Sigma rules: 2w

title: Access To Windows Credential History File By Uncommon Applications
id: 7a2a22ea-a203-4cd3-9abf-20eb1c5c6cd2
status: test
description: |
    Detects file access requests to the Windows Credential History File by an uncommon application.
    This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
references:
    - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
    - https://www.passcape.com/windows_password_recovery_dpapi_credhist
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-17
modified: 2024-07-29
tags:
    - attack.credential-access
    - attack.t1555.004
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection:
        FileName|endswith: '\Microsoft\Protect\CREDHIST'
    filter_main_system_folders:
        Image|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_main_explorer:
        Image: 'C:\Windows\explorer.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
# Increase level after false positives filters are good enough
level: medium

title: Azure Kubernetes Secret or Config Object Access
id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c
status: test
description: Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
    - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
    - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
    - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
author: Austin Songer @austinsonger
date: 2021-08-07
modified: 2022-08-23
tags:
    - attack.impact
    - attack.t1485
    - attack.t1496
    - attack.t1489
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName:
            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/WRITE
            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/CONFIGMAPS/DELETE
            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/WRITE
            - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SECRETS/DELETE
    condition: selection
falsepositives:
    - Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

title: Base64 MZ Header In CommandLine
id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f
status: test
description: Detects encoded base64 MZ header in the commandline
references:
    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-12
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'TVqQAAMAAAAEAAAA' # MZ..........
            - 'TVpQAAIAAAAEAA8A'
            - 'TVqAAAEAAAAEABAA'
            - 'TVoAAAAAAAAAAAAA'
            - 'TVpTAQEAAAAEAAAA'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Cmd Launched with Hidden Start Flags to Suspicious Targets
id: 5a6b7c8d-9e0f-1a2b-3c4d-5e6f7a8b9c0d
status: experimental
description: |
    Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags.
    To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.
    This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.
references:
    - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
    - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
    - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
tags:
    - attack.stealth
    - attack.t1564.003
author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-01-24
logsource:
    category: process_creation
    product: windows
detection:
    selection_cmd_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cmd_hidden_start_1:
        CommandLine|contains|windash:
            - 'start '
            - 'start/b'
            - 'start/min'
    selection_cmd_hidden_start_2:
        CommandLine|contains|windash:
            - '/b '
            - '/b"'
            - '/min '
            - '/min"'
    selection_cli_uncommon_location:
        CommandLine|contains:
            - ':\Perflogs\'
            - ':\Temp\'
            - ':\Users\Default\'
            - ':\Windows\Temp\'
            - '\AppData\Roaming\'
            - '\Contacts\'
            - '\Documents\'
            - '\Downloads\'
            - '\Favorites\'
            - '\Favourites\'
            - '\inetpub\'
            - '\Music\'
            - '\Photos\'
            - '\Temporary Internet\'
            - '\Users\Public\'
            - '\Videos\'
    selection_cli_susp_extension:
        CommandLine|contains:
            - '.bat'
            - '.cmd'
            - '.cpl'
            - '.hta'
            - '.js'
            - '.ps1'
            - '.scr'
            - '.vbe'
            - '.vbs'
    selection_cli_susp_pattern:
        CommandLine|contains:
            - ' -nop '
            - ' -sta '
            - '.downloadfile(' # PowerShell download command
            - '.downloadstring(' # PowerShell download command
            - '-noni '
            - '-w hidden '
    condition: all of selection_cmd_* and 1 of selection_cli_*
falsepositives:
    - Legitimate administrative scripts running from temporary folders.
    - Niche software updaters utilizing hidden batch files in ProgramData.
level: medium # Can be increased after an initial baseline and tuning
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmd_launched_with_hidden_start_flag/info.yml

title: Creation Of An User Account
id: 759d0d51-bc99-4b5e-9add-8f5b2c8e7512
status: test
description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
references:
    - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files
    - https://access.redhat.com/articles/4409591#audit-record-types-2
    - https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07
author: Marie Euler, Pawel Mazur
date: 2020-05-18
modified: 2022-12-20
tags:
    - attack.t1136.001
    - attack.persistence
logsource:
    product: linux
    service: auditd
detection:
    selection_syscall_record_type:
        type: 'SYSCALL'
        exe|endswith: '/useradd'
    selection_add_user_record_type:
        type: 'ADD_USER' # This is logged without having to configure audit rules on both Ubuntu and Centos
    condition: 1 of selection_*
falsepositives:
    - Admin activity
level: medium

title: CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
id: 87c83d8e-5390-44ce-aa4a-d3b37e54d0a0
related:
    - id: ff349b81-617f-4af4-924f-dbe8ea9bab41 # Proxy Attempt
      type: similar
    - id: aee7681f-b53d-4594-a9de-ac51e6ad3362 # Proxy Exploit
      type: similar
    - id: a4e068b5-e27c-4f21-85b3-e69e5a4f7ce1 # Webserver Exploit
      type: similar
status: test
description: Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.
references:
    - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
    - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
    - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
    - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
    - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)
date: 2023-11-28
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-4966
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/oauth/idp/.well-known/openid-configuration'
        sc-status: 200
    condition: selection
falsepositives:
    - Vulnerability scanners
level: medium

title: DotNET Assembly DLL Loaded Via Office Application
id: ff0f2b05-09db-4095-b96d-1b75ca24894a
status: test
description: Detects any assembly DLL being loaded by an Office Product
references:
    - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
author: Antonlovesdnb
date: 2020-02-19
modified: 2023-03-29
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith:
            - '\excel.exe'
            - '\mspub.exe'
            - '\onenote.exe'
            - '\onenoteim.exe' # Just in case
            - '\outlook.exe'
            - '\powerpnt.exe'
            - '\winword.exe'
        ImageLoaded|startswith: 'C:\Windows\assembly\'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback
id: 4d431012-2ab5-4db7-a84e-b29809da2172
status: test
description: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship.
references:
    - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista
author: X__Junior (Nextron Systems)
date: 2023-11-03
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Microsoft\WBEM\CIMOM\AllowAnonymousCallback'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Administrative activity
level: medium

title: HackTool - SharpView Execution
id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
related:
    - id: dcd74b95-3f36-4ed9-9598-0490951643aa
      type: similar
status: test
description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
references:
    - https://github.com/tevora-threat/SharpView/
    - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
author: frack113
date: 2021-12-10
modified: 2023-02-14
tags:
    - attack.discovery
    - attack.t1049
    - attack.t1069.002
    - attack.t1482
    - attack.t1135
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName: 'SharpView.exe'
        - Image|endswith: '\SharpView.exe'
        - CommandLine|contains:
              # - 'Add-DomainGroupMember'
              # - 'Add-DomainObjectAcl'
              # - 'Add-ObjectAcl'
              - 'Add-RemoteConnection'
              - 'Convert-ADName'
              - 'ConvertFrom-SID'
              - 'ConvertFrom-UACValue'
              - 'Convert-SidToName'
              # - 'ConvertTo-SID'
              - 'Export-PowerViewCSV'
              # - 'Find-DomainLocalGroupMember'
              - 'Find-DomainObjectPropertyOutlier'
              - 'Find-DomainProcess'
              - 'Find-DomainShare'
              - 'Find-DomainUserEvent'
              - 'Find-DomainUserLocation'
              - 'Find-ForeignGroup'
              - 'Find-ForeignUser'
              - 'Find-GPOComputerAdmin'
              - 'Find-GPOLocation'
              - 'Find-Interesting' # 'Find-InterestingDomainAcl', 'Find-InterestingDomainShareFile', 'Find-InterestingFile'
              - 'Find-LocalAdminAccess'
              - 'Find-ManagedSecurityGroups'
              # - 'Get-ADObject'
              - 'Get-CachedRDPConnection'
              - 'Get-DFSshare'
              # - 'Get-DNSRecord'
              # - 'Get-DNSZone'
              # - 'Get-Domain'
              - 'Get-DomainComputer'
              - 'Get-DomainController'
              - 'Get-DomainDFSShare'
              - 'Get-DomainDNSRecord'
              # - 'Get-DomainDNSZone'
              - 'Get-DomainFileServer'
              - 'Get-DomainForeign' # 'Get-DomainForeignGroupMember', 'Get-DomainForeignUser'
              - 'Get-DomainGPO' # 'Get-DomainGPOComputerLocalGroupMapping', 'Get-DomainGPOLocalGroup', 'Get-DomainGPOUserLocalGroupMapping'
              - 'Get-DomainGroup' # 'Get-DomainGroupMember'
              - 'Get-DomainGUIDMap'
              - 'Get-DomainManagedSecurityGroup'
              - 'Get-DomainObject' # 'Get-DomainObjectAcl'
              - 'Get-DomainOU'
              - 'Get-DomainPolicy' # 'Get-DomainPolicyData'
              - 'Get-DomainSID'
              - 'Get-DomainSite'
              - 'Get-DomainSPNTicket'
              - 'Get-DomainSubnet'
              - 'Get-DomainTrust' # 'Get-DomainTrustMapping'
              # - 'Get-DomainUser'
              - 'Get-DomainUserEvent'
              # - 'Get-Forest'
              - 'Get-ForestDomain'
              - 'Get-ForestGlobalCatalog'
              - 'Get-ForestTrust'
              - 'Get-GptTmpl'
              - 'Get-GroupsXML'
              # - 'Get-GUIDMap'
              # - 'Get-IniContent'
              # - 'Get-IPAddress'
              - 'Get-LastLoggedOn'
              - 'Get-LoggedOnLocal'
              - 'Get-NetComputer' # 'Get-NetComputerSiteName'
              - 'Get-NetDomain' # 'Get-NetDomainController', 'Get-NetDomainTrust'
              - 'Get-NetFileServer'
              - 'Get-NetForest' # 'Get-NetForestCatalog', 'Get-NetForestDomain', 'Get-NetForestTrust'
              - 'Get-NetGPO' # 'Get-NetGPOGroup'
              # - 'Get-NetGroup'
              - 'Get-NetGroupMember'
              - 'Get-NetLocalGroup' # 'Get-NetLocalGroupMember'
              - 'Get-NetLoggedon'
              - 'Get-NetOU'
              - 'Get-NetProcess'
              - 'Get-NetRDPSession'
              - 'Get-NetSession'
              - 'Get-NetShare'
              - 'Get-NetSite'
              - 'Get-NetSubnet'
              - 'Get-NetUser'
              # - 'Get-ObjectAcl'
              - 'Get-PathAcl'
              - 'Get-PrincipalContext'
              # - 'Get-Proxy'
              - 'Get-RegistryMountedDrive'
              - 'Get-RegLoggedOn'
              # - 'Get-SiteName'
              # - 'Get-UserEvent'
              # - 'Get-WMIProcess'
              - 'Get-WMIRegCachedRDPConnection'
              - 'Get-WMIRegLastLoggedOn'
              - 'Get-WMIRegMountedDrive'
              - 'Get-WMIRegProxy'
              - 'Invoke-ACLScanner'
              - 'Invoke-CheckLocalAdminAccess'
              - 'Invoke-Kerberoast'
              - 'Invoke-MapDomainTrust'
              - 'Invoke-RevertToSelf'
              - 'Invoke-Sharefinder'
              - 'Invoke-UserImpersonation'
              # - 'New-DomainGroup'
              # - 'New-DomainUser'
              - 'Remove-DomainObjectAcl'
              - 'Remove-RemoteConnection'
              - 'Request-SPNTicket'
              # - 'Resolve-IPAddress'
              # - 'Set-ADObject'
              - 'Set-DomainObject'
              # - 'Set-DomainUserPassword'
              - 'Test-AdminAccess'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_sharpview/info.yml

title: Leviathan Registry Key Activity
id: 70d43542-cd2d-483c-8f30-f16b436fd7db
status: test
description: Detects registry key used by Leviathan APT in Malaysian focused campaign
references:
    - https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign
author: Aidan Bracher
date: 2020-07-07
modified: 2023-09-19
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
    - detection.emerging-threats
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'
    condition: selection
level: critical

title: Malware Shellcode in Verclsid Target Process
id: b7967e22-3d7e-409b-9ed5-cdae3f9243a1
status: test
description: Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro
references:
    - https://twitter.com/JohnLaTwC/status/837743453039534080
author: John Lambert (tech), Florian Roth (Nextron Systems)
date: 2017-03-04
modified: 2021-11-27
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.emerging-threats
logsource:
    category: process_access
    product: windows
    definition: 'Requirements: The following config is required to generate the necessary Event ID 10 Process Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
detection:
    selection_target:
        TargetImage|endswith: '\verclsid.exe'
        GrantedAccess: '0x1FFFFF'
    selection_calltrace_1:
        CallTrace|contains|all:
            - '|UNKNOWN('
            - 'VBE7.DLL'
    selection_calltrace_2:
        SourceImage|contains: '\Microsoft Office\'
        CallTrace|contains: '|UNKNOWN'
    condition: selection_target and 1 of selection_calltrace_*
falsepositives:
    - Unknown
level: high

title: Named Pipe Created Via Mkfifo
id: 9d779ce8-5256-4b13-8b6f-b91c602b43f4
status: test
description: Detects the creation of a new named pipe using the "mkfifo" utility
references:
    - https://dev.to/0xbf/use-mkfifo-to-create-named-pipe-linux-tips-5bbk
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/mkfifo'
    condition: selection
falsepositives:
    - Unknown
level: low

title: Network Communication With Crypto Mining Pool
id: fa5b1358-b040-4403-9868-15f7d9ab6329
status: stable
description: |
    Detects initiated network connections to crypto mining pools.
    It indicates that the system is likely infected with a crypto miner malware or is being used for crypto mining.
references:
    - https://www.poolwatch.io/coin/monero
    - https://github.com/stamparm/maltrail/blob/da082537e0f37b9dece3a6998583e43bb5709c4e/trails/static/suspicious/crypto_mining.txt
    - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-10-26
modified: 2026-07-24
tags:
    - attack.impact
    - attack.t1496
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname:
            - 'aeon-pool.com'
            - 'alimabi.cn'
            - 'ap.luckpool.net'
            - 'api.fastpool.xyz'
            - 'auto.c3pool.org'
            - 'awgoaigartnj-xmr.com'
            - 'backup.fastpool.xyz'
            - 'bcn.pool.minergate.com'
            - 'bcn.vip.pool.minergate.com'
            - 'bizxmr.cc'
            - 'bmpool.org'
            - 'bohemianpool.com'
            - 'byw.dscloud.me'
            - 'c3.wptask.cyou'
            - 'c3pool.org'
            - 'ca-aipg.miningocean.org'
            - 'ca-dynex.miningocean.org'
            - 'ca-neurai.miningocean.org'
            - 'ca-qrl.miningocean.org'
            - 'ca-upx.miningocean.org'
            - 'ca-zephyr.miningocean.org'
            - 'ca.minexmr.com'
            - 'ca.monero.herominers.com'
            - 'cbd.monerpool.org'
            - 'cbdv2.monerpool.org'
            - 'community-pools.mysrv.cloud'
            - 'covid19crypto.com'
            - 'cryptmonero.com'
            - 'crypto-pool.fr'
            - 'crypto-pool.info'
            - 'cryptominded.com'
            - 'cryptonight-hub.miningpoolhub.com'
            - 'd1pool.ddns.net'
            - 'd5pool.us'
            - 'daili01.monerpool.org'
            - 'de-aipg.miningocean.org'
            - 'de-dynex.miningocean.org'
            - 'de-zephyr.miningocean.org'
            - 'de.minexmr.com'
            - 'de.moneroocean.stream'
            - 'de.salvium.herominers.com'
            - 'de.zephyr.herominers.com'
            - 'dl.nbminer.com'
            - 'donate.graef.in'
            - 'donate.ssl.xmrig.com'
            - 'donate.v2.xmrig.com'
            - 'donate.xmrig.com'
            - 'donate2.graef.in'
            - 'drill.moneroworld.com'
            - 'dwarfpool.com'
            - 'emercoin.com'
            - 'emercoin.net'
            - 'emergate.net'
            - 'ethereumpool.co'
            - 'eu.luckpool.net'
            - 'eu.minerpool.pw'
            - 'f2pool.com'
            - 'fastpool.xyz'
            - 'fcn-xmr.pool.minergate.com'
            - 'fee.xmrig.com'
            - 'fi.moneroocean.stream'
            - 'fr-aipg.miningocean.org'
            - 'fr-dynex.miningocean.org'
            - 'fr-neurai.miningocean.org'
            - 'fr-qrl.miningocean.org'
            - 'fr-tarirx.luckypool.io'
            - 'fr-upx.miningocean.org'
            - 'fr-zephyr.miningocean.org'
            - 'fr.minexmr.com'
            - 'fr.moneroocean.stream'
            - 'friendspool.club'
            - 'ftp.fastpool.xyz'
            - 'gandalph3000.com'
            - 'googleminer.com'
            - 'grin.2miners.com'
            - 'gulf.moneroocean.stream'
            - 'hellominer.com'
            - 'herominers.com'
            - 'hk-aipg.miningocean.org'
            - 'hk-dynex.miningocean.org'
            - 'hk-neurai.miningocean.org'
            - 'hk-qrl.miningocean.org'
            - 'hk-upx.miningocean.org'
            - 'hk-zephyr.miningocean.org'
            - 'hns.f2pool.com'
            - 'huadong1-aeon.ppxxmr.com'
            - 'imap.fastpool.xyz'
            - 'iwanttoearn.money'
            - 'joulecoin.org'
            - 'jp.moneroocean.stream'
            - 'jw-js1.ppxxmr.com'
            - 'koto-pool.work'
            - 'kronecoin.org'
            - 'kryptex.network'
            - 'kubo.ultra-pool.com'
            - 'lhr.nbminer.com'
            - 'lhr3.nbminer.com'
            - 'linux.monerpool.org'
            - 'litecoinpool.org'
            - 'lokiturtle.herominers.com'
            - 'luckpool.net'
            - 'luckypool.io'
            - 'mail.fastpool.xyz'
            - 'masari.miner.rocks'
            - 'mine.aeon-pool.com'
            - 'mine.bmpool.org'
            - 'mine.c3pool.com'
            - 'mine.fastpool.xyz'
            - 'mine.lesliejust.is'
            - 'mine.moneropool.com'
            - 'mine.ppxxmr.com'
            - 'mine.zpool.ca'
            - 'mine1.ppxxmr.com'
            - 'minemonero.gq'
            - 'miner.ppxxmr.com'
            - 'miner.rocks'
            - 'minercircle.com'
            - 'minergate.com'
            - 'minerpool.pw'
            - 'minerrocks.com'
            - 'miners.pro'
            - 'minerxmr.ru'
            - 'minexmr.cn'
            - 'minexmr.com'
            - 'mining-help.ru'
            - 'mining.bittubeapp.com'
            - 'miningocean.org'
            - 'miningpoolhub.com'
            - 'miningrigrentals.com'
            - 'mixpools.org'
            - 'moner.monerpool.org'
            - 'moner1min.monerpool.org'
            - 'monero-master.crypto-pool.fr'
            - 'monero.crypto-pool.fr'
            - 'monero.hashvault.pro'
            - 'monero.herominers.com'
            - 'monero.lindon-pool.win'
            - 'monero.miners.pro'
            - 'monero.riefly.id'
            - 'monero.us.to'
            - 'monerocean.stream'
            - 'monerogb.com'
            - 'monerohash.com'
            - 'moneroocean.stream'
            - 'monerooceans.stream'
            - 'moneropool.com'
            - 'moneropool.nl'
            - 'monerorx.com'
            - 'monerpool.org'
            - 'moriaxmr.com'
            - 'mro.pool.minergate.com'
            - 'multipool.us'
            - 'myxmr.pw'
            - 'na.luckpool.net'
            - 'nanopool.org'
            - 'nbminer.com'
            - 'node.btx.tools'
            - 'node3.luckpool.net'
            - 'noobxmr.com'
            - 'p06.2miners.com'
            - 'pangolinminer.com'
            - 'pool-de.supportxmr.com'
            - 'pool-fr.supportxmr.com'
            - 'pool-nyc.supportxmr.com'
            - 'pool-phx.supportxmr.com'
            - 'pool.4i7i.com'
            - 'pool.armornetwork.org'
            - 'pool.awgoaigartnj-xmr.com'
            - 'pool.cortins.tk'
            - 'pool.gntl.co.uk'
            - 'pool.hashvault.pro'
            - 'pool.minergate.com'
            - 'pool.minexmr.com'
            - 'pool.minexmr.uk'
            - 'pool.monero.hashvault.pro'
            - 'pool.ppxxmr.com'
            - 'pool.somec.cc'
            - 'pool.support'
            - 'pool.supportxmr.com'
            - 'pool.usa-138.com'
            - 'pool.xmr.pt'
            - 'pool.xmrfast.com'
            - 'pool2.armornetwork.org'
            - 'poolchange.ppxxmr.com'
            - 'pooldd.com'
            - 'poolmining.org'
            - 'poolto.be'
            - 'pop.fastpool.xyz'
            - 'ppxvip1.ppxxmr.com'
            - 'ppxxmr.com'
            - 'prohash.net'
            - 'r.twotouchauthentication.online'
            - 'randomx.xmrig.com'
            - 'ratchetmining.com'
            - 'rx.unmineable.com'
            - 'salvium.herominers.com'
            - 'seed.emercoin.com'
            - 'seed.emercoin.net'
            - 'seed.emergate.net'
            - 'seed.kronecoin.org'
            - 'seed.titcoinpool.com'
            - 'seed.titcoins.info'
            - 'seed1.joulecoin.org'
            - 'seed2.joulecoin.org'
            - 'seed3.joulecoin.org'
            - 'seed4.joulecoin.org'
            - 'seed5.joulecoin.org'
            - 'seed6.joulecoin.org'
            - 'seed7.joulecoin.org'
            - 'seed8.joulecoin.org'
            - 'sg-aipg.miningocean.org'
            - 'sg-dynex.miningocean.org'
            - 'sg-neurai.miningocean.org'
            - 'sg-qrl.miningocean.org'
            - 'sg-upx.miningocean.org'
            - 'sg-zephyr.miningocean.org'
            - 'sg.minexmr.com'
            - 'sheepman.mine.bz'
            - 'siamining.com'
            - 'smtp.fastpool.xyz'
            - 'solarray.club'
            - 'solo-grin.2miners.com'
            - 'solo-grin.2miners.ru'
            - 'solo-xmr.2miners.com'
            - 'solo-xmr.2miners.ru'
            - 'soloxmr2min.dyndns.org'
            - 'sparechange.io'
            - 'ssl.fastpool.xyz'
            - 'sumokoin.minerrocks.com'
            - 'supportxmr.com'
            - 'suprnova.cc'
            - 'system-check.services'
            - 'system-update.info'
            - 'teracycle.net'
            - 'titcoinpool.com'
            - 'titcoins.info'
            - 'tpool.yiluzhuanqian.com'
            - 'trtl.cnpool.cc'
            - 'trtl.pool.mine2gether.com'
            - 'turtle.miner.rocks'
            - 'ultra-pool.com'
            - 'unmineable.com'
            - 'us-aipg.miningocean.org'
            - 'us-dynex.miningocean.org'
            - 'us-grin.2miners.com'
            - 'us-neurai.miningocean.org'
            - 'us-west.minexmr.com'
            - 'us-zephyr.miningocean.org'
            - 'usxmrpool.com'
            - 'viaxmr.com'
            - 'web.xmrpool.eu'
            - 'webservicepag.webhop.net'
            - 'winxmr.club'
            - 'x109.node.btx.tools'
            - 'xcn1.yiluzhuanqian.com'
            - 'xiazai.monerpool.org'
            - 'xiazai1.monerpool.org'
            - 'xmc.pool.minergate.com'
            - 'xmo.pool.minergate.com'
            - 'xmr-asia1.nanopool.org'
            - 'xmr-au1.nanopool.org'
            - 'xmr-eu1.nanopool.org'
            - 'xmr-eu2.nanopool.org'
            - 'xmr-jp1.nanopool.org'
            - 'xmr-us-east1.nanopool.org'
            - 'xmr-us-west1.nanopool.org'
            - 'xmr-us.suprnova.cc'
            - 'xmr-usa.dwarfpool.com'
            - 'xmr.2miners.com'
            - 'xmr.5b6b7b.ru'
            - 'xmr.748pz.net'
            - 'xmr.alimabi.cn'
            - 'xmr.bepooh.com'
            - 'xmr.bohemianpool.com'
            - 'xmr.crypto-pool.fr'
            - 'xmr.crypto-pool.info'
            - 'xmr.f2pool.com'
            - 'xmr.hashcity.org'
            - 'xmr.hex7e4.ru'
            - 'xmr.ip28.net'
            - 'xmr.kryptex.network'
            - 'xmr.monerpool.org'
            - 'xmr.mypool.online'
            - 'xmr.nanopool.org'
            - 'xmr.pool.gntl.co.uk'
            - 'xmr.pool.minergate.com'
            - 'xmr.poolto.be'
            - 'xmr.ppxxmr.com'
            - 'xmr.prohash.net'
            - 'xmr.simka.pw'
            - 'xmr.somec.cc'
            - 'xmr.suprnova.cc'
            - 'xmr.usa-138.com'
            - 'xmr.vip.pool.minergate.com'
            - 'xmr.yiluzhuanqian.com'
            - 'xmr1min.monerpool.org'
            - 'xmrf.520fjh.org'
            - 'xmrf.fjhan.club'
            - 'xmrfast.com'
            - 'xmrigcc.graef.in'
            - 'xmrminer.cc'
            - 'xmrpool.de'
            - 'xmrpool.eu'
            - 'xmrpool.me'
            - 'xmrpool.net'
            - 'xmrpool.xyz'
            - 'xx11m.monerpool.org'
            - 'xx11mv2.monerpool.org'
            - 'xxx.hex7e4.ru'
            - 'yes.fastpool.xyz'
            - 'zarabotaibitok.ru'
            - 'zeph-eu2.nanopool.org'
            - 'zeph.2miners.com'
            - 'zephyr.herominers.com'
            - 'zer0day.ru'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: New Root or CA or AuthRoot Certificate to Store
id: d223b46b-5621-4037-88fe-fda32eead684
status: test
description: Detects the addition of new root, CA or AuthRoot certificates to the Windows registry
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store
    - https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec
author: frack113
date: 2022-04-04
modified: 2023-08-17
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\'
            - '\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates\'
            - '\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\'
            - '\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\'
            - '\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates\'
            - '\SOFTWARE\Microsoft\EnterpriseCertificates\CA\Certificates\'
            - '\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\'
            - '\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot\Certificates\'
            - '\SOFTWARE\Microsoft\EnterpriseCertificates\AuthRoot\Certificates\'
        TargetObject|endswith: '\Blob'
        Details: 'Binary Data'
    condition: selection
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: Add Root Certificate to CurrentUser Certificate Store
      technique: T1553.004
      atomic_guid: ca20a3f1-42b5-4e21-ad3f-1049199ec2e0
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat/info.yml

title: Okta API Token Revoked
id: cf1dbc6b-6205-41b4-9b88-a83980d2255b
status: test
description: Detects when a API Token is revoked.
references:
    - https://developer.okta.com/docs/reference/api/system-log/
    - https://developer.okta.com/docs/reference/api/event-types/
author: Austin Songer @austinsonger
date: 2021-09-12
modified: 2026-04-27
tags:
    - attack.impact
logsource:
    product: okta
    service: okta
detection:
    selection:
        eventType: system.api_token.revoke
    condition: selection
falsepositives:
    - Unknown

level: medium

title: Operation Wocao Activity - Security
id: 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d
status: test
description: Detects activity mentioned in Operation Wocao report
references:
    - https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
    - https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
    - https://twitter.com/SBousseaden/status/1207671369963646976
author: Florian Roth (Nextron Systems), frack113
date: 2019-12-20
modified: 2022-11-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.discovery
    - attack.stealth
    - attack.t1012
    - attack.t1036.004
    - attack.t1027
    - attack.execution
    - attack.t1053.005
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4799
        TargetUserName|startswith: 'Administr'
        CallerProcessName|endswith: '\checkadmin.exe'
    condition: selection
falsepositives:
    - Administrators that use checkadmin.exe tool to enumerate local administrators
level: high

title: Potential Dosfuscation Activity
id: a77c1610-fc73-4019-8e29-0f51efc04a51
status: test
description: Detects possible payload obfuscation via the commandline
references:
    - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
    - https://github.com/danielbohannon/Invoke-DOSfuscation
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2022-02-15
modified: 2023-03-06
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '^^'
            - '^|^'
            - ',;,'
            - ';;;;'
            - ';; ;;'
            - '(,(,'
            - '%COMSPEC:~'
            - ' c^m^d'
            - '^c^m^d'
            - ' c^md'
            - ' cm^d'
            - '^cm^d'
            - ' s^et '
            - ' s^e^t '
            - ' se^t '
            # - '%%'
            # - '&&'
            # - '""'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Potential EACore.DLL Sideloading
id: edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5
status: test
description: Detects potential DLL sideloading of "EACore.dll"
references:
    - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
author: X__Junior (Nextron Systems)
date: 2023-08-03
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\EACore.dll'
    filter_main_legit_path:
        Image|contains|all:
            - 'C:\Program Files\Electronic Arts\EA Desktop\'
            - '\EACoreServer.exe'
        ImageLoaded|startswith: 'C:\Program Files\Electronic Arts\EA Desktop\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential Edputil.DLL Sideloading
id: e4903324-1a10-4ed3-981b-f6fe3be3a2c2
status: test
description: Detects potential DLL sideloading of "edputil.dll"
references:
    - https://alternativeto.net/news/2023/5/cybercriminals-use-wordpad-vulnerability-to-spread-qbot-malware/
author: X__Junior (Nextron Systems)
date: 2023-06-09
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\edputil.dll'
    filter_main_generic:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential Mfdetours.DLL Sideloading
id: d2605a99-2218-4894-8fd3-2afb7946514d
status: test
description: Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-03
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\mfdetours.dll'
    filter_main_legit_path:
        ImageLoaded|contains: ':\Program Files (x86)\Windows Kits\10\bin\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: medium

title: Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity
id: c3b2a774-3152-4989-83c1-7afc48fd1599
status: test
description: Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.
references:
    - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
    - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
    - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
    - https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-01
modified: 2024-08-13
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-34362
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection_generic:
        TargetFilename|contains:
            - '\MOVEit Transfer\wwwroot\'
            - '\MOVEitTransfer\wwwroot\'
        TargetFilename|endswith:
            - '.7z'
            - '.bat'
            - '.dll'
            - '.exe'
            - '.ps1'
            - '.rar'
            - '.vbe'
            - '.vbs'
            - '.zip'
    selection_known_ioc:
        TargetFilename|endswith:
            - '\MOVEit Transfer\wwwroot\_human2.aspx.lnk'
            - '\MOVEit Transfer\wwwroot\_human2.aspx'
            - '\MOVEit Transfer\wwwroot\human2.aspx.lnk'
            - '\MOVEit Transfer\wwwroot\human2.aspx'
            - '\MOVEitTransfer\wwwroot\_human2.aspx.lnk'
            - '\MOVEitTransfer\wwwroot\_human2.aspx'
            - '\MOVEitTransfer\wwwroot\human2.aspx.lnk'
            - '\MOVEitTransfer\wwwroot\human2.aspx'
    # Uncomment selection if you wanna threat hunt for additional artifacts
    # selection_cmdline:
    #    TargetFilename|contains: ':\Windows\TEMP\'
    #    TargetFilename|endswith: '.cmdline'
    selection_compiled_asp:
        CreationUtcTime|startswith:
            - '2023-03- '
            - '2023-04- '
            - '2023-05- '
            - '2023-06- '
        TargetFilename|contains|all:
            - '\Windows\Microsoft.net\Framework64\v'
            - '\Temporary ASP.NET Files\'
            - 'App_Web_'
        TargetFilename|endswith: '.dll'
    condition: 1 of selection_*
falsepositives:
    - To avoid FP, this rule should only be applied on MOVEit servers.
level: high

title: Potential Persistence Via Scrobj.dll COM Hijacking
id: fe20dda1-6f37-4379-bbe0-a98d400cae90
status: test
description: Detect use of scrobj.dll as this DLL looks for the ScriptletURL key to get the location of the script to execute
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1546.015/T1546.015.md
author: frack113
date: 2022-08-20
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: 'InprocServer32\(Default)'
        Details: 'C:\WINDOWS\system32\scrobj.dll'
    condition: selection
falsepositives:
    - Legitimate use of the dll.
level: medium
simulation:
    - type: atomic-red-team
      name: COM Hijacking - InprocServer32
      technique: T1546.015
      atomic_guid: 48117158-d7be-441b-bc6a-d9e36e47b52b

title: PowerShell Module File Created
id: e36941d0-c0f0-443f-bc6f-cb2952eb69ea
status: test
description: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.
references:
    - Internal Research
    - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-09
tags:
    - attack.persistence
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetFilename|contains:
            - '\WindowsPowerShell\Modules\'
            - '\PowerShell\7\Modules\'
    condition: selection
falsepositives:
    - Likely
level: low