Sigma rules: 2j

title: Azure Device No Longer Managed or Compliant
id: 542b9912-c01f-4e3f-89a8-014c48cdca7d
status: test
description: Identifies when a device in azure is no longer managed or compliant
references:
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
author: Austin Songer @austinsonger
date: 2021-09-03
modified: 2026-04-30
tags:
    - attack.impact
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        operationName:
            - 'Device no longer compliant'
            - 'Device no longer managed'
    condition: selection
falsepositives:
    - Administrator may have forgotten to review the device.
level: medium

title: Change User Agents with WebRequest
id: d4488827-73af-4f8d-9244-7b7662ef046e
status: test
description: |
    Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
    Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
author: frack113
date: 2022-01-23
modified: 2025-07-18
tags:
    - attack.command-and-control
    - attack.t1071.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_webrequest:
        ScriptBlockText|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - ' irm ' # Space before and after to avoid false positives with 'irm' as a variable
            - 'iwr '
    selection_useragent:
        ScriptBlockText|contains: '-UserAgent '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent/info.yml

title: Cisco Show Commands Input
id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b
status: test
description: See what commands are being input into the device by other people, full credentials can be in the history
author: Austin Clark
date: 2019-08-11
modified: 2023-01-04
tags:
    - attack.credential-access
    - attack.t1552.003
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'show history'
        - 'show history all'
        - 'show logging'
    condition: keywords
falsepositives:
    - Not commonly run by administrators, especially if remote logging is configured
level: medium

title: Custom File Open Handler Executes PowerShell
id: 7530b96f-ad8e-431d-a04d-ac85cc461fdc
status: test
description: Detects the abuse of custom file open handler, executing powershell
references:
    - https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728
author: CD_R0M_
date: 2022-06-11
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1202
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'shell\open\command\'
        Details|contains|all:
            - 'powershell'
            - '-command'
    condition: selection
falsepositives:
    - Unknown
level: high

title: CVE-2023-46747 Exploitation Activity - Proxy
id: f195b2ff-e542-41bf-8d91-864fb81e5c20
related:
    - id: e9928831-ba14-42ea-a4bc-33d352b9929a
      type: similar
status: test
description: Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.
references:
    - https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
    - https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
    - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
    - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-11-08
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-46747
    - detection.emerging-threats
logsource:
    category: proxy
    definition: 'Requirements: The POST request body data must be collected in order to make use of this detection'
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/mgmt/tm/util/bash'
    keywords_hex:
        '|all':
            - '2f746d75692f436f6e74726f6c2f666f726d' # /tmui/Control/form
            - '666f726d5f706167653d253266746d756925326673797374656d253266757365722532666372656174652e6a7370' # form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp
    keywords_plain:
        '|all':
            - '/tmui/Control/form'
            - 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp'
    condition: selection and (keywords_hex or keywords_plain)
falsepositives:
    - Unlikely
level: high

title: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
id: c39f0c81-7348-4965-ab27-2fde35a1b641
status: test
description: Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
references:
    - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
date: 2020-10-12
modified: 2022-11-26
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1021.003
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5145
        RelativeTargetName|endswith: '\Internet Explorer\iertutil.dll'
    filter:
        SubjectUserName|endswith: '$'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: DeviceCredentialDeployment Execution
id: b8b1b304-a60f-4999-9a6e-c547bde03ffd
status: test
description: |
    Detects the execution of DeviceCredentialDeployment to hide a process from view.
references:
    - https://github.com/LOLBAS-Project/LOLBAS/pull/147
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\DeviceCredentialDeployment.exe'
    condition: selection
falsepositives:
    - Unlikely
level: medium

title: Execution of Powershell Script in Public Folder
id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4
status: test
description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
references:
    - https://www.mandiant.com/resources/evolution-of-fin7
author: Max Altgelt (Nextron Systems)
date: 2022-04-06
modified: 2022-07-14
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - '-f C:\Users\Public'
            - '-f "C:\Users\Public'
            - '-f %Public%'
            - '-fi C:\Users\Public'
            - '-fi "C:\Users\Public'
            - '-fi %Public%'
            - '-fil C:\Users\Public'
            - '-fil "C:\Users\Public'
            - '-fil %Public%'
            - '-file C:\Users\Public'
            - '-file "C:\Users\Public'
            - '-file %Public%'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: File Encryption/Decryption Via Gpg4win From Suspicious Locations
id: e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d
status: test
description: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.
references:
    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
    - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2022-11-30
modified: 2023-08-09
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_metadata:
        - Image|endswith:
              - '\gpg.exe'
              - '\gpg2.exe'
        - Product: 'GNU Privacy Guard (GnuPG)'
        - Description: 'GnuPG’s OpenPGP tool'
    selection_cli:
        CommandLine|contains: '-passphrase'
    selection_paths:
        CommandLine|contains:
            - ':\PerfLogs\'
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Group Has Been Deleted Via Groupdel
id: 8a46f16c-8c4c-82d1-b121-0fdd3ba70a84
status: test
description: Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
references:
    - https://linuxize.com/post/how-to-delete-group-in-linux/
    - https://www.cyberciti.biz/faq/linux-remove-user-command/
    - https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/
    - https://linux.die.net/man/8/groupdel
author: Tuan Le (NCSGroup)
date: 2022-12-26
tags:
    - attack.impact
    - attack.t1531
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/groupdel'
    condition: selection
falsepositives:
    - Legitimate administrator activities
level: medium

title: HackTool - Default PowerSploit/Empire Scheduled Task Creation
id: 56c217c3-2de2-479b-990f-5c109ba8458f
status: test
description: Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
references:
    - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
    - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py
author: Markus Neis, @Karneades
date: 2018-03-06
modified: 2023-03-03
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.s0111
    - attack.g0022
    - attack.g0060
    - car.2013-08-001
    - attack.t1053.005
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - '/Create'
            - 'powershell.exe -NonI'
            - '/TN Updater /TR'
        CommandLine|contains:
            - '/SC ONLOGON'
            - '/SC DAILY /ST'
            - '/SC ONIDLE'
            - '/SC HOURLY'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Ie4uinit Lolbin Use From Invalid Path
id: d3bf399f-b0cf-4250-8bb4-dfc192ab81dc
status: test
description: Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
    - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
author: frack113
date: 2022-05-07
modified: 2022-05-16
tags:
    - attack.stealth
    - attack.t1218
logsource:
    product: windows
    category: process_creation
detection:
    lolbin:
        - Image|endswith: '\ie4uinit.exe'
        - OriginalFileName: 'IE4UINIT.EXE'
    filter_correct:
        CurrentDirectory:
            - 'c:\windows\system32\'
            - 'c:\windows\sysWOW64\'
    filter_missing:
        CurrentDirectory: null
    condition: lolbin and not 1 of filter_*
falsepositives:
    - ViberPC updater calls this binary with the following commandline "ie4uinit.exe -ClearIconCache"
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit/info.yml

title: Kernel Memory Dump Via LiveKD
id: c7746f1c-47d3-43d6-8c45-cd1e54b6b0a2
status: test
description: Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
    - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/
    - https://kb.acronis.com/content/60892
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-16
modified: 2024-03-13
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\livekd.exe'
              - '\livekd64.exe'
        - OriginalFileName: 'livekd.exe'
    selection_cli:
        CommandLine|contains|windash: ' -m'
    condition: all of selection_*
falsepositives:
    - Unlikely in production environment
level: high

title: Member added to DNSadmin group
description: Detects scenarios where a suspicious change is done on DNSadmin group in order to abuse DNSadmin privileges for DLL load.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html
- https://medium.com/r3d-buck3t/escalating-privileges-with-dnsadmins-group-active-directory-6f7adbc7005b
- https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise
- http://www.labofapenetrationtester.com/2017/05/abusing-dnsadmins-privilege-for-escalation-in-active-directory.html
- https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
- https://medium.com/r3d-buck3t/escalating-privileges-with-dnsadmins-group-active-directory-6f7adbc7005b
- https://medium.com/techzap/dns-admin-privesc-in-active-directory-ad-windows-ecc7ed5a21a2
- https://phackt.com/dnsadmins-group-exploitation-write-permissions
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID:
      - 4728 # security global group member added
      - 4756 # universal group member added
      - 4732 # local and domain local group member added > group below is per default with this group type
    TargetUserName: DnsAdmins # Group SID is random
  condition: selection
falsepositives:
- Rare administrator activity
level: high

title: Microsoft Defender critical security components disabled (PowerShell)
description: Detects scenarios where an attacker attempts to disable Defender security features in PowerShell
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.001-Impair%20Defenses-Disable%20or%20Modify%20tool
- https://github.com/swagkarna/Defeat-Defender-V1.2
- https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2019-ps
- https://docs.microsoft.com/en-us/windows/client-management/mdm/defender-csp
- https://powershell.one/wmi/root/microsoft/windows/defender/msft_mppreference
- https://gist.github.com/pe3zx/7c5e0080c3b0869ccba1f1dc2ea0c5e0
- https://cloudbrothers.info/en/current-limits-defender-av-tamper-protection/
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # Set-MpPreference -DisableRealtimeMonitoring $true
  selection1_powershell_native:
    EventID: 800
    EventData|contains: Set-MpPreference
    EventData|contains:
      - '1'
      - '$true'
    EventData|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection # scans downloaded files and attachment
      - DisableIntrusionPreventionSystem # network protection against exploitation of known vulnerabilities
      - DisableInboundConnectionFiltering

  selection2_powershell_modern:
    EventID: 4103
    EventData|contains: Set-MpPreference
    Payload|contains:
      - '1'
      - '$true'
    Payload|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection # scans downloaded files and attachment
      - DisableIntrusionPreventionSystem # network protection against exploitation of known vulnerabilities
      - DisableInboundConnectionFiltering

  selection3_powershell_block:
    EventID: 4104
    EventData|contains: Set-MpPreference
    ScriptBlockText|contains:
      - '1'
      - '$true'
    ScriptBlockText|contains:
      - DisableRealtimeMonitoring
      - DisableBehaviorMonitoring
      - DisableIOAVProtection # scans downloaded files and attachment
      - DisableIntrusionPreventionSystem # network protection against exploitation of known vulnerabilities
      - DisableInboundConnectionFiltering

  condition: 1 of selection*
falsepositives:
- None
level: high

title: Mint Sandstorm - ManageEngine Suspicious Process Execution
id: 58d8341a-5849-44cd-8ac8-8b020413a31b
status: test
description: Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm
references:
    - https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
author: Nasreddine Bencherchali (Nextron Systems), MSTIC (idea)
date: 2023-04-20
modified: 2025-10-19
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_path:
        ParentImage|contains:
            - 'manageengine'
            - 'ServiceDesk'
    selection_parent_image:
        ParentImage|contains: '\java'
    selection_special_child_powershell_img:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
    selection_special_child_powershell_cli:
        - CommandLine|contains:
              - ' echo '
              - '-dumpmode'
              - '-ssh'
              - '.dmp'
              - 'add-MpPreference'
              - 'adscredentials'
              - 'bitsadmin'
              - 'certutil'
              - 'csvhost.exe'
              - 'DownloadFile'
              - 'DownloadString'
              - 'dsquery'
              - 'ekern.exe'
              - 'FromBase64String'
              - 'iex '
              - 'iex('
              - 'Invoke-Expression'
              - 'Invoke-WebRequest'
              - 'localgroup administrators'
              - 'o365accountconfiguration'
              - 'samaccountname='
              - 'set-MpPreference'
              - 'svhost.exe'
              - 'System.IO.Compression'
              - 'System.IO.MemoryStream'
              - 'usoprivate'
              - 'usoshared'
              - 'whoami'
        - CommandLine|re: '[-/–][Ee^]{1,2}[ncodema^]*\s[A-Za-z0-9+/=]{15,}'
        - CommandLine|re: 'net\s+user'
        - CommandLine|re: 'net\s+group'
        - CommandLine|re: 'query\ssession'
    selection_special_child_lsass_1:
        CommandLine|contains: 'lsass'
    selection_special_child_lsass_2:
        CommandLine|contains:
            - 'procdump'
            - 'tasklist'
            - 'findstr'
    selection_child_wget:
        Image|endswith: '\wget.exe'
        CommandLine|contains: 'http'
    selection_child_curl:
        Image|endswith: '\curl.exe'
        CommandLine|contains: 'http'
    selection_child_script:
        CommandLine|contains:
            - 'E:jscript'
            - 'e:vbscript'
    selection_child_localgroup:
        CommandLine|contains|all:
            - 'localgroup Administrators'
            - '/add'
    selection_child_net:
        CommandLine|contains: 'net' # Covers net1
        CommandLine|contains|all:
            - 'user'
            - '/add'
    selection_child_reg:
        - CommandLine|contains|all:
              - 'reg add'
              - 'DisableAntiSpyware'
              - '\Microsoft\Windows Defender'
        - CommandLine|contains|all:
              - 'reg add'
              - 'DisableRestrictedAdmin'
              - 'CurrentControlSet\Control\Lsa'
    selection_child_wmic_1:
        CommandLine|contains|all:
            - 'wmic'
            - 'process call create'
    selection_child_wmic_2:
        CommandLine|contains|all:
            - 'wmic'
            - 'delete'
            - 'shadowcopy'
    selection_child_vssadmin:
        CommandLine|contains|all:
            - 'vssadmin'
            - 'delete'
            - 'shadows'
    selection_child_wbadmin:
        CommandLine|contains|all:
            - 'wbadmin'
            - 'delete'
            - 'catalog'
    filter_main:
        CommandLine|contains|all:
            - 'download.microsoft.com'
            - 'manageengine.com'
            - 'msiexec'
    condition: all of selection_parent_* and (all of selection_special_child_powershell_* or all of selection_special_child_lsass_* or 1 of selection_child_*) and not filter_main
falsepositives:
    - Unlikely
level: critical

title: MSI Installation From Web
id: 5594e67a-7f92-4a04-b65d-1a42fd824a60
status: test
description: Detects installation of a remote msi file from web.
references:
    - https://twitter.com/_st0pp3r_/status/1583922009842802689
author: Stamatis Chatzimangou
date: 2022-10-23
tags:
    - attack.stealth
    - attack.t1218
    - attack.t1218.007
logsource:
    product: windows
    service: application
    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
    selection:
        Provider_Name: 'MsiInstaller'
        EventID:
            - 1040
            - 1042
        Data|contains: '://'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: New PortProxy Registry Entry Added
id: a54f842a-3713-4b45-8c84-5f136fdebd3c
status: test
description: Detects the modification of the PortProxy registry key which is used for port forwarding.
references:
    - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
    - https://adepts.of0x.cc/netsh-portproxy-code/
    - https://www.dfirnotes.net/portproxy_detection/
author: Andreas Hunkeler (@Karneades)
date: 2021-06-22
modified: 2024-03-25
tags:
    - attack.lateral-movement
    - attack.command-and-control
    - attack.t1090
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        # Example: HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4\tcp\0.0.0.0/1337
        TargetObject|contains: '\Services\PortProxy\v4tov4\tcp\'
    condition: selection
falsepositives:
    - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)
    - Synergy Software KVM (https://symless.com/synergy)
level: medium

title: New Self Extracting Package Created Via IExpress.EXE
id: c2b478fc-09bf-40b2-8768-ab3ec8d61c9a
status: test
description: |
    Detects the "iexpress.exe" utility creating self-extracting packages.
    Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
    Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.
references:
    - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
    - https://en.wikipedia.org/wiki/IExpress
    - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
    - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2024-02-05
tags:
    - attack.stealth
    - attack.t1218
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_1_parent:
        ParentImage|endswith: '\iexpress.exe'
    selection_1_img:
        - Image|endswith: '\makecab.exe'
        - OriginalFileName: 'makecab.exe'
    selection_2_img:
        - Image|endswith: '\iexpress.exe'
        - OriginalFileName: 'IEXPRESS.exe'
    selection_2_cli:
        CommandLine|contains: ' /n '
    condition: all of selection_1_* or all of selection_2_*
falsepositives:
    - Administrators building packages using iexpress.exe
level: medium

title: Oracle WebLogic Exploit
id: 37e8369b-43bb-4bf8-83b6-6dd43bda2000
status: test
description: Detects access to a webshell dropped into a keystore folder on the WebLogic server
references:
    - https://twitter.com/pyn3rd/status/1020620932967223296
    - https://github.com/LandGrey/CVE-2018-2894
author: Florian Roth (Nextron Systems)
date: 2018-07-22
modified: 2023-01-02
tags:
    - attack.t1190
    - attack.initial-access
    - attack.persistence
    - attack.t1505.003
    - cve.2018-2894
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query: '*/config/keystore/*.js*'
    condition: selection
falsepositives:
    - Unknown
level: critical

title: Potential Active Directory Reconnaissance/Enumeration Via LDAP
id: 31d68132-4038-47c7-8f8e-635a39a7c174
status: test
description: Detects potential Active Directory enumeration via LDAP
references:
    - https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726
    - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
    - https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs
    - https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c
    - https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427
    - https://ipurple.team/2024/07/15/sharphound-detection/
author: Adeem Mawani
date: 2021-06-22
modified: 2025-07-04
tags:
    - attack.discovery
    - attack.t1069.002
    - attack.t1087.002
    - attack.t1482
logsource:
    product: windows
    service: ldap
    definition: 'Requirements: Microsoft-Windows-LDAP-Client/Debug ETW logging'
detection:
    generic_search:
        EventID: 30
        SearchFilter|contains:
            - '(groupType:1.2.840.113556.1.4.803:=2147483648)'
            - '(groupType:1.2.840.113556.1.4.803:=2147483656)'
            - '(groupType:1.2.840.113556.1.4.803:=2147483652)'
            - '(groupType:1.2.840.113556.1.4.803:=2147483650)'
            - '(sAMAccountType=805306369)'
            - '(sAMAccountType=805306368)'
            - '(sAMAccountType=536870913)'
            - '(sAMAccountType=536870912)'
            - '(sAMAccountType=268435457)'
            - '(sAMAccountType=268435456)'
            - '(objectCategory=groupPolicyContainer)'
            - '(objectCategory=organizationalUnit)'
            # - '(objectCategory=Computer)' Prone to false positives
            - '(objectCategory=nTDSDSA)'
            - '(objectCategory=server)'
            - '(objectCategory=domain)'
            - '(objectCategory=person)'
            - '(objectCategory=group)'
            - '(objectCategory=user)'
            - '(objectClass=trustedDomain)'
            - '(objectClass=computer)'
            - '(objectClass=server)'
            - '(objectClass=group)'
            - '(objectClass=user)'
            - '(primaryGroupID=521)'
            - '(primaryGroupID=516)'
            - '(primaryGroupID=515)'
            - '(primaryGroupID=512)'
            - 'Domain Admins'
            - 'objectGUID=\*'
            - '(schemaIDGUID=\*)'
            - 'admincount=1'
    distinguished_name_enumeration:
        EventID: 30
        SearchFilter: '(objectclass=\*)'
        DistinguishedName|contains:
            - 'CN=Domain Admins'
            - 'CN=Enterprise Admins'
            - 'CN=Group Policy Creator Owners'
    suspicious_flag:
        EventID: 30
        SearchFilter|contains:
            - '(userAccountControl:1.2.840.113556.1.4.803:=4194304)'
            - '(userAccountControl:1.2.840.113556.1.4.803:=2097152)'
            - '!(userAccountControl:1.2.840.113556.1.4.803:=1048574)'
            - '(userAccountControl:1.2.840.113556.1.4.803:=524288)'
            - '(userAccountControl:1.2.840.113556.1.4.803:=65536)'
            - '(userAccountControl:1.2.840.113556.1.4.803:=8192)'
            - '(userAccountControl:1.2.840.113556.1.4.803:=544)'
            - '!(UserAccountControl:1.2.840.113556.1.4.803:=2)'
            - 'msDS-AllowedToActOnBehalfOfOtherIdentity'
            - 'msDS-AllowedToDelegateTo'
            - 'msDS-GroupManagedServiceAccount'
            - '(accountExpires=9223372036854775807)'
            - '(accountExpires=0)'
            - '(adminCount=1)'
            - 'ms-MCS-AdmPwd'
    narrow_down_filter:
        EventID: 30
        SearchFilter|contains:
            - '(domainSid=*)'
            - '(objectSid=*)'
    condition: (generic_search and not narrow_down_filter) or suspicious_flag or distinguished_name_enumeration
level: medium

title: Potential Linux Process Code Injection Via DD Utility
id: 4cad6c64-d6df-42d6-8dae-eb78defdc415
status: test
description: Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.
references:
    - https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
    - https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh
author: Joseph Kamau
date: 2023-12-01
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055.009
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/dd'
        CommandLine|contains|all:
            - 'of='
            - '/proc/'
            - '/mem'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Potential Windows Defender AV Bypass Via Dump64.EXE Rename
id: 129966c9-de17-4334-a123-8b58172e664d
status: test
description: |
    Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
    Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.
references:
    - https://twitter.com/mrd0x/status/1460597833917251595
author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-11-26
modified: 2024-06-21
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_dump:
        Image|startswith: ':\Program Files'
        Image|contains: '\Microsoft Visual Studio\'
        Image|endswith: '\dump64.exe'
    selection_tools_procdump:
        - OriginalFileName: 'procdump'
        - CommandLine|contains:
              - ' -ma ' # Full Dump
              - ' -mp ' # Mini Plus
    condition: selection_dump and 1 of selection_tools_*
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Image Load of Offreg.dll
id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95
status: experimental
description: |
    Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
    Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
    bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
    while evading detection mechanisms that rely on standard registry event logs.
references:
    - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library
    - https://github.com/MSNightmare/LegacyHive
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-07-23
tags:
    - attack.defense-impairment
    - attack.persistence
    - attack.t1112
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\offreg.dll'
    filter_main_system32:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    filter_main_program_files:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
    filter_main_appdata_local_programs:
        Image|startswith: 'C:\Users\'
        Image|contains: '\AppData\Local\Programs\'
    filter_main_defender:
        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
        Image|endswith: '\MsMpEng.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Third-party backup or forensic software that performs offline registry parsing
    - Windows deployment tools (DISM, ADK) run from non-standard paths
level: medium
regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml

title: Powershell Detect Virtualization Environment
id: d93129cd-1ee0-479f-bc03-ca6f129882e3
status: test
description: |
    Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
    This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
    - https://techgenix.com/malicious-powershell-scripts-evade-detection/
author: frack113, Duc.Le-GTSC
date: 2021-08-03
modified: 2022-03-03
tags:
    - attack.discovery
    - attack.stealth
    - attack.t1497.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_action:
        ScriptBlockText|contains:
            - Get-WmiObject
            - gwmi
    selection_module:
        ScriptBlockText|contains:
            - MSAcpi_ThermalZoneTemperature
            - Win32_ComputerSystem
    condition: all of selection*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env/info.yml

title: PowerShell PSAttack
id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5
status: test
description: Detects the use of PSAttack PowerShell hack tool
references:
    - https://adsecurity.org/?p=2921
author: Sean Metcalf (source), Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2022-12-25
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: 'PS ATTACK!!!'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Print History File Contents
id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66
status: test
description: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
references:
    - https://github.com/sleventyeleven/linuxprivchecker/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
author: Florian Roth (Nextron Systems)
date: 2022-06-20
modified: 2022-09-15
tags:
    - attack.reconnaissance
    - attack.t1592.004
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/cat'
            - '/head'
            - '/tail'
            - '/more'
    selection_history:
        - CommandLine|contains:
              - '/.bash_history'
              - '/.zsh_history'
        - CommandLine|endswith:
              - '_history'
              - '.history'
              - 'zhistory'
    condition: all of selection*
falsepositives:
    - Legitimate administration activities
level: medium

title: Raccine Uninstall
id: a31eeaed-3fd5-478e-a8ba-e62c6b3f9ecc
status: test
description: Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.
references:
    - https://github.com/Neo23x0/Raccine
author: Florian Roth (Nextron Systems)
date: 2021-01-21
modified: 2022-10-09
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all:
            - 'taskkill '
            - 'RaccineSettings.exe'
    selection2:
        CommandLine|contains|all:
            - 'reg.exe'
            - 'delete'
            - 'Raccine Tray'
    selection3:
        CommandLine|contains|all:
            - 'schtasks'
            - '/DELETE'
            - 'Raccine Rules Updater'
    condition: 1 of selection*
falsepositives:
    - Legitimate deinstallation by administrative staff
level: high