Detection rules › Sigma
Sigma rules: 2q
Application Using Device Code Authentication Flow
#Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious.
Known False Positives
- Applications that are input constrained will need to use device code flow and are valid authentications.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| Entra ID | SigninLogs sign-in event: Sign-in record (SigninLogs, any result) |
Rule Body
title: Application Using Device Code Authentication Flow
id: 248649b7-d64f-46f0-9fb2-a52774166fb5
status: test
description: |
Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.
If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.
This can be a misconfigured application or potentially something malicious.
references:
- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'
date: 2022-06-01
tags:
- attack.stealth
- attack.t1078
- attack.persistence
- attack.privilege-escalation
- attack.initial-access
logsource:
product: azure
service: signinlogs
detection:
selection:
properties.message: Device Code
condition: selection
falsepositives:
- Applications that are input constrained will need to use device code flow and are valid authentications.
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
properties.message: Device Code
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
properties.message | eq |
| field:"properties.message" kind:eq value:"Device Code" |
Arbitrary File Download Via PresentationHost.EXE
#Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Arbitrary File Download Via PresentationHost.EXE
id: b124ddf4-778d-418e-907f-6dd3fc0d31cd
status: test
description: Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files
references:
- https://github.com/LOLBAS-Project/LOLBAS/pull/239/files
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-19
modified: 2023-11-09
tags:
- attack.execution
- attack.stealth
- attack.t1218
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\presentationhost.exe'
- OriginalFileName: 'PresentationHost.exe'
selection_cli:
CommandLine|contains:
- 'http://'
- 'https://'
- 'ftp://'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_img
selection_img:
- Image|endswith: '\presentationhost.exe'
- OriginalFileName: 'PresentationHost.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains:
- 'http://'
- 'https://'
- 'ftp://'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\presentationhost.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"PresentationHost.exe" |
Cisco Local Accounts
#Find local accounts being created or modified as well as remote authentication configurations
Known False Positives
- When remote authentication is in place, this should not change often
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence | |
| Privilege Escalation |
Rule Body
title: Cisco Local Accounts
id: 6d844f0f-1c18-41af-8f19-33e7654edfc3
status: test
description: Find local accounts being created or modified as well as remote authentication configurations
author: Austin Clark
date: 2019-08-12
modified: 2023-01-04
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1136.001
- attack.t1098
logsource:
product: cisco
service: aaa
detection:
keywords:
- 'username'
- 'aaa'
condition: keywords
falsepositives:
- When remote authentication is in place, this should not change often
level: high
Stages and Predicates
Stage 0: condition
keywordsStage 1: keywords
keywords:
- 'username'
- 'aaa'
CMD Shell Output Redirect
#Detects the use of the redirection character ">" to redirect information on the command line. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Known False Positives
- Internet Download Manager extensions use named pipes and redirection via CLI. Filter it out if you use it in your environment
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: CMD Shell Output Redirect
id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a
related:
- id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
type: similar
status: test
description: |
Detects the use of the redirection character ">" to redirect information on the command line.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
references:
- https://ss64.com/nt/syntax-redirection.html
author: frack113
date: 2022-01-22
modified: 2024-03-19
tags:
- attack.discovery
- attack.t1082
- detection.threat-hunting
logsource:
category: process_creation
product: windows
detection:
selection_cmd:
- OriginalFileName: 'Cmd.Exe'
- Image|endswith: '\cmd.exe'
selection_cli:
CommandLine|contains: '>'
filter_optional_idm_extension:
CommandLine|contains:
- 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
- 'chrome-extension://'
- '\\.\pipe\chrome.nativeMessaging'
condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
- Internet Download Manager extensions use named pipes and redirection via CLI. Filter it out if you use it in your environment
level: low
Stages and Predicates
Stage 0: condition
all of selection_* and not 1 of filter_optional_*Stage 1: selection_cmd
selection_cmd:
- OriginalFileName: 'Cmd.Exe'
- Image|endswith: '\cmd.exe'
Stage 2: selection_cli
selection_cli:
CommandLine|contains: '>'
Stage 3: not filter_optional_idm_extension
filter_optional_idm_extension:
CommandLine|contains:
- 'C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe'
- 'chrome-extension://'
- '\\.\pipe\chrome.nativeMessaging'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:">" |
Image | ends_with |
| field:"Image" kind:ends_with value:"\cmd.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"Cmd.Exe" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
CommandLine | match | C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe | excludes:CommandLine field:"CommandLine" value:"C:\Program Files (x86)\Internet Download Manager\IDMMsgHost.exe" |
CommandLine | match | \\.\pipe\chrome.nativeMessaging | excludes:CommandLine field:"CommandLine" value:"\\.\pipe\chrome.nativeMessaging" |
CommandLine | match | chrome-extension:// | excludes:CommandLine field:"CommandLine" value:"chrome-extension://" |
DNS RCE CVE-2020-1350
#Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process
Known False Positives
- Unknown but benign sub processes of the Windows DNS service dns.exe
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Execution |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: DNS RCE CVE-2020-1350
id: b5281f31-f9cc-4d0d-95d0-45b91c45b487
status: test
description: Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process
references:
- https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
- https://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
author: Florian Roth (Nextron Systems)
date: 2020-07-15
modified: 2022-07-12
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1569.002
- cve.2020-1350
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\System32\dns.exe'
filter:
Image|endswith:
- '\System32\werfault.exe'
- '\System32\conhost.exe'
- '\System32\dnscmd.exe'
- '\System32\dns.exe'
condition: selection and not filter
falsepositives:
- Unknown but benign sub processes of the Windows DNS service dns.exe
level: critical
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
ParentImage|endswith: '\System32\dns.exe'
Stage 2: not filter
filter:
Image|endswith:
- '\System32\werfault.exe'
- '\System32\conhost.exe'
- '\System32\dnscmd.exe'
- '\System32\dns.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\System32\dns.exe" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \System32\conhost.exe | excludes:Image field:"Image" value:"\System32\conhost.exe" |
Image | ends_with | \System32\dns.exe | excludes:Image field:"Image" value:"\System32\dns.exe" |
Image | ends_with | \System32\dnscmd.exe | excludes:Image field:"Image" value:"\System32\dnscmd.exe" |
Image | ends_with | \System32\werfault.exe | excludes:Image field:"Image" value:"\System32\werfault.exe" |
Enable Windows Remote Management
#Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
Known False Positives
- Legitimate script
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule Body
title: Enable Windows Remote Management
id: 991a9744-f2f0-44f2-bd33-9092eba17dc3
status: test
description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
author: frack113
date: 2022-01-07
tags:
- attack.lateral-movement
- attack.t1021.006
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection_cmdlet:
ScriptBlockText|contains: 'Enable-PSRemoting '
condition: selection_cmdlet
falsepositives:
- Legitimate script
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting/info.yml
Stages and Predicates
Stage 0: condition
selection_cmdletStage 1: selection_cmdlet
selection_cmdlet:
ScriptBlockText|contains: 'Enable-PSRemoting '
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScriptBlockText | match |
| field:"ScriptBlockText" kind:match value:"Enable-PSRemoting " |
Failed Logon From Public IP
#Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
Known False Positives
- Legitimate logon attempts over the internet
- IPv4-to-IPv6 mapped IPs
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4625: An account failed to log on. |
Rule Body
title: Failed Logon From Public IP
id: f88e112a-21aa-44bd-9b01-6ee2a2bbbed1
status: test
description: Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
references:
- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
author: NVISO
date: 2020-05-06
modified: 2024-03-11
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.persistence
- attack.stealth
- attack.t1078
- attack.t1190
- attack.t1133
logsource:
product: windows
service: security
detection:
selection:
EventID: 4625
filter_main_ip_unknown:
IpAddress|contains: '-'
filter_main_local_ranges:
IpAddress|cidr:
- '::1/128' # IPv6 loopback
- '10.0.0.0/8'
- '127.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '169.254.0.0/16'
- 'fc00::/7' # IPv6 private addresses
- 'fe80::/10' # IPv6 link-local addresses
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate logon attempts over the internet
- IPv4-to-IPv6 mapped IPs
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
EventID: 4625
Stage 2: not filter_main_*
filter_main_ip_unknown:
IpAddress|contains: '-'
filter_main_local_ranges:
IpAddress|cidr:
- '::1/128'
- '10.0.0.0/8'
- '127.0.0.0/8'
- '172.16.0.0/12'
- '192.168.0.0/16'
- '169.254.0.0/16'
- 'fc00::/7'
- 'fe80::/10'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
IpAddress | cidr_match | 10.0.0.0/8 | excludes:IpAddress field:"IpAddress" value:"10.0.0.0/8" |
IpAddress | cidr_match | 127.0.0.0/8 | excludes:IpAddress field:"IpAddress" value:"127.0.0.0/8" |
IpAddress | cidr_match | 169.254.0.0/16 | excludes:IpAddress field:"IpAddress" value:"169.254.0.0/16" |
IpAddress | cidr_match | 172.16.0.0/12 | excludes:IpAddress field:"IpAddress" value:"172.16.0.0/12" |
IpAddress | cidr_match | 192.168.0.0/16 | excludes:IpAddress field:"IpAddress" value:"192.168.0.0/16" |
IpAddress | cidr_match | ::1/128 | excludes:IpAddress field:"IpAddress" value:"::1/128" |
IpAddress | cidr_match | fc00::/7 | excludes:IpAddress field:"IpAddress" value:"fc00::/7" |
IpAddress | cidr_match | fe80::/10 | excludes:IpAddress field:"IpAddress" value:"fe80::/10" |
IpAddress | match | - | excludes:IpAddress field:"IpAddress" value:"-" |
Massive remote service creation via named pipes (TChopper, CME)
#Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
Known False Positives
- Administrator activity, backup solutions
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution |
Telemetry Coverage
Rule Body
title: Massive remote service creation via named pipes (TChopper, CME)
description: Detects scenarios where an attacker remotely creates a service over named pipes. Tools like Tchopper or CrackMapExec can trigger this rule.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1569.002-Service%20execution
- https://github.com/lawrenceamer/TChopper
tags:
- attack.execution
- attack.t1569
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection:
EventID: 5145
ShareName: '\\*\IPC$'
RelativeTargetName: svcctl
AccessList|contains: '%%4417' # WriteData
filter:
SubjectUserName|endswith: '$'
condition: selection and not filter | count(Computer) by IpAddress > 20
falsepositives:
- Administrator activity, backup solutions
level: high
Stages and Predicates
Stage 0: condition
selection and not filter | count(Computer) by IpAddress > 20Stage 1: selection
selection:
EventID: 5145
ShareName: '\\*\IPC$'
RelativeTargetName: svcctl
AccessList|contains: '%%4417'
Stage 2: not filter
filter:
SubjectUserName|endswith: '$'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
AccessList | match |
| field:"AccessList" kind:match value:"%%4417" |
RelativeTargetName | eq |
| field:"RelativeTargetName" kind:eq value:"svcctl" |
ShareName | wildcard |
| field:"ShareName" kind:wildcard value:"\\*\IPC$" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
SubjectUserName | ends_with | $ | excludes:SubjectUserName field:"SubjectUserName" value:"$" |
Microsoft Defender service components status disabled (Registry via Sysmon)
#Detects scenarios where an attacker attempts to disable Defender security features by modifying service configuration in registry.
Known False Positives
- None
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 13: RegistryEvent (Value Set) |
Rule Body
title: Microsoft Defender service components status disabled (Registry via Sysmon)
description: Detects scenarios where an attacker attempts to disable Defender security features by modifying service configuration in registry.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.001-Impair%20Defenses-Disable%20or%20Modify%20tool
- https://www.securityartwork.es/2021/09/27/trustedinstaller-parando-windows-defender/
- https://github.com/lab52io/StopDefender
- https://github.com/APTortellini/DefenderSwitch
- https://twitter.com/malwarelab_eu/status/1531536165458825219
- https://cloudbrothers.info/en/current-limits-defender-av-tamper-protection/
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
EventID: 13 # registry value set
EventType: SetValue
TargetObject|endswith:
- '\SYSTEM\CurrentControlSet\Services\wscsvc\Start'
- '\SYSTEM\CurrentControlSet\Services\SecurityHealthService\Start'
- '\SYSTEM\CurrentControlSet\Services\Sense\Start'
- '\SYSTEM\CurrentControlSet\Services\WdBoot\Start'
- '\SYSTEM\CurrentControlSet\Services\WdFilter\Start'
- '\SYSTEM\CurrentControlSet\Services\WdNisDrv\Start'
- '\SYSTEM\CurrentControlSet\Services\WdNisSvc\Start'
- '\SYSTEM\CurrentControlSet\Services\WinDefend\Start'
Details|contains:
- '0x00000003' # Manual
- '0x00000004' # Disabled
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 13
EventType: SetValue
TargetObject|endswith:
- '\SYSTEM\CurrentControlSet\Services\wscsvc\Start'
- '\SYSTEM\CurrentControlSet\Services\SecurityHealthService\Start'
- '\SYSTEM\CurrentControlSet\Services\Sense\Start'
- '\SYSTEM\CurrentControlSet\Services\WdBoot\Start'
- '\SYSTEM\CurrentControlSet\Services\WdFilter\Start'
- '\SYSTEM\CurrentControlSet\Services\WdNisDrv\Start'
- '\SYSTEM\CurrentControlSet\Services\WdNisSvc\Start'
- '\SYSTEM\CurrentControlSet\Services\WinDefend\Start'
Details|contains:
- '0x00000003'
- '0x00000004'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Details | match |
| field:"Details" kind:match |
EventType | eq |
| field:"EventType" kind:eq value:"SetValue" |
TargetObject | ends_with |
| field:"TargetObject" kind:ends_with |
Potential Bucket Enumeration on AWS
#Looks for potential enumeration of AWS buckets via ListBuckets.
Known False Positives
- Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
| Platform | Record / event type |
|---|---|
| AWS | CloudTrail event ListBuckets: Lists all S3 buckets owned by the authenticated requester. |
Rules Detecting the Same Action
These rules filter on the same operation.
Rule Body
title: Potential Bucket Enumeration on AWS
id: f305fd62-beca-47da-ad95-7690a0620084
related:
- id: 4723218f-2048-41f6-bcb0-417f2d784f61
type: similar
status: test
description: Looks for potential enumeration of AWS buckets via ListBuckets.
references:
- https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md
- https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html
- https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/
author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
date: 2023-01-06
modified: 2024-07-10
tags:
- attack.discovery
- attack.t1580
- attack.t1619
logsource:
product: aws
service: cloudtrail
detection:
selection:
eventSource: 's3.amazonaws.com'
eventName: 'ListBuckets'
filter:
userIdentity.type: 'AssumedRole'
condition: selection and not filter
falsepositives:
- Administrators listing buckets, it may be necessary to filter out users who commonly conduct this activity.
level: low
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
eventSource: 's3.amazonaws.com'
eventName: 'ListBuckets'
Stage 2: not filter
filter:
userIdentity.type: 'AssumedRole'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
eventName | eq |
| field:"aws::eventName" kind:eq value:"ListBuckets" |
eventSource | eq |
| field:"aws::eventSource" kind:eq value:"s3.amazonaws.com" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
userIdentity.type | eq | AssumedRole | excludes:userIdentity.type field:"userIdentity.type" value:"AssumedRole" |
Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
#Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth | No specific technique |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
id: f9578658-9e71-4711-b634-3f9b50cd3c06
status: test
description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.
author: '@Kostastsale, TheDFIRReport'
references:
- Internal Research
tags:
- attack.stealth
date: 2022-12-05
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains:
- '🦆'
- '🦅'
- '🦉'
- '🦇'
- '🐺'
- '🐗'
- '🐴'
- '🦄'
- '🐝'
- '🪱'
- '🐛'
- '🦋'
- '🐌'
- '🐞'
- '🐜'
- '🪰'
- '🪲'
- '🪳'
- '🦟'
- '🦗'
- '🕷'
- '🕸'
- '🦂'
- '🐢'
- '🐍'
- '🦎'
- '🦖'
- '🦕'
- '🐙'
- '🦑'
- '🦐'
- '🦞'
- '🦀'
- '🪸'
- '🐡'
- '🐠'
- '🐟'
- '🐬'
- '🐳'
- '🐋'
- '🦈'
- '🐊'
- '🐅'
- '🐆'
- '🦓'
- '🦍'
- '🦧'
- '🦣'
- '🐘'
- '🦛'
- '🦏'
- '🐪'
- '🐫'
- '🦒'
- '🦘'
- '🦬'
- '🐃'
- '🐂'
- '🐄'
- '🐎'
- '🐖'
- '🐏'
- '🐑'
- '🦙'
- '🐐'
- '🦌'
- '🐕'
- '🐩'
- '🦮'
- '🐕🦺'
- '🐈'
- '🐈⬛'
- '🪶'
- '🐓'
- '🦃'
- '🦤'
- '🦚'
- '🦜'
- '🦢'
- '🦩'
- '🕊'
- '🐇'
- '🦝'
- '🦨'
- '🦡'
- '🦫'
- '🦦'
- '🦥'
- '🐁'
- '🐀'
- '🐿'
- '🦔'
- '🐾'
- '🐉'
- '🐲'
- '🌵'
- '🎄'
- '🌲'
- '🌳'
- '🌴'
- '🪹'
- '🪺'
- '🪵'
- '🌱'
- '🌿'
- '☘️'
- '🍀'
- '🎍'
- '🪴'
- '🎋'
- '🍃'
- '🍂'
- '🍁'
- '🍄'
- '🐚'
- '🪨'
- '🌾'
- '💐'
- '🌷'
- '🪷'
- '🌹'
- '🥀'
- '🌺'
- '🌸'
- '🌼'
- '🌻'
- '🌞'
- '🌝'
- '🌛'
- '🌜'
- '🌚'
- '🌕'
- '🌖'
- '🌗'
- '🌘'
- '🌑'
- '🌒'
- '🌓'
- '🌔'
- '🌙'
- '🌎'
- '🌍'
- '🌏'
- '🪐'
- '💫'
- '⭐️'
- '🌟'
- '✨'
- '⚡️'
- '☄️'
- '💥'
- '🔥'
- '🌪'
- '🌈'
- '☀️'
- '🌤'
- '⛅️'
- '🌥'
- '☁️'
- '🌦'
- '🌧'
- '⛈'
- '🌩'
- '🌨'
- '❄️'
- '☃️'
- '⛄️'
- '🌬'
- '💨'
- '💧'
- '💦'
- '🫧'
- '☔️'
- '☂️'
- '🌊'
- '🌫🍏'
- '🍎'
- '🍐'
- '🍊'
- '🍋'
- '🍌'
- '🍉'
- '🍇'
- '🍓'
- '🫐'
- '🍈'
- '🍒'
- '🍑'
- '🥭'
- '🍍'
- '🥥'
- '🥝'
- '🍅'
- '🍆'
- '🥑'
- '🥦'
- '🥬'
- '🥒'
- '🌶'
- '🫑'
- '🌽'
- '🥕'
- '🫒'
- '🧄'
- '🧅'
- '🥔'
- '🍠'
- '🫘'
- '🥐'
- '🥯'
- '🍞'
- '🥖'
- '🥨'
- '🧀'
- '🥚'
- '🍳'
- '🧈'
- '🥞'
- '🧇'
- '🥓'
- '🥩'
- '🍗'
- '🍖'
- '🦴'
- '🌭'
- '🍔'
- '🍟'
- '🍕'
- '🫓'
- '🥪'
- '🥙'
- '🧆'
- '🌮'
- '🌯'
- '🫔'
- '🥗'
- '🥘'
- '🫕'
- '🥫'
- '🍝'
- '🍜'
- '🍲'
- '🍛'
- '🍣'
- '🍱'
- '🥟'
- '🦪'
- '🍤'
- '🍙'
- '🍚'
- '🍘'
- '🍥'
- '🥠'
- '🥮'
- '🍢'
- '🍡'
- '🍧'
- '🍨'
- '🍦'
- '🥧'
- '🧁'
- '🍰'
- '🎂'
- '🍮'
- '🍭'
- '🍬'
- '🍫'
- '🍿'
- '🍩'
- '🍪'
- '🌰'
- '🥜'
- '🍯'
- '🥛'
- '🍼'
- '🫖'
- '☕️'
- '🍵'
- '🧃'
- '🥤'
- '🧋'
- '🫙'
- '🍶'
- '🍺'
- '🍻'
- '🥂'
- '🍷'
- '🫗'
- '🥃'
- '🍸'
- '🍹'
- '🧉'
- '🍾'
- '🧊'
- '🥄'
- '🍴'
- '🍽'
- '🥣'
- '🥡'
- '🥢'
- '🧂'
- '⚽️'
- '🏀'
- '🏈'
- '⚾️'
- '🥎'
- '🎾'
- '🏐'
- '🏉'
- '🥏'
- '🎱'
- '🪀'
- '🏓'
- '🏸'
- '🏒'
- '🏑'
- '🥍'
- '🏏'
- '🪃'
- '🥅'
- '⛳️'
- '🪁'
- '🏹'
- '🎣'
- '🤿'
- '🥊'
- '🥋'
- '🎽'
- '🛹'
- '🛼'
- '🛷'
- '⛸'
- '🥌'
- '🎿'
- '⛷'
- '🏂'
- '🪂'
- '🏋️♀️'
- '🏋️'
- '🏋️♂️'
- '🤼♀️'
- '🤼'
- '🤼♂️'
- '🤸♀️'
- '🤸'
- '🤸♂️'
- '⛹️♀️'
- '⛹️'
- '⛹️♂️'
- '🤺'
- '🤾♀️'
- '🤾'
- '🤾♂️'
- '🏌️♀️'
- '🏌️'
- '🏌️♂️'
- '🏇'
- '🧘♀️'
- '🧘'
- '🧘♂️'
- '🏄♀️'
- '🏄'
- '🏄♂️'
- '🏊♀️'
- '🏊'
- '🏊♂️'
- '🤽♀️'
- '🤽'
- '🤽♂️'
- '🚣♀️'
- '🚣'
- '🚣♂️'
- '🧗♀️'
- '🧗'
- '🧗♂️'
- '🚵♀️'
- '🚵'
- '🚵♂️'
- '🚴♀️'
- '🚴'
- '🚴♂️'
- '🏆'
- '🥇'
- '🥈'
- '🥉'
- '🏅'
- '🎖'
- '🏵'
- '🎗'
- '🎫'
- '🎟'
- '🎪'
- '🤹'
- '🤹♂️'
- '🤹♀️'
- '🎭'
- '🩰'
- '🎨'
- '🎬'
- '🎤'
- '🎧'
- '🎼'
- '🎹'
- '🥁'
- '🪘'
- '🎷'
- '🎺'
- '🪗'
- '🎸'
- '🪕'
- '🎻'
- '🎲'
- '♟'
- '🎯'
- '🎳'
- '🎮'
- '🎰'
- '🧩'
- '🚗'
- '🚕'
- '🚙'
- '🚌'
- '🚎'
- '🏎'
- '🚓'
- '🚑'
- '🚒'
- '🚐'
- '🛻'
- '🚚'
- '🚛'
- '🚜'
- '🦯'
- '🦽'
- '🦼'
- '🛴'
- '🚲'
- '🛵'
- '🏍'
- '🛺'
- '🚨'
- '🚔'
- '🚍'
- '🚘'
- '🚖'
- '🛞'
- '🚡'
- '🚠'
- '🚟'
- '🚃'
- '🚋'
- '🚞'
- '🚝'
- '🚄'
- '🚅'
- '🚈'
- '🚂'
- '🚆'
- '🚇'
- '🚊'
- '🚉'
- '✈️'
- '🛫'
- '🛬'
- '🛩'
- '💺'
- '🛰'
- '🚀'
- '🛸'
- '🚁'
- '🛶'
- '⛵️'
- '🚤'
- '🛥'
- '🛳'
- '⛴'
- '🚢'
- '⚓️'
- '🛟'
- '🪝'
- '⛽️'
- '🚧'
- '🚦'
- '🚥'
- '🚏'
- '🗺'
- '🗿'
- '🗽'
- '🗼'
- '🏰'
- '🏯'
- '🏟'
- '🎡'
- '🎢'
- '🛝'
- '🎠'
- '⛲️'
- '⛱'
- '🏖'
- '🏝'
- '🏜'
- '🌋'
- '⛰'
- '🏔'
- '🗻'
- '🏕'
- '⛺️'
- '🛖'
- '🏠'
- '🏡'
- '🏘'
- '🏚'
- '🏗'
- '🏭'
- '🏢'
- '🏬'
- '🏣'
- '🏤'
- '🏥'
- '🏦'
- '🏨'
- '🏪'
- '🏫'
- '🏩'
- '💒'
- '🏛'
- '⛪️'
- '🕌'
- '🕍'
- '🛕'
- '🕋'
- '⛩'
- '🛤'
- '🛣'
- '🗾'
- '🎑'
- '🏞'
- '🌅'
- '🌄'
- '🌠'
- '🎇'
- '🎆'
- '🌇'
- '🌆'
- '🏙'
- '🌃'
- '🌌'
- '🌉'
- '🌁'
- '⌚️'
- '📱'
- '📲'
- '💻'
- '⌨️'
- '🖥'
- '🖨'
- '🖱'
- '🖲'
- '🕹'
- '🗜'
- '💽'
- '💾'
- '💿'
- '📀'
- '📼'
- '📷'
- '📸'
- '📹'
- '🎥'
- '📽'
- '🎞'
- '📞'
- '☎️'
- '📟'
- '📠'
- '📺'
- '📻'
- '🎙'
- '🎚'
- '🎛'
- '🧭'
- '⏱'
- '⏲'
- '⏰'
- '🕰'
- '⌛️'
- '⏳'
- '📡'
- '🔋'
- '🪫'
- '🔌'
- '💡'
- '🔦'
- '🕯'
- '🪔'
- '🧯'
- '🛢'
- '💸'
- '💵'
- '💴'
- '💶'
- '💷'
- '🪙'
- '💰'
- '💳'
- '💎'
- '⚖️'
- '🪜'
- '🧰'
- '🪛'
- '🔧'
- '🔨'
- '⚒'
- '🛠'
- '⛏'
- '🪚'
- '🔩'
- '⚙️'
- '🪤'
- '🧱'
- '⛓'
- '🧲'
- '🔫'
- '💣'
- '🧨'
- '🪓'
- '🔪'
- '🗡'
- '⚔️'
- '🛡'
- '🚬'
- '⚰️'
- '🪦'
- '⚱️'
- '🏺'
- '🔮'
- '📿'
- '🧿'
- '🪬'
- '💈'
- '⚗️'
- '🔭'
- '🔬'
- '🕳'
- '🩹'
- '🩺'
- '🩻'
- '🩼'
- '💊'
- '💉'
- '🩸'
- '🧬'
- '🦠'
- '🧫'
- '🧪'
- '🌡'
- '🧹'
- '🪠'
- '🧺'
- '🧻'
- '🚽'
- '🚰'
- '🚿'
- '🛁'
- '🛀'
- '🧼'
- '🪥'
- '🪒'
- '🧽'
- '🪣'
- '🧴'
- '🛎'
- '🔑'
- '🗝'
- '🚪'
- '🪑'
- '🛋'
- '🛏'
- '🛌'
- '🧸'
- '🪆'
- '🖼'
- '🪞'
- '🪟'
- '🛍'
- '🛒'
- '🎁'
- '🎈'
- '🎏'
- '🎀'
- '🪄'
- '🪅'
- '🎊'
- '🎉'
- '🪩'
- '🎎'
- '🏮'
- '🎐'
- '🧧'
- '✉️'
- '📩'
- '📨'
- '📧'
- '💌'
- '📥'
- '📤'
- '📦'
- '🏷'
- '🪧'
- '📪'
- '📫'
- '📬'
- '📭'
- '📮'
- '📯'
- '📜'
- '📃'
- '📄'
- '📑'
- '🧾'
- '📊'
- '📈'
- '📉'
- '🗒'
- '🗓'
- '📆'
- '📅'
- '🗑'
- '🪪'
- '📇'
- '🗃'
- '🗳'
- '🗄'
- '📋'
- '📁'
- '📂'
- '🗂'
- '🗞'
- '📰'
- '📓'
- '📔'
- '📒'
- '📕'
- '📗'
- '📘'
- '📙'
- '📚'
- '📖'
- '🔖'
- '🧷'
- '🔗'
- '📎'
- '🖇'
- '📐'
- '📏'
- '🧮'
- '📌'
- '📍'
- '✂️'
- '🖊'
- '🖋'
- '✒️'
- '🖌'
- '🖍'
- '📝'
- '✏️'
- '🔍'
- '🔎'
- '🔏'
- '🔐'
- '🔒'
- '🔓❤️'
- '🧡'
- '💛'
- '💚'
- '💙'
- '💜'
- '🖤'
- '🤍'
- '🤎'
- '❤️🔥'
- '❤️🩹'
- '💔'
- '❣️'
- '💕'
- '💞'
- '💓'
- '💗'
- '💖'
- '💘'
- '💝'
- '💟'
- '☮️'
- '✝️'
- '☪️'
- '🕉'
- '☸️'
- '✡️'
- '🔯'
- '🕎'
- '☯️'
- '☦️'
- '🛐'
- '⛎'
- '♈️'
- '♉️'
- '♊️'
- '♋️'
- '♌️'
- '♍️'
- '♎️'
- '♏️'
- '♐️'
- '♑️'
- '♒️'
- '♓️'
- '🆔'
- '⚛️'
- '🉑'
- '☢️'
- '☣️'
- '📴'
- '📳'
- '🈶'
- '🈚️'
- '🈸'
- '🈺'
- '🈷️'
- '✴️'
- '🆚'
- '💮'
- '🉐'
- '㊙️'
- '㊗️'
- '🈴'
- '🈵'
- '🈹'
- '🈲'
- '🅰️'
- '🅱️'
- '🆎'
- '🆑'
- '🅾️'
- '🆘'
- '❌'
- '⭕️'
- '🛑'
- '⛔️'
- '📛'
- '🚫'
- '💯'
- '💢'
- '♨️'
- '🚷'
- '🚯'
- '🚳'
- '🚱'
- '🔞'
- '📵'
- '🚭'
- '❗️'
- '❕'
- '❓'
- '❔'
- '‼️'
- '⁉️'
- '🔅'
- '🔆'
- '〽️'
- '⚠️'
- '🚸'
- '🔱'
- '⚜️'
- '🔰'
- '♻️'
- '✅'
- '🈯️'
- '💹'
- '❇️'
- '✳️'
- '❎'
- '🌐'
- '💠'
- 'Ⓜ️'
- '🌀'
- '💤'
- '🏧'
- '🚾'
- '♿️'
- '🅿️'
- '🛗'
- '🈳'
- '🈂️'
- '🛂'
- '🛃'
- '🛄'
- '🛅'
- '🚹'
- '🚺'
- '🚼'
- '⚧'
- '🚻'
- '🚮'
- '🎦'
- '📶'
- '🈁'
- '🔣'
- 'ℹ️'
- '🔤'
- '🔡'
- '🔠'
- '🆖'
- '🆗'
- '🆙'
- '🆒'
- '🆕'
- '🆓'
- '0️⃣'
- '1️⃣'
- '2️⃣'
- '3️⃣'
- '4️⃣'
- '5️⃣'
- '6️⃣'
- '7️⃣'
- '8️⃣'
- '9️⃣'
- '🔟'
- '🔢'
- '#️⃣'
- '*️⃣'
- '⏏️'
- '▶️'
- '⏸'
- '⏯'
- '⏹'
- '⏺'
- '⏭'
- '⏮'
- '⏩'
- '⏪'
- '⏫'
- '⏬'
- '◀️'
- '🔼'
- '🔽'
- '➡️'
- '⬅️'
- '⬆️'
- '⬇️'
- '↗️'
- '↘️'
- '↙️'
- '↖️'
- '↕️'
- '↔️'
- '↪️'
- '↩️'
- '⤴️'
- '⤵️'
- '🔀'
- '🔁'
- '🔂'
- '🔄'
- '🔃'
- '🎵'
- '🎶'
- '➕'
- '➖'
- '➗'
- '✖️'
- '🟰'
- '♾'
- '💲'
- '💱'
- '™️'
- '©️'
- '®️'
- '〰️'
- '➰'
- '➿'
- '🔚'
- '🔙'
- '🔛'
- '🔝'
- '🔜'
- '✔️'
- '☑️'
- '🔘'
- '🔴'
- '🟠'
- '🟡'
- '🟢'
- '🔵'
- '🟣'
- '⚫️'
- '⚪️'
- '🟤'
- '🔺'
- '🔻'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains:
- '🦆'
- '🦅'
- '🦉'
- '🦇'
- '🐺'
- '🐗'
- '🐴'
- '🦄'
- '🐝'
- '🪱'
- '🐛'
- '🦋'
- '🐌'
- '🐞'
- '🐜'
- '🪰'
- '🪲'
- '🪳'
- '🦟'
- '🦗'
- '🕷'
- '🕸'
- '🦂'
- '🐢'
- '🐍'
- '🦎'
- '🦖'
- '🦕'
- '🐙'
- '🦑'
- '🦐'
- '🦞'
- '🦀'
- '🪸'
- '🐡'
- '🐠'
- '🐟'
- '🐬'
- '🐳'
- '🐋'
- '🦈'
- '🐊'
- '🐅'
- '🐆'
- '🦓'
- '🦍'
- '🦧'
- '🦣'
- '🐘'
- '🦛'
- '🦏'
- '🐪'
- '🐫'
- '🦒'
- '🦘'
- '🦬'
- '🐃'
- '🐂'
- '🐄'
- '🐎'
- '🐖'
- '🐏'
- '🐑'
- '🦙'
- '🐐'
- '🦌'
- '🐕'
- '🐩'
- '🦮'
- '🐕🦺'
- '🐈'
- '🐈⬛'
- '🪶'
- '🐓'
- '🦃'
- '🦤'
- '🦚'
- '🦜'
- '🦢'
- '🦩'
- '🕊'
- '🐇'
- '🦝'
- '🦨'
- '🦡'
- '🦫'
- '🦦'
- '🦥'
- '🐁'
- '🐀'
- '🐿'
- '🦔'
- '🐾'
- '🐉'
- '🐲'
- '🌵'
- '🎄'
- '🌲'
- '🌳'
- '🌴'
- '🪹'
- '🪺'
- '🪵'
- '🌱'
- '🌿'
- '☘️'
- '🍀'
- '🎍'
- '🪴'
- '🎋'
- '🍃'
- '🍂'
- '🍁'
- '🍄'
- '🐚'
- '🪨'
- '🌾'
- '💐'
- '🌷'
- '🪷'
- '🌹'
- '🥀'
- '🌺'
- '🌸'
- '🌼'
- '🌻'
- '🌞'
- '🌝'
- '🌛'
- '🌜'
- '🌚'
- '🌕'
- '🌖'
- '🌗'
- '🌘'
- '🌑'
- '🌒'
- '🌓'
- '🌔'
- '🌙'
- '🌎'
- '🌍'
- '🌏'
- '🪐'
- '💫'
- '⭐️'
- '🌟'
- '✨'
- '⚡️'
- '☄️'
- '💥'
- '🔥'
- '🌪'
- '🌈'
- '☀️'
- '🌤'
- '⛅️'
- '🌥'
- '☁️'
- '🌦'
- '🌧'
- '⛈'
- '🌩'
- '🌨'
- '❄️'
- '☃️'
- '⛄️'
- '🌬'
- '💨'
- '💧'
- '💦'
- '🫧'
- '☔️'
- '☂️'
- '🌊'
- '🌫🍏'
- '🍎'
- '🍐'
- '🍊'
- '🍋'
- '🍌'
- '🍉'
- '🍇'
- '🍓'
- '🫐'
- '🍈'
- '🍒'
- '🍑'
- '🥭'
- '🍍'
- '🥥'
- '🥝'
- '🍅'
- '🍆'
- '🥑'
- '🥦'
- '🥬'
- '🥒'
- '🌶'
- '🫑'
- '🌽'
- '🥕'
- '🫒'
- '🧄'
- '🧅'
- '🥔'
- '🍠'
- '🫘'
- '🥐'
- '🥯'
- '🍞'
- '🥖'
- '🥨'
- '🧀'
- '🥚'
- '🍳'
- '🧈'
- '🥞'
- '🧇'
- '🥓'
- '🥩'
- '🍗'
- '🍖'
- '🦴'
- '🌭'
- '🍔'
- '🍟'
- '🍕'
- '🫓'
- '🥪'
- '🥙'
- '🧆'
- '🌮'
- '🌯'
- '🫔'
- '🥗'
- '🥘'
- '🫕'
- '🥫'
- '🍝'
- '🍜'
- '🍲'
- '🍛'
- '🍣'
- '🍱'
- '🥟'
- '🦪'
- '🍤'
- '🍙'
- '🍚'
- '🍘'
- '🍥'
- '🥠'
- '🥮'
- '🍢'
- '🍡'
- '🍧'
- '🍨'
- '🍦'
- '🥧'
- '🧁'
- '🍰'
- '🎂'
- '🍮'
- '🍭'
- '🍬'
- '🍫'
- '🍿'
- '🍩'
- '🍪'
- '🌰'
- '🥜'
- '🍯'
- '🥛'
- '🍼'
- '🫖'
- '☕️'
- '🍵'
- '🧃'
- '🥤'
- '🧋'
- '🫙'
- '🍶'
- '🍺'
- '🍻'
- '🥂'
- '🍷'
- '🫗'
- '🥃'
- '🍸'
- '🍹'
- '🧉'
- '🍾'
- '🧊'
- '🥄'
- '🍴'
- '🍽'
- '🥣'
- '🥡'
- '🥢'
- '🧂'
- '⚽️'
- '🏀'
- '🏈'
- '⚾️'
- '🥎'
- '🎾'
- '🏐'
- '🏉'
- '🥏'
- '🎱'
- '🪀'
- '🏓'
- '🏸'
- '🏒'
- '🏑'
- '🥍'
- '🏏'
- '🪃'
- '🥅'
- '⛳️'
- '🪁'
- '🏹'
- '🎣'
- '🤿'
- '🥊'
- '🥋'
- '🎽'
- '🛹'
- '🛼'
- '🛷'
- '⛸'
- '🥌'
- '🎿'
- '⛷'
- '🏂'
- '🪂'
- '🏋️♀️'
- '🏋️'
- '🏋️♂️'
- '🤼♀️'
- '🤼'
- '🤼♂️'
- '🤸♀️'
- '🤸'
- '🤸♂️'
- '⛹️♀️'
- '⛹️'
- '⛹️♂️'
- '🤺'
- '🤾♀️'
- '🤾'
- '🤾♂️'
- '🏌️♀️'
- '🏌️'
- '🏌️♂️'
- '🏇'
- '🧘♀️'
- '🧘'
- '🧘♂️'
- '🏄♀️'
- '🏄'
- '🏄♂️'
- '🏊♀️'
- '🏊'
- '🏊♂️'
- '🤽♀️'
- '🤽'
- '🤽♂️'
- '🚣♀️'
- '🚣'
- '🚣♂️'
- '🧗♀️'
- '🧗'
- '🧗♂️'
- '🚵♀️'
- '🚵'
- '🚵♂️'
- '🚴♀️'
- '🚴'
- '🚴♂️'
- '🏆'
- '🥇'
- '🥈'
- '🥉'
- '🏅'
- '🎖'
- '🏵'
- '🎗'
- '🎫'
- '🎟'
- '🎪'
- '🤹'
- '🤹♂️'
- '🤹♀️'
- '🎭'
- '🩰'
- '🎨'
- '🎬'
- '🎤'
- '🎧'
- '🎼'
- '🎹'
- '🥁'
- '🪘'
- '🎷'
- '🎺'
- '🪗'
- '🎸'
- '🪕'
- '🎻'
- '🎲'
- '♟'
- '🎯'
- '🎳'
- '🎮'
- '🎰'
- '🧩'
- '🚗'
- '🚕'
- '🚙'
- '🚌'
- '🚎'
- '🏎'
- '🚓'
- '🚑'
- '🚒'
- '🚐'
- '🛻'
- '🚚'
- '🚛'
- '🚜'
- '🦯'
- '🦽'
- '🦼'
- '🛴'
- '🚲'
- '🛵'
- '🏍'
- '🛺'
- '🚨'
- '🚔'
- '🚍'
- '🚘'
- '🚖'
- '🛞'
- '🚡'
- '🚠'
- '🚟'
- '🚃'
- '🚋'
- '🚞'
- '🚝'
- '🚄'
- '🚅'
- '🚈'
- '🚂'
- '🚆'
- '🚇'
- '🚊'
- '🚉'
- '✈️'
- '🛫'
- '🛬'
- '🛩'
- '💺'
- '🛰'
- '🚀'
- '🛸'
- '🚁'
- '🛶'
- '⛵️'
- '🚤'
- '🛥'
- '🛳'
- '⛴'
- '🚢'
- '⚓️'
- '🛟'
- '🪝'
- '⛽️'
- '🚧'
- '🚦'
- '🚥'
- '🚏'
- '🗺'
- '🗿'
- '🗽'
- '🗼'
- '🏰'
- '🏯'
- '🏟'
- '🎡'
- '🎢'
- '🛝'
- '🎠'
- '⛲️'
- '⛱'
- '🏖'
- '🏝'
- '🏜'
- '🌋'
- '⛰'
- '🏔'
- '🗻'
- '🏕'
- '⛺️'
- '🛖'
- '🏠'
- '🏡'
- '🏘'
- '🏚'
- '🏗'
- '🏭'
- '🏢'
- '🏬'
- '🏣'
- '🏤'
- '🏥'
- '🏦'
- '🏨'
- '🏪'
- '🏫'
- '🏩'
- '💒'
- '🏛'
- '⛪️'
- '🕌'
- '🕍'
- '🛕'
- '🕋'
- '⛩'
- '🛤'
- '🛣'
- '🗾'
- '🎑'
- '🏞'
- '🌅'
- '🌄'
- '🌠'
- '🎇'
- '🎆'
- '🌇'
- '🌆'
- '🏙'
- '🌃'
- '🌌'
- '🌉'
- '🌁'
- '⌚️'
- '📱'
- '📲'
- '💻'
- '⌨️'
- '🖥'
- '🖨'
- '🖱'
- '🖲'
- '🕹'
- '🗜'
- '💽'
- '💾'
- '💿'
- '📀'
- '📼'
- '📷'
- '📸'
- '📹'
- '🎥'
- '📽'
- '🎞'
- '📞'
- '☎️'
- '📟'
- '📠'
- '📺'
- '📻'
- '🎙'
- '🎚'
- '🎛'
- '🧭'
- '⏱'
- '⏲'
- '⏰'
- '🕰'
- '⌛️'
- '⏳'
- '📡'
- '🔋'
- '🪫'
- '🔌'
- '💡'
- '🔦'
- '🕯'
- '🪔'
- '🧯'
- '🛢'
- '💸'
- '💵'
- '💴'
- '💶'
- '💷'
- '🪙'
- '💰'
- '💳'
- '💎'
- '⚖️'
- '🪜'
- '🧰'
- '🪛'
- '🔧'
- '🔨'
- '⚒'
- '🛠'
- '⛏'
- '🪚'
- '🔩'
- '⚙️'
- '🪤'
- '🧱'
- '⛓'
- '🧲'
- '🔫'
- '💣'
- '🧨'
- '🪓'
- '🔪'
- '🗡'
- '⚔️'
- '🛡'
- '🚬'
- '⚰️'
- '🪦'
- '⚱️'
- '🏺'
- '🔮'
- '📿'
- '🧿'
- '🪬'
- '💈'
- '⚗️'
- '🔭'
- '🔬'
- '🕳'
- '🩹'
- '🩺'
- '🩻'
- '🩼'
- '💊'
- '💉'
- '🩸'
- '🧬'
- '🦠'
- '🧫'
- '🧪'
- '🌡'
- '🧹'
- '🪠'
- '🧺'
- '🧻'
- '🚽'
- '🚰'
- '🚿'
- '🛁'
- '🛀'
- '🧼'
- '🪥'
- '🪒'
- '🧽'
- '🪣'
- '🧴'
- '🛎'
- '🔑'
- '🗝'
- '🚪'
- '🪑'
- '🛋'
- '🛏'
- '🛌'
- '🧸'
- '🪆'
- '🖼'
- '🪞'
- '🪟'
- '🛍'
- '🛒'
- '🎁'
- '🎈'
- '🎏'
- '🎀'
- '🪄'
- '🪅'
- '🎊'
- '🎉'
- '🪩'
- '🎎'
- '🏮'
- '🎐'
- '🧧'
- '✉️'
- '📩'
- '📨'
- '📧'
- '💌'
- '📥'
- '📤'
- '📦'
- '🏷'
- '🪧'
- '📪'
- '📫'
- '📬'
- '📭'
- '📮'
- '📯'
- '📜'
- '📃'
- '📄'
- '📑'
- '🧾'
- '📊'
- '📈'
- '📉'
- '🗒'
- '🗓'
- '📆'
- '📅'
- '🗑'
- '🪪'
- '📇'
- '🗃'
- '🗳'
- '🗄'
- '📋'
- '📁'
- '📂'
- '🗂'
- '🗞'
- '📰'
- '📓'
- '📔'
- '📒'
- '📕'
- '📗'
- '📘'
- '📙'
- '📚'
- '📖'
- '🔖'
- '🧷'
- '🔗'
- '📎'
- '🖇'
- '📐'
- '📏'
- '🧮'
- '📌'
- '📍'
- '✂️'
- '🖊'
- '🖋'
- '✒️'
- '🖌'
- '🖍'
- '📝'
- '✏️'
- '🔍'
- '🔎'
- '🔏'
- '🔐'
- '🔒'
- '🔓❤️'
- '🧡'
- '💛'
- '💚'
- '💙'
- '💜'
- '🖤'
- '🤍'
- '🤎'
- '❤️🔥'
- '❤️🩹'
- '💔'
- '❣️'
- '💕'
- '💞'
- '💓'
- '💗'
- '💖'
- '💘'
- '💝'
- '💟'
- '☮️'
- '✝️'
- '☪️'
- '🕉'
- '☸️'
- '✡️'
- '🔯'
- '🕎'
- '☯️'
- '☦️'
- '🛐'
- '⛎'
- '♈️'
- '♉️'
- '♊️'
- '♋️'
- '♌️'
- '♍️'
- '♎️'
- '♏️'
- '♐️'
- '♑️'
- '♒️'
- '♓️'
- '🆔'
- '⚛️'
- '🉑'
- '☢️'
- '☣️'
- '📴'
- '📳'
- '🈶'
- '🈚️'
- '🈸'
- '🈺'
- '🈷️'
- '✴️'
- '🆚'
- '💮'
- '🉐'
- '㊙️'
- '㊗️'
- '🈴'
- '🈵'
- '🈹'
- '🈲'
- '🅰️'
- '🅱️'
- '🆎'
- '🆑'
- '🅾️'
- '🆘'
- '❌'
- '⭕️'
- '🛑'
- '⛔️'
- '📛'
- '🚫'
- '💯'
- '💢'
- '♨️'
- '🚷'
- '🚯'
- '🚳'
- '🚱'
- '🔞'
- '📵'
- '🚭'
- '❗️'
- '❕'
- '❓'
- '❔'
- '‼️'
- '⁉️'
- '🔅'
- '🔆'
- '〽️'
- '⚠️'
- '🚸'
- '🔱'
- '⚜️'
- '🔰'
- '♻️'
- '✅'
- '🈯️'
- '💹'
- '❇️'
- '✳️'
- '❎'
- '🌐'
- '💠'
- 'Ⓜ️'
- '🌀'
- '💤'
- '🏧'
- '🚾'
- '♿️'
- '🅿️'
- '🛗'
- '🈳'
- '🈂️'
- '🛂'
- '🛃'
- '🛄'
- '🛅'
- '🚹'
- '🚺'
- '🚼'
- '⚧'
- '🚻'
- '🚮'
- '🎦'
- '📶'
- '🈁'
- '🔣'
- 'ℹ️'
- '🔤'
- '🔡'
- '🔠'
- '🆖'
- '🆗'
- '🆙'
- '🆒'
- '🆕'
- '🆓'
- '0️⃣'
- '1️⃣'
- '2️⃣'
- '3️⃣'
- '4️⃣'
- '5️⃣'
- '6️⃣'
- '7️⃣'
- '8️⃣'
- '9️⃣'
- '🔟'
- '🔢'
- '#️⃣'
- '*️⃣'
- '⏏️'
- '▶️'
- '⏸'
- '⏯'
- '⏹'
- '⏺'
- '⏭'
- '⏮'
- '⏩'
- '⏪'
- '⏫'
- '⏬'
- '◀️'
- '🔼'
- '🔽'
- '➡️'
- '⬅️'
- '⬆️'
- '⬇️'
- '↗️'
- '↘️'
- '↙️'
- '↖️'
- '↕️'
- '↔️'
- '↪️'
- '↩️'
- '⤴️'
- '⤵️'
- '🔀'
- '🔁'
- '🔂'
- '🔄'
- '🔃'
- '🎵'
- '🎶'
- '➕'
- '➖'
- '➗'
- '✖️'
- '🟰'
- '♾'
- '💲'
- '💱'
- '™️'
- '©️'
- '®️'
- '〰️'
- '➰'
- '➿'
- '🔚'
- '🔙'
- '🔛'
- '🔝'
- '🔜'
- '✔️'
- '☑️'
- '🔘'
- '🔴'
- '🟠'
- '🟡'
- '🟢'
- '🔵'
- '🟣'
- '⚫️'
- '⚪️'
- '🟤'
- '🔺'
- '🔻'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Potential DLL Sideloading Of MpSvc.DLL
#Detects potential DLL sideloading of "MpSvc.dll".
Known False Positives
- Legitimate applications loading their own versions of the DLL mentioned in this rule.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 7: Image loaded |
Rule Body
title: Potential DLL Sideloading Of MpSvc.DLL
id: 5ba243e5-8165-4cf7-8c69-e1d3669654c1
status: test
description: Detects potential DLL sideloading of "MpSvc.dll".
references:
- https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema
date: 2024-07-11
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
product: windows
category: image_load
detection:
selection:
ImageLoaded|endswith: '\MpSvc.dll'
filter_main_generic:
ImageLoaded|startswith:
- 'C:\Program Files\Windows Defender\'
- 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
- 'C:\Windows\WinSxS\'
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate applications loading their own versions of the DLL mentioned in this rule.
level: medium
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
ImageLoaded|endswith: '\MpSvc.dll'
Stage 2: not filter_main_generic
filter_main_generic:
ImageLoaded|startswith:
- 'C:\Program Files\Windows Defender\'
- 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
- 'C:\Windows\WinSxS\'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ImageLoaded | ends_with |
| field:"ImageLoaded" kind:ends_with value:"\MpSvc.dll" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
ImageLoaded | starts_with | C:\Program Files\Windows Defender\ | excludes:ImageLoaded field:"ImageLoaded" value:"C:\Program Files\Windows Defender\" |
ImageLoaded | starts_with | C:\ProgramData\Microsoft\Windows Defender\Platform\ | excludes:ImageLoaded field:"ImageLoaded" value:"C:\ProgramData\Microsoft\Windows Defender\Platform\" |
ImageLoaded | starts_with | C:\Windows\WinSxS\ | excludes:ImageLoaded field:"ImageLoaded" value:"C:\Windows\WinSxS\" |
Potential Mftrace.EXE Abuse
#Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Known False Positives
- Legitimate use for tracing purposes
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential Mftrace.EXE Abuse
id: 3d48c9d3-1aa6-418d-98d3-8fd3c01a564e
status: test
description: Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
references:
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-09
modified: 2023-08-03
tags:
- attack.execution
- attack.stealth
- attack.t1127
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\mftrace.exe'
condition: selection
falsepositives:
- Legitimate use for tracing purposes
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
ParentImage|endswith: '\mftrace.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\mftrace.exe" |
Potential SMB Relay Attack Tool Execution
#Detects different hacktools used for relay attacks on Windows for privilege escalation
Known False Positives
- Legitimate files with these rare hacktool names
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access | |
| Collection |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Potential SMB Relay Attack Tool Execution
id: 5589ab4f-a767-433c-961d-c91f3f704db1
status: test
description: Detects different hacktools used for relay attacks on Windows for privilege escalation
references:
- https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
- https://pentestlab.blog/2017/04/13/hot-potato/
- https://github.com/ohpe/juicy-potato
- https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
- https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
- https://www.localpotato.com/
author: Florian Roth (Nextron Systems)
date: 2021-07-24
modified: 2023-02-14
tags:
- attack.collection
- attack.execution
- attack.credential-access
- attack.t1557.001
logsource:
category: process_creation
product: windows
detection:
selection_pe:
Image|contains:
- 'PetitPotam'
- 'RottenPotato'
- 'HotPotato'
- 'JuicyPotato'
- '\just_dce_'
- 'Juicy Potato'
- '\temp\rot.exe'
- '\Potato.exe'
- '\SpoolSample.exe'
- '\Responder.exe'
- '\smbrelayx'
- '\ntlmrelayx'
- '\LocalPotato'
selection_script:
CommandLine|contains:
- 'Invoke-Tater'
- ' smbrelay'
- ' ntlmrelay'
- 'cme smb '
- ' /ntlm:NTLMhash '
- 'Invoke-PetitPotam'
- '.exe -t * -p ' # JuicyPotatoNG pattern https://github.com/antonioCoco/JuicyPotatoNG
selection_juicypotato_enum: # appears when JuicyPotatoNG is used with -b
CommandLine|contains: '.exe -c "{'
CommandLine|endswith: '}" -z'
filter_hotpotatoes: # known goodware https://hotpot.uvic.ca/
Image|contains:
- 'HotPotatoes6'
- 'HotPotatoes7'
- 'HotPotatoes ' # Covers the following: 'HotPotatoes 6', 'HotPotatoes 7', 'HotPotatoes Help', 'HotPotatoes Tutorial'
condition: 1 of selection_* and not 1 of filter_*
falsepositives:
- Legitimate files with these rare hacktool names
level: critical
Stages and Predicates
Stage 0: condition
1 of selection_* and not 1 of filter_*Stage 1: selection_pe
selection_pe:
Image|contains:
- 'PetitPotam'
- 'RottenPotato'
- 'HotPotato'
- 'JuicyPotato'
- '\just_dce_'
- 'Juicy Potato'
- '\temp\rot.exe'
- '\Potato.exe'
- '\SpoolSample.exe'
- '\Responder.exe'
- '\smbrelayx'
- '\ntlmrelayx'
- '\LocalPotato'
Stage 2: selection_script
selection_script:
CommandLine|contains:
- 'Invoke-Tater'
- ' smbrelay'
- ' ntlmrelay'
- 'cme smb '
- ' /ntlm:NTLMhash '
- 'Invoke-PetitPotam'
- '.exe -t * -p '
Stage 3: selection_juicypotato_enum
selection_juicypotato_enum:
CommandLine|contains: '.exe -c "{'
CommandLine|endswith: '}" -z'
Stage 4: not filter_hotpotatoes
filter_hotpotatoes:
Image|contains:
- 'HotPotatoes6'
- 'HotPotatoes7'
- 'HotPotatoes '
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | ends_with |
| field:"CommandLine" kind:ends_with |
CommandLine | match |
| field:"CommandLine" kind:match |
Image | match |
| field:"Image" kind:match |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | match | HotPotatoes | excludes:Image field:"Image" value:"HotPotatoes " |
Image | match | HotPotatoes6 | excludes:Image field:"Image" value:"HotPotatoes6" |
Image | match | HotPotatoes7 | excludes:Image field:"Image" value:"HotPotatoes7" |
Powershell Defender Disable Scan Feature
#Detects requests to disable Microsoft Defender features using PowerShell commands
Known False Positives
- Possible administrative activity
- Other Cmdlets that may use the same parameters
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Powershell Defender Disable Scan Feature
id: 1ec65a5f-9473-4f12-97da-622044d6df21
status: test
description: Detects requests to disable Microsoft Defender features using PowerShell commands
references:
- https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
- https://www.virustotal.com/gui/file/d609799091731d83d75ec5d1f030571af20c45efeeb94840b67ea09a3283ab65/behavior/C2AE
- https://www.virustotal.com/gui/search/content%253A%2522Set-MpPreference%2520-Disable%2522/files
author: Florian Roth (Nextron Systems)
date: 2022-03-03
modified: 2024-01-02
tags:
- attack.defense-impairment
- attack.t1685
logsource:
category: process_creation
product: windows
detection:
selection_cli_cmdlet:
CommandLine|contains:
- 'Add-MpPreference '
- 'Set-MpPreference '
selection_cli_option:
CommandLine|contains:
- 'DisableArchiveScanning '
- 'DisableRealtimeMonitoring '
- 'DisableIOAVProtection '
- 'DisableBehaviorMonitoring '
- 'DisableBlockAtFirstSeen '
- 'DisableCatchupFullScan '
- 'DisableCatchupQuickScan '
selection_cli_value:
CommandLine|contains:
- '$true'
- ' 1 '
selection_encoded_modifier:
CommandLine|base64offset|contains:
# Note: Since this is calculating offsets casing is important
- 'disablearchivescanning '
- 'DisableArchiveScanning '
- 'disablebehaviormonitoring '
- 'DisableBehaviorMonitoring '
- 'disableblockatfirstseen '
- 'DisableBlockAtFirstSeen '
- 'disablecatchupfullscan '
- 'DisableCatchupFullScan '
- 'disablecatchupquickscan '
- 'DisableCatchupQuickScan '
- 'disableioavprotection '
- 'DisableIOAVProtection '
- 'disablerealtimemonitoring '
- 'DisableRealtimeMonitoring '
selection_encoded_direct:
CommandLine|contains:
- 'RABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'EAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'RABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIA'
- 'QAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0AGUAYwB0AGkAbwBuACAA'
- 'EAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgA'
- 'RABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'EAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'RABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAA'
- 'QAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgA'
- 'EAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIA'
- 'ZABpAHMAYQBiAGwAZQByAGUAYQBsAHQAaQBtAGUAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAcgBlAGEAbAB0AGkAbQBlAG0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'kAGkAcwBhAGIAbABlAHIAZQBhAGwAdABpAG0AZQBtAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'ZABpAHMAYQBiAGwAZQBpAG8AYQB2AHAAcgBvAHQAZQBjAHQAaQBvAG4AIA'
- 'QAaQBzAGEAYgBsAGUAaQBvAGEAdgBwAHIAbwB0AGUAYwB0AGkAbwBuACAA'
- 'kAGkAcwBhAGIAbABlAGkAbwBhAHYAcAByAG8AdABlAGMAdABpAG8AbgAgA'
- 'ZABpAHMAYQBiAGwAZQBiAGUAaABhAHYAaQBvAHIAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAYgBlAGgAYQB2AGkAbwByAG0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'kAGkAcwBhAGIAbABlAGIAZQBoAGEAdgBpAG8AcgBtAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'ZABpAHMAYQBiAGwAZQBiAGwAbwBjAGsAYQB0AGYAaQByAHMAdABzAGUAZQBuACAA'
- 'QAaQBzAGEAYgBsAGUAYgBsAG8AYwBrAGEAdABmAGkAcgBzAHQAcwBlAGUAbgAgA'
- 'kAGkAcwBhAGIAbABlAGIAbABvAGMAawBhAHQAZgBpAHIAcwB0AHMAZQBlAG4AIA'
- 'RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAEYAdQBsAGwAUwBjAGEAbgA'
- 'RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAFEAdQBpAGMAawBTAGMAYQBuAA'
- 'RABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwA'
condition: all of selection_cli_* or 1 of selection_encoded_*
falsepositives:
- Possible administrative activity
- Other Cmdlets that may use the same parameters
level: high
Stages and Predicates
Stage 0: condition
all of selection_cli_* or 1 of selection_encoded_*Stage 1: selection_cli_cmdlet
selection_cli_cmdlet:
CommandLine|contains:
- 'Add-MpPreference '
- 'Set-MpPreference '
Stage 2: selection_cli_option
selection_cli_option:
CommandLine|contains:
- 'DisableArchiveScanning '
- 'DisableRealtimeMonitoring '
- 'DisableIOAVProtection '
- 'DisableBehaviorMonitoring '
- 'DisableBlockAtFirstSeen '
- 'DisableCatchupFullScan '
- 'DisableCatchupQuickScan '
Stage 3: selection_cli_value
selection_cli_value:
CommandLine|contains:
- '$true'
- ' 1 '
Stage 4: selection_encoded_modifier
selection_encoded_modifier:
CommandLine|base64offset|contains:
- 'disablearchivescanning '
- 'DisableArchiveScanning '
- 'disablebehaviormonitoring '
- 'DisableBehaviorMonitoring '
- 'disableblockatfirstseen '
- 'DisableBlockAtFirstSeen '
- 'disablecatchupfullscan '
- 'DisableCatchupFullScan '
- 'disablecatchupquickscan '
- 'DisableCatchupQuickScan '
- 'disableioavprotection '
- 'DisableIOAVProtection '
- 'disablerealtimemonitoring '
- 'DisableRealtimeMonitoring '
Stage 5: selection_encoded_direct
selection_encoded_direct:
CommandLine|contains:
- 'RABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'EAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'RABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIA'
- 'QAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0AGUAYwB0AGkAbwBuACAA'
- 'EAGkAcwBhAGIAbABlAEkATwBBAFYAUAByAG8AdABlAGMAdABpAG8AbgAgA'
- 'RABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'EAGkAcwBhAGIAbABlAEIAZQBoAGEAdgBpAG8AcgBNAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'RABpAHMAYQBiAGwAZQBCAGwAbwBjAGsAQQB0AEYAaQByAHMAdABTAGUAZQBuACAA'
- 'QAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgAgA'
- 'EAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIA'
- 'ZABpAHMAYQBiAGwAZQByAGUAYQBsAHQAaQBtAGUAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAcgBlAGEAbAB0AGkAbQBlAG0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'kAGkAcwBhAGIAbABlAHIAZQBhAGwAdABpAG0AZQBtAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'ZABpAHMAYQBiAGwAZQBpAG8AYQB2AHAAcgBvAHQAZQBjAHQAaQBvAG4AIA'
- 'QAaQBzAGEAYgBsAGUAaQBvAGEAdgBwAHIAbwB0AGUAYwB0AGkAbwBuACAA'
- 'kAGkAcwBhAGIAbABlAGkAbwBhAHYAcAByAG8AdABlAGMAdABpAG8AbgAgA'
- 'ZABpAHMAYQBiAGwAZQBiAGUAaABhAHYAaQBvAHIAbQBvAG4AaQB0AG8AcgBpAG4AZwAgA'
- 'QAaQBzAGEAYgBsAGUAYgBlAGgAYQB2AGkAbwByAG0AbwBuAGkAdABvAHIAaQBuAGcAIA'
- 'kAGkAcwBhAGIAbABlAGIAZQBoAGEAdgBpAG8AcgBtAG8AbgBpAHQAbwByAGkAbgBnACAA'
- 'ZABpAHMAYQBiAGwAZQBiAGwAbwBjAGsAYQB0AGYAaQByAHMAdABzAGUAZQBuACAA'
- 'QAaQBzAGEAYgBsAGUAYgBsAG8AYwBrAGEAdABmAGkAcgBzAHQAcwBlAGUAbgAgA'
- 'kAGkAcwBhAGIAbABlAGIAbABvAGMAawBhAHQAZgBpAHIAcwB0AHMAZQBlAG4AIA'
- 'RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAEYAdQBsAGwAUwBjAGEAbgA'
- 'RABpAHMAYQBiAGwAZQBDAGEAdABjAGgAdQBwAFEAdQBpAGMAawBTAGMAYQBuAA'
- 'RABpAHMAYQBiAGwAZQBBAHIAYwBoAGkAdgBlAFMAYwBhAG4AbgBpAG4AZwA'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
PUA - WebBrowserPassView Execution
#Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
Known False Positives
- Legitimate use
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: PUA - WebBrowserPassView Execution
id: d0dae994-26c6-4d2d-83b5-b3c8b79ae513
status: test
description: Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera
references:
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1555.003/T1555.003.md
author: frack113
date: 2022-08-20
modified: 2023-02-14
tags:
- attack.credential-access
- attack.t1555.003
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: 'Web Browser Password Viewer'
- Image|endswith: '\WebBrowserPassView.exe'
condition: selection
falsepositives:
- Legitimate use
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
- Description: 'Web Browser Password Viewer'
- Image|endswith: '\WebBrowserPassView.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Description | eq |
| field:"Description" kind:eq value:"Web Browser Password Viewer" |
Image | ends_with |
| field:"Image" kind:ends_with value:"\WebBrowserPassView.exe" |
Remote Access Tool - Potential MeshAgent Execution - Windows
#Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
Known False Positives
- Environments that legitimately use MeshAgent
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule Body
title: Remote Access Tool - Potential MeshAgent Execution - Windows
id: 2fbbe9ff-0afc-470b-bdc0-592198339968
related:
- id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9
type: similar
status: experimental
description: |
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.
references:
- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
- https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
- https://www.security.com/threat-intelligence/medusa-ransomware-attacks
author: Norbert Jaśniewicz (AlphaSOC)
date: 2025-05-19
tags:
- attack.command-and-control
- attack.t1219.002
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: '--meshServiceName'
condition: selection
falsepositives:
- Environments that legitimately use MeshAgent
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
CommandLine|contains: '--meshServiceName'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match value:"--meshServiceName" |
Renamed PAExec Execution
#Detects execution of renamed version of PAExec. Often used by attackers
Known False Positives
- Weird admins that rename their tools
- Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing
- When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]"
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Renamed PAExec Execution
id: c4e49831-1496-40cf-8ce1-b53f942b02f9
related:
- id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b
type: obsolete
status: test
description: Detects execution of renamed version of PAExec. Often used by attackers
references:
- https://www.poweradmin.com/paexec/
- https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf
author: Florian Roth (Nextron Systems), Jason Lynch
date: 2021-05-22
modified: 2024-11-23
tags:
- attack.stealth
- attack.t1202
logsource:
category: process_creation
product: windows
detection:
selection:
- Description: 'PAExec Application'
- OriginalFileName: 'PAExec.exe'
- Product|contains: 'PAExec'
- Hashes|contains:
- IMPHASH=11D40A7B7876288F919AB819CC2D9802
- IMPHASH=6444f8a34e99b8f7d9647de66aabe516
- IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f
- IMPHASH=1a6cca4d5460b1710a12dea39e4a592c
filter_main_known_location:
- Image|endswith: '\paexec.exe'
- Image|startswith: 'C:\Windows\PAExec-'
condition: selection and not 1 of filter_main_*
falsepositives:
- Weird admins that rename their tools
- Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing
- When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]"
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
- Description: 'PAExec Application'
- OriginalFileName: 'PAExec.exe'
- Product|contains: 'PAExec'
- Hashes|contains:
- IMPHASH=11D40A7B7876288F919AB819CC2D9802
- IMPHASH=6444f8a34e99b8f7d9647de66aabe516
- IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f
- IMPHASH=1a6cca4d5460b1710a12dea39e4a592c
Stage 2: not filter_main_known_location
filter_main_known_location:
- Image|endswith: '\paexec.exe'
- Image|startswith: 'C:\Windows\PAExec-'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Description | eq |
| field:"Description" kind:eq value:"PAExec Application" |
Hashes | match |
| field:"Hashes" kind:match |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"PAExec.exe" |
Product | match |
| field:"Product" kind:match value:"PAExec" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
Image | ends_with | \paexec.exe | excludes:Image field:"Image" value:"\paexec.exe" |
Image | starts_with | C:\Windows\PAExec- | excludes:Image field:"Image" value:"C:\Windows\PAExec-" |
SAM Registry Hive Handle Request
#Detects handles requested to SAM registry hive
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access | |
| Discovery |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4656: A handle to an object was requested. |
Rule Body
title: SAM Registry Hive Handle Request
id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332
status: test
description: Detects handles requested to SAM registry hive
references:
- https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
author: Roberto Rodriguez @Cyb3rWard0g
date: 2019-08-12
modified: 2021-11-27
tags:
- attack.discovery
- attack.t1012
- attack.credential-access
- attack.t1552.002
logsource:
product: windows
service: security
detection:
selection:
EventID: 4656
ObjectType: 'Key'
ObjectName|endswith: '\SAM'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4656
ObjectType: 'Key'
ObjectName|endswith: '\SAM'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ObjectName | ends_with |
| field:"ObjectName" kind:ends_with value:"\SAM" |
ObjectType | eq |
| field:"ObjectType" kind:eq value:"Key" |
Silence.EDA Detection
#Detects Silence EmpireDNSAgent as described in the Group-IP report
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Command & Control | |
| Impact |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule Body
title: Silence.EDA Detection
id: 3ceb2083-a27f-449a-be33-14ec1b7cc973
status: test
description: Detects Silence EmpireDNSAgent as described in the Group-IP report
references:
- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
author: Alina Stepchenkova, Group-IB, oscd.community
date: 2019-11-01
modified: 2023-04-03
tags:
- attack.execution
- attack.t1059.001
- attack.command-and-control
- attack.t1071.004
- attack.t1572
- attack.impact
- attack.t1529
- attack.g0091
- attack.s0363
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
empire:
# better to randomise the order
ScriptBlockText|contains|all:
- 'System.Diagnostics.Process'
- 'Stop-Computer'
- 'Restart-Computer'
- 'Exception in execution'
- '$cmdargs'
- 'Close-Dnscat2Tunnel'
dnscat:
# better to randomise the order
ScriptBlockText|contains|all:
- 'set type=$LookupType`nserver'
- '$Command | nslookup 2>&1 | Out-String'
- 'New-RandomDNSField'
- '[Convert]::ToString($SYNOptions, 16)'
- '$Session.Dead = $True'
- '$Session["Driver"] -eq'
condition: empire and dnscat
falsepositives:
- Unknown
level: critical
Stages and Predicates
Stage 0: condition
empire and dnscatStage 1: empire
empire:
ScriptBlockText|contains|all:
- 'System.Diagnostics.Process'
- 'Stop-Computer'
- 'Restart-Computer'
- 'Exception in execution'
- '$cmdargs'
- 'Close-Dnscat2Tunnel'
Stage 2: dnscat
dnscat:
ScriptBlockText|contains|all:
- 'set type=$LookupType`nserver'
- '$Command | nslookup 2>&1 | Out-String'
- 'New-RandomDNSField'
- '[Convert]::ToString($SYNOptions, 16)'
- '$Session.Dead = $True'
- '$Session["Driver"] -eq'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScriptBlockText | match |
| field:"ScriptBlockText" kind:match |
Suspicious Windows Strings In URI
#Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
Known False Positives
- Legitimate application and websites that use windows paths in their URL
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Rule Body
title: Suspicious Windows Strings In URI
id: 9f6a34b4-2688-4eb7-a7f5-e39fef573d0e
status: test
description: Detects suspicious Windows strings in URI which could indicate possible exfiltration or webshell communication
references:
- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-06
modified: 2023-01-02
tags:
- attack.persistence
- attack.exfiltration
- attack.t1505.003
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- '=C:/Users'
- '=C:/Program%20Files'
- '=C:/Windows'
- '=C%3A%5CUsers'
- '=C%3A%5CProgram%20Files'
- '=C%3A%5CWindows'
condition: selection
falsepositives:
- Legitimate application and websites that use windows paths in their URL
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
cs-uri-query|contains:
- '=C:/Users'
- '=C:/Program%20Files'
- '=C:/Windows'
- '=C%3A%5CUsers'
- '=C%3A%5CProgram%20Files'
- '=C%3A%5CWindows'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
cs-uri-query | match |
| field:"cs-uri-query" kind:match |
TanStack Supply-Chain Attack DNS Indicators
#Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Command & Control | |
| Exfiltration |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 22: DNSEvent (DNS query) |
Rule Body
title: TanStack Supply-Chain Attack DNS Indicators
id: ac5a4e3f-7f9d-6abc-d8ea-3b4c5f6a7b8c
status: experimental
description: |
Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on.
The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz.
The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.
references:
- https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
- https://socket.dev/supply-chain-attacks/mini-shai-hulud
- https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
author: Leonardo Gasparini
date: 2026-05-12
tags:
- attack.command-and-control
- attack.t1071.001
- attack.exfiltration
- attack.t1048
- detection.emerging-threats
logsource:
category: dns_query
product: windows
detection:
selection_attacker_apex:
QueryName: 'git-tanstack.com'
selection_session_exfil:
QueryName: 'filev2.getsession.org'
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
1 of selection_*Stage 1: selection_attacker_apex
selection_attacker_apex:
QueryName: 'git-tanstack.com'
Stage 2: selection_session_exfil
selection_session_exfil:
QueryName: 'filev2.getsession.org'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
QueryName | eq |
| field:"QueryName" kind:eq |
Testing Usage of Uncommonly Used Port
#Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
Known False Positives
- Legitimate administrative script
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Command & Control |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| PowerShell | Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule Body
title: Testing Usage of Uncommonly Used Port
id: adf876b3-f1f8-4aa9-a4e4-a64106feec06
status: test
description: |
Adversaries may communicate using a protocol and port paring that are typically not associated.
For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
- https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
author: frack113
date: 2022-01-23
tags:
- attack.command-and-control
- attack.t1571
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection:
ScriptBlockText|contains|all:
- Test-NetConnection
- '-ComputerName '
- '-port '
filter:
ScriptBlockText|contains:
- ' 443 '
- ' 80 '
condition: selection and not filter
falsepositives:
- Legitimate administrative script
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_test_netconnection/info.yml
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
ScriptBlockText|contains|all:
- Test-NetConnection
- '-ComputerName '
- '-port '
Stage 2: not filter
filter:
ScriptBlockText|contains:
- ' 443 '
- ' 80 '
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ScriptBlockText | match |
| field:"ScriptBlockText" kind:match |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
ScriptBlockText | match | 443 | excludes:ScriptBlockText field:"ScriptBlockText" value:" 443 " |
ScriptBlockText | match | 80 | excludes:ScriptBlockText field:"ScriptBlockText" value:" 80 " |
Unrecognized IP in attack protection allowlists
#Detect when new IPs are added into any attack protection allowlist. Since allowlists suspend some controls, they should be closely monitored for unrecognized IPs. A threat actor can try to add a malicious IP in order to bypass attack protection features.
Known False Positives
- Legitimate updates by an administrator. This rule is designed for threat hunting and to be a starting point for further investigation. It is expected to be correlated with a list of known/trusted IPs.
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment |
Rule Body
title: Unrecognized IP in attack protection allowlists
id: 5b7a6b8c-6e3b-11f0-a54c-723487b9527e
status: experimental
description: |
Detect when new IPs are added into any attack protection allowlist.
Since allowlists suspend some controls, they should be closely monitored for unrecognized IPs.
A threat actor can try to add a malicious IP in order to bypass attack protection features.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
product: auth0
references:
- https://auth0.com/docs/secure/attack-protection
- https://auth0.com/docs/secure/attack-protection/playbooks
- https://auth0.com/docs/api/management/v2/attack-protection/patch-suspicious-ip-throttling
detection:
selection:
data.type: sapi
data.description:
- Update Brute-force settings
- Create or update the anomaly detection captcha
- Update Suspicious IP Throttling settings
filter:
data.request.body.allowlist:
- '192.0.2.0/24' # An example. Provide a list of allowed IPs or CIDRs.
condition: selection and not filter
explanation: >
The query checks for log entries that modify settings related to brute-force protection, bot detection, or suspicious IP throttling.
It collects allowed IPs from the request body and compares them with the pre-defined list of allowed IPs.
The Splunk detection is based on the assumption that the recognized IP addresses are maintained in an external file.
splunk: |
index=auth0 data.tenant_name="{your-tenant-name}"
data.type=sapi
data.description IN ("Update Brute-force settings", "Create or update the anomaly detection captcha",
"Update Suspicious IP Throttling settings")
| fields data.details.request.body.allowlist{}
| stats values(data.details.request.body.allowlist{}) as allowed_ips
| mvexpand allowed_ips
| lookup {your-csv-file-with-recognized-ips} ip_address AS allowed_ips OUTPUT ip_address as is_known_ip
| where isnull(is_known_ip)
| dedup allowed_ips
```Display the information in a table```
| stats values(allowed_ips) as ips_not_in_csv
comments:
- The Splunk query above shall be tuned to reflect a valid tenant name and the file name containing recognized IPs,
i.e. IPs allowed to be excluded from the Attack protection features.
tenant_logs: |
type:"sapi" AND (description: "Create or update the anomaly detection captcha"
OR description: "Update Brute-force settings"
OR description: "Update Suspicious IP Throttling settings")
prevention:
- Control tenant admins, i.e. "Admin", as this role has permissions to modify any application.
- Enforce MFA for tenant admins to reduce the risk of an adversary gaining access.
- Control Management API scopes that allow modification of attack protection features - update:attack_protection.
- Control usage of Management API from only trusted IPs by applying Network ACL scoped to "management".
falsepositives:
- Legitimate updates by an administrator. This rule is designed for threat hunting and to be a starting point for further investigation.
It is expected to be correlated with a list of known/trusted IPs.
level: medium
tags:
- attack.defense-evasion
- attack.t1562
- attack.t1562.007
- detection.threat-hunting
Stages and Predicates
Stage 0: condition
selection and not filterStage 1: selection
selection:
data.type: sapi
data.description:
- Update Brute-force settings
- Create or update the anomaly detection captcha
- Update Suspicious IP Throttling settings
Stage 2: not filter
filter:
data.request.body.allowlist:
- '192.0.2.0/24'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
data.description | eq |
| field:"data.description" kind:eq |
data.type | eq |
| field:"data.type" kind:eq value:"sapi" |
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
data.request.body.allowlist | eq | 192.0.2.0/24 | excludes:data.request.body.allowlist field:"data.request.body.allowlist" value:"192.0.2.0/24" |
Unsigned Module Loaded by ClickOnce Application
#Detects unsigned module load by ClickOnce application.
Known False Positives
- Unlikely
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Execution | |
| Stealth |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 7: Image loaded |
Rule Body
title: Unsigned Module Loaded by ClickOnce Application
id: 060d5ad4-3153-47bb-8382-43e5e29eda92
status: test
description: Detects unsigned module load by ClickOnce application.
references:
- https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
author: '@SerkinValery'
date: 2023-06-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection_path:
Image|contains: '\AppData\Local\Apps\2.0\'
selection_sig_status:
- Signed: 'false'
- SignatureStatus: 'Expired'
condition: all of selection_*
falsepositives:
- Unlikely
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_path
selection_path:
Image|contains: '\AppData\Local\Apps\2.0\'
Stage 2: selection_sig_status
selection_sig_status:
- Signed: 'false'
- SignatureStatus: 'Expired'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | match |
| field:"Image" kind:match value:"\AppData\Local\Apps\2.0\" |
SignatureStatus | eq |
| field:"SignatureStatus" kind:eq value:"Expired" |
Signed | eq |
| field:"Signed" kind:eq value:"false" |
WerFault LSASS Process Memory Dump
#Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Credential Access |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 11: FileCreate |
Rule Body
title: WerFault LSASS Process Memory Dump
id: c3e76af5-4ce0-4a14-9c9a-25ceb8fda182
status: test
description: Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials
references:
- https://github.com/helpsystems/nanodump
author: Florian Roth (Nextron Systems)
date: 2022-06-27
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
category: file_event
detection:
selection:
Image: C:\WINDOWS\system32\WerFault.exe
TargetFilename|contains:
- '\lsass'
- 'lsass.exe'
condition: selection
falsepositives:
- Unknown
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image: C:\WINDOWS\system32\WerFault.exe
TargetFilename|contains:
- '\lsass'
- 'lsass.exe'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Image | eq |
| field:"Image" kind:eq value:"C:\WINDOWS\system32\WerFault.exe" |
TargetFilename | match |
| field:"TargetFilename" kind:match |
Winlogon process contact to C2 - Blacklotus (Sysmon)
#Detects Blacklotus HTTP downloader injection into winlogon.exe process.
Known False Positives
- None
MITRE ATT&CK Coverage
| Tactic | Techniques |
|---|---|
| Discovery |
Telemetry Coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule Body
title: Winlogon process contact to C2 - Blacklotus (Sysmon)
description: Detects Blacklotus HTTP downloader injection into winlogon.exe process.
requirements: SYSMON configuration from SwiftOnSecurity needs to be adapted in order to audit winlogon.exe connections.
references:
- https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
tags:
- attack.command_and_control
- attack.discovery
- attack.t1016 # System Network Configuration Discovery
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\winlogon.exe'
DestinationPort: 80
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image|endswith: '\winlogon.exe'
DestinationPort: 80
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
DestinationPort | eq |
| field:"DestinationPort" kind:eq value:"80" |
Image | ends_with |
| field:"Image" kind:ends_with value:"\winlogon.exe" |