Sigma rules: 2z

title: Add Debugger Entry To AeDebug For Persistence
id: 092af964-4233-4373-b4ba-d86ea2890288
status: test
description: Detects when an attacker adds a new "Debugger" value to the "AeDebug" key in order to achieve persistence which will get invoked when an application crashes
references:
    - https://persistence-info.github.io/Data/aedebug.html
    - https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AeDebug\Debugger'
        Details|endswith: '.dll'
    filter:
        Details: '"C:\WINDOWS\system32\vsjitdebugger.exe" -p %ld -e %ld -j 0x%p'
    condition: selection and not filter
falsepositives:
    - Legitimate use of the key to setup a debugger. Which is often the case on developers machines
level: medium

title: Bitlocker Key Retrieval
id: a0413867-daf3-43dd-9245-734b3a787942
status: test
description: Monitor and alert for Bitlocker key retrieval.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
author: Michael Epping, '@mepples21'
date: 2022-06-28
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078.004
logsource:
    product: azure
    service: auditlogs
detection:
    selection:
        Category: KeyManagement
        OperationName: Read BitLocker key
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Cisco Duo Successful MFA Authentication Via Bypass Code
id: 6f7e1c10-2dc9-4312-adb6-9574ff09a5c8
status: test
description: |
    Detects when a successful MFA authentication occurs due to the use of a bypass code.
    A bypass code is a temporary passcode created by an administrator for a specific user to access a Duo-protected application. These are generally used as "backup codes," so that enrolled users who are having problems with their mobile devices (e.g., mobile service is disrupted, the device is lost or stolen, etc.) or who temporarily can't use their enrolled devices (on a plane without mobile data services) can still access their Duo-protected systems.
references:
    - https://duo.com/docs/adminapi#logs
    - https://help.duo.com/s/article/6327?language=en_US
author: Nikita Khalimonenkov
date: 2024-04-17
tags:
    - attack.credential-access
    - attack.initial-access
    - attack.stealth
logsource:
    product: cisco
    service: duo
detection:
    selection:
        event_type: authentication
        reason: bypass_user
    condition: selection
falsepositives:
    - Legitimate user that was assigned on purpose to a bypass group
level: medium

title: DCOM lateral movement (via MMC20)
description: Detects scenarios where an attacker execute the Impacket DCOMexec tool in order to abuse DCOM services.  
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.003-Distributed%20Component%20Object%20Model%20(DCOM)
- https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/
- https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py
- https://www.ired.team/offensive-security/lateral-movement/t1175-distributed-component-object-model
- https://www.synacktiv.com/publications/traces-of-windows-remote-command-execution.html
tags:
- attack.lateral_movement
- attack.t1021.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:  # full command: '[System.Activator]::CreateInstance([type]::GetTypeFromProgID('MMC20.Application.1','target_host'))''

  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - '[System.Activator]'
      - 'CreateInstance'
      - 'GetTypeFromProgID'
      - 'MMC20.Application'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - '[System.Activator]'
      - 'CreateInstance'
      - 'GetTypeFromProgID'
      - 'MMC20.Application'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - '[System.Activator]'
      - 'CreateInstance'
      - 'GetTypeFromProgID'
      - 'MMC20.Application'

  condition: 1 of selection*
falsepositives:
- none
level: high

title: Default RDP Port Changed to Non Standard Port
id: 509e84b9-a71a-40e0-834f-05470369bd1e
status: test
description: |
    Detects changes to the default RDP port.
    Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface.
    Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md
author: frack113
date: 2022-01-01
modified: 2024-03-25
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.010
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Control\Terminal Server\WinStations\RDP-Tcp\PortNumber'
    filter_main_port:
        Details: DWORD (0x00000d3d) # 3389
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml
simulation:
    - type: atomic-red-team
      name: Changing RDP Port to Non Standard Port via Powershell
      technique: T1021.001
      atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771
    - type: atomic-red-team
      name: Changing RDP Port to Non Standard Port via Command_Prompt
      technique: T1021.001
      atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73

title: Diamond Sleet APT DLL Sideloading Indicators
id: d1b65d98-37d7-4ff6-b139-2d87c1af3042
status: test
description: Detects DLL sideloading activity seen used by Diamond Sleet APT
references:
    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-24
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    product: windows
    category: image_load
detection:
    selection_1:
        Image|endswith: ':\ProgramData\clip.exe'
        ImageLoaded|endswith: ':\ProgramData\Version.dll'
    selection_2:
        Image|endswith: ':\ProgramData\wsmprovhost.exe'
        ImageLoaded|endswith: ':\ProgramData\DSROLE.dll'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: Exploiting CVE-2019-1388
id: 02e0b2ea-a597-428e-b04a-af6a1a403e5c
status: stable
description: Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM
references:
    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388
    - https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege
author: Florian Roth (Nextron Systems)
date: 2019-11-20
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1068
    - cve.2019-1388
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        ParentImage|endswith: '\consent.exe'
        Image|endswith: '\iexplore.exe'
        CommandLine|contains: ' http'
    selection_rights:
        - IntegrityLevel:
              - 'System'  # for Sysmon users
              - 'S-1-16-16384' # System
        - User|contains: # covers many language settings
              - 'AUTHORI'
              - 'AUTORI'
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical

title: Exports Registry Key To a File
id: f0e53e89-8d22-46ea-9db5-9d4796ee2f8a
related:
    - id: 82880171-b475-4201-b811-e9c826cd5eaa
      type: similar
status: test
description: Detects the export of the target Registry key to a file.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: Oddvar Moe, Sander Wiebing, oscd.community
date: 2020-10-07
modified: 2024-03-13
tags:
    - attack.exfiltration
    - attack.discovery
    - attack.t1012
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\regedit.exe'
        - OriginalFileName: 'REGEDIT.EXE'
    selection_cli:
        CommandLine|contains|windash: ' -E '
    filter_1:   # filters to avoid intersection with critical keys rule
        CommandLine|contains:
            - 'hklm'
            - 'hkey_local_machine'
    filter_2:
        CommandLine|endswith:
            - '\system'
            - '\sam'
            - '\security'
    condition: all of selection_* and not all of filter_*
falsepositives:
    - Legitimate export of keys
level: low

title: Github Push Protection Bypass Detected
id: 02cf536a-cf21-4876-8842-4159c8aee3cc
status: test
description: Detects when a user bypasses the push protection on a secret detected by secret scanning.
references:
    - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
    - https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
author: Muhammad Faisal (@faisalusuf)
date: 2024-03-07
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: github
    service: audit
    definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming'
detection:
    selection:
        action|contains: 'secret_scanning_push_protection.bypass'
    condition: selection
falsepositives:
    - Allowed administrative activities.
level: low

title: Invoke-Obfuscation Via Use MSHTA - PowerShell
id: e55a5195-4724-480e-a77e-3ebe64bd3759
status: test
description: Detects Obfuscated Powershell via use MSHTA in Scripts
references:
    - https://github.com/SigmaHQ/sigma/issues/1009 # (Task31)
author: Nikita Nazarov, oscd.community
date: 2020-10-08
modified: 2022-11-29
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_4104:
        ScriptBlockText|contains|all:
            - 'set'
            - '&&'
            - 'mshta'
            - 'vbscript:createobject'
            - '.run'
            - '(window.close)'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

title: macOS ESF Suspicious Process Execution
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
description: Detects suspicious process execution patterns commonly used in malware and attacks
author: Eric Brown - Nebulock, Inc.
date: 2025/01/15
modified: 2025/01/15
logsource:
    product: macos
    service: endpointsecurity
    category: process_creation
detection:
    selection:
        esf.event_type: 9
        event.action: exec
        Image|contains:
            - '/tmp/'
            - '/var/tmp/'
            - '/dev/shm/'
        CommandLine|contains:
            - 'curl'
            - 'wget'
            - 'bash -c'
            - 'python -c'
            - '/bin/sh'
    condition: selection
falsepositives:
    - Legitimate system scripts and automation tools
level: medium
tags:
    - attack.execution
    - attack.command_and_control

title: macOS XPC Service Abuse
id: e5f6a7b8-c9d0-4123-ef01-234567890123
status: experimental
description: |
  Detects potential abuse of XPC (Inter-Process Communication) services.
  XPC is used for secure communication between processes, but can be abused
  for privilege escalation or accessing protected system services.
references:
  - https://attack.mitre.org/techniques/T1559/
  - https://wojciechregula.blog/post/learn-xpc-exploitation-part-1/
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.xpc
  selection_sensitive_services:
    message|contains:
      - 'com.apple.security'
      - 'com.apple.authd'
      - 'com.apple.coreservices.launchservicesd'
      - 'com.apple.TCC'
      - 'com.apple.system.DirectoryService'
  selection_indicators:
    message|contains:
      - 'connection rejected'
      - 'denied'
      - 'invalid entitlement'
      - 'unauthorized'
      - 'suspicious'
  condition: selection_subsystem and selection_sensitive_services and selection_indicators
falsepositives:
  - Legitimate applications with missing entitlements
  - Development/testing environments
level: medium
tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1559

title: MSSQL SPProcoption Set
id: b3d57a5c-c92e-4b48-9a79-5f124b7cf964
status: test
description: Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
references:
    - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
    - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-13
modified: 2024-06-26
tags:
    - attack.persistence
logsource:
    product: windows
    service: application
    definition: 'Requirements: MSSQL audit policy to monitor for "sp_procoption" must be enabled in order to receive this event in the application log'
    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
    selection:
        Provider_Name|contains: 'MSSQL' # Note: We use contains to account for other third party providers - See https://github.com/SigmaHQ/sigma/issues/4876
        EventID: 33205
        Data|contains|all:
            - 'object_name:sp_procoption'
            - 'statement:EXEC'
    condition: selection
falsepositives:
    - Legitimate use of the feature by administrators (rare)
level: high

title: OceanLotus Registry Activity
id: 4ac5fc44-a601-4c06-955b-309df8c4e9d4
status: test
description: Detects registry keys created in OceanLotus (also known as APT32) attacks
references:
    - https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
    - https://github.com/eset/malware-ioc/tree/master/oceanlotus
author: megan201296, Jonhnathan Ribeiro
date: 2019-04-14
modified: 2023-09-28
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    category: registry_event
    product: windows
detection:
    selection_clsid:
        TargetObject|contains: '\SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model'
    selection_hkcu:
        TargetObject|contains:
            # HKCU\SOFTWARE\Classes\AppXc52346ec40fb4061ad96be0e6cb7d16a\
            - 'Classes\AppXc52346ec40fb4061ad96be0e6cb7d16a\'
            # HKCU\SOFTWARE\Classes\AppX3bbba44c6cae4d9695755183472171e2\
            - 'Classes\AppX3bbba44c6cae4d9695755183472171e2\'
            # HKCU\SOFTWARE\Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}\
            - 'Classes\CLSID\{E3517E26-8E93-458D-A6DF-8030BC80528B}\'
            - 'Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model'
    selection_appx_1:
        TargetObject|contains: '\SOFTWARE\App\'
    selection_appx_2:
        TargetObject|contains:
            - 'AppXbf13d4ea2945444d8b13e2121cb6b663\'
            - 'AppX70162486c7554f7f80f481985d67586d\'
            - 'AppX37cc7fdccd644b4f85f4b22d5a3f105a\'
        TargetObject|endswith:
            - 'Application'
            - 'DefaultIcon'
    condition: selection_clsid or selection_hkcu or all of selection_appx_*
falsepositives:
    - Unknown
level: critical

title: Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32
id: bd70d3f8-e60e-4d25-89f0-0b5a9cff20e0
status: test
description: Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local
references:
    - https://pbs.twimg.com/media/EF3yLGoWkAEGeLa?format=jpg
author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
date: 2019-10-02
modified: 2023-03-29
tags:
    - attack.stealth
    - attack.t1218.010
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'regsvr32'
            - '\AppData\Local\'
            - '.dll'
            - ',DllEntry'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Potential DLL Sideloading Of MsCorSvc.DLL
id: cdb15e19-c2d0-432a-928e-e49c8c60dcf2
status: test
description: Detects potential DLL sideloading of "mscorsvc.dll".
references:
    - https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html
author: Wietze Beukema
date: 2024-07-11
modified: 2025-02-26
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '\mscorsvc.dll'
    filter_main_generic:
        ImageLoaded|startswith:
            - 'C:\Windows\Microsoft.NET\Framework\'
            - 'C:\Windows\Microsoft.NET\Framework64\'
            - 'C:\Windows\Microsoft.NET\FrameworkArm\'
            - 'C:\Windows\Microsoft.NET\FrameworkArm64\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate applications loading their own versions of the DLL mentioned in this rule.
level: medium

title: Potential Initial Access via DLL Search Order Hijacking
id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c
status: test
description: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
references:
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
    - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
author: Tim Rauch (rule), Elastic (idea)
date: 2022-10-21
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1566
    - attack.t1566.001
    - attack.initial-access
    - attack.t1574
    - attack.t1574.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            # add more processes when you find them
            - '\winword.exe'
            - '\excel.exe'
            - '\powerpnt.exe'
            - '\MSACCESS.EXE'
            - '\MSPUB.EXE'
            - '\fltldr.exe'
            - '\cmd.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\cscript.exe'
            - '\wscript.exe'
            - '\curl.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetFilename|endswith: '.dll'
        TargetFilename|contains|all:
            - '\Users\'
            - '\AppData\'
        TargetFilename|contains:
            # add more suspicious paths when you find them
            - '\Microsoft\OneDrive\'
            - '\Microsoft OneDrive\'
            - '\Microsoft\Teams\'
            - '\Local\slack\app-'
            - '\Local\Programs\Microsoft VS Code\'
    filter:
        Image|endswith: '\cmd.exe'
        TargetFilename|contains|all:
            - '\Users\'
            - '\AppData\'
            - '\Microsoft\OneDrive\'
            - '\api-ms-win-core-'
    condition: selection and not filter
falsepositives:
    - Unknown
level: medium

title: PUA - NirCmd Execution
id: 4e2ed651-1906-4a59-a78a-18220fca1b22
status: test
description: Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity
references:
    - https://www.nirsoft.net/utils/nircmd.html
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
    - https://www.nirsoft.net/utils/nircmd2.html#using
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-24
modified: 2023-02-13
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_org:
        - Image|endswith: '\NirCmd.exe'
        - OriginalFileName: 'NirCmd.exe'
    selection_cmd:
        CommandLine|contains:
            - ' execmd '
            - '.exe script '
            - '.exe shexec '
            - ' runinteractive '
    combo_exec:
        CommandLine|contains:
            - ' exec '
            - ' exec2 '
    combo_exec_params:
        CommandLine|contains:
            - ' show '
            - ' hide '
    condition: 1 of selection_* or all of combo_*
falsepositives:
    - Legitimate use by administrators
level: medium

title: Python Initiated Connection
id: bef0bc5a-b9ae-425d-85c6-7b2d705980c6
status: test
description: Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python
    - https://pypi.org/project/scapy/
author: frack113
date: 2021-12-10
modified: 2025-03-05
tags:
    - attack.discovery
    - attack.t1046
logsource:
    category: network_connection
    product: windows
    definition: 'Requirements: Field enrichment is required for the filters to work. As field such as CommandLine and ParentImage are not available by default on this event type'
detection:
    selection:
        Initiated: 'true'
        Image|contains|all:
            - '\python'
            - '.exe'
    filter_optional_conda:
        # Related to anaconda updates. Command example: "conda update conda"
        # This filter will only work with aurora agent enriched data as Sysmon EID 3 doesn't contain CommandLine nor ParentImage
        ParentImage: C:\ProgramData\Anaconda3\Scripts\conda.exe
        CommandLine|contains|all:
            - ':\ProgramData\Anaconda3\Scripts\conda-script.py'
            - 'update'
    filter_optional_conda_jupyter_notebook:
        # Related to anaconda opening an instance of Jupyter Notebook
        # This filter will only work with aurora agent enriched data as Sysmon EID 3 doesn't contain CommandLine nor ParentImage
        ParentImage: C:\ProgramData\Anaconda3\python.exe
        CommandLine|contains: 'C:\ProgramData\Anaconda3\Scripts\jupyter-notebook-script.py'
    filter_main_local_communication:
        # This could be caused when launching an instance of Jupyter Notebook locally for example but can also be caused by other instances of python opening sockets locally etc. So comment this out if you want to monitor for those instances
        DestinationIp: 127.0.0.1
        SourceIp: 127.0.0.1
    filter_main_pip:
        CommandLine|contains|all:
            - 'pip.exe'
            - 'install'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying.
level: medium

title: Remove Account From Domain Admin Group
id: 48a45d45-8112-416b-8a67-46e03a4b2107
status: test
description: |
    Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
    Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1531/T1531.md#atomic-test-3---remove-account-from-domain-admin-group
author: frack113
date: 2021-12-26
tags:
    - attack.impact
    - attack.t1531
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'Remove-ADGroupMember'
            - '-Identity '
            - '-Members '
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Rundll32 Execution Without Parameters
id: 5bb68627-3198-40ca-b458-49f973db8752
status: test
description: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module
references:
    - https://bczyz1.github.io/2021/01/30/psexec.html
author: Bartlomiej Czyz, Relativity
date: 2021-01-31
modified: 2023-02-28
tags:
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1570
    - attack.execution
    - attack.t1569.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine:
            - 'rundll32.exe'
            - 'rundll32'
    condition: selection
falsepositives:
    - False positives may occur if a user called rundll32 from CLI with no options
level: high

title: Scheduled Cron Task/Job - Linux
id: 6b14bac8-3e3a-4324-8109-42f0546a347f
status: test
description: Detects abuse of the cron utility to perform task scheduling for initial or recurring execution of malicious code. Detection will focus on crontab jobs uploaded from the tmp folder.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.003/T1053.003.md
author: Alejandro Ortuno, oscd.community
date: 2020-10-06
modified: 2022-11-27
tags:
    - attack.execution
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1053.003
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: 'crontab'
        CommandLine|contains: '/tmp/'
    condition: selection
falsepositives:
    - Legitimate administration activities
level: medium

title: Suspicious Access to Sensitive File Extensions - Zeek
id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc
related:
    - id: 91c945bc-2ad1-4799-a591-4d00198a1215
      type: derived
status: test
description: Detects known sensitive file extensions via Zeek
references:
    - Internal Research
author: Samir Bousseaden, @neu5ron
date: 2020-04-02
modified: 2025-10-17
tags:
    - attack.collection
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        name|endswith:
            - '.pst'
            - '.ost'
            - '.msg'
            - '.nst'
            - '.oab'
            - '.edb'
            - '.nsf'
            - '.bak'
            - '.dmp'
            - '.kirbi'
            # - '\groups.xml'  # Commented out: groups.xml is accessed legitimately by Group Policy processing; high FP rate in enterprise environments
            - '.rdp'
    condition: selection
falsepositives:
    - Help Desk operator doing backup or re-imaging end user machine or backup software
    - Users working with these data types or exchanging message files
level: medium

title: Suspicious Child Process of SolarWinds WebHelpDesk
id: 8c7f4a2d-3b9e-4f1c-9a6d-2e8f5c3d9a1b
status: experimental
description: |
    Detects suspicious child processes spawned by SolarWinds WebHelpDesk (WHD) application, which may indicate exploitation activity leveraging RCE vulnerabilities such as CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399
references:
    - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
    - https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399
    - https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
author: Huntress Team, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-02-11
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-26399
    - cve.2025-40536
    - cve.2025-40551
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: '\WebHelpDesk\bin\'
        ParentImage|endswith:
            - '\java.exe'
            - '\javaw.exe'
        ParentCommandLine|contains: 'tomcat'
    selection_suspicious_child:
        CommandLine|contains:
            - '-enc'
            - 'base64'
            - 'bitsadmin'
            - 'certutil'
            - 'curl'
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - 'irm '
            - 'iwr '
            - 'mshta'
            - 'msiexec'
            - 'Net.WebClient'
            - 'Start-BitsTransfer'
            - 'wget'
            - 'wmic'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Suspicious Download from Office Domain
id: 00d49ed5-4491-4271-a8db-650a4ef6f8c1
status: test
description: Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
references:
    - https://twitter.com/an0n_r0/status/1474698356635193346?s=12
    - https://twitter.com/mrd0x/status/1475085452784844803?s=12
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-12-27
modified: 2022-08-02
tags:
    - attack.command-and-control
    - attack.resource-development
    - attack.t1105
    - attack.t1608
logsource:
    product: windows
    category: process_creation
detection:
    selection_download:
        - Image|endswith:
              - '\curl.exe'
              - '\wget.exe'
        - CommandLine|contains:
              - 'Invoke-WebRequest'
              - 'iwr '
              - 'curl '
              - 'wget '
              - 'Start-BitsTransfer'
              - '.DownloadFile('
              - '.DownloadString('
    selection_domains:
        CommandLine|contains:
            - 'https://attachment.outlook.live.net/owa/'
            - 'https://onenoteonlinesync.onenote.com/onenoteonlinesync/'
    condition: all of selection_*
falsepositives:
    - Scripts or tools that download attachments from these domains (OneNote, Outlook 365)
level: high

title: Suspicious Environment Variable Has Been Registered
id: 966315ef-c5e1-4767-ba25-fce9c8de3660
status: test
description: Detects the creation of user-specific or system-wide environment variables via the registry. Which contains suspicious commands and strings
references:
    - https://infosec.exchange/@sbousseaden/109542254124022664
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-20
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.stealth
logsource:
    product: windows
    category: registry_set
detection:
    selection_main:
        TargetObject|contains: '\Environment\'
    selection_details:
        - Details:
              - 'powershell'
              - 'pwsh'
        - Details|contains:
              # Add more suspicious strings in env variables below
              - '\AppData\Local\Temp\'
              - 'C:\Users\Public\'
              # Base64 MZ Header
              - 'TVqQAAMAAAAEAAAA' # MZ..........
              - 'TVpQAAIAAAAEAA8A'
              - 'TVqAAAEAAAAEABAA'
              - 'TVoAAAAAAAAAAAAA'
              - 'TVpTAQEAAAAEAAAA'
              # Base64 Invoke- (UTF-8)
              - 'SW52b2tlL'
              - 'ludm9rZS'
              - 'JbnZva2Ut'
              # Base64 Invoke- (UTF-16LE)
              - 'SQBuAHYAbwBrAGUALQ'
              - 'kAbgB2AG8AawBlAC0A'
              - 'JAG4AdgBvAGsAZQAtA'
        - Details|startswith:  # https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
              - 'SUVY'
              - 'SQBFAF'
              - 'SQBuAH'
              - 'cwBhA'
              - 'aWV4'
              - 'aQBlA'
              - 'R2V0'
              - 'dmFy'
              - 'dgBhA'
              - 'dXNpbm'
              - 'H4sIA'
              - 'Y21k'
              - 'cABhAH'
              - 'Qzpc'
              - 'Yzpc'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_suspicious_env_variables/info.yml

title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32
id: 8cde342c-ba48-4b74-b615-172c330f2e93
status: test
description: Detects rundll32 loading a renamed comsvcs.dll to dump process memory
references:
    - https://twitter.com/sbousseaden/status/1555200155351228419
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-14
modified: 2023-02-17
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        Hashes|contains:
            # Add more hashes for other windows versions
            - IMPHASH=eed93054cb555f3de70eaa9787f32ebb # Windows 11 21H2 x64
            - IMPHASH=5e0dbdec1fce52daae251a110b4f309d # Windows 10 1607
            - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 # Windows 10 1809
            - IMPHASH=407ca0f7b523319d758a40d7c0193699 # Windows 10 2004 x64
            - IMPHASH=281d618f4e6271e527e6386ea6f748de # Windows 10 2004 x86
    filter:
        ImageLoaded|endswith: '\comsvcs.dll'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

title: Suspicious Service Installation
id: 1d61f71d-59d2-479e-9562-4ff5f4ead16b
related:
    - id: ca83e9f3-657a-45d0-88d6-c1ac280caf53
      type: obsolete
    - id: 26481afe-db26-4228-b264-25a29fe6efc7
      type: similar
status: test
description: Detects suspicious service installation commands
references:
    - Internal Research
author: pH-T (Nextron Systems), Florian Roth (Nextron Systems)
date: 2022-03-18
modified: 2023-12-04
tags:
    - attack.persistence
    - attack.privilege-escalation
    - car.2013-09-005
    - attack.t1543.003
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ImagePath|contains:
            - ' -nop '
            - ' -sta '
            - ' -w hidden '
            - ':\Temp\'
            - '.downloadfile(' # PowerShell download command
            - '.downloadstring(' # PowerShell download command
            - '\ADMIN$\'
            - '\Perflogs\'
            - '&&'
    condition: selection
falsepositives:
    - Unknown
level: high

title: UAC Bypass Via Wsreset
id: 6ea3bf32-9680-422d-9f50-e90716b12a66
status: test
description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.
references:
    - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly
    - https://lolbas-project.github.io/lolbas/Binaries/Wsreset
author: oscd.community, Dmitry Uchakin
date: 2020-10-07
modified: 2021-11-27
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: '\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command'
    condition: selection
falsepositives:
    - Unknown
level: high