Detection rules › Sigma
Sigma rules: 1z
BPFtrace Unsafe Option Usage
#Detects the usage of the unsafe bpftrace option
Known False Positives
- Legitimate usage of the unsafe option
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Linux | Event ID 1: Process Create |
Rule Body
title: BPFtrace Unsafe Option Usage
id: f8341cb2-ee25-43fa-a975-d8a5a9714b39
status: test
description: Detects the usage of the unsafe bpftrace option
references:
- https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/
- https://bpftrace.org/
author: Andreas Hunkeler (@Karneades)
date: 2022-02-11
tags:
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith: 'bpftrace'
CommandLine|contains: '--unsafe'
condition: selection
falsepositives:
- Legitimate usage of the unsafe option
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image|endswith: 'bpftrace'
CommandLine|contains: '--unsafe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:"--unsafe" |
Image | ends_with |
| field:"Image" kind:ends_with value:"bpftrace" |
CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
#Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation.
Known False Positives
- Antivirus and other third party products are known to trigger this rule quite a lot. Initial filters and tuning is required before using this rule.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
Telemetry Coverage
Rule Body
title: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
id: f8931561-97f5-4c46-907f-0a4a592e47a7
status: experimental
description: |
Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired.
This event is best correlated with EID 3089 to determine the error of the validation.
references:
- https://twitter.com/SBousseaden/status/1483810148602814466
- https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-20
modified: 2025-02-28
tags:
- attack.execution
logsource:
product: windows
service: codeintegrity-operational
detection:
selection:
EventID:
- 3033 # Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements.
- 3034 # Code Integrity determined that a process (%4) attempted to load %2 that did not meet the %5 signing level requirements or violated code integrity policy. However, due to code integrity auditing policy, the image was allowed to load.
filter_optional_dtrace:
# Example: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume5\Program Files\DTrace\dtrace.dll that did not meet the Windows signing level requirements.
FileNameBuffer|endswith: '\Program Files\DTrace\dtrace.dll'
ProcessNameBuffer|endswith: '\Windows\System32\svchost.exe'
RequestedPolicy: 12
filter_optional_av_generic:
# Example: Code Integrity determined that a process (\Device\HarddiskVolume5\ProgramData\Microsoft\Windows Defender\Platform\4.18.2207.7-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_36fb67bd6dbd887d\igd10iumd64.dll that did not meet the Custom 3 / Antimalware signing level requirements.
FileNameBuffer|contains: '\Windows\System32\DriverStore\FileRepository\'
FileNameBuffer|endswith: '\igd10iumd64.dll'
# ProcessNameBuffer is AV products
RequestedPolicy: 7
filter_optional_electron_based_app:
# Example: Code Integrity determined that a process (\Device\HarddiskVolume5\Users\user\AppData\Local\Keybase\Gui\Keybase.exe) attempted to load \Device\HarddiskVolume5\Windows\System32\nvspcap64.dll that did not meet the Microsoft signing level requirements.
FileNameBuffer|endswith: '\Windows\System32\nvspcap64.dll'
ProcessNameBuffer|endswith:
- '\AppData\Local\Keybase\Gui\Keybase.exe'
- '\Microsoft\Teams\stage\Teams.exe'
RequestedPolicy: 8
filter_optional_bonjour:
FileNameBuffer|endswith: '\Program Files\Bonjour\mdnsNSP.dll'
ProcessNameBuffer|endswith:
- '\Windows\System32\svchost.exe'
- '\Windows\System32\SIHClient.exe'
RequestedPolicy:
- 8
- 12
filter_optional_msoffice_1:
FileNameBuffer|contains: '\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE'
FileNameBuffer|endswith: '\MSOXMLMF.DLL'
# ProcessNameBuffer is AV products
RequestedPolicy: 7
filter_optional_msoffice_2:
ProcessNameBuffer|contains: '\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office'
FileNameBuffer|contains: '\Windows\System32\'
RequestedPolicy: 8
filter_optional_slack:
# Example: https://user-images.githubusercontent.com/112784902/197407680-96d4b662-8a59-4289-a483-b24d630ac2a9.png
# Even though it's the same DLL as the one used in the electron based app filter. We need to do a separate selection due to slack's folder naming convention with the version number :)
FileNameBuffer|endswith: '\Windows\System32\nvspcap64.dll'
ProcessNameBuffer|contains: '\AppData\Local\slack\app-'
ProcessNameBuffer|endswith: '\slack.exe'
RequestedPolicy: 8
filter_optional_firefox:
# Example: https://user-images.githubusercontent.com/62423083/197451483-70e89010-ed96-4357-8079-b5a061a239d6.png
FileNameBuffer|endswith:
- '\Mozilla Firefox\mozavcodec.dll'
- '\Mozilla Firefox\mozavutil.dll'
ProcessNameBuffer|endswith: '\Mozilla Firefox\firefox.exe'
RequestedPolicy: 8
filter_optional_avast:
FileNameBuffer|endswith:
- '\Program Files\Avast Software\Avast\aswAMSI.dll'
- '\Program Files (x86)\Avast Software\Avast\aswAMSI.dll'
RequestedPolicy:
- 8
- 12
filter_main_gac:
# Filtering the path containing this string because of multiple possible DLLs in that location
FileNameBuffer|contains: '\Windows\assembly\GAC\'
ProcessNameBuffer|endswith: '\mscorsvw.exe'
ProcessNameBuffer|contains: '\Windows\Microsoft.NET\'
RequestedPolicy: 8
filter_optional_google_drive:
# Example: \Program Files\Google\Drive File Stream\67.0.2.0\crashpad_handler.exe
FileNameBuffer|contains: '\Program Files\Google\Drive File Stream\'
FileNameBuffer|endswith: '\crashpad_handler.exe'
ProcessNameBuffer|endswith: '\Windows\ImmersiveControlPanel\SystemSettings.exe'
RequestedPolicy: 8
filter_optional_trend_micro:
FileNameBuffer|endswith: '\Trend Micro\Client Server Security Agent\perficrcperfmonmgr.dll'
RequestedPolicy: 8
filter_optional_mdns_responder:
FileNameBuffer|endswith: '\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll '
filter_optional_mcafee:
FileNameBuffer|endswith:
- '\Program Files\McAfee\Endpoint Security\Threat Prevention\MfeAmsiProvider.dll'
- '\Program Files\McAfee\MfeAV\AMSIExt.dll'
filter_optional_eset:
FileNameBuffer|endswith: '\Program Files\ESET\ESET Security\eamsi.dll'
filter_optional_comodo:
FileNameBuffer|endswith: '\Program Files\comodo\comodo internet security\amsiprovider_x64.dll'
filter_optional_sentinel_one:
# Example: program files\sentinelone\sentinel agent 23.4.4.223\inprocessclient64.dll
- FileNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
# Example: Program Files\SentinelOne\Sentinel Agent 23.4.4.223\SentinelAgent.exe
- ProcessNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
filter_optional_national_instruments:
# Example: \device\harddiskvolume3\program files\national instruments\shared\mdns responder\nimdnsnsp.dll
FileNameBuffer|contains: '\National Instruments\Shared\mDNS Responder\'
filter_optional_kaspersky:
# Example: \Program Files (x86)\Kaspersky Lab\Kaspersky Endpoint Security for Windows\x64\antimalware_provider.dll
- ProcessNameBuffer|contains|all:
- '\Kaspersky Lab\'
- '\avp.exe'
- FileNameBuffer|contains|all:
- '\Kaspersky Lab\'
- '\antimalware_provider.dll'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Antivirus and other third party products are known to trigger this rule quite a lot. Initial filters and tuning is required before using this rule.
level: low
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection
selection:
EventID:
- 3033
- 3034
Stage 2: not filter_main_gac
filter_main_gac:
FileNameBuffer|contains: '\Windows\assembly\GAC\'
ProcessNameBuffer|endswith: '\mscorsvw.exe'
ProcessNameBuffer|contains: '\Windows\Microsoft.NET\'
RequestedPolicy: 8
Stage 3: not filter_optional_*
filter_optional_dtrace:
FileNameBuffer|endswith: '\Program Files\DTrace\dtrace.dll'
ProcessNameBuffer|endswith: '\Windows\System32\svchost.exe'
RequestedPolicy: 12
filter_optional_av_generic:
FileNameBuffer|contains: '\Windows\System32\DriverStore\FileRepository\'
FileNameBuffer|endswith: '\igd10iumd64.dll'
RequestedPolicy: 7
filter_optional_electron_based_app:
FileNameBuffer|endswith: '\Windows\System32\nvspcap64.dll'
ProcessNameBuffer|endswith:
- '\AppData\Local\Keybase\Gui\Keybase.exe'
- '\Microsoft\Teams\stage\Teams.exe'
RequestedPolicy: 8
filter_optional_bonjour:
FileNameBuffer|endswith: '\Program Files\Bonjour\mdnsNSP.dll'
ProcessNameBuffer|endswith:
- '\Windows\System32\svchost.exe'
- '\Windows\System32\SIHClient.exe'
RequestedPolicy:
- 8
- 12
filter_optional_msoffice_1:
FileNameBuffer|contains: '\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE'
FileNameBuffer|endswith: '\MSOXMLMF.DLL'
RequestedPolicy: 7
filter_optional_msoffice_2:
ProcessNameBuffer|contains: '\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office'
FileNameBuffer|contains: '\Windows\System32\'
RequestedPolicy: 8
filter_optional_slack:
FileNameBuffer|endswith: '\Windows\System32\nvspcap64.dll'
ProcessNameBuffer|contains: '\AppData\Local\slack\app-'
ProcessNameBuffer|endswith: '\slack.exe'
RequestedPolicy: 8
filter_optional_firefox:
FileNameBuffer|endswith:
- '\Mozilla Firefox\mozavcodec.dll'
- '\Mozilla Firefox\mozavutil.dll'
ProcessNameBuffer|endswith: '\Mozilla Firefox\firefox.exe'
RequestedPolicy: 8
filter_optional_avast:
FileNameBuffer|endswith:
- '\Program Files\Avast Software\Avast\aswAMSI.dll'
- '\Program Files (x86)\Avast Software\Avast\aswAMSI.dll'
RequestedPolicy:
- 8
- 12
filter_optional_google_drive:
FileNameBuffer|contains: '\Program Files\Google\Drive File Stream\'
FileNameBuffer|endswith: '\crashpad_handler.exe'
ProcessNameBuffer|endswith: '\Windows\ImmersiveControlPanel\SystemSettings.exe'
RequestedPolicy: 8
filter_optional_trend_micro:
FileNameBuffer|endswith: '\Trend Micro\Client Server Security Agent\perficrcperfmonmgr.dll'
RequestedPolicy: 8
filter_optional_mdns_responder:
FileNameBuffer|endswith: '\Program Files\National Instruments\Shared\mDNS Responder\nimdnsNSP.dll '
filter_optional_mcafee:
FileNameBuffer|endswith:
- '\Program Files\McAfee\Endpoint Security\Threat Prevention\MfeAmsiProvider.dll'
- '\Program Files\McAfee\MfeAV\AMSIExt.dll'
filter_optional_eset:
FileNameBuffer|endswith: '\Program Files\ESET\ESET Security\eamsi.dll'
filter_optional_comodo:
FileNameBuffer|endswith: '\Program Files\comodo\comodo internet security\amsiprovider_x64.dll'
filter_optional_sentinel_one:
- FileNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
- ProcessNameBuffer|contains: '\Program Files\SentinelOne\Sentinel Agent'
filter_optional_national_instruments:
FileNameBuffer|contains: '\National Instruments\Shared\mDNS Responder\'
filter_optional_kaspersky:
- ProcessNameBuffer|contains|all:
- '\Kaspersky Lab\'
- '\avp.exe'
- FileNameBuffer|contains|all:
- '\Kaspersky Lab\'
- '\antimalware_provider.dll'
Exclusions
The rule actively suppresses these predicates.
COLDSTEEL RAT Cleanup Command Execution
#Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence | No specific technique |
| Stealth | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: COLDSTEEL RAT Cleanup Command Execution
id: 88516f06-ebe0-47ad-858e-ae9fd060ddea
status: test
description: Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-30
tags:
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\svchost.exe'
ParentCommandLine|contains:
- ' -k msupdate'
- ' -k msupdate2'
- ' -k alg'
Image|endswith: '\rundll32.exe'
CommandLine|contains:
- 'UpdateDriverForPlugAndPlayDevicesW'
- 'ServiceMain'
- 'DiUninstallDevice'
condition: selection
falsepositives:
- Unlikely
level: critical
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
ParentImage|endswith: '\svchost.exe'
ParentCommandLine|contains:
- ' -k msupdate'
- ' -k msupdate2'
- ' -k alg'
Image|endswith: '\rundll32.exe'
CommandLine|contains:
- 'UpdateDriverForPlugAndPlayDevicesW'
- 'ServiceMain'
- 'DiUninstallDevice'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\rundll32.exe" |
ParentCommandLine | match |
| field:"ParentCommandLine" kind:match |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\svchost.exe" |
Conti NTDS Exfiltration Command
#Detects a command used by conti to exfiltrate NTDS
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Collection |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Conti NTDS Exfiltration Command
id: aa92fd02-09f2-48b0-8a93-864813fb8f41
status: test
description: Detects a command used by conti to exfiltrate NTDS
references:
- https://twitter.com/vxunderground/status/1423336151860002816?s=20
- https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
date: 2021-08-09
modified: 2022-10-09
tags:
- attack.collection
- attack.t1560
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
- '7za.exe'
- '\\C$\\temp\\log.zip'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains|all:
- '7za.exe'
- '\\C$\\temp\\log.zip'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
ConvertTo-SecureString Cmdlet Usage Via CommandLine
#Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
Known False Positives
- Legitimate use to pass password to different powershell commands
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: ConvertTo-SecureString Cmdlet Usage Via CommandLine
id: 74403157-20f5-415d-89a7-c505779585cf
status: test
description: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
date: 2020-10-11
modified: 2023-02-01
tags:
- attack.stealth
- attack.t1027
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_cli:
CommandLine|contains: 'ConvertTo-SecureString'
condition: all of selection_*
falsepositives:
- Legitimate use to pass password to different powershell commands
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring/info.yml
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
Stage 2: selection_cli
selection_cli:
CommandLine|contains: 'ConvertTo-SecureString'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:"ConvertTo-SecureString" |
Image | ends_with |
| field:"Image" kind:ends_with |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq |
Discovery Using AzureHound
#Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Entra ID | SigninLogs sign-in event: Successful sign-in |
Rules Detecting the Same Action
These rules filter on the same operation.
- [Entra ID] Suspicious Continuous OAuth Token Usage (Kusto)
- Anomalous sign-in location by user account and authenticating application (Kusto)
- Anomalous Single Factor Signin (Kusto)
- Authentications of Privileged Accounts Outside of Expected Controls (Kusto)
- Azure Portal sign in from another Azure Tenant (Kusto)
- Azure Service Principal Sign-In Followed by Arc Cluster Credential Access (Elastic)
- Azure SignIn via Legacy Authentication Protocol (Panther)
- Cisco - firewall block but success logon to Microsoft Entra ID (Kusto)
Rule Body
title: Discovery Using AzureHound
id: 35b781cc-1a08-4a5a-80af-42fd7c315c6b
status: test
description: Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.
references:
- https://github.com/BloodHoundAD/AzureHound
author: Janantha Marasinghe
date: 2022-11-27
tags:
- attack.discovery
- attack.t1087.004
- attack.t1526
logsource:
product: azure
service: signinlogs
detection:
selection:
userAgent|contains: 'azurehound'
ResultType: 0
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
userAgent|contains: 'azurehound'
ResultType: 0
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ResultType | eq |
| field:"ResultType" kind:eq value:"0" |
userAgent | match |
| field:"userAgent" kind:match value:"azurehound" |
ESXi VSAN Information Discovery Via ESXCLI
#Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
Known False Positives
- Legitimate administration activities
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Discovery |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Linux | Event ID 1: Process Create |
Rule Body
title: ESXi VSAN Information Discovery Via ESXCLI
id: d54c2f06-aca9-4e2b-81c9-5317858f4b79
status: test
description: Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.
references:
- https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html
- https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
author: Nasreddine Bencherchali (Nextron Systems), Cedric Maurugeon
date: 2023-09-04
tags:
- attack.discovery
- attack.execution
- attack.t1033
- attack.t1007
- attack.t1059.012
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: '/esxcli'
CommandLine|contains: 'vsan'
selection_cli:
CommandLine|contains:
- ' get'
- ' list'
condition: all of selection_*
falsepositives:
- Legitimate administration activities
# Note: level can be reduced to low in some envs
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
Image|endswith: '/esxcli'
CommandLine|contains: 'vsan'
Stage 2: selection_cli
selection_cli:
CommandLine|contains:
- ' get'
- ' list'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"/esxcli" |
Event log clear attempt (wmi)
#Detects scenarios where an attacker attempts to clear the event logs.
Known False Positives
- None
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth | |
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Event log clear attempt (wmi)
description: Detects scenarios where an attacker attempts to clear the event logs.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1070.001-Clear%20Windows%20event%20logs
- https://www.windows-commandline.com/backup-delete-event-log-files/
- https://lolbas-project.github.io/lolbas/Binaries/Wmic/
tags:
- attack.defense_evasion
- attack.t1070.001
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection: # full command: "wmic nteventlog where filename="security" cleareventlog"
selection:
NewProcessName|endswith: '\WMIC.exe'
CommandLine|contains|all:
- wmic
- cleareventlog
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
NewProcessName|endswith: '\WMIC.exe'
CommandLine|contains|all:
- wmic
- cleareventlog
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
NewProcessName | ends_with |
| field:"Image" kind:ends_with value:"\WMIC.exe" |
FortiGate - New VPN SSL Web Portal Added
#Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall. This behavior was observed in pair with modification of VPN SSL settings.
Known False Positives
- A VPN SSL Web Portal can be added for legitimate purposes.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence |
Rule Body
title: FortiGate - New VPN SSL Web Portal Added
id: 2bfb6216-0c31-4d20-8501-2629b29a3fa2
status: experimental
description: |
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
references:
- https://www.fortiguard.com/psirt/FG-IR-24-535
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
date: 2025-11-01
tags:
- attack.persistence
- attack.initial-access
- attack.t1133
logsource:
product: fortigate
service: event
detection:
selection:
action: 'Add'
cfgpath: 'vpn.ssl.web.portal'
condition: selection
falsepositives:
- A VPN SSL Web Portal can be added for legitimate purposes.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
action: 'Add'
cfgpath: 'vpn.ssl.web.portal'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
action | eq |
| field:"action" kind:eq value:"Add" |
cfgpath | eq |
| field:"cfgpath" kind:eq value:"vpn.ssl.web.portal" |
Grafana Path Traversal Exploitation CVE-2021-43798
#Detects a successful Grafana path traversal exploitation
Known False Positives
- Vulnerability scanners that scan a host that returns 200 status codes even in cases of a file not found or other error
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule Body
title: Grafana Path Traversal Exploitation CVE-2021-43798
id: 7b72b328-5708-414f-9a2a-6a6867c26e16
status: test
description: Detects a successful Grafana path traversal exploitation
references:
- https://grafana.com/blog/2021/12/07/grafana-8.3.1-8.2.7-8.1.8-and-8.0.7-released-with-high-severity-security-fix/
- https://github.com/search?q=CVE-2021-43798
author: Florian Roth (Nextron Systems)
date: 2021-12-08
modified: 2023-01-02
tags:
- attack.initial-access
- attack.t1190
- cve.2021-43798
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_traversal:
cs-uri-query|contains: '/../../../../../../../'
sc-status: 200
selection_plugins:
cs-uri-query|contains:
- '/public/plugins/live'
- '/public/plugins/icon'
- '/public/plugins/loki'
- '/public/plugins/text'
- '/public/plugins/logs'
- '/public/plugins/news'
- '/public/plugins/stat'
- '/public/plugins/mssql'
- '/public/plugins/mixed'
- '/public/plugins/mysql'
- '/public/plugins/tempo'
- '/public/plugins/graph'
- '/public/plugins/gauge'
- '/public/plugins/table'
- '/public/plugins/debug'
- '/public/plugins/zipkin'
- '/public/plugins/jaeger'
- '/public/plugins/geomap'
- '/public/plugins/canvas'
- '/public/plugins/grafana'
- '/public/plugins/welcome'
- '/public/plugins/xychart'
- '/public/plugins/heatmap'
- '/public/plugins/postgres'
- '/public/plugins/testdata'
- '/public/plugins/opentsdb'
- '/public/plugins/influxdb'
- '/public/plugins/barchart'
- '/public/plugins/annolist'
- '/public/plugins/bargauge'
- '/public/plugins/graphite'
- '/public/plugins/dashlist'
- '/public/plugins/piechart'
- '/public/plugins/dashboard'
- '/public/plugins/nodeGraph'
- '/public/plugins/alertlist'
- '/public/plugins/histogram'
- '/public/plugins/table-old'
- '/public/plugins/pluginlist'
- '/public/plugins/timeseries'
- '/public/plugins/cloudwatch'
- '/public/plugins/prometheus'
- '/public/plugins/stackdriver'
- '/public/plugins/alertGroups'
- '/public/plugins/alertmanager'
- '/public/plugins/elasticsearch'
- '/public/plugins/gettingstarted'
- '/public/plugins/state-timeline'
- '/public/plugins/status-history'
- '/public/plugins/grafana-clock-panel'
- '/public/plugins/grafana-simple-json-datasource'
- '/public/plugins/grafana-azure-monitor-datasource'
condition: all of selection*
falsepositives:
- Vulnerability scanners that scan a host that returns 200 status codes even in cases of a file not found or other error
level: critical
Stages and Predicates
Stage 0: condition
all of selection*Stage 1: selection_traversal
selection_traversal:
cs-uri-query|contains: '/../../../../../../../'
sc-status: 200
Stage 2: selection_plugins
selection_plugins:
cs-uri-query|contains:
- '/public/plugins/live'
- '/public/plugins/icon'
- '/public/plugins/loki'
- '/public/plugins/text'
- '/public/plugins/logs'
- '/public/plugins/news'
- '/public/plugins/stat'
- '/public/plugins/mssql'
- '/public/plugins/mixed'
- '/public/plugins/mysql'
- '/public/plugins/tempo'
- '/public/plugins/graph'
- '/public/plugins/gauge'
- '/public/plugins/table'
- '/public/plugins/debug'
- '/public/plugins/zipkin'
- '/public/plugins/jaeger'
- '/public/plugins/geomap'
- '/public/plugins/canvas'
- '/public/plugins/grafana'
- '/public/plugins/welcome'
- '/public/plugins/xychart'
- '/public/plugins/heatmap'
- '/public/plugins/postgres'
- '/public/plugins/testdata'
- '/public/plugins/opentsdb'
- '/public/plugins/influxdb'
- '/public/plugins/barchart'
- '/public/plugins/annolist'
- '/public/plugins/bargauge'
- '/public/plugins/graphite'
- '/public/plugins/dashlist'
- '/public/plugins/piechart'
- '/public/plugins/dashboard'
- '/public/plugins/nodeGraph'
- '/public/plugins/alertlist'
- '/public/plugins/histogram'
- '/public/plugins/table-old'
- '/public/plugins/pluginlist'
- '/public/plugins/timeseries'
- '/public/plugins/cloudwatch'
- '/public/plugins/prometheus'
- '/public/plugins/stackdriver'
- '/public/plugins/alertGroups'
- '/public/plugins/alertmanager'
- '/public/plugins/elasticsearch'
- '/public/plugins/gettingstarted'
- '/public/plugins/state-timeline'
- '/public/plugins/status-history'
- '/public/plugins/grafana-clock-panel'
- '/public/plugins/grafana-simple-json-datasource'
- '/public/plugins/grafana-azure-monitor-datasource'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-uri-query | match |
| field:"cs-uri-query" kind:match |
sc-status | eq |
| field:"sc-status" kind:eq value:"200" |
Nginx Core Dump
#Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
Known False Positives
- Serious issues with a configuration or plugin
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Impact |
Rule Body
title: Nginx Core Dump
id: 59ec40bb-322e-40ab-808d-84fa690d7e56
status: test
description: Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.
references:
- https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps
- https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/
author: Florian Roth (Nextron Systems)
date: 2021-05-31
modified: 2023-05-08
tags:
- attack.impact
- attack.t1499.004
logsource:
service: nginx
detection:
keywords:
- 'exited on signal 6 (core dumped)'
condition: keywords
falsepositives:
- Serious issues with a configuration or plugin
level: high
Stages and Predicates
Stage 0: condition
keywordsStage 1: keywords
keywords:
- 'exited on signal 6 (core dumped)'
NotPetya Ransomware Activity
#Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth | |
| Defense Impairment | |
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: NotPetya Ransomware Activity
id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
status: test
description: Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil
references:
- https://securelist.com/schroedingers-petya/78870/
- https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
author: Florian Roth (Nextron Systems), Tom Ueltschi
date: 2019-01-16
modified: 2022-12-15
tags:
- attack.stealth
- attack.defense-impairment
- attack.t1218.011
- attack.t1685.005
- attack.credential-access
- attack.t1003.001
- car.2016-04-002
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_specific_pattern:
CommandLine|contains:
- 'wevtutil cl Application & fsutil usn deletejournal /D C:'
- 'dllhost.dat %WINDIR%\ransoms'
selection_rundll32:
Image|endswith: '\rundll32.exe'
CommandLine|endswith:
- '.dat,#1'
- '.dat #1' # Sysmon removes comma
- '.zip.dll",#1'
selection_perfc_keyword:
- '\perfc.dat'
condition: 1 of selection_*
falsepositives:
- Unknown
level: critical
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_specific_pattern
selection_specific_pattern:
CommandLine|contains:
- 'wevtutil cl Application & fsutil usn deletejournal /D C:'
- 'dllhost.dat %WINDIR%\ransoms'
Stage 2: selection_rundll32
selection_rundll32:
Image|endswith: '\rundll32.exe'
CommandLine|endswith:
- '.dat,#1'
- '.dat #1'
- '.zip.dll",#1'
Stage 3: selection_perfc_keyword
selection_perfc_keyword:
- '\perfc.dat'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | ends_with |
| field:"CommandLine" kind:ends_with |
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\rundll32.exe" |
Persistence and Execution at Scale via GPO Scheduled Task
#Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Known False Positives
- If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Privilege Escalation |
Telemetry Coverage
Rule Body
title: Persistence and Execution at Scale via GPO Scheduled Task
id: a8f29a7b-b137-4446-80a0-b804272f3da2
status: test
description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
references:
- https://twitter.com/menasec1/status/1106899890377052160
- https://www.secureworks.com/blog/ransomware-as-a-distraction
- https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html
author: Samir Bousseaden
date: 2019-04-03
modified: 2024-09-04
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.lateral-movement
- attack.t1053.005
logsource:
product: windows
service: security
definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
selection_5136:
EventID: 5136
AttributeLDAPDisplayName:
- 'gPCMachineExtensionNames'
- 'gPCUserExtensionNames'
AttributeValue|contains:
- 'CAB54552-DEEA-4691-817E-ED4A4D1AFC72'
- 'AADCED64-746C-4633-A97C-D61349046527'
selection_5145:
EventID: 5145
ShareName|endswith: '\SYSVOL' # looking for the string \\*\SYSVOL
RelativeTargetName|endswith: 'ScheduledTasks.xml'
AccessList|contains:
- 'WriteData'
- '%%4417'
condition: 1 of selection_*
falsepositives:
- If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks.
level: high
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_5136
selection_5136:
EventID: 5136
AttributeLDAPDisplayName:
- 'gPCMachineExtensionNames'
- 'gPCUserExtensionNames'
AttributeValue|contains:
- 'CAB54552-DEEA-4691-817E-ED4A4D1AFC72'
- 'AADCED64-746C-4633-A97C-D61349046527'
Stage 2: selection_5145
selection_5145:
EventID: 5145
ShareName|endswith: '\SYSVOL'
RelativeTargetName|endswith: 'ScheduledTasks.xml'
AccessList|contains:
- 'WriteData'
- '%%4417'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AccessList | match |
| field:"AccessList" kind:match |
AttributeLDAPDisplayName | eq |
| field:"AttributeLDAPDisplayName" kind:eq |
AttributeValue | match |
| field:"AttributeValue" kind:match |
RelativeTargetName | ends_with |
| field:"RelativeTargetName" kind:ends_with value:"ScheduledTasks.xml" |
ShareName | ends_with |
| field:"ShareName" kind:ends_with value:"\SYSVOL" |
Potential Emotet Activity
#Detects all Emotet like process executions that are not covered by the more generic rules
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential Emotet Activity
id: d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18
status: stable
description: Detects all Emotet like process executions that are not covered by the more generic rules
references:
- https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
- https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
- https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
- https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/
author: Florian Roth (Nextron Systems)
date: 2019-09-30
modified: 2023-02-04
tags:
- attack.execution
- attack.stealth
- attack.t1059.001
- attack.t1027
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- ' -e* PAA'
- 'JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ' # $env:userprofile
- 'QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA' # $env:userprofile
- 'kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA' # $env:userprofile
- 'IgAoACcAKgAnACkAOwAkA' # "('*');$
- 'IAKAAnACoAJwApADsAJA' # "('*');$
- 'iACgAJwAqACcAKQA7ACQA' # "('*');$
- 'JABGAGwAeAByAGgAYwBmAGQ'
- 'PQAkAGUAbgB2ADoAdABlAG0AcAArACgA' # =$env:temp+(
- '0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA' # =$env:temp+(
- '9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA' # =$env:temp+(
filter:
CommandLine|contains:
- 'fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ'
- 'wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA'
- '8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA'
condition: selection and not filter
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
CommandLine|contains:
- ' -e* PAA'
- 'JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ'
- 'QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA'
- 'kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA'
- 'IgAoACcAKgAnACkAOwAkA'
- 'IAKAAnACoAJwApADsAJA'
- 'iACgAJwAqACcAKQA7ACQA'
- 'JABGAGwAeAByAGgAYwBmAGQ'
- 'PQAkAGUAbgB2ADoAdABlAG0AcAArACgA'
- '0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA'
- '9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA'
Stage 2: not filter
filter:
CommandLine|contains:
- 'fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ'
- 'wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA'
- '8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
CommandLine | match | 8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA | excludes:CommandLine field:"CommandLine" value:"8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA" |
CommandLine | match | fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ | excludes:CommandLine field:"CommandLine" value:"fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ" |
CommandLine | match | wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA | excludes:CommandLine field:"CommandLine" value:"wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA" |
Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
#Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
id: fe9e8ba9-4419-41e6-a574-bd9f7b3af961
status: test
description: |
Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command.
This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.
references:
- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
- https://tria.ge/240123-rapteaahhr/behavioral1
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2024-03-22
tags:
- attack.persistence
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\schtasks.exe'
CommandLine|contains|all:
- ' /create '
- 'shutdown /l /f'
- 'WEEKLY'
filter_main_system_user:
User|contains: # covers many language settings
- 'AUTHORI'
- 'AUTORI'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
Image|endswith: '\schtasks.exe'
CommandLine|contains|all:
- ' /create '
- 'shutdown /l /f'
- 'WEEKLY'
Stage 2: not filter_main_system_user
filter_main_system_user:
User|contains:
- 'AUTHORI'
- 'AUTORI'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\schtasks.exe" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
User | match | AUTHORI | excludes:User field:"User" value:"AUTHORI" |
User | match | AUTORI | excludes:User field:"User" value:"AUTORI" |
Potential MFA Bypass Using Legacy Client Authentication
#Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
Known False Positives
- Known Legacy Accounts
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth | |
| Credential Access |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Entra ID | SigninLogs sign-in event: Successful sign-in |
Rule Body
title: Potential MFA Bypass Using Legacy Client Authentication
id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc
status: test
description: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
references:
- https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
- https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/
author: Harjot Singh, '@cyb3rjy0t'
date: 2023-03-20
tags:
- attack.privilege-escalation
- attack.persistence
- attack.initial-access
- attack.credential-access
- attack.stealth
- attack.t1078.004
- attack.t1110
logsource:
product: azure
service: signinlogs
detection:
selection:
Status: 'Success'
userAgent|contains:
- 'BAV2ROPC'
- 'CBAinPROD'
- 'CBAinTAR'
condition: selection
falsepositives:
- Known Legacy Accounts
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Status: 'Success'
userAgent|contains:
- 'BAV2ROPC'
- 'CBAinPROD'
- 'CBAinTAR'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Status | eq |
| field:"Status" kind:eq value:"Success" |
userAgent | match |
| field:"userAgent" kind:match |
Potential Python DLL SideLoading
#Detects potential DLL sideloading of Python DLL files.
Known False Positives
- Legitimate software using Python DLLs
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 7: Image loaded |
Rule Body
title: Potential Python DLL SideLoading
id: d36f7c12-14a3-4d48-b6b8-774b9c66f44d
status: test
description: Detects potential DLL sideloading of Python DLL files.
references:
- https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/
- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
author: Swachchhanda Shrawan Poudel
date: 2024-10-06
modified: 2025-08-18
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|endswith:
- '\python39.dll'
- '\python310.dll'
- '\python311.dll'
- '\python312.dll'
filter_main_default_install_paths:
- ImageLoaded|startswith:
- 'C:\Program Files\Python3'
- 'C:\Program Files (x86)\Python3'
- ImageLoaded|contains: '\AppData\Local\Programs\Python\Python3'
filter_optional_visual_studio:
ImageLoaded|startswith: 'C:\Program Files\Microsoft Visual Studio\'
filter_optional_anaconda:
ImageLoaded|startswith: 'C:\ProgramData\Anaconda3\' # Comment out if you don't use Anaconda in your environment
filter_optional_cpython:
ImageLoaded|contains:
- '\cpython\externals\'
- '\cpython\PCbuild\'
filter_optional_pyinstaller:
# Triggered by programs bundled with PyInstaller
ImageLoaded|startswith: 'C:\Users'
ImageLoaded|contains: '\AppData\Local\Temp\_MEI'
filter_main_legit_signature_details:
Product: 'Python'
Signed: 'true'
Description: 'Python'
Company: 'Python Software Foundation'
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- Legitimate software using Python DLLs
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_* and not 1 of filter_optional_*Stage 1: selection
selection:
ImageLoaded|endswith:
- '\python39.dll'
- '\python310.dll'
- '\python311.dll'
- '\python312.dll'
Stage 2: not filter_main_*
filter_main_default_install_paths:
- ImageLoaded|startswith:
- 'C:\Program Files\Python3'
- 'C:\Program Files (x86)\Python3'
- ImageLoaded|contains: '\AppData\Local\Programs\Python\Python3'
filter_main_legit_signature_details:
Product: 'Python'
Signed: 'true'
Description: 'Python'
Company: 'Python Software Foundation'
Stage 3: not filter_optional_*
filter_optional_visual_studio:
ImageLoaded|startswith: 'C:\Program Files\Microsoft Visual Studio\'
filter_optional_anaconda:
ImageLoaded|startswith: 'C:\ProgramData\Anaconda3\'
filter_optional_cpython:
ImageLoaded|contains:
- '\cpython\externals\'
- '\cpython\PCbuild\'
filter_optional_pyinstaller:
ImageLoaded|startswith: 'C:\Users'
ImageLoaded|contains: '\AppData\Local\Temp\_MEI'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ImageLoaded | ends_with |
| field:"ImageLoaded" kind:ends_with |
Exclusions
The rule actively suppresses these predicates.
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
#Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Known False Positives
- Administrative activity
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Discovery |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
id: 575dce0c-8139-4e30-9295-1ee75969f7fe
related:
- id: f92a6f1e-a512-4a15-9735-da09e78d7273 # FileCreate
type: similar
- id: 07aa184a-870d-413d-893a-157f317f6f58 # ProcCreation Susp
type: similar
status: test
description: Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
references:
- https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
- https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
author: blueteamer8699
date: 2022-01-03
modified: 2023-02-08
tags:
- attack.discovery
- attack.execution
- attack.t1615
- attack.t1059.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- '\cscript.exe'
- '\wscript.exe'
- OriginalFileName:
- 'cscript.exe'
- 'wscript.exe'
selection_cli:
CommandLine|contains: 'gatherNetworkInfo.vbs'
condition: all of selection_*
falsepositives:
- Administrative activity
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith:
- '\cscript.exe'
- '\wscript.exe'
- OriginalFileName:
- 'cscript.exe'
- 'wscript.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains: 'gatherNetworkInfo.vbs'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:"gatherNetworkInfo.vbs" |
Image | ends_with |
| field:"Image" kind:ends_with |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq |
Potential SentinelOne Shell Context Menu Scan Command Tampering
#Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule Body
title: Potential SentinelOne Shell Context Menu Scan Command Tampering
id: 6c304b02-06e6-402d-8be4-d5833cdf8198
status: test
description: Detects potentially suspicious changes to the SentinelOne context menu scan command by a process other than SentinelOne.
references:
- https://mrd0x.com/sentinelone-persistence-via-menu-context/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-03-06
tags:
- attack.persistence
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: '\shell\SentinelOneScan\command\'
filter_main_sentinelone_default_scan_binary:
Details|startswith:
- 'C:\Program Files\SentinelOne\Sentinel Agent'
- 'C:\Program Files (x86)\SentinelOne\Sentinel Agent'
Details|contains: '\SentinelScanFromContextMenu.exe'
filter_main_sentinelone_binary:
Image|endswith:
- 'C:\Program Files\SentinelOne\'
- 'C:\Program Files (x86)\SentinelOne\'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
TargetObject|contains: '\shell\SentinelOneScan\command\'
Stage 2: not filter_main_*
filter_main_sentinelone_default_scan_binary:
Details|startswith:
- 'C:\Program Files\SentinelOne\Sentinel Agent'
- 'C:\Program Files (x86)\SentinelOne\Sentinel Agent'
Details|contains: '\SentinelScanFromContextMenu.exe'
filter_main_sentinelone_binary:
Image|endswith:
- 'C:\Program Files\SentinelOne\'
- 'C:\Program Files (x86)\SentinelOne\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetObject | match |
| field:"TargetObject" kind:match value:"\shell\SentinelOneScan\command\" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Details | starts_with | C:\Program Files (x86)\SentinelOne\Sentinel Agent | excludes:Details field:"Details" value:"C:\Program Files (x86)\SentinelOne\Sentinel Agent" |
Details | starts_with | C:\Program Files\SentinelOne\Sentinel Agent | excludes:Details field:"Details" value:"C:\Program Files\SentinelOne\Sentinel Agent" |
Details | match | \SentinelScanFromContextMenu.exe | excludes:Details field:"Details" value:"\SentinelScanFromContextMenu.exe" |
Image | ends_with | C:\Program Files (x86)\SentinelOne\ | excludes:Image field:"Image" value:"C:\Program Files (x86)\SentinelOne\" |
Image | ends_with | C:\Program Files\SentinelOne\ | excludes:Image field:"Image" value:"C:\Program Files\SentinelOne\" |
Potential Sidecar Injection Into Running Deployment
#Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | patch-deployments: patch deployments |
Rules Detecting the Same Action
These rules filter on the same operation.
- Direct Interactive Kubernetes API Request by Unusual Utilities (Elastic)
- GKE Sensitive RBAC Change Followed by Workload Modification (Elastic)
- GKE Unusual Sensitive Workload Modification (Elastic)
- Kubernetes Sensitive RBAC Change Followed by Workload Modification (Elastic)
- Unusual Kubernetes Sensitive Workload Modification (Elastic)
Rule Body
title: Potential Sidecar Injection Into Running Deployment
id: ad9012a6-e518-4432-9890-f3b82b8fc71f
status: test
description: |
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.
references:
- https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
- attack.t1609
- attack.execution
logsource:
category: application
product: kubernetes
service: audit
detection:
selection:
verb: 'patch'
apiGroup: 'apps'
objectRef.resource: 'deployments'
condition: selection
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
verb: 'patch'
apiGroup: 'apps'
objectRef.resource: 'deployments'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
apiGroup | eq |
| field:"apiGroup" kind:eq value:"apps" |
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"deployments" |
verb | eq |
| field:"verb" kind:eq value:"patch" |
Powershell Token Obfuscation - Powershell
#Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts. Use this rule as a threat-hunting baseline to find obfuscated scripts in your environment. Once tested and tuned, consider deploying a production detection rule based on this hunting rule.
Known False Positives
- Edge case might be possible with heavy use of string formatting or obfuscation in legitimate scripts.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule Body
title: Powershell Token Obfuscation - Powershell
id: f3a98ce4-6164-4dd4-867c-4d83de7eca51
related:
- id: deb9b646-a508-44ee-b7c9-d8965921c6b6
type: similar
status: test
description: |
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts.
Use this rule as a threat-hunting baseline to find obfuscated scripts in your environment.
Once tested and tuned, consider deploying a production detection rule based on this hunting rule.
references:
- https://github.com/danielbohannon/Invoke-Obfuscation
author: frack113
date: 2022-12-27
modified: 2025-10-19
tags:
- attack.stealth
- attack.t1027.009
- detection.threat-hunting
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection:
# Examples:
# IN`V`o`Ke-eXp`ResSIOn (Ne`W-ob`ject Net.WebClient).DownloadString
# &('In'+'voke-Expressi'+'o'+'n') (.('New-Ob'+'jec'+'t') Net.WebClient).DownloadString
# &("{2}{3}{0}{4}{1}"-f 'e','Expression','I','nvok','-') (&("{0}{1}{2}"-f'N','ew-O','bject') Net.WebClient).DownloadString
- ScriptBlockText|re: '\w+`(\w+|-|.)`[\w+|\s]'
# - ScriptBlockText|re: '\((\'(\w|-|\.)+\'\+)+\'(\w|-|\.)+\'\)' TODO: fixme
- ScriptBlockText|re: '"(\{\d\}){2,}"\s*-f' # trigger on at least two placeholders. One might be used for legitimate string formatting
# ${e`Nv:pATh}
- ScriptBlockText|re: '(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'
filter_envpath:
ScriptBlockText|contains: '${env:path}' # TODO: Fix this. See https://github.com/SigmaHQ/sigma/pull/4964
filter_chocolatey:
ScriptBlockText|contains:
- 'it will return true or false instead' # Chocolatey install script https://github.com/chocolatey/chocolatey
- 'The function also prevents `Get-ItemProperty` from failing' # https://docs.chocolatey.org/en-us/create/functions/get-uninstallregistrykey
filter_exchange:
Path|startswith: 'C:\Program Files\Microsoft\Exchange Server\'
Path|endswith: '\bin\servicecontrol.ps1'
ScriptBlockText|contains: '`r`n'
condition: selection and not 1 of filter_*
falsepositives:
- Edge case might be possible with heavy use of string formatting or obfuscation in legitimate scripts.
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_token_obfuscation/info.yml
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_*Stage 1: selection
selection:
- ScriptBlockText|re: '\w+`(\w+|-|.)`[\w+|\s]'
- ScriptBlockText|re: '"(\{\d\}){2,}"\s*-f'
- ScriptBlockText|re: '(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'
Stage 2: not filter_*
filter_envpath:
ScriptBlockText|contains: '${env:path}'
filter_chocolatey:
ScriptBlockText|contains:
- 'it will return true or false instead'
- 'The function also prevents `Get-ItemProperty` from failing'
filter_exchange:
Path|startswith: 'C:\Program Files\Microsoft\Exchange Server\'
Path|endswith: '\bin\servicecontrol.ps1'
ScriptBlockText|contains: '`r`n'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScriptBlockText | regex_match |
| field:"ScriptBlockText" kind:regex_match |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Path | ends_with | \bin\servicecontrol.ps1 | excludes:Path field:"Path" value:"\bin\servicecontrol.ps1" |
Path | starts_with | C:\Program Files\Microsoft\Exchange Server\ | excludes:Path field:"Path" value:"C:\Program Files\Microsoft\Exchange Server\" |
ScriptBlockText | match | `r`n | excludes:ScriptBlockText field:"ScriptBlockText" value:"`r`n" |
ScriptBlockText | match | ${env:path} | excludes:ScriptBlockText field:"ScriptBlockText" value:"${env:path}" |
ScriptBlockText | match | The function also prevents `Get-ItemProperty` from failing | excludes:ScriptBlockText field:"ScriptBlockText" value:"The function also prevents `Get-ItemProperty` from failing" |
ScriptBlockText | match | it will return true or false instead | excludes:ScriptBlockText field:"ScriptBlockText" value:"it will return true or false instead" |
Python Path Configuration File Creation - Linux
#Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).
Known False Positives
- Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Linux | Event ID 11: File created |
Rule Body
title: Python Path Configuration File Creation - Linux
id: fb96c26c-9f85-4ae7-af0d-ed1ed1f1f5ce
related:
- id: e3652ba3-0ad8-4010-a957-b7ba369e7bac # Windows
type: similar
- id: 4f394635-13ef-4599-b677-3353e0f84f55 # MacOS
type: similar
status: test
description: |
Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.
Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.
Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).
references:
- https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
- https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
- https://docs.python.org/3/library/site.html
author: Andreas Braathen (mnemonic.io)
date: 2024-04-25
tags:
- attack.execution
- attack.t1059.006
- detection.threat-hunting
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|re: '(?i)/lib/python3\.([5-9]|[0-9]{2})/site-packages/' # Unix and macOS
TargetFilename|endswith: '.pth'
condition: selection
falsepositives:
- Although .pth files are discouraged due to potential security implications, these are legitimate files by specification.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetFilename|re: '(?i)/lib/python3\.([5-9]|[0-9]{2})/site-packages/'
TargetFilename|endswith: '.pth'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with value:".pth" |
TargetFilename | regex_match |
| field:"TargetFilename" kind:regex_match value:"(?i)/lib/python3.([5-9]|[0-9]{2})/site-packages/" |
RDP over Reverse SSH Tunnel WFP
#Detects svchost hosting RDP termsvcs communicating with the loopback address
Known False Positives
- Programs that connect locally to the RDP port
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | |
| Command & Control |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 5156: The Windows Filtering Platform has permitted a connection. |
Rule Body
title: RDP over Reverse SSH Tunnel WFP
id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41
status: test
description: Detects svchost hosting RDP termsvcs communicating with the loopback address
references:
- https://twitter.com/SBousseaden/status/1096148422984384514
- https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx
author: Samir Bousseaden
date: 2019-02-16
modified: 2022-09-02
tags:
- attack.command-and-control
- attack.lateral-movement
- attack.t1090.001
- attack.t1090.002
- attack.t1021.001
- car.2013-07-002
logsource:
product: windows
service: security
detection:
selection:
EventID: 5156
sourceRDP:
SourcePort: 3389
DestAddress:
- '127.*'
- '::1'
destinationRDP:
DestPort: 3389
SourceAddress:
- '127.*'
- '::1'
filter_app_container:
FilterOrigin: 'AppContainer Loopback'
filter_thor: # checking BlueKeep vulnerability
Application|endswith:
- '\thor.exe'
- '\thor64.exe'
condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter*
falsepositives:
- Programs that connect locally to the RDP port
level: high
Stages and Predicates
Stage 0: condition
selection and ( sourceRDP or destinationRDP ) and not 1 of filter*Stage 1: selection
selection:
EventID: 5156
Stage 2: sourceRDP
sourceRDP:
SourcePort: 3389
DestAddress:
- '127.*'
- '::1'
Stage 3: destinationRDP
destinationRDP:
DestPort: 3389
SourceAddress:
- '127.*'
- '::1'
Stage 4: not filter*
filter_app_container:
FilterOrigin: 'AppContainer Loopback'
filter_thor:
Application|endswith:
- '\thor.exe'
- '\thor64.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DestAddress | wildcard |
| field:"dest_ip" kind:wildcard |
DestPort | eq |
| field:"DestinationPort" kind:eq value:"3389" |
SourceAddress | wildcard |
| field:"src_ip" kind:wildcard |
SourcePort | eq |
| field:"SourcePort" kind:eq value:"3389" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Application | ends_with | \thor.exe | excludes:Application field:"Application" value:"\thor.exe" |
Application | ends_with | \thor64.exe | excludes:Application field:"Application" value:"\thor64.exe" |
FilterOrigin | eq | AppContainer Loopback | excludes:FilterOrigin field:"FilterOrigin" value:"AppContainer Loopback" |
Remote Access Tool - AnyDesk Piped Password Via CLI
#Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
Known False Positives
- Legitimate piping of the password to anydesk
- Some FP could occur with similar tools that uses the same command line '--set-password'
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Remote Access Tool - AnyDesk Piped Password Via CLI
id: b1377339-fda6-477a-b455-ac0923f9ec2c
status: test
description: Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
references:
- https://redcanary.com/blog/misbehaving-rats/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-28
modified: 2023-03-05
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|all:
# Example: C:\WINDOWS\system32\cmd.exe /C cmd.exe /c echo J9kzQ2Y0qO |C:\ProgramData\anydesk.exe --set-password
- '/c '
- 'echo '
- '.exe --set-password'
condition: selection
falsepositives:
- Legitimate piping of the password to anydesk
- Some FP could occur with similar tools that uses the same command line '--set-password'
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains|all:
- '/c '
- 'echo '
- '.exe --set-password'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Renamed VsCode Code Tunnel Execution - File Indicator
#Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Command & Control | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule Body
title: Renamed VsCode Code Tunnel Execution - File Indicator
id: d102b8f5-61dc-4e68-bd83-9a3187c67377
status: test
description: |
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.
references:
- https://ipfyx.fr/post/visual-studio-code-tunnel/
- https://badoption.eu/blog/2023/01/31/code_c2.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-25
tags:
- attack.command-and-control
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: '\code_tunnel.json'
filter_main_legit_name:
# Note: There might be other legitimate names for VsCode. Please add them if found
Image|endswith:
- '\code-tunnel.exe'
- '\code.exe'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
TargetFilename|endswith: '\code_tunnel.json'
Stage 2: not filter_main_legit_name
filter_main_legit_name:
Image|endswith:
- '\code-tunnel.exe'
- '\code.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with value:"\code_tunnel.json" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \code-tunnel.exe | excludes:Image field:"Image" value:"\code-tunnel.exe" |
Image | ends_with | \code.exe | excludes:Image field:"Image" value:"\code.exe" |
Scheduled Task Creation Masquerading as System Processes
#Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
Known False Positives
- Legitimate system administration tasks scheduling trusted system processes.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Scheduled Task Creation Masquerading as System Processes
id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab
status: experimental
description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
references:
- https://tria.ge/241015-l98snsyeje/behavioral2
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-02-05
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.stealth
- attack.t1053.005
- attack.t1036.004
- attack.t1036.005
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\schtasks.exe'
- OriginalFileName: 'schtasks.exe'
selection_cli:
CommandLine|contains|windash: ' /create '
CommandLine|contains:
- ' audiodg'
- ' conhost'
- ' dwm.exe'
- ' explorer'
- ' lsass'
- ' lsm'
- ' mmc'
- ' msiexec'
- ' regsvr32'
- ' rundll32'
- ' services'
- ' spoolsv'
- ' svchost'
- ' taskeng'
- ' taskhost'
- ' wininit'
- ' winlogon'
condition: all of selection_*
falsepositives:
- Legitimate system administration tasks scheduling trusted system processes.
level: high
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith: '\schtasks.exe'
- OriginalFileName: 'schtasks.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains|windash: ' /create '
CommandLine|contains:
- ' audiodg'
- ' conhost'
- ' dwm.exe'
- ' explorer'
- ' lsass'
- ' lsm'
- ' mmc'
- ' msiexec'
- ' regsvr32'
- ' rundll32'
- ' services'
- ' spoolsv'
- ' svchost'
- ' taskeng'
- ' taskhost'
- ' wininit'
- ' winlogon'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\schtasks.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"schtasks.exe" |
Shai-Hulud Malicious Bun Execution
#Detects the execution of bun_environment.js via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack. The malware uses a setup_bun.js script to install the Bun runtime if not present, and then executes the malicious bun_environment.js payload.
Known False Positives
- Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Shai-Hulud Malicious Bun Execution
id: 5299fadf-f228-4526-8274-251db1960be9
related:
- id: eb827bbd-670a-4d58-8446-c464d8ac2323
type: similar
status: experimental
description: |
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
references:
- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
- https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js
- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-25
tags:
- attack.t1195.002
- attack.t1203
- attack.execution
- attack.initial-access
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith: '\node.exe'
selection_child_bun_script:
Image|endswith: '\bun.exe'
CommandLine|contains:
- 'bun_environment.js'
- 'https://github.com/actions/runner/releases/download/v2.330.0'
condition: selection_parent and 1 of selection_child_*
falsepositives:
- Legitimate but uncommon use of files named `bun_environment.js` could trigger this rule.
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Shai-Hulud/proc_creation_win_mal_shai_hulud_malicious_node_bun_execution/info.yml
Stages and Predicates
Stage 0: condition
selection_parent and 1 of selection_child_*Stage 1: selection_parent
selection_parent:
ParentImage|endswith: '\node.exe'
Stage 2: selection_child_bun_script
selection_child_bun_script:
Image|endswith: '\bun.exe'
CommandLine|contains:
- 'bun_environment.js'
- 'https://github.com/actions/runner/releases/download/v2.330.0'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\bun.exe" |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\node.exe" |
Sliver C2 Default Service Installation
#Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Privilege Escalation |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Service-Control-Manager | Event ID 7045: A service was installed in the system. |
Rule Body
title: Sliver C2 Default Service Installation
id: 31c51af6-e7aa-4da7-84d4-8f32cc580af2
status: test
description: Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands
references:
- https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231
- https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-25
tags:
- attack.persistence
- attack.execution
- attack.privilege-escalation
- attack.t1543.003
- attack.t1569.002
logsource:
product: windows
service: system
detection:
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_service_1:
ImagePath|re: '^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe'
selection_service_2:
ServiceName:
- 'Sliver'
- 'Sliver implant'
condition: selection_eid and 1 of selection_service_*
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selection_eid and 1 of selection_service_*Stage 1: selection_eid
selection_eid:
Provider_Name: 'Service Control Manager'
EventID: 7045
Stage 2: selection_service_1
selection_service_1:
ImagePath|re: '^[a-zA-Z]:\\windows\\temp\\[a-zA-Z0-9]{10}\.exe'
Stage 3: selection_service_2
selection_service_2:
ServiceName:
- 'Sliver'
- 'Sliver implant'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ImagePath | regex_match |
| field:"ImagePath" kind:regex_match value:"^[a-zA-Z]:\windows\temp\[a-zA-Z0-9]{10}.exe" |
Provider_Name | eq |
| field:"Provider_Name" kind:eq value:"Service Control Manager" |
ServiceName | eq |
| field:"ServiceName" kind:eq |
Suspicious Download From Direct IP Via Bitsadmin
#Detects usage of bitsadmin downloading a file using an URL that contains an IP
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Persistence | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Suspicious Download From Direct IP Via Bitsadmin
id: 99c840f2-2012-46fd-9141-c761987550ef
related:
- id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7
type: similar
status: test
description: Detects usage of bitsadmin downloading a file using an URL that contains an IP
references:
- https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
- https://isc.sans.edu/diary/22264
- https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
- https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
author: Florian Roth (Nextron Systems)
date: 2022-06-28
modified: 2023-02-15
tags:
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1197
- attack.s0190
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\bitsadmin.exe'
- OriginalFileName: 'bitsadmin.exe'
selection_flags:
CommandLine|contains:
- ' /transfer '
- ' /create '
- ' /addfile '
selection_extension:
CommandLine|contains:
- '://1'
- '://2'
- '://3'
- '://4'
- '://5'
- '://6'
- '://7'
- '://8'
- '://9'
filter_seven_zip:
CommandLine|contains: '://7-' # For https://7-zip.org/
condition: all of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip/info.yml
Stages and Predicates
Stage 0: condition
all of selection_* and not 1 of filter_*Stage 1: selection_img
selection_img:
- Image|endswith: '\bitsadmin.exe'
- OriginalFileName: 'bitsadmin.exe'
Stage 2: selection_flags
selection_flags:
CommandLine|contains:
- ' /transfer '
- ' /create '
- ' /addfile '
Stage 3: selection_extension
selection_extension:
CommandLine|contains:
- '://1'
- '://2'
- '://3'
- '://4'
- '://5'
- '://6'
- '://7'
- '://8'
- '://9'
Stage 4: not filter_seven_zip
filter_seven_zip:
CommandLine|contains: '://7-'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\bitsadmin.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"bitsadmin.exe" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
CommandLine | match | ://7- | excludes:CommandLine field:"CommandLine" value:"://7-" |
Suspicious Execution of Hostname
#Use of hostname to get information
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Suspicious Execution of Hostname
id: 7be5fb68-f9ef-476d-8b51-0256ebece19e
status: test
description: Use of hostname to get information
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname
author: frack113
date: 2022-01-01
tags:
- attack.discovery
- attack.t1082
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: '\HOSTNAME.EXE'
condition: selection
falsepositives:
- Unknown
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image|endswith: '\HOSTNAME.EXE'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | ends_with |
| field:"Image" kind:ends_with value:"\HOSTNAME.EXE" |
Suspicious User-Agents Related To Recon Tools
#Detects known suspicious (default) user-agents related to scanning/recon tools
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access |
Rule Body
title: Suspicious User-Agents Related To Recon Tools
id: 19aa4f58-94ca-45ff-bc34-92e533c0994a
status: test
description: Detects known suspicious (default) user-agents related to scanning/recon tools
references:
- https://github.com/commixproject/commix/blob/c7f1447371524427bb30abe731235acc7386153b/src/utils/settings.py#L281
- https://github.com/epi052/feroxbuster/blob/ffdf871abe0a358a1531ba4135e208d4dbe8fc31/src/config/utils.rs#L100
- https://github.com/ffuf/ffuf/blob/ce3cf6bd733a24d3a9f024305234c1a6298198eb/pkg/runner/simple.go#L130
- https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92
- https://github.com/nmap/nmap/blob/2e47fa87469fd358ef64689d2d2de7294e385eb8/nselib/http.lua#L160
- https://github.com/OJ/gobuster/blob/d20300cc46096984565e82fb73a45bf8d281b990/libgobuster/helpers.go#L124
- https://github.com/sqlmapproject/sqlmap/blob/be216041e2f255ae43b050d466bd5bf92681e665/lib/core/settings.py#L29
- https://github.com/sullo/nikto/blob/999670cb6a939b6c93840ce666941756e4c5dcf5/program/plugins/nikto_core.plugin#L3515
- https://github.com/urbanadventurer/WhatWeb/blob/d279d93042d034f3fd29d5a893d44ccc0595d3f8/lib/whatweb.rb#L68
- https://github.com/wpscanteam/wpscan/blob/4f1ce142b9768044be3e35bd0cddf1052e35efe8/lib/wpscan/browser.rb#L32
- https://github.com/xmendez/wfuzz/blob/2263cd0932fef333118cd197656f709141bab615/src/wfuzz/facade.py#L43
- https://github.com/zmap/zgrab2/blob/e91fc9860ca6611eb7c6fe7d2fe2be70212a37ba/modules/http/scanner.go#L54
author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
date: 2022-07-19
modified: 2026-06-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-user-agent|contains:
# Add more tools as you see fit
- 'commix/'
- 'feroxbuster/'
- 'Fuzz Faster U Fool'
- 'GIS - AppSec Team - Project Vision'
- 'gobuster/'
- 'Nikto/'
- 'Nmap Scripting Engine'
- 'Recon-ng/v'
- 'sqlmap/'
- 'WhatWeb/'
- 'Wfuzz/'
- 'WPScan v'
- 'zgrab/'
condition: selection
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
cs-user-agent|contains:
- 'commix/'
- 'feroxbuster/'
- 'Fuzz Faster U Fool'
- 'GIS - AppSec Team - Project Vision'
- 'gobuster/'
- 'Nikto/'
- 'Nmap Scripting Engine'
- 'Recon-ng/v'
- 'sqlmap/'
- 'WhatWeb/'
- 'Wfuzz/'
- 'WPScan v'
- 'zgrab/'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-user-agent | match |
| field:"cs-user-agent" kind:match |
System Network Discovery - macOS
#Detects enumeration of local network configuration
Known False Positives
- Legitimate administration activities
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
Rule Body
title: System Network Discovery - macOS
id: 58800443-f9fc-4d55-ae0c-98a3966dfb97
status: test
description: Detects enumeration of local network configuration
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
author: remotephone, oscd.community
date: 2020-10-06
modified: 2024-08-29
tags:
- attack.discovery
- attack.t1016
logsource:
product: macos
category: process_creation
detection:
selection_1:
Image|endswith:
- '/arp'
- '/ifconfig'
- '/netstat'
- '/networksetup'
- '/socketfilterfw'
selection_2:
Image: '/usr/bin/defaults'
CommandLine|contains|all:
- '/Library/Preferences/com.apple.alf'
- 'read'
filter_main_wifivelocityd:
ParentImage|endswith: '/wifivelocityd'
condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
- Legitimate administration activities
level: informational
Stages and Predicates
Stage 0: condition
1 of selection_* and not 1 of filter_main_*Stage 1: selection_1
selection_1:
Image|endswith:
- '/arp'
- '/ifconfig'
- '/netstat'
- '/networksetup'
- '/socketfilterfw'
Stage 2: selection_2
selection_2:
Image: '/usr/bin/defaults'
CommandLine|contains|all:
- '/Library/Preferences/com.apple.alf'
- 'read'
Stage 3: not filter_main_wifivelocityd
filter_main_wifivelocityd:
ParentImage|endswith: '/wifivelocityd'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |
Image | eq |
| field:"Image" kind:eq value:"/usr/bin/defaults" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
ParentImage | ends_with | /wifivelocityd | excludes:ParentImage field:"ParentImage" value:"/wifivelocityd" |
UNC4841 - Barracuda ESG Exploitation Indicators
#Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | No specific technique |
| Persistence | No specific technique |
| Stealth | No specific technique |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Linux | Event ID 11: File created |
Rule Body
title: UNC4841 - Barracuda ESG Exploitation Indicators
id: 5627c337-a9b2-407a-a82d-5fd97035ff39
status: test
description: Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
modified: 2025-08-19
tags:
- attack.execution
- attack.persistence
- detection.emerging-threats
- attack.stealth
logsource:
product: linux
category: file_event
detection:
selection:
TargetFilename|endswith:
- '/11111.tar'
- '/aacore.sh'
- '/appcheck.sh'
- '/autoins'
- '/BarracudaMailService'
- '/etc/cron.daily/core_check.sh'
- '/etc/cron.daily/core.sh'
- '/etc/cron.hourly/aacore.sh'
- '/etc/cron.hourly/appcheck.sh'
- '/etc/cron.hourly/core.sh'
- '/get_fs_info.pl'
- '/imgdata.jpg'
- '/install_att_v2.tar'
- '/install_bvp74_auth.tar'
- '/install_helo.tar'
- '/install_reuse.tar'
- '/intent_helo'
- '/intent_reuse'
- '/intentbas'
# - '/mknod'
- '/mod_attachment.lua'
- '/mod_content.lua'
- '/mod_require_helo.lua'
- '/mod_rtf'
- '/mod_sender.lua'
- '/mod_udp.so'
- '/nfsd_stub.ko'
- '/resize_reisertab'
- '/resize_risertab'
- '/resize2fstab'
- '/rverify'
- '/saslautchd'
- '/sendscd'
- '/snapshot.tar'
- '/tmp/p'
- '/tmp/p7'
- '/tmp/t'
- '/update_v2.sh'
- '/update_v31.sh'
- '/update_v35.sh'
- '/update_version'
condition: selection
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
TargetFilename|endswith:
- '/11111.tar'
- '/aacore.sh'
- '/appcheck.sh'
- '/autoins'
- '/BarracudaMailService'
- '/etc/cron.daily/core_check.sh'
- '/etc/cron.daily/core.sh'
- '/etc/cron.hourly/aacore.sh'
- '/etc/cron.hourly/appcheck.sh'
- '/etc/cron.hourly/core.sh'
- '/get_fs_info.pl'
- '/imgdata.jpg'
- '/install_att_v2.tar'
- '/install_bvp74_auth.tar'
- '/install_helo.tar'
- '/install_reuse.tar'
- '/intent_helo'
- '/intent_reuse'
- '/intentbas'
- '/mod_attachment.lua'
- '/mod_content.lua'
- '/mod_require_helo.lua'
- '/mod_rtf'
- '/mod_sender.lua'
- '/mod_udp.so'
- '/nfsd_stub.ko'
- '/resize_reisertab'
- '/resize_risertab'
- '/resize2fstab'
- '/rverify'
- '/saslautchd'
- '/sendscd'
- '/snapshot.tar'
- '/tmp/p'
- '/tmp/p7'
- '/tmp/t'
- '/update_v2.sh'
- '/update_v31.sh'
- '/update_v35.sh'
- '/update_version'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
TargetFilename | ends_with |
| field:"TargetFilename" kind:ends_with |
Usage Of Web Request Commands And Cmdlets
#Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine
Known False Positives
- Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Usage Of Web Request Commands And Cmdlets
id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
related:
- id: 1139d2e2-84b1-4226-b445-354492eba8ba
type: similar
- id: f67dbfce-93bc-440d-86ad-a95ae8858c90
type: obsolete
- id: cd5c8085-4070-4e22-908d-a5b3342deb74
type: obsolete
- id: 6e897651-f157-4d8f-aaeb-df8151488385
type: obsolete
status: test
description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine
references:
- https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
- https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
- https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps
author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger
date: 2019-10-24
modified: 2025-10-20
tags:
- attack.execution
- attack.t1059.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- '[System.Net.WebRequest]::create'
- 'curl '
- 'Invoke-RestMethod'
- 'Invoke-WebRequest'
- ' irm ' # Space before and after to avoid false positives with 'irm' as a substring
- 'iwr '
# - 'Net.WebClient' # There are various other rules that cover this, so it is commented out
- 'Resume-BitsTransfer'
- 'Start-BitsTransfer'
- 'wget '
- 'WinHttp.WinHttpRequest'
condition: selection
falsepositives:
- Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets/info.yml
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains:
- '[System.Net.WebRequest]::create'
- 'curl '
- 'Invoke-RestMethod'
- 'Invoke-WebRequest'
- ' irm '
- 'iwr '
- 'Resume-BitsTransfer'
- 'Start-BitsTransfer'
- 'wget '
- 'WinHttp.WinHttpRequest'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |