Sigma rules: 3c

title: Abusing Print Executable
id: bafac3d6-7de9-4dd9-8874-4a1194b493ed
status: test
description: Attackers can use print.exe for remote file copy
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Print/
    - https://twitter.com/Oddvarmoe/status/985518877076541440
author: 'Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative'
date: 2020-10-05
modified: 2022-07-07
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\print.exe'
        CommandLine|startswith: 'print'
        CommandLine|contains|all:
            - '/D'
            - '.exe'
    filter_print:
        CommandLine|contains: 'print.exe'
    condition: selection and not filter_print
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_print_remote_file_copy/info.yml

title: Assembly DLL Creation Via AspNetCompiler
id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 # TMP File
related:
    - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 # SuspChild
      type: similar
    - id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 # Susp Paths
      type: similar
    - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 # Exec
      type: similar
status: test
description: |
    Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-14
tags:
    - attack.execution
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\aspnet_compiler.exe'
        TargetFilename|contains|all:
            - '\Temporary ASP.NET Files\'
            - '\assembly\tmp\'
            - '.dll'
    condition: selection
falsepositives:
    - Legitimate assembly compilation using a build provider
level: medium

title: Atera Agent Installation
id: 87261fb2-69d0-42fe-b9de-88c6b5f65a43
status: test
description: Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
references:
    - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
author: Bhabesh Raj
date: 2021-09-01
modified: 2022-12-25
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    service: application
    product: windows
detection:
    selection:
        EventID: 1033
        Provider_Name: MsiInstaller
        Message|contains: AteraAgent
    condition: selection
falsepositives:
    - Legitimate Atera agent installation
level: high

title: Axios NPM Compromise Indicators - macOS
id: a09ee860-31b3-4586-8a68-0ebd74ce0e5f
status: experimental
description: |
    Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.
author: Swachchhanda Shrawan Poudel (Nextron Systems)
references:
    - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
    - https://www.derp.ca/research/axios-npm-supply-chain-rat/
    - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
    - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
    - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09
date: 2026-04-01
tags:
    - attack.initial-access
    - attack.t1195.002
    - attack.execution
    - attack.command-and-control
    - attack.t1059.002
    - attack.t1059.004
    - attack.t1105
    - detection.emerging-threats
logsource:
    category: process_creation
    product: macos
detection:
    selection_osascript:
        CommandLine|contains|all:
            - 'nohup '
            - 'osascript '
            - '/tmp/6202033'
    selection_curl_download:
        CommandLine|contains|all:
            - 'curl '
            - 'packages.npm.org/product'
            - '/Library/Caches/com.apple.act.mond'
    selection_cleanup:
        CommandLine|contains|all:
            - 'rm '
            - '-rf '
            - '/tmp/6202033'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: Cloudflared Tunnel Connections Cleanup
id: 7050bba1-1aed-454e-8f73-3f46f09ce56a
status: test
description: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
references:
    - https://github.com/cloudflare/cloudflared
    - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-17
modified: 2023-12-21
tags:
    - attack.command-and-control
    - attack.t1102
    - attack.t1090
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - ' tunnel '
            - 'cleanup '
        CommandLine|contains:
            - '-config '
            - '-connector-id '
    condition: selection
falsepositives:
    - Legitimate usage of Cloudflared.
level: medium

title: Code Injection by ld.so Preload
id: 7e3c4651-c347-40c4-b1d4-d48590fdf684
status: test
description: Detects the ld.so preload persistence file. See `man ld.so` for more information.
references:
    - https://man7.org/linux/man-pages/man8/ld.so.8.html
author: Christian Burkard (Nextron Systems)
date: 2021-05-05
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.006
logsource:
    product: linux
detection:
    keywords:
        - '/etc/ld.so.preload'
    condition: keywords
falsepositives:
    - Rare temporary workaround for library misconfiguration
level: high

title: Diskshadow Script Mode - Uncommon Script Extension Execution
id: 1dde5376-a648-492e-9e54-4241dd9b0c7f
related:
    - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 # Diskshadow Script Mode - Execution From Potential Suspicious Location
      type: similar
    - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 # Potentially Suspicious Child Process Of DiskShadow.EXE
      type: similar
    - id: 56b1dde8-b274-435f-a73a-fb75eb81262a # Diskshadow Child Process Spawned
      type: similar
    - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 # Diskshadow Script Mode Execution
      type: similar
status: test
description: |
    Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension.
    Initial baselining of the allowed extension list is required.
references:
    - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
    - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
    - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
    - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
    - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware
    - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-15
modified: 2024-03-05
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'diskshadow.exe'
        - Image|endswith: '\diskshadow.exe'
    selection_flag:
        CommandLine|contains|windash: '-s '
    filter_main_ext:
        # Note: can be changed to an "endswith" to avoid rare FPs. But you need to account for quoted paths
        # Note: Using the ".txt" is based on the MS documentation example. Best add the extension you use internally before using this rule
        CommandLine|contains: '.txt'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - False postitve might occur with legitimate or uncommon extensions used internally. Initial baseline is required.
level: medium

title: Exchange transport agent installation artifacts (PowerShell)
description: Detects scenarios where an attacker attempts to load an artifact in the Exchange transport agent.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1505-Server%20Software%20Component
- https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook
- https://www.welivesecurity.com/wp-content/uploads/2019/05/ESET-LightNeuron.pdf
tags:
- attack.persistence
- attack.t1505.002 # Server Software Component: Transport Agent 
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains:
      - Enable-TransportAgent
      - Install-TransportAgent

  selection_powershell_modern:
    EventID: 4103
    Payload|contains:
      - Enable-TransportAgent
      - Install-TransportAgent

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains:
      - Enable-TransportAgent
      - Install-TransportAgent

  condition: 1 of selection*
falsepositives:
- rare administrator change
level: high

title: HackTool - WinPwn Execution
id: d557dc06-62e8-4468-a8e8-7984124908ce
related:
    - id: 851fd622-b675-4d26-b803-14bc7baa517a
      type: similar
status: test
description: |
    Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
author: Swachchhanda Shrawan Poudel
date: 2023-12-04
references:
    - https://github.com/S3cur3Th1sSh1t/WinPwn
    - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
    - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
    - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
    - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
tags:
    - attack.credential-access
    - attack.discovery
    - attack.execution
    - attack.privilege-escalation
    - attack.t1046
    - attack.t1082
    - attack.t1106
    - attack.t1518
    - attack.t1548.002
    - attack.t1552.001
    - attack.t1555
    - attack.t1555.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Offline_Winpwn'
            - 'WinPwn '
            - 'WinPwn.exe'
            - 'WinPwn.ps1'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_winpwn/info.yml

title: HackTool Named File Stream Created
id: 19b041f6-e583-40dc-b842-d6fa8011493f
status: test
description: Detects the creation of a named file stream with the imphash of a well-known hack tool
references:
    - https://github.com/gentilkiwi/mimikatz
    - https://github.com/topotam/PetitPotam
    - https://github.com/ohpe/juicy-potato
    - https://github.com/antonioCoco/RoguePotato
    - https://www.tarasco.org/security/pwdump_7/
    - https://github.com/fortra/nanodump
    - https://github.com/codewhitesec/HandleKatz
    - https://github.com/xuanxuan0/DripLoader
    - https://github.com/hfiref0x/UACME
    - https://github.com/outflanknl/Dumpert
    - https://github.com/wavestone-cdt/EDRSandblast
author: Florian Roth (Nextron Systems)
date: 2022-08-24
modified: 2024-11-23
tags:
    - attack.stealth
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
    definition: 'Requirements: Sysmon config with Imphash logging activated'
detection:
    selection:
        Hash|contains: # Sysmon field hashes contains all types
            - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 # PetitPotam
            - IMPHASH=3A19059BD7688CB88E70005F18EFC439 # PetitPotam
            - IMPHASH=bf6223a49e45d99094406777eb6004ba # PetitPotam
            - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 # Mimikatz
            - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 # Mimikatz
            - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF # Mimikatz
            - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 # Mimikatz
            - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F # Mimikatz
            - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A # Mimikatz
            - IMPHASH=672B13F4A0B6F27D29065123FE882DFC # Mimikatz
            - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F # Mimikatz
            - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D # Mimikatz
            - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 # Mimikatz
            - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 # Mimikatz
            - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 # Mimikatz
            - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 # Mimikatz
            - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 # Mimikatz
            - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 # Mimikatz
            - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 # JuicyPotato
            - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC # JuicyPotato
            - IMPHASH=F9A28C458284584A93B14216308D31BD # JuicyPotatoNG
            - IMPHASH=6118619783FC175BC7EBECFF0769B46E # RoguePotato
            - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA # RoguePotato
            - IMPHASH=563233BFA169ACC7892451F71AD5850A # RoguePotato
            - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 # RoguePotato
            - IMPHASH=13F08707F759AF6003837A150A371BA1 # Pwdump
            - IMPHASH=1781F06048A7E58B323F0B9259BE798B # Pwdump
            - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 # Pwdump
            - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D # Pwdump
            - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 # Pwdump
            - IMPHASH=713C29B396B907ED71A72482759ED757 # Pwdump
            - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F # Pwdump
            - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E # Pwdump
            - IMPHASH=8B114550386E31895DFAB371E741123D # Pwdump
            - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 # PwDumpX
            - IMPHASH=9D68781980370E00E0BD939EE5E6C141 # Pwdump
            - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE # Pwdump
            - IMPHASH=CB567F9498452721D77A451374955F5F # Pwdump
            - IMPHASH=730073214094CD328547BF1F72289752 # Htran
            - IMPHASH=17B461A082950FC6332228572138B80C # Cobalt Strike beacons
            - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 # Cobalt Strike beacons
            - IMPHASH=819B19D53CA6736448F9325A85736792 # Cobalt Strike beacons
            - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E # Cobalt Strike beacons
            - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 # PPLDump
            - IMPHASH=0588081AB0E63BA785938467E1B10CCA # PPLDump
            - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C # NanoDump
            - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 # NanoDump
            - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 # NanoDump
            - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 # NanoDump
            - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF # NanoDump
            - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE # NanoDump
            - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 # NanoDump
            - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 # NanoDump
            - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E # NanoDump
            - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 # NanoDump
            - IMPHASH=3AD59991CCF1D67339B319B15A41B35D # NanoDump
            - IMPHASH=FFDD59E0318B85A3E480874D9796D872 # NanoDump
            - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 # NanoDump
            - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 # NanoDump
            - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 # NanoDump
            - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 # HandleKatz
            - IMPHASH=0E2216679CA6E1094D63322E3412D650 # HandleKatz
            - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB # DripLoader
            - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 # DripLoader
            - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 # DripLoader
            - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 # DripLoader
            - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F # CreateMiniDump
            - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 # UACMe Akagi
            - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 # UACMe Akagi
            - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC # UACMe Akagi
            - IMPHASH=7D010C6BB6A3726F327F7E239166D127 # UACMe Akagi
            - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 # UACMe Akagi
            - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F # UACMe Akagi
            - IMPHASH=5834ED4291BDEB928270428EBBAF7604 # UACMe Akagi
            - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 # UACMe Akagi
            - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 # UACMe Akagi
            - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 # UACMe Akagi
            - IMPHASH=3DE09703C8E79ED2CA3F01074719906B # UACMe Akagi
            - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F # WCE
            - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 # WCE
            - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 # Sliver Stagers
            - IMPHASH=09D278F9DE118EF09163C6140255C690 # Dumpert
            - IMPHASH=03866661686829d806989e2fc5a72606 # Dumpert
            - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d # Dumpert
            - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE # SysmonEnte
            - IMPHASH=19584675D94829987952432E018D5056 # SysmonQuiet
            - IMPHASH=330768A4F172E10ACB6287B87289D83B # ShaprEvtMute Hook
            - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 # Forkatz
            - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC # PPLKiller
            - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 # PPLKiller
            - IMPHASH=96DF3A3731912449521F6F8D183279B1 # Backstab
            - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 # Backstab
            - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 # Backstab
            - IMPHASH=25CE42B079282632708FC846129E98A5 # Forensia
            - IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20 # EDRSandBlast
            - IMPHASH=59223B5F52D8799D38E0754855CBDF42 # EDRSandBlast
            - IMPHASH=81E75D8F1D276C156653D3D8813E4A43 # EDRSandBlast
            - IMPHASH=17244E8B6B8227E57FE709CCAD421420 # EDRSandBlast
            - IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4 # EDRSandBlast
            - IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C # EDRSandBlast
            - IMPHASH=40445337761D80CF465136FAFB1F63E6 # EDRSandBlast
            - IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6 # EDRSilencer
    condition: selection
falsepositives:
    - Unknown
level: high

title: Impacket SMBexec service creation (registry)
description: Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1112-Modify%20registry
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
- https://nv2lt.github.io/windows/smb-psexec-smbexec-winexe-how-to/
tags:
- attack.defense_evasion
- attack.t1112
- attack.privilege_execution
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains: \CurrentControlSet\Services\BTOBTO\ # Service name can be changed in the application name
    #Image|endswith: \services.exe
  condition: selection
falsepositives:
- None
level: high

title: LSASS dump via process access
description: Detects scenarios where an attacker attempt to dump LSASS process with tools like Mimikatz.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1003-Credential%20dumping
- https://threathunterplaybook.com/notebooks/windows/06_credential_access/WIN-191030201010.html
- https://medium.com/threatpunter/detecting-attempts-to-steal-passwords-from-memory-558f16dce4ea
- https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
tags:
- attack.credential_access
- attack.t1003.001
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_access
detection:
  selection:
    EventID: 10 # process accessed
    TargetImage|endswith: '\system32\lsass.exe'
    GrantedAccess:
      - '0x1410'
      - '0x1010'
      - '0x1438' # could refers to misc::memssp
      - '0x143a'
      - '0x1418'
      - '0x1fffff' # ProcDump
  filter:
    SourceImage:
      - '*\ProgramData\Microsoft\Windows Defender\Platform\*'
      - '*\Program Files\Windows Defender Advanced Threat Protection\*'
      - '*\system32\csrss.exe'
      - '*\system32\wininit.exe'
  condition: selection and not filter
falsepositives:
- Antivirus, security products, browsers
level: high

title: macOS XProtect Malware Detection
id: c1a51851-4230-4141-9601-5d9f0cde7b96
status: experimental
description: 'Detects XProtect malware detection and remediation events. XProtect
  is Apple''s

  built-in malware detection system. These events indicate confirmed malware

  presence and should trigger immediate incident response.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1204/
- https://support.apple.com/guide/security/protecting-against-malware-sec469d47bd8/web
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_detected:
    esf.event_type: 112
    event.action: xp_malware_detected
  selection_remediated:
    esf.event_type: 113
    event.action: xp_malware_remediated
  condition: selection_detected or selection_remediated
falsepositives:
- Security testing with known malware samples
- False positives from XProtect signatures (rare)
fields:
- event_type
- event_name
- ProcessId
- Image
- User
- file_path
tags:
- attack.execution
- attack.t1204
- attack.initial_access
level: critical

title: Medium risk local/domain local group membership change
description: Detects scenarios where a suspicious group membership is changed.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1098.xxx-Account%20manipulation
- https://ss64.com/nt/syntax-groups.html
- https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/security-identifiers
tags:
- attack.persistence
- attack.t1098
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4732 # local and domain local group
    TargetSid|startswith: 'S-1-5-32'
    TargetSid|endswith:
      - '-546'  # Guests
      - '-550'  # Print Operators
      - '-555'  # Remote Desktop Users
      - '-556'  # Network Configuration Operators
      - '-557'  # Incoming Forest Trust Builders
      - '-560'  # Windows Authorization Access Group
      - '-562'  # Distributed COM Users
      - '-568'  # IIS_IUSRS
      - '-569'  # Cryptographic Operators
      - '-573'  # Event Log Readers
      - '-574'  # Certificate Service DCOM Access
      - '-579'  # Access Control Assistance Operators
      - '-580'  # Remote Management Users
      - '-582'  # Storage Replica Administrators
      # add DnsAdmins group but has no default RID
  filter_sytem:
    SubjectUserSid: 'S-1-5-18' # LAPS or others IAM solutions may trigger this as a false positive
  filter_iis:
    TargetSid: "S-1-5-32-568" # IIS_IUSRS
    MemberSid: "S-1-5-20"     # Network service account
  condition: selection and not (filter_sytem OR filter_iis)
falsepositives:
- Administrator activity
level: high

title: Meterpreter or Cobalt Strike Getsystem Service Installation - Security
id: ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34
related:
    - id: 843544a7-56e0-4dcc-a44f-5cc266dd97d6
      type: derived
status: test
description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
date: 2019-10-26
modified: 2023-11-15
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1134.001
    - attack.t1134.002
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection_eid:
        EventID: 4697
    selection_cli_cmd:
        # meterpreter getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
        # cobaltstrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
        # cobaltstrike getsystem technique 1b (expanded %COMSPEC%): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
        ServiceFileName|contains|all:
            - '/c'
            - 'echo'
            - '\pipe\'
        ServiceFileName|contains:
            - 'cmd'
            - '%COMSPEC%'
    selection_cli_rundll:
        # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
        ServiceFileName|contains|all:
            - 'rundll32'
            - '.dll,a'
            - '/p:'
    selection_cli_share:
        ServiceFileName|startswith: '\\\\127.0.0.1\\ADMIN$\'  # https://twitter.com/svch0st/status/1413688851877416960?lang=en
    condition: selection_eid and 1 of selection_cli_*
falsepositives:
    - Unlikely
level: high

title: Microsoft Word Add-In Loaded
id: 1337afba-d17d-4d23-bd55-29b927603b30
status: test
description: |
    Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.
references:
    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
    - https://nored0x.github.io/red-teaming/office-persistence/#what-is-a-wll-file
author: Steffen Rogge (dr0pd34d)
date: 2024-07-10
tags:
    - attack.execution
    - attack.t1204.002
    - detection.threat-hunting
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\winword.exe'
        ImageLoaded|endswith: '.wll'
    condition: selection
falsepositives:
    - The rules is only looking for ".wll" loads. So some false positives are expected with legitimate and allowed WLLs.
level: low

title: Network Connection Initiated To Visual Studio Code Tunnels Domain
id: 4b657234-038e-4ad5-997c-4be42340bce4
related:
    - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 # Net Connection DevTunnels
      type: similar
    - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 # DNS VsCode
      type: similar
    - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b # DNS DevTunnels
      type: similar
status: test
description: |
    Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
references:
    - https://ipfyx.fr/post/visual-studio-code-tunnel/
    - https://badoption.eu/blog/2023/01/31/code_c2.html
    - https://cydefops.com/vscode-data-exfiltration
author: Kamran Saifullah
date: 2023-11-20
tags:
    - attack.exfiltration
    - attack.command-and-control
    - attack.t1567
    - attack.t1572
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|endswith: '.tunnels.api.visualstudio.com'
    condition: selection
falsepositives:
    - Legitimate use of Visual Studio Code tunnel will also trigger this.
level: medium

title: New Kind of Network (NKN) Detection
id: fa7703d6-0ee8-4949-889c-48c84bc15b6f
status: test
description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
references:
    - https://github.com/nknorg/nkn-sdk-go
    - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/
    - https://github.com/Maka8ka/NGLite
author: Michael Portera (@mportatoes)
date: 2022-04-21
tags:
    - attack.command-and-control
logsource:
    product: zeek
    service: dns
detection:
    selection:
        query|contains|all:
            - 'seed'
            - '.nkn.org'
    condition: selection
falsepositives:
    - Unknown
level: low

title: Potential CobaltStrike Service Installations - Registry
id: 61a7697c-cb79-42a8-a2ff-5f0cdfae0130
status: test
description: |
    Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.
references:
    - https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395
author: Wojciech Lesicki
date: 2021-06-29
modified: 2024-03-25
tags:
    - attack.persistence
    - attack.execution
    - attack.privilege-escalation
    - attack.lateral-movement
    - attack.t1021.002
    - attack.t1543.003
    - attack.t1569.002
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        - TargetObject|contains: '\System\CurrentControlSet\Services'
        - TargetObject|contains|all:
              - '\System\ControlSet'
              - '\Services'
    selection_details:
        - Details|contains|all:
              - 'ADMIN$'
              - '.exe'
        - Details|contains|all:
              - '%COMSPEC%'
              - 'start'
              - 'powershell'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential Encoded PowerShell Patterns In CommandLine
id: cdf05894-89e7-4ead-b2b0-0a5f97a90f2f
related:
    - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6
      type: similar
status: test
description: Detects specific combinations of encoding methods in PowerShell via the commandline
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
date: 2020-10-11
modified: 2023-01-26
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_to_1:
        CommandLine|contains:
            - 'ToInt'
            - 'ToDecimal'
            - 'ToByte'
            - 'ToUint'
            - 'ToSingle'
            - 'ToSByte'
    selection_to_2:
        CommandLine|contains:
            - 'ToChar'
            - 'ToString'
            - 'String'
    selection_gen_1:
        CommandLine|contains|all:
            - 'char'
            - 'join'
    selection_gen_2:
        CommandLine|contains|all:
            - 'split'
            - 'join'
    condition: selection_img and (all of selection_to_* or 1 of selection_gen_*)
falsepositives:
    - Unknown
level: low

title: Potential File Override/Append Via SET Command
id: 65e4c134-ee52-4099-9e35-5e17a4b45c62
status: test
description: |
    Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign.
    Attackers used this technique along with an append redirection operator ">>" in order to update the content of a file indirectly.
    Ex: cmd /c >> example.txt set /p="test data". This will append "test data" to contents of "example.txt".
    The typical use case of the "set /p=" command is to prompt the user for input.
references:
    - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
    - https://ss64.com/nt/set.html
author: Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan)
date: 2024-08-22
tags:
    - attack.execution
    - detection.threat-hunting
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\cmd.exe'
        - OriginalFileName: 'Cmd.Exe'
    selection_cli:
        CommandLine|contains:
            - '/c set /p='
            - '"set /p='
            - '>>*set /p=' # To catch edge cases where the attacker passes it via a "cmd /c"
    condition: all of selection_*
falsepositives:
    - Legitimate use of the SET with the "/p" flag for user prompting. command in administrative scripts or user-generated scripts.
level: low

title: Potential Java WebShell Upload in SAP NetViewer Server
id: 639b893f-f93a-4e53-a7c8-f08cf73fe7f7
status: experimental
description: |
    Detects potential Java webshell uploads via HTTP requests with Content-Type 'application/octet-stream' and Java file extensions.
    This behavior might indicate exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution through webshells in SAP NetViewer.
references:
    - https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-05-14
tags:
    - attack.persistence
    - attack.t1505.003
    - detection.emerging-threats
    - cve.2025-31324
logsource:
    category: webserver
detection:
    selection:
        cs-content-type: 'application/octet-stream'
        cs-method: 'POST'
        cs-uri-stem|contains|all:
            - '/irj/'
            - '.jsp'
        cs-uri-stem|endswith:
            - '.class'
            - '.java'
            - '.jsp'
    condition: selection
falsepositives:
    - Legitimate uploads of Java files in development environments
level: high

title: Potential Mpclient.DLL Sideloading
id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
related:
    - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
      type: similar
status: test
description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
author: Bhabesh Raj
date: 2022-08-02
modified: 2023-08-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '\mpclient.dll'
        Image|endswith:
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
    filter_main_known_locations:
        Image|startswith:
            - 'C:\Program Files (x86)\Windows Defender\'
            - 'C:\Program Files\Microsoft Security Client\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: PowerShell Create Local User
id: 243de76f-4725-4f2e-8225-a8a69b15ad61
status: test
description: Detects creation of a local user via PowerShell
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
author: '@ROxPinTeddy'
date: 2020-04-11
modified: 2022-12-25
tags:
    - attack.execution
    - attack.t1059.001
    - attack.persistence
    - attack.t1136.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains: 'New-LocalUser'
    condition: selection
falsepositives:
    - Legitimate user creation
level: medium

title: Ps.exe Renamed SysInternals Tool
id: 18da1007-3f26-470f-875d-f77faf1cab31
status: test
description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
references:
    - https://www.us-cert.gov/ncas/alerts/TA17-293A
author: Florian Roth (Nextron Systems)
date: 2017-10-22
modified: 2023-05-02
tags:
    - attack.stealth
    - attack.g0035
    - attack.t1036.003
    - car.2013-05-009
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'ps.exe -accepteula'
            - '-s cmd /c netstat'
    condition: selection
falsepositives:
    - Renamed SysInternals tool
level: high

title: RDP session hijack via TSCON abuse command
description: Detects scenarios where an attacker attempts to create a service that triggers TSCON in order to preform local RDP session hijack.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.001-Remote%20Desktop%20Protocol
- https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement
- https://www.csoonline.com/article/3566917/rdp-hijacking-attacks-explained-and-how-to-mitigate-them.html
- https://gist.github.com/bohops/f722f1a54d9ac1070350bdcaf2da618b
- https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
- https://twitter.com/bohops/status/992232940900962304
tags:
- attack.lateral_movement
- attack.t1563.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4688
    CommandLine|contains|all: # full command "sc.exe create random_service binpath= "cmd.exe /k tscon 2 /dest:rdp-tcp#5""
      - tscon
      - 'dest:rdp-'
  condition: selection
falsepositives:
- None
level: high

title: Role Assignment Created
id: c3425eff-76ea-42f5-8874-aeaa30d499fb
status: test
description:
    Creates role assignment.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/change-history-report#interpret-a-log-entry
author: Fukusuke Takahashi
date: 2025-12-02
tags:
    - attack.privilege-escalation
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName: MICROSOFT.AUTHORIZATION/ROLEASSIGNMENTS/WRITE
        properties.statusCode: Created
    condition: selection
falsepositives:
level: informational

title: Scheduled task creation with command line
description: Detects scenarios where an attacker creates a scheduled task via commmand line.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1053.005-Scheduled%20Task
- https://www.ired.team/offensive-security/persistence/t1053-schtask
- https://pentestlab.blog/2019/11/04/persistence-scheduled-tasks/
- http://www.fuzzysecurity.com/tutorials/19.html
- https://nasbench.medium.com/a-deep-dive-into-windows-scheduled-tasks-and-the-processes-running-them-218d1eed4cce
- https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
- https://www.darkoperator.com/blog/2009/4/11/abusing-the-scheduler-with-meterpreter.html
- https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
- https://strontic.github.io/xcyclopedia/library/schtasks.exe-5BD86A7193D38880F339D4AFB1F9B63A.html
- https://nasbench.medium.com/behind-the-detection-schtasks-eb67a33a8710
- https://redcanary.com/threat-detection-report/techniques/scheduled-task/
- https://www.linkedin.com/pulse/lolbin-attacks-scheduled-tasks-t1503005-how-detect-them-v%C3%B6gele
- https://www.elastic.co/security-labs/invisible-miners-unveiling-ghostengine
tags:
- attack.execution
- attack.t1053.005
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # Full command: "schtasks" /create /sc minute /mo 1 /tn eviltask /tr C:\tools\shell.cmd /ru SYSTEM
  selection:
    NewProcessName|endswith: \schtasks.exe
    CommandLine|contains: create
  filter:
    CommandLine|contains|all: # See schedule persistent rule with SYSTEM privileges
        #- ru      # Run with privileges from user X
        #- SYSTEM  # Run with SYSTEM privileges
      - tr      # Program, path or command to run
      - sc      # Run task every X minutes
  condition: selection and not filter
falsepositives:
- Administrator
level: medium

title: Security Software Discovery Via Powershell Script
id: 904e8e61-8edf-4350-b59c-b905fc8e810c
status: test
description: |
    Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes.
    Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell
author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)
date: 2021-12-16
modified: 2023-10-24
tags:
    - attack.discovery
    - attack.t1518.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_cmdlet:
        ScriptBlockText|contains:
            - 'get-process | \?'
            - 'get-process | where'
            - 'gps | \?'
            - 'gps | where'
    selection_field:
        ScriptBlockText|contains:
            - 'Company -like'
            - 'Description -like'
            - 'Name -like'
            - 'Path -like'
            - 'Product -like'
    selection_keywords:
        ScriptBlockText|contains:
            # Note: These strings are using wildcard assuming the search is using the "-like" operator.
            #       You can add specific variant with the actual process names to increase coverage
            - '\*avira\*'
            - '\*carbonblack\*'
            - '\*cylance\*'
            - '\*defender\*'
            - '\*kaspersky\*'
            - '\*malware\*'
            - '\*sentinel\*'
            - '\*symantec\*'
            - '\*virus\*'
    condition: all of selection_*
falsepositives:
    - False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required.
    - As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_get_process_security_software_discovery/info.yml