Sigma rules: 3b

title: Audit policy disabled by command line
description: Detects scenarios where an attacker attempts to disbale or clear the audit policy for defense evasion purposes.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.002-Disable%20Windows%20Event%20Logging
- https://searchitchannel.techtarget.com/feature/Using-AuditPol-to-audit-Windows-users-and-set-policies
tags:
- attack.defense_evasion
- attack.t1562.002 # Impair Defenses: Disable Windows Event Logging 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: '\auditpol.exe'
    CommandLine|contains:
      - clear   # "auditpol /clear /y"
      - disable # "auditpol /set /category:* /success:disable /failure:disable"
  condition: selection
falsepositives:
- Administrator debugging audit policy
level: high

title: Binary Padding - Linux
id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba
status: test
description: |
    Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
    This rule detect using dd and truncate to add a junk data to file.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md
author: Igor Fits, oscd.community
date: 2020-10-13
modified: 2023-05-03
tags:
    - attack.stealth
    - attack.t1027.001
logsource:
    product: linux
    service: auditd
detection:
    selection_execve:
        type: 'EXECVE'
    keywords_truncate:
        '|all':
            - 'truncate'
            - '-s'
    keywords_dd:
        '|all':
            - 'dd'
            - 'if='
    keywords_filter:
        - 'of='
    condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter))
falsepositives:
    - Unknown
level: high
simulation:
    - type: atomic-red-team
      name: Pad Binary to Change Hash - Linux/macOS dd
      technique: T1027.001
      atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a

title: Changing Existing Service ImagePath Value Via Reg.EXE
id: 9b0b7ac3-6223-47aa-a3fd-e8f211e637db
status: test
description: |
    Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
    Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
    Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe
author: frack113
date: 2021-12-30
modified: 2024-03-13
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.011
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\reg.exe'
        CommandLine|contains|all:
            - 'add '
            - 'SYSTEM\CurrentControlSet\Services\'
            - ' ImagePath '
    selection_value:
        CommandLine|contains|windash: ' -d '
    condition: all of selection*
falsepositives:
    - Unknown
level: medium

title: Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
id: 917789e1-2c1f-4bf5-8c91-6f71a017f469
status: experimental
description: |
    Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password.
    This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.
references:
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-20
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078.001
    - detection.emerging-threats
    - cve.2025-57788
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'qlogin'
            - '_+_PublicSharingUser_'
        # Detects the use of a GUID as the password, which is indicative of an exploit attempt
        CommandLine|re: '[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}'
    condition: selection
falsepositives:
    - Legitimate administrative scripts that use the `_+_PublicSharingUser_` account for valid purposes.
level: medium

title: Conhost Spawned By Uncommon Parent Process
id: cbb9e3d1-2386-4e59-912e-62f1484f7a89
status: test
description: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
references:
    - https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html
author: Tim Rauch, Elastic (idea)
date: 2022-09-28
modified: 2025-03-06
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\conhost.exe'
        ParentImage|endswith:
            - '\explorer.exe'
            # - '\csrss.exe'  # Legitimate parent as seen in EchoTrail https://www.echotrail.io/insights/search/csrss.exe
            # - '\ctfmon.exe'  # Seen several times in a testing environment
            # - '\dllhost.exe'  # FP on clean system from grandparent 'svchost.exe -k DcomLaunch -p'
            - '\lsass.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\services.exe'
            - '\smss.exe'
            - '\spoolsv.exe'
            - '\svchost.exe'
            - '\userinit.exe'
            # - '\wermgr.exe'  # Legitimate parent as seen in EchoTrail https://www.echotrail.io/insights/search/wermgr.exe
            - '\wininit.exe'
            - '\winlogon.exe'
    filter_main_svchost:
        ParentCommandLine|contains:
            - '-k apphost -s AppHostSvc'
            - '-k imgsvc'
            - '-k localService -p -s RemoteRegistry'
            - '-k LocalSystemNetworkRestricted -p -s NgcSvc'
            - '-k NetSvcs -p -s NcaSvc'
            - '-k netsvcs -p -s NetSetupSvc'
            - '-k netsvcs -p -s wlidsvc'
            - '-k NetworkService -p -s DoSvc'
            - '-k wsappx -p -s AppXSvc'
            - '-k wsappx -p -s ClipSVC'
            - '-k wusvcs -p -s WaaSMedicSvc'
    filter_optional_dropbox:
        ParentCommandLine|contains:
            - 'C:\Program Files (x86)\Dropbox\Client\'
            - 'C:\Program Files\Dropbox\Client\'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium

title: Droppers Exploiting CVE-2017-11882
id: 678eb5f4-8597-4be6-8be7-905e4234b53a
status: stable
description: Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe
references:
    - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
    - https://www.linkedin.com/pulse/exploit-available-dangerous-ms-office-rce-vuln-called-thebenygreen-
    - https://github.com/embedi/CVE-2017-11882
author: Florian Roth (Nextron Systems)
date: 2017-11-23
modified: 2021-11-27
tags:
    - attack.execution
    - attack.t1203
    - attack.t1204.002
    - attack.initial-access
    - attack.t1566.001
    - cve.2017-11882
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\EQNEDT32.EXE'
    condition: selection
falsepositives:
    - Unknown
level: critical

title: Firewall configuration enumerated (PowerShell)
description: Detects scenarios where an attacker attempts to extract current Windows firewall configuration to prepare an attack.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1016-System%20Network%20Configuration%20Discovery
- https://docs.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallprofile?view=windowsserver2019-ps
tags:
- attack.discovery
- attack.t1016
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: Get-NetFirewallSetting
  selection_powershell_native:
    EventID: 800
    EventData|contains:
      - Get-NetFirewallProfile
      - Get-NetFirewallRule
      - Get-NetFirewallSetting

  selection_powershell_modern:
    EventID: 4103
    Payload|contains:
      - Get-NetFirewallProfile
      - Get-NetFirewallRule
      - Get-NetFirewallSetting

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains:
      - Get-NetFirewallProfile
      - Get-NetFirewallRule
      - Get-NetFirewallSetting

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- Administrator activity
level: medium

title: GALLIUM Artefacts - Builtin
id: 3db10f25-2527-4b79-8d4b-471eb900ee29
related:
    - id: 440a56bf-7873-4439-940a-1c8a671073c2
      type: derived
status: test
description: Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.
references:
    - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11)
author: Tim Burrell
date: 2020-02-07
modified: 2023-01-02
tags:
    - attack.credential-access
    - attack.command-and-control
    - attack.t1071
    - detection.emerging-threats
logsource:
    product: windows
    service: dns-server-analytic
    definition: 'Requirements: Microsoft-Windows-DNS-Server/Analytical ({EB79061A-A566-4698-9119-3ED2807060E7}) Event Log must be collected in order to receive the events.'
detection:
    selection:
        EventID: 257
        QNAME:
            - 'asyspy256.ddns.net'
            - 'hotkillmail9sddcc.ddns.net'
            - 'rosaf112.ddns.net'
            - 'cvdfhjh1231.myftp.biz'
            - 'sz2016rose.ddns.net'
            - 'dffwescwer4325.myftp.biz'
            - 'cvdfhjh1231.ddns.net'
    condition: selection
falsepositives:
    - Unknown
level: high

title: HackTool - SharpWSUS/WSUSpendu Execution
id: b0ce780f-10bd-496d-9067-066d23dc3aa5
status: test
description: |
    Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.
    Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.
references:
    - https://labs.nettitude.com/blog/introducing-sharpwsus/
    - https://github.com/nettitude/SharpWSUS
    - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1
author: '@Kostastsale, Nasreddine Bencherchali (Nextron Systems)'
date: 2022-10-07
modified: 2024-08-23
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1210
logsource:
    product: windows
    category: process_creation
detection:
    selection_wsuspendu_inject:
        CommandLine|contains: ' -Inject '
    selection_wsuspendu_payload:
        CommandLine|contains:
            - ' -PayloadArgs '
            - ' -PayloadFile '
    selection_sharpwsus_commands:
        CommandLine|contains:
            - ' approve '
            - ' create '
            - ' check '
            - ' delete '
    selection_sharpwsus_flags:
        CommandLine|contains:
            - ' /payload:'
            - ' /payload='
            - ' /updateid:'
            - ' /updateid='
    condition: all of selection_wsuspendu_* or all of selection_sharpwsus_*
falsepositives:
    - Unknown
level: high

title: Import PowerShell Modules From Suspicious Directories
id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab
related:
    - id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3
      type: similar
status: test
description: Detects powershell scripts that import modules from suspicious directories
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-07
modified: 2023-01-10
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Import-Module "$Env:Temp\'
            - Import-Module '$Env:Temp\
            - 'Import-Module $Env:Temp\'
            - 'Import-Module "$Env:Appdata\'
            - Import-Module '$Env:Appdata\
            - 'Import-Module $Env:Appdata\'
            - 'Import-Module C:\Users\Public\'
            # Import-Module alias is "ipmo"
            - 'ipmo "$Env:Temp\'
            - ipmo '$Env:Temp\
            - 'ipmo $Env:Temp\'
            - 'ipmo "$Env:Appdata\'
            - ipmo '$Env:Appdata\
            - 'ipmo $Env:Appdata\'
            - 'ipmo C:\Users\Public\'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Microsoft Defender threat exclusion added (PowerShell)
description: Detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities
references:
- https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/troubleshoot-microsoft-defender-antivirus
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.001-Impair%20Defenses-Disable%20or%20Modify%20tool
- https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
- https://cloudbrothers.info/en/current-limits-defender-av-tamper-protection/
- https://www.intrinsec.com/apt27-analysis/
- https://cybersecuritynews-com.cdn.ampproject.org/c/s/cybersecuritynews.com/u-s-federal-network-hacked/?amp
- https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
tags:
- attack.defense_evasion
- attack.t1562.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection1_powershell_native:
    EventID: 800
    EventData|contains|all:
      - Add-MpPreference
      - Set-MpPreference
    EventData|contains:
      - ExclusionPath
      - ExclusionExtension
      - ExclusionProcess
      - ExclusionIpAddress 

  selection2_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - Add-MpPreference
      - Set-MpPreference
    Payload|contains:
      - ExclusionPath
      - ExclusionExtension
      - ExclusionProcess
      - ExclusionIpAddress 

  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - Add-MpPreference
      - Set-MpPreference
    ScriptBlockText|contains:
      - ExclusionPath
      - ExclusionExtension
      - ExclusionProcess
      - ExclusionIpAddress 

  condition: 1 of selection*
falsepositives:
- Unknown
level: high

title: Net.EXE Execution
id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
status: test
description: Detects execution of "Net.EXE".
references:
    - https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
    - https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html
    - https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html
    - https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe
author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)
date: 2019-01-16
modified: 2022-07-11
tags:
    - attack.discovery
    - attack.t1007
    - attack.t1049
    - attack.t1018
    - attack.t1135
    - attack.t1201
    - attack.t1069.001
    - attack.t1069.002
    - attack.t1087.001
    - attack.t1087.002
    - attack.lateral-movement
    - attack.t1021.002
    - attack.s0039
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\net.exe'
              - '\net1.exe'
        - OriginalFileName:
              - 'net.exe'
              - 'net1.exe'
    selection_cli:
        CommandLine|contains:
            - ' accounts'
            - ' group'
            - ' localgroup'
            - ' share'
            - ' start'
            - ' stop '
            - ' user'
            - ' view'
    condition: all of selection_*
falsepositives:
    - Likely
level: low

title: Obfuscated payload transfered via service name - Tchopper (command)
description: Detects scenarios where an attacker uses the Tchopper tool by abusing the display name of a service as a placeholder to upload an obfuscated payload. With this command, attacker appends the current service name to a file.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1027-Obfuscated%20Files%20or%20Information
- https://github.com/lawrenceamer/TChopper
tags:
- attack.defense_evasion
- attack.t1027
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # Full command: "powershell -command "Get-Service "seg243" | select -Expand DisplayName |out-file -append tmp_payload.txt""
  selection:
    EventID: 4688
    #ParentProcessName|endswith: # Only for informational purpose
    #  - \services.exe
    #  - \cmd.exe
    #Version: 2
    NewProcessName|endswith:
      - '\cmd.exe'        # Process spawned by \services.exe
      - '\powershell.exe' # Process spwaned by \cmd.exe
    CommandLine|contains|all:
      - powershell
      - command
      - out-file
      - append
      #- Get-Service # not present using the WMI mode
  condition: selection | count(EventRecordID) by Computer > 50
  timeframe: 20m
falsepositives:
- None
level: high

title: Outlook EnableUnsafeClientMailRules Setting Enabled - Registry
id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08
related:
    - id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a
      type: similar
    - id: 55f0a3a1-846e-40eb-8273-677371b8d912 # ProcCreation variation
      type: similar
status: test
description: Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros
references:
    - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-08
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Outlook\Security\EnableUnsafeClientMailRules'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Peach Sandstorm APT Process Activity Indicators
id: 2e7bbd54-2f26-476e-b4a1-ba5f1a012614
status: test
description: Detects process creation activity related to Peach Sandstorm APT
references:
    - https://twitter.com/MsftSecIntel/status/1737895710169628824
    - https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
author: X__Junior (Nextron Systems)
date: 2024-01-15
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'QP''s\*(58vaP!tF4'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
id: 02b18447-ea83-4b1b-8805-714a8a34546a
status: test
description: |
    Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory.
    The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/
author: frack113
date: 2022-03-06
modified: 2023-08-03
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\OfflineScannerShell.exe'
        - OriginalFileName: 'OfflineScannerShell.exe'
    filter_main_legit_dir:
        CurrentDirectory: 'C:\Program Files\Windows Defender\Offline\'
    filter_main_empty:
        CurrentDirectory: ''
    filter_main_null:
        CurrentDirectory: null
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

title: Potential RDP Session Hijacking Activity
id: 224f140f-3553-4cd1-af78-13d81bf9f7cc
status: test
description: Detects potential RDP Session Hijacking activity on Windows systems
references:
    - https://twitter.com/Moti_B/status/909449115477659651
author: '@juju4'
date: 2022-12-27
modified: 2024-12-01
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\tscon.exe'
        - OriginalFileName: 'tscon.exe'
    selection_integrity:
        IntegrityLevel:
            - 'System'
            - 'S-1-16-16384'
    condition: all of selection_*
falsepositives:
    - Administrative activity
level: medium

title: Potential RDP Tunneling Via SSH
id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d
related:
    - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da # plink.exe
      type: similar
status: test
description: Execution of ssh.exe to perform data exfiltration and tunneling through RDP
references:
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-12
modified: 2023-01-25
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ssh.exe'
        CommandLine|contains: ':3389'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Call To Win32_NTEventlogFile Class
id: caf201a9-c2ce-4a26-9c3a-2b9525413711
related:
    - id: e2812b49-bae0-4b21-b366-7c142eafcde2
      type: similar
status: test
description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-13
tags:
    - attack.defense-impairment
logsource:
    category: process_creation
    product: windows
detection:
    selection_class:
        CommandLine|contains: 'Win32_NTEventlogFile'
    selection_function:
        CommandLine|contains:
            - '.BackupEventlog('
            - '.ChangeSecurityPermissions('
            - '.ChangeSecurityPermissionsEx('
            - '.ClearEventLog('
            - '.Delete('
            - '.DeleteEx('
            - '.Rename('
            - '.TakeOwnerShip('
            - '.TakeOwnerShipEx('
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: PowerShell Download Pattern
id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
related:
    - id: e6c54d94-498c-4562-a37c-b469d8e9a275
      type: derived
    - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5
      type: obsolete
status: test
description: Detects a Powershell process that contains download commands in its command line string
references:
    - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html
    - https://lab52.io/blog/winter-vivern-all-summer/
    - https://hatching.io/blog/powershell-analysis/
author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
date: 2019-01-16
modified: 2025-10-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell_ise.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell_ISE.EXE'
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli:
        CommandLine|contains|all:
            - 'new-object'
            - 'net.webclient).'
            - 'download'
        CommandLine|contains:
            - 'string('
            - 'file('
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_download_patterns/info.yml

title: PowerShell Script Execution Policy Enabled
id: 8218c875-90b9-42e2-b60d-0b0069816d10
related:
    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814
      type: derived
status: test
description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.
references:
    - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts
author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo
date: 2023-10-18
tags:
    - attack.execution
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Policies\Microsoft\Windows\PowerShell\EnableScripts'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Likely
level: low

title: Process Initiated Network Connection To Ngrok Domain
id: 18249279-932f-45e2-b37a-8925f2597670
related:
    - id: 1d08ac94-400d-4469-a82f-daee9a908849
      type: similar
status: test
description: |
    Detects an executable initiating a network connection to "ngrok" domains.
    Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
    While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
references:
    - https://ngrok.com/
    - https://ngrok.com/blog-post/new-ngrok-domains
    - https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/
    - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
author: Florian Roth (Nextron Systems)
date: 2022-07-16
modified: 2025-07-30
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.t1567
    - attack.t1572
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith:
            - '.ngrok-free.app'
            - '.ngrok-free.dev'
            - '.ngrok.app'
            - '.ngrok.dev'
            - '.ngrok.io'
    condition: selection
falsepositives:
    - Legitimate use of the ngrok service.
# Note: The level of this rule is related to your internal policy.
level: high

title: Pulse Secure Attack CVE-2019-11510
id: 2dbc10d7-a797-49a8-8776-49efa6442e60
status: test
description: Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole
references:
    - https://www.exploit-db.com/exploits/47297
author: Florian Roth (Nextron Systems)
date: 2019-11-18
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2019-11510
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query: '*?/dana/html5acc/guacamole/*'
    condition: selection
falsepositives:
    - Unknown
level: critical

title: RTCore Suspicious Service Installation
id: 91c49341-e2ef-40c0-ac45-49ec5c3fe26c
status: test
description: Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse
references:
    - https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-30
tags:
    - attack.persistence
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ServiceName: 'RTCore64'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Service Reconnaissance Via Wmic.EXE
id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae
related:
    - id: 68bcd73b-37ef-49cb-95fc-edc809730be6
      type: similar
status: test
description: |
    An adversary might use WMI to check if a certain remote service is running on a remote device.
    When the test completes, a service information will be displayed on the screen if it exists.
    A common feedback message is that "No instance(s) Available" if the service queried is not running.
    A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
    - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service
author: frack113, Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-14
modified: 2026-01-07
tags:
    - attack.execution
    - attack.t1047
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains: 'service'
    filter_main_manipulation:
        # Duplicate with 0b7163dc-7eee-4960-af17-c0cd517f92da
        CommandLine|contains:
            - 'stopservice'
            - 'startservice'
    filter_main_win32_methods:
        CommandLine|contains:
            - 'Change'
            - 'Create'
            - 'Delete'
            - 'PauseService'
            - 'ResumeService'
            - 'SetSecurityDescriptor'
            - 'StartService'
            - 'StopService'
            - 'UserControlService'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium
simulation:
    - type: atomic-red-team
      name: WMI Reconnaissance List Remote Services
      technique: T1047
      atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml

title: SMB Spoolss Name Piped Usage
id: bae2865c-5565-470d-b505-9496c87d0c30
status: test
description: Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
references:
    - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
    - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
    - https://twitter.com/_dirkjan/status/1309214379003588608
author: OTR (Open Threat Research), @neu5ron
date: 2018-11-28
modified: 2022-10-09
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        path|endswith: 'IPC$'
        name: spoolss
    condition: selection
falsepositives:
    - Domain Controllers that are sometimes, commonly although should not be, acting as printer servers too
level: medium

title: Successful MSIX/AppX Package Installation
id: 289dfa9e-e378-4a56-a9d4-7ed5ee218029
status: experimental
description: |
    Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log.
    While most installations are legitimate, this can help identify unauthorized or suspicious package installations.
    It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.
references:
    - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-03
tags:
    - attack.execution
    - attack.t1204.002
    - detection.threat-hunting
logsource:
    product: windows
    service: appxdeployment-server
detection:
    selection:
        EventID: 854
    condition: selection
falsepositives:
    - Legitimate MSIX/AppX package installations
level: low

title: Suspicious HWP Sub Processes
id: 023394c4-29d5-46ab-92b8-6a534c6f447b
status: test
description: Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
references:
    - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
    - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1
    - https://twitter.com/cyberwar_15/status/1187287262054076416
    - https://blog.alyac.co.kr/1901
    - https://en.wikipedia.org/wiki/Hangul_(word_processor)
author: Florian Roth (Nextron Systems)
date: 2019-10-24
modified: 2021-11-27
tags:
    - attack.initial-access
    - attack.t1566.001
    - attack.execution
    - attack.t1203
    - attack.t1059.003
    - attack.g0032
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\Hwp.exe'
        Image|endswith: '\gbb.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Suspicious IP Throttling - critical settings manipulated
id: afb609fe-716f-11f0-b060-723487b9527c
status: experimental
description: |
    A threat actor can manipulate the critical settings of Suspicious IP Throttling, such as disabling
    the feature or setting it to a monitoring mode where no blocking occurs.
    This can allow malicious IPs to bypass protections and continue attacks without being blocked.
author: Okta
date: 2025-07-11
modified: 2025-09-02
logsource:
    product: auth0
detection:
    selection:
        data.type: sapi
        data.description: "Update Suspicious IP Throttling settings"
    filter:
        data.details.response.body.enabled:
            - false
        # Alternatively, if the feature is set to monitoring mode (no blocking or no admin notifications)
        # we can check for shields not containing "block" or "admin_notification"
    condition: selection or filter
explanation: >
    The query filters for an event indicating a change of Suspicious IP Throttling settings.
    The Splunk query below alerts when the feature is completely disabled or set into a monitoring mode,
    i.e. no blocking of IP is enabled or/and notifications to admin are turned off.
    It displays the modifying IP, the enabled mode, and that staus of admin notifications.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=sapi data.description="Update Suspicious IP Throttling settings"
    | fields data.details.response.body.shields{}, data.details.response.body.enabled, data.ip
    ```Take only the last change of configurations that reflects the current settings```
    | sort - _time
    | head 1
    | rename data.details.response.body.shields{} as shields
    | rename data.details.response.body.enabled as susp_ip_throttling_enabled
    | eval susp_ip_throttling_blocking = if(isnotnull(mvfind(shields, "block")), "true", "false")
    | eval susp_ip_throttling_admin_notifications = if(isnotnull(mvfind(shields, "admin_notification")), "true", "false")
    ```Alert when suspicious IP throttling is completely disabled or its blocking responses```
    | where susp_ip_throttling_enabled = "false" OR
            (susp_ip_throttling_enabled = "true" AND
            (susp_ip_throttling_blocking="false" OR
            susp_ip_throttling_admin_notifications="false"))
        ```Display the information in a table```
    | table _time, data.ip, shields, susp_ip_throttling_enabled, susp_ip_throttling_blocking,
    susp_ip_throttling_admin_notifications
comments:
    - The Splunk query above shall be tuned to reflect a valid tenant name.
    - Limit the detection to actions conducted from not white-listed IPs and/or particular users.
    - Adjust the "where" clauses when needed, i.e. if admin notifications are supposed to be disabled
      and not triggering an alert (susp_ip_throttling_admin_notifications).
    - This detection can be used for reporting of all changes of the suspicsiou IP throttling settings
      by removing the "where" and "head" clauses.
tenant_logs: |
    type: "sapi" AND description: "Update Suspicious IP Throttling settings"
prevention:
    - Control tenant admins, i.e. "Admin", as this role has permissions to modify any application.
    - Enforce MFA for tenant admins to reduce the risk of an adversary gaining access.
    - Control Management API scopes that allow modification of attack protection features - update:attack_protection.
    - Control usage of Management API from only trusted IPs by applying Network ACL scoped to "management".
falsepositives:
    - When custom domain has not been configured, all authentication happends through the canonical domain.
level: medium
tags:
    - attack.defense-evasion
    - attack.t1562
    - attack.t1562.007

title: Suspicious Machine Account Replication - DcSync Indicator
id: 611eab06-a145-4dfa-a295-3ccc5c20f59a
related:
    - id: 17d619c1-e020-4347-957e-1d1207455c93 # Active Directory Replication from Non Machine Account
      type: similar
status: test
description: |
    Detects suspicious Active Directory Replication Service (ADRS) requests originating from
    a machine account (SubjectUserName ending in '$') rather than a legitimate Domain Controller.

    Under normal operation, only Domain Controllers initiate replication requests carrying the
    DS-Replication-Get-Changes-All right. If a threat actor obtains valid machine account
    credentials — for example by abusing certificate-based authentication (PKINIT) to
    impersonate a DC after exploiting a CA vulnerability such as CVE-2026-54121 (Certighost),
    where a temporary machine account is created to request a DC certificate and then used to
    perform DCSync — they can dump all domain credential material including the krbtgt hash.
references:
    - https://twitter.com/gentilkiwi/status/1003236624925413376
    - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
    - https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
    - https://github.com/aniqfakhrul/CVE-2026-54121
author: Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermett, Sorina Ionescu
date: 2018-06-03
modified: 2026-07-30
tags:
    - attack.credential-access
    - attack.s0002
    - attack.t1003.006
    - cve.2026-54121
logsource:
    product: windows
    service: security
    definition: |
        Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com)
        to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties →
        Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to:
        This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All.
        The OS audit subcategory must also be enabled:
        auditpol /set /subcategory:"Directory Service Access" /success:enable
detection:
    selection:
        EventID: 4662
        Properties|contains:
            - '1131f6ad-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes-All
            - '1131f6aa-9c07-11d1-f79f-00c04fc2dcd2' # DS-Replication-Get-Changes
            - '9923a32a-3607-11d2-b9be-0000f87a36b2' # DS-Replication-Synchronize
            - '89e95b76-444d-4c62-991a-0facbeda640c' # DS-Replication-Get-Changes-In-Filtered-Set
        SubjectUserName|endswith: '$'
    filter_main_subject_usersid:
        SubjectUserSid|startswith: 'S-1-5-18'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Valid DC Sync that is not covered by the filters; please report
level: medium

title: Suspicious Workstation Locking via Rundll32
id: 3b5b0213-0460-4e3f-8937-3abf98ff7dcc
status: test
description: Detects a suspicious call to the user32.dll function that locks the user workstation
references:
    - https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/
author: frack113
date: 2022-06-04
modified: 2023-02-09
tags:
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_call_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    selection_call_parent:
        ParentImage|endswith: '\cmd.exe'
    selection_call_cli:
        CommandLine|contains: 'user32.dll,'
    selection_function:
        CommandLine|contains: 'LockWorkStation'
    condition: all of selection_*
falsepositives:
    - Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option
level: medium