\'
TargetFilename|endswith: '.xll'
selection_xladropped:
TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
TargetFilename|endswith: '.xlam'
selection_generic:
TargetFilename|contains: '\Microsoft\Addins\'
TargetFilename|endswith:
- '.xlam'
- '.xla'
- '.ppam'
condition: 1 of selection_*
falsepositives:
- Legitimate add-ins
level: high
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_wlldropped
selection_wlldropped:
TargetFilename|contains: '\Microsoft\Word\Startup\'
TargetFilename|endswith: '.wll'
Stage 2: selection_xlldropped
selection_xlldropped:
TargetFilename|contains: '\Microsoft\Excel\Startup\'
TargetFilename|endswith: '.xll'
Stage 3: selection_xladropped
selection_xladropped:
TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
TargetFilename|endswith: '.xlam'
Stage 4: selection_generic
selection_generic:
TargetFilename|contains: '\Microsoft\Addins\'
TargetFilename|endswith:
- '.xlam'
- '.xla'
- '.ppam'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with |
TargetFilename | match |
| field:"TargetFilename" kind:match |
Potentially Suspicious Child Process Of WinRAR.EXE
#Detects potentially suspicious child processes of WinRAR.exe.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Potentially Suspicious Child Process Of WinRAR.EXE
id: 146aace8-9bd6-42ba-be7a-0070d8027b76
related:
- id: ec3a3c2f-9bb0-4a9b-8f4b-5ec386544343
type: similar
status: test
description: Detects potentially suspicious child processes of WinRAR.exe.
references:
- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
- https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-31
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\WinRAR.exe'
selection_binaries:
# Note: add additional binaries that the attacker might use
- Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wscript.exe'
- OriginalFileName:
- 'Cmd.Exe'
- 'cscript.exe'
- 'mshta.exe'
- 'PowerShell.EXE'
- 'pwsh.dll'
- 'regsvr32.exe'
- 'RUNDLL32.EXE'
- 'wscript.exe'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_parent
selection_parent:
ParentImage|endswith: '\WinRAR.exe'
Stage 2: selection_binaries
selection_binaries:
- Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wscript.exe'
- OriginalFileName:
- 'Cmd.Exe'
- 'cscript.exe'
- 'mshta.exe'
- 'PowerShell.EXE'
- 'pwsh.dll'
- 'regsvr32.exe'
- 'RUNDLL32.EXE'
- 'wscript.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\WinRAR.exe" |
Potentially Suspicious Electron Application CommandLine
#Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.
Known False Positives
- Legitimate usage for debugging purposes
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Potentially Suspicious Electron Application CommandLine
id: 378a05d8-963c-46c9-bcce-13c7657eac99
related:
- id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8
type: similar
status: test
description: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.
references:
- https://positive.security/blog/ms-officecmd-rce
- https://lolbas-project.github.io/lolbas/Binaries/Teams/
- https://lolbas-project.github.io/lolbas/Binaries/Msedge/
- https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
- https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
- https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-05
modified: 2023-11-09
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
# Add more electron based app to the list
- '\chrome.exe'
- '\code.exe'
- '\discord.exe'
- '\GitHubDesktop.exe'
- '\keybase.exe'
- '\msedge_proxy.exe'
- '\msedge.exe'
- '\msedgewebview2.exe'
- '\msteams.exe'
- '\slack.exe'
- '\Teams.exe'
- OriginalFileName:
# Add more electron based app to the list
- 'chrome.exe'
- 'code.exe'
- 'discord.exe'
- 'GitHubDesktop.exe'
- 'keybase.exe'
- 'msedge_proxy.exe'
- 'msedge.exe'
- 'msedgewebview2.exe'
- 'msteams.exe'
- 'slack.exe'
- 'Teams.exe'
selection_cli:
CommandLine|contains:
- '--browser-subprocess-path'
- '--gpu-launcher'
- '--renderer-cmd-prefix'
- '--utility-cmd-prefix'
condition: all of selection_*
falsepositives:
- Legitimate usage for debugging purposes
# Increase the level once FP rate is known better (see status)
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith:
- '\chrome.exe'
- '\code.exe'
- '\discord.exe'
- '\GitHubDesktop.exe'
- '\keybase.exe'
- '\msedge_proxy.exe'
- '\msedge.exe'
- '\msedgewebview2.exe'
- '\msteams.exe'
- '\slack.exe'
- '\Teams.exe'
- OriginalFileName:
- 'chrome.exe'
- 'code.exe'
- 'discord.exe'
- 'GitHubDesktop.exe'
- 'keybase.exe'
- 'msedge_proxy.exe'
- 'msedge.exe'
- 'msedgewebview2.exe'
- 'msteams.exe'
- 'slack.exe'
- 'Teams.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains:
- '--browser-subprocess-path'
- '--gpu-launcher'
- '--renderer-cmd-prefix'
- '--utility-cmd-prefix'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq |
Potentially Suspicious Windows App Activity
#Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution
Known False Positives
- Legitimate packages that make use of external binaries such as Windows Terminal
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potentially Suspicious Windows App Activity
id: f91ed517-a6ba-471d-9910-b3b4a398c0f3
status: test
description: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution
references:
- https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
- https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-12
modified: 2025-10-07
tags:
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection_parent:
# GrandParentImage|endswith: '\sihost.exe'
ParentImage|contains: 'C:\Program Files\WindowsApps\'
selection_susp_img:
Image|endswith:
# You can add more LOLBINs
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wscript.exe'
selection_susp_cli:
# You can add more potentially suspicious keywords
CommandLine|contains:
- 'cmd /c'
- 'Invoke-'
- 'Base64'
filter_optional_terminal:
ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal'
ParentImage|endswith: '\WindowsTerminal.exe'
# Note: to avoid FP add the default shells and profiles that your WT integrates
Image|endswith:
- '\powershell.exe'
- '\cmd.exe'
- '\pwsh.exe'
filter_optional_sysinternals:
ParentImage|startswith: 'C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite'
Image|endswith: '\cmd.exe'
condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*
falsepositives:
- Legitimate packages that make use of external binaries such as Windows Terminal
level: medium
Stages and Predicates
Stage 0: condition
selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*Stage 1: selection_parent
selection_parent:
ParentImage|contains: 'C:\Program Files\WindowsApps\'
Stage 2: selection_susp_img
selection_susp_img:
Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wscript.exe'
Stage 3: selection_susp_cli
selection_susp_cli:
CommandLine|contains:
- 'cmd /c'
- 'Invoke-'
- 'Base64'
Stage 4: not filter_optional_*
filter_optional_terminal:
ParentImage|contains: ':\Program Files\WindowsApps\Microsoft.WindowsTerminal'
ParentImage|endswith: '\WindowsTerminal.exe'
Image|endswith:
- '\powershell.exe'
- '\cmd.exe'
- '\pwsh.exe'
filter_optional_sysinternals:
ParentImage|startswith: 'C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite'
Image|endswith: '\cmd.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |
ParentImage | match |
| field:"ParentImage" kind:match value:"C:\Program Files\WindowsApps\" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \cmd.exe | excludes:Image field:"Image" value:"\cmd.exe" |
Image | ends_with | \powershell.exe | excludes:Image field:"Image" value:"\powershell.exe" |
Image | ends_with | \pwsh.exe | excludes:Image field:"Image" value:"\pwsh.exe" |
ParentImage | ends_with | \WindowsTerminal.exe | excludes:ParentImage field:"ParentImage" value:"\WindowsTerminal.exe" |
ParentImage | match | :\Program Files\WindowsApps\Microsoft.WindowsTerminal | excludes:ParentImage field:"ParentImage" value:":\Program Files\WindowsApps\Microsoft.WindowsTerminal" |
ParentImage | starts_with | C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite | excludes:ParentImage field:"ParentImage" value:"C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite" |
PowerShell Base64 Encoded IEX Cmdlet
#Detects usage of a base64 encoded "IEX" cmdlet in a process command line
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: PowerShell Base64 Encoded IEX Cmdlet
id: 88f680b8-070e-402c-ae11-d2914f2257f1
status: test
description: Detects usage of a base64 encoded "IEX" cmdlet in a process command line
references:
- Internal Research
author: Florian Roth (Nextron Systems)
date: 2019-08-23
modified: 2023-04-06
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
- CommandLine|base64offset|contains:
- 'IEX (['
- 'iex (['
- 'iex (New'
- 'IEX (New'
- 'IEX(['
- 'iex(['
- 'iex(New'
- 'IEX(New'
- "IEX(('"
- "iex(('"
# UTF16 LE
- CommandLine|contains:
- 'SQBFAFgAIAAoAFsA'
- 'kARQBYACAAKABbA'
- 'JAEUAWAAgACgAWw'
- 'aQBlAHgAIAAoAFsA'
- 'kAZQB4ACAAKABbA'
- 'pAGUAeAAgACgAWw'
- 'aQBlAHgAIAAoAE4AZQB3A'
- 'kAZQB4ACAAKABOAGUAdw'
- 'pAGUAeAAgACgATgBlAHcA'
- 'SQBFAFgAIAAoAE4AZQB3A'
- 'kARQBYACAAKABOAGUAdw'
- 'JAEUAWAAgACgATgBlAHcA'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
- CommandLine|base64offset|contains:
- 'IEX (['
- 'iex (['
- 'iex (New'
- 'IEX (New'
- 'IEX(['
- 'iex(['
- 'iex(New'
- 'IEX(New'
- "IEX(('"
- "iex(('"
- CommandLine|contains:
- 'SQBFAFgAIAAoAFsA'
- 'kARQBYACAAKABbA'
- 'JAEUAWAAgACgAWw'
- 'aQBlAHgAIAAoAFsA'
- 'kAZQB4ACAAKABbA'
- 'pAGUAeAAgACgAWw'
- 'aQBlAHgAIAAoAE4AZQB3A'
- 'kAZQB4ACAAKABOAGUAdw'
- 'pAGUAeAAgACgATgBlAHcA'
- 'SQBFAFgAIAAoAE4AZQB3A'
- 'kARQBYACAAKABOAGUAdw'
- 'JAEUAWAAgACgATgBlAHcA'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
PowerShell Execution With Potential Decryption Capabilities
#Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: PowerShell Execution With Potential Decryption Capabilities
id: 434c08ba-8406-4d15-8b24-782cb071a691
status: test
description: Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.
references:
- https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-30
modified: 2023-12-05
tags:
- attack.execution
logsource:
product: windows
category: process_creation
detection:
selection_img:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cli_dir:
CommandLine|contains:
- "Get-ChildItem "
- "dir "
- "gci "
- "ls "
selection_cli_gc:
CommandLine|contains:
- "Get-Content "
- "gc "
- 'cat '
- 'type '
- 'ReadAllBytes'
selection_cli_specific:
- CommandLine|contains|all:
- ' ^| '
- '\*.lnk'
- '-Recurse'
- '-Skip '
- CommandLine|contains|all:
- ' -ExpandProperty '
- '\*.lnk'
- 'WriteAllBytes'
- ' .length '
condition: all of selection_*
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
Stage 2: selection_cli_dir
selection_cli_dir:
CommandLine|contains:
- "Get-ChildItem "
- "dir "
- "gci "
- "ls "
Stage 3: selection_cli_gc
selection_cli_gc:
CommandLine|contains:
- "Get-Content "
- "gc "
- 'cat '
- 'type '
- 'ReadAllBytes'
Stage 4: selection_cli_specific
selection_cli_specific:
- CommandLine|contains|all:
- ' ^| '
- '\*.lnk'
- '-Recurse'
- '-Skip '
- CommandLine|contains|all:
- ' -ExpandProperty '
- '\*.lnk'
- 'WriteAllBytes'
- ' .length '
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq |
PPL Tampering Via WerFaultSecure
#Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
Known False Positives
- Legitimate usage of WerFaultSecure for debugging purposes
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | |
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: PPL Tampering Via WerFaultSecure
id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
related:
- id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
type: similar
- id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
type: similar
status: experimental
description: |
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).
This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.
Distinct command line patterns help identify the specific tool:
- WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
- EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine
Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
references:
- https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
- https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251
author: Jason (https://github.com/0xbcf)
date: 2025-09-23
modified: 2025-11-23
tags:
- attack.defense-impairment
- attack.t1685
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection_image:
- Image|endswith: '\WerFaultSecure.exe'
- OriginalFileName: 'WerFaultSecure.exe'
selection_args:
CommandLine|contains|all:
- ' /h '
- ' /pid ' # Antimalware or EDR process pid will be after this flag
- ' /tid '
- ' /encfile '
- ' /cancel '
- ' /type '
- ' 268310'
condition: all of selection_*
falsepositives:
- Legitimate usage of WerFaultSecure for debugging purposes
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_image
selection_image:
- Image|endswith: '\WerFaultSecure.exe'
- OriginalFileName: 'WerFaultSecure.exe'
Stage 2: selection_args
selection_args:
CommandLine|contains|all:
- ' /h '
- ' /pid '
- ' /tid '
- ' /encfile '
- ' /cancel '
- ' /type '
- ' 268310'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\WerFaultSecure.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"WerFaultSecure.exe" |
PST Export Alert Using eDiscovery Alert
#Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
Known False Positives
- PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Collection |
Rule Body
title: PST Export Alert Using eDiscovery Alert
id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0
related:
- id: 6897cd82-6664-11ed-9022-0242ac120002
type: similar
status: test
description: Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
references:
- https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide
author: Sorina Ionescu
date: 2022-02-08
modified: 2022-11-17
tags:
- attack.collection
- attack.t1114
logsource:
service: threat_management
product: m365
definition: Requires the 'eDiscovery search or exported' alert to be enabled
detection:
selection:
eventSource: SecurityComplianceCenter
eventName: 'eDiscovery search started or exported'
status: success
condition: selection
falsepositives:
- PST export can be done for legitimate purposes but due to the sensitive nature of its content it must be monitored.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: SecurityComplianceCenter
eventName: 'eDiscovery search started or exported'
status: success
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"eDiscovery search started or exported" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"SecurityComplianceCenter" |
status | eq |
| field:"status" kind:eq value:"success" |
PUA - Advanced IP/Port Scanner Update Check
#Detect the update check performed by Advanced IP/Port Scanner utilities.
Known False Positives
- Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Reconnaissance |
Rule Body
title: PUA - Advanced IP/Port Scanner Update Check
id: 1a9bb21a-1bb5-42d7-aa05-3219c7c8f47d
status: test
description: Detect the update check performed by Advanced IP/Port Scanner utilities.
references:
- https://www.advanced-ip-scanner.com/
- https://www.advanced-port-scanner.com/
author: Axel Olsson
date: 2022-08-14
modified: 2024-02-15
tags:
- attack.discovery
- attack.reconnaissance
- attack.t1590
logsource:
category: proxy
detection:
selection:
# Example request: http://www.advanced-port-scanner.com/checkupdate.php?lng=en&ver=2-5-3680&beta=n&type=upd&rmode=p&product=aps
# Example request2: http://www.advanced-ip-scanner.com/checkupdate.php?lng=en&ver=2-5-3499&beta=n&type=upd&rmode=p&product=aips
c-uri|contains: '/checkupdate.php'
c-uri-query|contains|all:
- 'lng='
- 'ver='
- 'beta='
- 'type='
- 'rmode='
- 'product='
condition: selection
falsepositives:
- Expected if you legitimately use the Advanced IP or Port Scanner utilities in your environement.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
c-uri|contains: '/checkupdate.php'
c-uri-query|contains|all:
- 'lng='
- 'ver='
- 'beta='
- 'type='
- 'rmode='
- 'product='
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
c-uri | match |
| field:"c-uri" kind:match value:"/checkupdate.php" |
c-uri-query | match |
| field:"c-uri-query" kind:match |
Role Enumeration
#An attacker may have enumerated roles (groups of permissions(policies)) with aws iam list-roles.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
Rules Detecting the Same Action
These rules filter on the same operation.
Rule Body
title: Role Enumeration
id: a74c0244-43fa-47ea-90bf-802500dd3140
status: test
description: An attacker may have enumerated roles (groups of permissions(policies)) with `aws iam list-roles`.
references:
- https://attack.mitre.org/techniques/T1087/004/
author: Zach Mathis (@yamatosecurity)
date: 2025-04-24
modified: 2025-04-24
tags:
- attack.discovery
- attack.t1087.004 # Account Discovery: Cloud Accounts
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'ListRoles'
condition: selection
falsepositives:
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
eventSource: 'iam.amazonaws.com'
eventName: 'ListRoles'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"ListRoles" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"iam.amazonaws.com" |
Scheduled Task Created - Registry
#Detects the creation of a scheduled task via Registry keys.
Known False Positives
- Likely as this is a normal behaviour on Windows
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Privilege Escalation |
Telemetry Coverage
Rule Body
title: Scheduled Task Created - Registry
id: 93ff0ceb-e0ef-4586-8cd8-a6c277d738e3
status: test
description: Detects the creation of a scheduled task via Registry keys.
references:
- https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
- https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
date: 2023-09-27
tags:
- attack.execution
- attack.persistence
- attack.privilege-escalation
- attack.s0111
- attack.t1053.005
- car.2013-08-001
- detection.threat-hunting
logsource:
product: windows
category: registry_event
detection:
selection:
TargetObject|contains:
- '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\'
- '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
condition: selection
falsepositives:
- Likely as this is a normal behaviour on Windows
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetObject|contains:
- '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\'
- '\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | match |
| field:"TargetObject" kind:match |
Suspicious ArcSOC.exe Child Process
#Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Suspicious ArcSOC.exe Child Process
id: 8e95e73e-ba02-4a87-b4d7-0929b8053038
status: experimental
description: |
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.
references:
- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
- https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
author: Micah Babinski
date: 2025-11-25
tags:
- attack.execution
- attack.t1059
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\ArcSOC.exe'
Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wmic.exe'
- '\wscript.exe'
filter_main_cmd:
Image|endswith: '\cmd.exe'
CommandLine: 'cmd.exe /c "ver"'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
ParentImage|endswith: '\ArcSOC.exe'
Image|endswith:
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\regsvr32.exe'
- '\rundll32.exe'
- '\wmic.exe'
- '\wscript.exe'
Stage 2: not filter_main_cmd
filter_main_cmd:
Image|endswith: '\cmd.exe'
CommandLine: 'cmd.exe /c "ver"'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\ArcSOC.exe" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
CommandLine | eq | cmd.exe /c "ver" | excludes:CommandLine |
Image | ends_with | \cmd.exe | excludes:Image field:"Image" value:"\cmd.exe" |
Suspicious CrushFTP Child Process
#Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
Known False Positives
- Legitimate CrushFTP administrative actions
- Software updates
MITRE ATT&CK Coverage
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Suspicious CrushFTP Child Process
id: 459628e3-1b00-4e9b-9e5b-7da8961aea35
status: experimental
description: |
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as
CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.
The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
references:
- https://nvd.nist.gov/vuln/detail/CVE-2025-2825
- https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
- https://projectdiscovery.io/blog/crushftp-authentication-bypass
author: Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-04-10
tags:
- attack.initial-access
- attack.execution
- attack.t1059.001
- attack.t1059.003
- attack.t1190
- cve.2025-31161
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\crushftpservice.exe'
selection_child:
Image|endswith:
- '\bash.exe'
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\sh.exe'
- '\wscript.exe'
condition: all of selection_*
falsepositives:
- Legitimate CrushFTP administrative actions
- Software updates
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_parent
selection_parent:
ParentImage|endswith: '\crushftpservice.exe'
Stage 2: selection_child
selection_child:
Image|endswith:
- '\bash.exe'
- '\cmd.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\powershell.exe'
- '\powershell_ise.exe'
- '\pwsh.exe'
- '\sh.exe'
- '\wscript.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\crushftpservice.exe" |
Suspicious Email Delivered In Microsoft 365
#Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder. It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Microsoft 365 | TIMailData |
Rules Detecting the Same Action
These rules filter on the same operation.
Rule Body
title: Suspicious Email Delivered In Microsoft 365
id: 3569aefd-e535-4391-8c18-24bd01a21eaf
status: experimental
description: |
Detects instances where an email, identified as malicious or suspicious by the Microsoft Defender for Office 365 (formerly ATP) engine, was delivered to a user's Inbox or Junk folder.
It might indicate that a potential threat, such as a spearphishing attachment or links, has bypassed initial blocking mechanisms and reached an end-user, requiring further investigation and potential remediation.
references:
- https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about
- https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/
- https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2026-01-27
tags:
- attack.initial-access
- attack.t1566.001
- attack.t1566.002
logsource:
service: audit
product: m365
detection:
selection:
Workload: 'ThreatIntelligence'
Operation: 'TIMailData'
Directionality: 'Inbound'
filter_main_blocked:
DeliveryAction: 'Blocked'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
Workload: 'ThreatIntelligence'
Operation: 'TIMailData'
Directionality: 'Inbound'
Stage 2: not filter_main_blocked
filter_main_blocked:
DeliveryAction: 'Blocked'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Directionality | eq |
| field:"m365::Directionality" kind:eq value:"Inbound" |
Operation | eq |
| field:"Operation" kind:eq value:"TIMailData" |
Workload | eq |
| field:"Workload" kind:eq value:"ThreatIntelligence" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
DeliveryAction | eq | Blocked | excludes:DeliveryAction field:"DeliveryAction" value:"Blocked" |
Suspicious File Download From File Sharing Domain Via Wget.EXE
#Detects potentially suspicious file downloads from file sharing domains using wget.exe
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Suspicious File Download From File Sharing Domain Via Wget.EXE
id: a0d7e4d2-bede-4141-8896-bc6e237e977c
related:
- id: 8b48ad89-10d8-4382-a546-50588c410f0d
type: similar
- id: d635249d-86b5-4dad-a8c7-d7272b788586
type: similar
- id: 52182dfb-afb7-41db-b4bc-5336cb29b464
type: similar
- id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99
type: similar
- id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
type: similar
- id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
type: similar
- id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c
type: similar
- id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794
type: similar
- id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb
type: similar
- id: b6e04788-29e1-4557-bb14-77f761848ab8
type: similar
- id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7
type: similar
status: test
description: Detects potentially suspicious file downloads from file sharing domains using wget.exe
references:
- https://labs.withsecure.com/publications/fin7-target-veeam-servers
- https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
- https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-05
modified: 2026-03-29
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\wget.exe'
- OriginalFileName: 'wget.exe'
selection_websites:
CommandLine|contains:
- '.githubusercontent.com' # Includes both gists and github repositories / Michael Haag (idea)
- '0x0.st'
- 'anonfiles.com'
- 'bashupload.com'
- 'cdn.discordapp.com'
- 'chunk.io'
- 'ddns.net'
- 'dl.dropboxusercontent.com'
- 'ghostbin.co'
- 'github.com'
- 'glitch.me'
- 'gofile.io'
- 'hastebin.com'
- 'mediafire.com'
- 'mega.nz'
- 'onrender.com'
- 'pages.dev'
- 'paste.ee'
- 'pastebin.com'
- 'pastebin.pl'
- 'pastetext.net'
- 'pixeldrain.com'
- 'privatlab.com'
- 'privatlab.net'
- 'send.exploit.in'
- 'sendspace.com'
- 'storage.googleapis.com'
- 'storjshare.io'
- 'supabase.co'
- 'temp.sh'
- 'transfer.sh'
- 'trycloudflare.com'
- 'ufile.io'
- 'w3spaces.com'
- 'workers.dev'
- 'x0.at'
selection_http:
CommandLine|contains: 'http'
selection_flag:
- CommandLine|re: '\s-O\s'
- CommandLine|contains: '--output-document'
selection_ext:
CommandLine|endswith:
- '.ps1'
- ".ps1'"
- '.ps1"'
- '.dat'
- ".dat'"
- '.dat"'
- '.msi'
- ".msi'"
- '.msi"'
- '.bat'
- ".bat'"
- '.bat"'
- '.exe'
- ".exe'"
- '.exe"'
- '.vbs'
- ".vbs'"
- '.vbs"'
- '.vbe'
- ".vbe'"
- '.vbe"'
- '.hta'
- ".hta'"
- '.hta"'
- '.dll'
- ".dll'"
- '.dll"'
- '.psm1'
- ".psm1'"
- '.psm1"'
condition: all of selection_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith: '\wget.exe'
- OriginalFileName: 'wget.exe'
Stage 2: selection_websites
selection_websites:
CommandLine|contains:
- '.githubusercontent.com'
- '0x0.st'
- 'anonfiles.com'
- 'bashupload.com'
- 'cdn.discordapp.com'
- 'chunk.io'
- 'ddns.net'
- 'dl.dropboxusercontent.com'
- 'ghostbin.co'
- 'github.com'
- 'glitch.me'
- 'gofile.io'
- 'hastebin.com'
- 'mediafire.com'
- 'mega.nz'
- 'onrender.com'
- 'pages.dev'
- 'paste.ee'
- 'pastebin.com'
- 'pastebin.pl'
- 'pastetext.net'
- 'pixeldrain.com'
- 'privatlab.com'
- 'privatlab.net'
- 'send.exploit.in'
- 'sendspace.com'
- 'storage.googleapis.com'
- 'storjshare.io'
- 'supabase.co'
- 'temp.sh'
- 'transfer.sh'
- 'trycloudflare.com'
- 'ufile.io'
- 'w3spaces.com'
- 'workers.dev'
- 'x0.at'
Stage 3: selection_http
selection_http:
CommandLine|contains: 'http'
Stage 4: selection_flag
selection_flag:
- CommandLine|re: '\s-O\s'
- CommandLine|contains: '--output-document'
Stage 5: selection_ext
selection_ext:
CommandLine|endswith:
- '.ps1'
- ".ps1'"
- '.ps1"'
- '.dat'
- ".dat'"
- '.dat"'
- '.msi'
- ".msi'"
- '.msi"'
- '.bat'
- ".bat'"
- '.bat"'
- '.exe'
- ".exe'"
- '.exe"'
- '.vbs'
- ".vbs'"
- '.vbs"'
- '.vbe'
- ".vbe'"
- '.vbe"'
- '.hta'
- ".hta'"
- '.hta"'
- '.dll'
- ".dll'"
- '.dll"'
- '.psm1'
- ".psm1'"
- '.psm1"'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | ends_with |
| field:"CommandLine" kind:ends_with |
CommandLine | match |
| field:"CommandLine" kind:match |
CommandLine | regex_match |
| field:"CommandLine" kind:regex_match value:"\s-O\s" |
Image | ends_with |
| field:"Image" kind:ends_with value:"\wget.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"wget.exe" |
Suspicious GrpConv Execution
#Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Suspicious GrpConv Execution
id: f14e169e-9978-4c69-acb3-1cff8200bc36
status: test
description: Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors
references:
- https://twitter.com/0gtweet/status/1526833181831200770
author: Florian Roth (Nextron Systems)
date: 2022-05-19
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- 'grpconv.exe -o'
- 'grpconv -o'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains:
- 'grpconv.exe -o'
- 'grpconv -o'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Suspicious TCP Tunnel Via PowerShell Script
#Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule Body
title: Suspicious TCP Tunnel Via PowerShell Script
id: bd33d2aa-497e-4651-9893-5c5364646595
status: test
description: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
references:
- https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-08
tags:
- attack.command-and-control
- attack.t1090
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection:
ScriptBlockText|contains|all:
- '[System.Net.HttpWebRequest]'
- 'System.Net.Sockets.TcpListener'
- 'AcceptTcpClient'
condition: selection
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
ScriptBlockText|contains|all:
- '[System.Net.HttpWebRequest]'
- 'System.Net.Sockets.TcpListener'
- 'AcceptTcpClient'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScriptBlockText | match |
| field:"ScriptBlockText" kind:match |
WFP Filter Added via Registry
#Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule Body
title: WFP Filter Added via Registry
id: 1f1d8209-636e-4c6c-a137-781cca8b82f9
status: experimental
description: |
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.
references:
- https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c
- https://www.huntress.com/blog/silencing-the-edr-silencers
- https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
author: Frack113
date: 2025-10-23
tags:
- attack.execution
- attack.defense-impairment
- attack.t1685
- attack.t1569.002
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: '\BFE\Parameters\Policy\Persistent\Filter\'
filter_main_svchost:
Image:
- 'C:\Windows\System32\svchost.exe'
- 'C:\Windows\SysWOW64\svchost.exe'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
TargetObject|contains: '\BFE\Parameters\Policy\Persistent\Filter\'
Stage 2: not filter_main_svchost
filter_main_svchost:
Image:
- 'C:\Windows\System32\svchost.exe'
- 'C:\Windows\SysWOW64\svchost.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | match |
| field:"TargetObject" kind:match value:"\BFE\Parameters\Policy\Persistent\Filter\" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | eq | C:\Windows\SysWOW64\svchost.exe | excludes:Image field:"Image" value:"C:\Windows\SysWOW64\svchost.exe" |
Image | eq | C:\Windows\System32\svchost.exe | excludes:Image field:"Image" value:"C:\Windows\System32\svchost.exe" |
WMImplant Hack Tool
#Detects parameters used by WMImplant
Known False Positives
- Administrative scripts that use the same keywords.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule Body
title: WMImplant Hack Tool
id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7
status: test
description: Detects parameters used by WMImplant
references:
- https://github.com/FortyNorthSecurity/WMImplant
author: NVISO
date: 2020-03-26
modified: 2022-12-25
tags:
- attack.execution
- attack.t1047
- attack.t1059.001
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection:
ScriptBlockText|contains:
- 'WMImplant'
- ' change_user '
- ' gen_cli '
- ' command_exec '
- ' disable_wdigest '
- ' disable_winrm '
- ' enable_wdigest '
- ' enable_winrm '
- ' registry_mod '
- ' remote_posh '
- ' sched_job '
- ' service_mod '
- ' process_kill '
# - ' process_start '
- ' active_users '
- ' basic_info '
# - ' drive_list '
# - ' installed_programs '
- ' power_off '
- ' vacant_system '
- ' logon_events '
condition: selection
falsepositives:
- Administrative scripts that use the same keywords.
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
ScriptBlockText|contains:
- 'WMImplant'
- ' change_user '
- ' gen_cli '
- ' command_exec '
- ' disable_wdigest '
- ' disable_winrm '
- ' enable_wdigest '
- ' enable_winrm '
- ' registry_mod '
- ' remote_posh '
- ' sched_job '
- ' service_mod '
- ' process_kill '
- ' active_users '
- ' basic_info '
- ' power_off '
- ' vacant_system '
- ' logon_events '
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScriptBlockText | match |
| field:"ScriptBlockText" kind:match |