Sigma rules: 3e

title: Access To Windows Outlook Mail Files By Uncommon Applications
id: fc3e237f-2fef-406c-b90d-b3ae7e02fa8f
status: test
description: |
    Detects file access requests to Windows Outlook Mail by uncommon processes.
    Could indicate potential attempt of credential stealing.
    Requires heavy baselining before usage
references:
    - https://darkdefender.medium.com/windows-10-mail-app-forensics-39025f5418d2
    - https://github.com/redcanaryco/atomic-red-team/blob/58496ee3306e6e42a7054d36a94e6eb561ee3081/atomics/T1070.008/T1070.008.md#atomic-test-4---copy-and-modify-mailbox-data-on-windows
author: frack113
date: 2024-05-10
modified: 2024-07-29
tags:
    - attack.stealth
    - attack.t1070.008
    - detection.threat-hunting
logsource:
    category: file_access
    product: windows
    definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
    selection_unistore:
        FileName|contains: '\AppData\Local\Comms\Unistore\data'
    selection_unistoredb:
        FileName|endswith: '\AppData\Local\Comms\UnistoreDB\store.vol'
    filter_main_system:
        Image: 'System'
    filter_main_generic:
        # This filter is added to avoid large amount of FP with 3rd party software. You should remove this in favour of specific filter per-application
        Image|startswith:
            - 'C:\Program Files (x86)\'
            - 'C:\Program Files\'
            - 'C:\Windows\system32\'
            - 'C:\Windows\SysWOW64\'
    filter_optional_defender:
        Image|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
        Image|endswith:
            - '\MpCopyAccelerator.exe'
            - '\MsMpEng.exe'
    filter_optional_thor:
        Image|endswith:
            - '\thor64.exe'
            - '\thor.exe'
    condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Antivirus, Anti-Spyware, Anti-Malware Software
    - Backup software
    - Legitimate software installed on partitions other than "C:\"
    - Searching software such as "everything.exe"
# Note: Increase after initial baseline
level: low

title: Adwind RAT / JRAT File Artifact
id: 0bcfabcb-7929-47f4-93d6-b33fb67d34d1
related:
    - id: 1fac1481-2dbc-48b2-9096-753c49b4ec71
      type: derived
status: test
description: Detects javaw.exe in AppData folder as used by Adwind / JRAT
references:
    - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
    - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
date: 2017-11-10
modified: 2022-12-02
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: file_event
    product: windows
detection:
    selection:
        - TargetFilename|contains|all:
              - '\AppData\Roaming\Oracle\bin\java'
              - '.exe'
        - TargetFilename|contains|all:
              - '\Retrive'
              - '.vbs'
    condition: selection
level: high

title: BitLocker feature configuration (Reg via command)
description: Detects scenarios where an attacker configures BitLocker for ransomware purposes.
references:
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
- https://admx.help/?Category=MDOP&Policy=Microsoft.Policies.BitLockerManagement::BMSOSDEncryptionPolicy
- https://www.bleepingcomputer.com/news/microsoft/microsoft-iranian-hackers-encrypt-windows-systems-using-bitlocker/
tags:
- attack.impact
- attack.t1486
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    NewProcessName|endswith: \reg.exe
    CommandLine|contains|all: # Full command: "REG  ADD HKLM\SOFTWARE\Policies\Microsoft\FVE /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f"
      - REG ADD
      - '\SOFTWARE\Policies\Microsoft\FVE'
    CommandLine|contains:
      - UseTPM
      - UseTPMKey
      - UseTPMPIN
      - UseTPMKeyPIN
      - RecoveryKeyMessage
      - EnableBDEWithNoTPM
      - UseAdvancedStartup
      - RecoveryKeyMessageSource
  condition: selection
falsepositives:
- Initial BitLocker configuration via GPO
level: high

title: Cisco Sniffing
id: b9e1f193-d236-4451-aaae-2f3d2102120d
status: test
description: Show when a monitor or a span/rspan is setup or modified
author: Austin Clark
date: 2019-08-11
modified: 2023-01-04
tags:
    - attack.credential-access
    - attack.discovery
    - attack.t1040
logsource:
    product: cisco
    service: aaa
detection:
    keywords:
        - 'monitor capture point'
        - 'set span'
        - 'set rspan'
    condition: keywords
falsepositives:
    - Admins may setup new or modify old spans, or use a monitor for troubleshooting
level: medium

title: Curl.EXE Execution With Custom UserAgent
id: 3286d37a-00fd-41c2-a624-a672dcd34e60
status: test
description: Detects execution of curl.exe with custom useragent options
references:
    - https://curl.se/docs/manpage.html
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd
author: frack113
date: 2022-01-23
modified: 2023-02-21
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_curl:
        - Image|endswith: '\curl.exe'
        - Product: 'The curl executable'
    selection_opt:
        CommandLine|contains:
            - ' -A '
            - ' --user-agent '
    condition: all of selection_*
falsepositives:
    - Scripts created by developers and admins
    - Administrative activity
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_useragent/info.yml

title: Defrag Deactivation - Security
id: c5a178bf-9cfb-4340-b584-e4df39b6a3e7
related:
    - id: 958d81aa-8566-4cea-a565-59ccd4df27b0
      type: derived
status: test
description: Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group
references:
    - https://securelist.com/apt-slingshot/84312/
author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
date: 2019-03-04
modified: 2022-11-27
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053
    - attack.s0111
    - detection.emerging-threats
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit Policy : Audit Other Object Access Events > Success'
detection:
    selection:
        EventID: 4701
        TaskName: '\Microsoft\Windows\Defrag\ScheduledDefrag'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Diamond Sleet APT Scheduled Task Creation - Registry
id: 9f9f92ba-5300-43a4-b435-87d1ee571688
status: test
description: |
    Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability
references:
    - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-10-24
tags:
    - attack.defense-impairment
    - attack.t1685
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_event
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
            - 'Windows TeamCity Settings User Interface'
    condition: selection
falsepositives:
    - Unknown
level: high

title: DLL Sideloading by VMware Xfer Utility
id: ebea773c-a8f1-42ad-a856-00cb221966e8
status: test
description: Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL
references:
    - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-02
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\VMwareXferlogs.exe'
    filter: # VMware might be installed in another path so update the rule accordingly
        Image|startswith: 'C:\Program Files\VMware\'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

title: DNS TXT Answer with Possible Execution Strings
id: 8ae51330-899c-4641-8125-e39f2e07da72
status: test
description: Detects strings used in command execution in DNS TXT Answer
references:
    - https://twitter.com/stvemillertime/status/1024707932447854592
    - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1
author: Markus Neis
date: 2018-08-08
modified: 2021-11-27
tags:
    - attack.command-and-control
    - attack.t1071.004
logsource:
    category: dns
detection:
    selection:
        record_type: 'TXT'
        answer|contains:
            - 'IEX'
            - 'Invoke-Expression'
            - 'cmd.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: DoT (DNS over TLS) activation (command)
description: Detects scenarios where an attacker attempts to enable DNS over TLS in order to evade detection for command and control purposes.
references:
- https://techcommunity.microsoft.com/t5/networking-blog/dns-over-tls-available-to-windows-insiders/ba-p/3565859
- http://woshub.com/enable-dns-over-https-windows/
tags:
- attack.defense_evasion
- attack.command_and_control
- attack.t1071.004 
author: mdecrevoisier
status: stable
logsource:
  product: windows
  category: process_creation
detection:
  selection_baseline:
    EventID: 4688
    NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
    CommandLine|contains: add

  selection_enable: # full command: "netsh dns add global dot=yes"
    CommandLine|contains: 'dot=yes'

  selection_add_server: # full command: "netsh dns add encryption server=<resolver_ip> dothost=: autoupgrade=yes"
    CommandLine|contains: 'dothost='

  condition: selection_baseline and (selection_enable OR selection_add_server)
falsepositives:
- Legitimate DoT activation by administrators 
level: medium

title: Email Exifiltration Via Powershell
id: 312d0384-401c-4b8b-abdf-685ffba9a332
status: test
description: Detects email exfiltration via powershell cmdlets
references:
    - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
    - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml
author: Nasreddine Bencherchali (Nextron Systems),  Azure-Sentinel (idea)
date: 2022-09-09
tags:
    - attack.exfiltration
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains|all:
            - 'Add-PSSnapin'
            - 'Get-Recipient'
            - '-ExpandProperty'
            - 'EmailAddresses'
            - 'SmtpAddress'
            - '-hidetableheaders'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Firewall rule any/any created
description: Detects scenarios where a firewall rule any/any is added to allow any incoming or outgoing traffic.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0005-Defense%20Evasion/T1562.004-Impair%20Defenses-Disable%20or%20Modify%20System%20Firewall
- https://kb.eventtracker.com/evtpass/evtPages/EventId_2004_Microsoft-Windows-WindowsFirewallwithAdvancedS_65673.asp
tags:
- attack.defense_evasion
- attack.t1562.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: firewall-as
detection:
  selection_basic:
    EventID:
      - 2004  # new rule created
      - 2005  # existing rule modified
    Action: 3 # allow

  selection_any_port:
    LocalPorts: '*'
    RemotePorts: '*'

  selection_any_address:
    LocalAddresses: '*' 
    RemoteAddresses: '*'

  condition: selection_basic and (selection_any_port or selection_any_address)
falsepositives:
- Firewall rule debugging
level: high

title: HackTool - PowerTool Execution
id: a34f79a3-8e5f-4cc3-b765-de00695452c2
status: test
description: Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
references:
    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
    - https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
    - https://twitter.com/gbti_sa/status/1249653895900602375?lang=en
    - https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-11-29
modified: 2023-02-04
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        - Image|endswith:
              - '\PowerTool.exe'
              - '\PowerTool64.exe'
        - OriginalFileName: 'PowerTool.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Interactive privileged shell triggered by schedule task (deprecated)
description: Detects scenarios where an attacker abuse the at command to elevate privilages. Note that at command is deprecated since Windows 8 and replaced by schtask.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1053.005-Scheduled%20Task
- https://docs.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/use-at-command-to-schedule-tasks
- https://strontic.github.io/xcyclopedia/library/at.exe-5FD22B915C232378E567160D641CC9F2.html
- https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
- https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
- https://www.linkedin.com/pulse/lolbin-attacks-scheduled-tasks-t1503005-how-detect-them-v%C3%B6gele
tags:
- attack.execution
- attack.t1053.005
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: \cmd.exe
    CommandLine|contains|all:
      - at
      - interactive
      - cmd
  condition: selection
falsepositives:
- None
level: high

title: Kerberos Manipulation
id: f7644214-0eb0-4ace-9455-331ec4c09253
status: test
description: Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
author: Florian Roth (Nextron Systems)
date: 2017-02-10
modified: 2024-01-16
tags:
    - attack.credential-access
    - attack.t1212
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID:
            - 675
            - 4768
            - 4769
            - 4771
        Status:
            - '0x9'
            - '0xA'
            - '0xB'
            - '0xF'
            - '0x10'
            - '0x11'
            - '0x13'
            - '0x14'
            - '0x1A'
            - '0x1F'
            - '0x21'
            - '0x22'
            - '0x23'
            - '0x24'
            - '0x26'
            - '0x27'
            - '0x28'
            - '0x29'
            - '0x2C'
            - '0x2D'
            - '0x2E'
            - '0x2F'
            - '0x31'
            - '0x32'
            - '0x3E'
            - '0x3F'
            - '0x40'
            - '0x41'
            - '0x43'
            - '0x44'
    condition: selection
falsepositives:
    - Faulty legacy applications
level: high

title: Local group membership change
description: Detects if a member is added to a local group via PowerShell.
references:
- 
tags:
- attack.persistence
- attack.t1098 # account manipulation
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # Add-LocalGroupMember -Group "Administrators" -Member "Admin02",
  selection1_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'Add-LocalGroupMember'
      - '-Group'
      - '-Member'

  selection2_powershell_modern:
    EventID: 4103
      - 'Add-LocalGroupMember'
      - '-Group'
      - '-Member'
  
  selection3_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'Add-LocalGroupMember'
      - '-Group'
      - '-Member'

  condition: 1 of selection*
falsepositives:
- Pentest
- Administrator activity
- Splunk UF agent installation
level: high

title: Microsoft 365 - Potential Ransomware Activity
id: bd132164-884a-48f1-aa2d-c6d646b04c69
status: test
description: Detects when a Microsoft Cloud App Security reported when a user uploads files to the cloud that might be infected with ransomware.
references:
    - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
    - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
author: austinsonger
date: 2021-08-19
modified: 2022-10-09
tags:
    - attack.impact
    - attack.t1486
logsource:
    service: threat_management
    product: m365
detection:
    selection:
        eventSource: SecurityComplianceCenter
        eventName: 'Potential ransomware activity'
        status: success
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Mimikatz driver deployed via service
description: Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://posts.specterops.io/mimidrv-in-depth-4d273d19e148?gi=a5033fbeb71d
- https://gorkemkaradeniz.medium.com/defeating-runasppl-utilizing-vulnerable-drivers-to-read-lsass-with-mimikatz-28f4b50b1de5
tags:
- attack.privilege_escalation
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: 
    - system
    - security
detection:
  selection:
    EventID:
      - 4697 # SECURITY logs: new service
      - 7045 # SYSTEM logs: new service
    ServiceName|contains:
      - mimidrv
      - mimikatz
  condition: selection
falsepositives:
- None
level: high

title: Network Connection Initiated By Eqnedt32.EXE
id: a66bc059-c370-472c-a0d7-f8fd1bf9d583
status: test
description: Detects network connections from the Equation Editor process "eqnedt32.exe".
references:
    - https://twitter.com/forensicitguy/status/1513538712986079238
    - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/
    - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/
author: Max Altgelt (Nextron Systems)
date: 2022-04-14
modified: 2024-05-31
tags:
    - attack.execution
    - attack.t1203
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\eqnedt32.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: New Network Route Added
id: c803b2ce-c4a2-4836-beae-b112010390b1
status: test
description: |
    Detects the addition of a new network route to a route table in AWS.
references:
    - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/
author: jamesc-grafana
date: 2024-07-11
tags:
    - attack.defense-impairment
    - attack.t1686.001
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ec2.amazonaws.com'
        eventName: 'CreateRoute'
    condition: selection
falsepositives:
    - New VPC Creation requiring setup of a new route table
    - New subnets added requiring routing setup
level: medium

title: OpenCanary - GIT Clone Request
id: 4fe17521-aef3-4e6a-9d6b-4a7c8de155a8
status: test
description: Detects instances where a GIT service on an OpenCanary node has had Git Clone request.
references:
    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
author: Security Onion Solutions
date: 2024-03-08
tags:
    - attack.collection
    - attack.t1213
logsource:
    category: application
    product: opencanary
detection:
    selection:
        logtype: 16001
    condition: selection
falsepositives:
    - Unlikely
level: high

title: OpenCanary - SSH New Connection Attempt
id: cd55f721-5623-4663-bd9b-5229cab5237d
status: test
description: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
references:
    - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
    - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52
author: Security Onion Solutions
date: 2024-03-08
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.lateral-movement
    - attack.persistence
    - attack.stealth
    - attack.t1133
    - attack.t1021
    - attack.t1078
logsource:
    category: application
    product: opencanary
detection:
    selection:
        logtype: 4000
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Password policy discovery via commandline
description: Detects scenarios where an attacker attempts to enumerate the password policy via commandline.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0007-Discovery/T1201-Password%20Policy%20Discovery
- https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
- https://attack.mitre.org/software/S0039/
tags:
- attack.discovery
- attack.t1201
author: mdecrevoisier
logsource:
  product: windows
  category: process_creation
detection:
  selection: # Full command example: 'net accounts [/domain]'
    NewProcessName|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains|all:
      - accounts
      - /do # refers to '/domain'
  condition: selection
falsepositives:
- Pentest
level: high

title: Potential Ursnif Malware Activity - Registry
id: 21f17060-b282-4249-ade0-589ea3591558
status: test
description: Detects registry keys related to Ursnif malware.
references:
    - https://blog.yoroi.company/research/ursnif-long-live-the-steganography/
    - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
author: megan201296
date: 2019-02-13
modified: 2025-10-22
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_add
detection:
    selection:
        TargetObject|endswith: '\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-7C9D-AB0E-15700F2219A4'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Malware Callback Communication - Linux
id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376
related:
    - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
      type: derived
status: test
description: |
    Detects programs that connect to known malware callback ports based on threat intelligence reports.
references:
    - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections
    - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team
    - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
    - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html
    - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors
author: hasselj
date: 2024-05-10
tags:
    - attack.persistence
    - attack.command-and-control
    - attack.t1571
logsource:
    category: network_connection
    product: linux
detection:
    selection:
        Initiated: 'true'
        DestinationPort:
            - 888
            - 999
            - 2200
            - 2222
            - 4000
            - 4444
            - 6789
            - 8531
            - 50501
            - 51820
    filter_main_local_ranges:
        DestinationIp|cidr:
            - '127.0.0.0/8'
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
            - '::1/128'         # IPv6 loopback
            - 'fe80::/10'       # IPv6 link-local addresses
            - 'fc00::/7'        # IPv6 private addresses
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: PUA - Crassus Execution
id: 2c32b543-1058-4808-91c6-5b31b8bed6c5
status: test
description: Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.
references:
    - https://github.com/vu-ls/Crassus
author: pH-T (Nextron Systems)
date: 2023-04-17
tags:
    - attack.discovery
    - attack.reconnaissance
    - attack.t1590.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\Crassus.exe'
        - OriginalFileName: 'Crassus.exe'
        - Description|contains: 'Crassus'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Remote Registry Recon
id: d8ffe17e-04be-4886-beb9-c1dd1944b9a8
status: test
description: Detects remote RPC calls to collect information
references:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
author: Sagie Dulce, Dekel Paz
date: 2022-01-01
tags:
    - attack.discovery
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:338cd001-2244-31f1-aaaa-900038001003"'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: 338cd001-2244-31f1-aaaa-900038001003
    filter:
        OpNum:
            - 6
            - 7
            - 8
            - 13
            - 18
            - 19
            - 21
            - 22
            - 23
            - 35
    condition: selection and not filter
falsepositives:
    - Remote administration of registry values
level: high

title: Shell Execution via Nice - Linux
id: 093d68c7-762a-42f4-9f46-95e79142571a
status: test
description: |
    Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
references:
    - https://gtfobins.github.io/gtfobins/nice/#shell
    - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
date: 2024-09-02
tags:
    - attack.discovery
    - attack.t1083
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/nice'
        CommandLine|endswith:
            - '/bin/bash'
            - '/bin/dash'
            - '/bin/fish'
            - '/bin/sh'
            - '/bin/zsh'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Suspicious Executable File Creation
id: 74babdd6-a758-4549-9632-26535279e654
status: test
description: |
    Detect creation of suspicious executable file names.
    Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
references:
    - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
    - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/
author: frack113
date: 2022-09-05
modified: 2023-12-11
tags:
    - attack.stealth
    - attack.t1564
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - ':\$Recycle.Bin.exe'
            - ':\Documents and Settings.exe'
            - ':\MSOCache.exe'
            - ':\PerfLogs.exe'
            - ':\Recovery.exe'
            - '.bat.exe'
            - '.sys.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Suspicious Response File Execution Via Odbcconf.EXE
id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5
related:
    - id: 5f03babb-12db-4eec-8c82-7b4cb5580868
      type: derived
    - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e
      type: obsolete
status: test
description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.
references:
    - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
    - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
    - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-22
modified: 2024-03-13
tags:
    - attack.stealth
    - attack.t1218.008
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\odbcconf.exe'
        - OriginalFileName: 'odbcconf.exe'
    selection_cli:
        CommandLine|contains|windash: ' -f '
    filter_main_rsp_ext:
        CommandLine|contains: '.rsp'
    filter_main_runonce_odbc:
        # When odbcconf is run with the "/R" flag, it creates a "runonce" key to run at the next reboot
        ParentImage: 'C:\Windows\System32\runonce.exe'
        Image: 'C:\Windows\System32\odbcconf.exe'
        CommandLine|contains: '.exe /E /F "C:\WINDOWS\system32\odbcconf.tmp"'
    condition: all of selection_* and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Suspicious Velociraptor Child Process
id: 4bc90587-e6ca-4b41-be0b-ed4d04e4ed0c
status: experimental
description: Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.
references:
    - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-08-29
tags:
    - attack.command-and-control
    - attack.persistence
    - attack.t1219
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\Velociraptor.exe'
    selection_child_vscode_tunnel:
        CommandLine|contains|all:
            - 'code.exe'
            - 'tunnel'
            - '--accept-server-license-terms'
    selection_child_msiexec:
        CommandLine|contains|all:
            - 'msiexec'
            - '/i'
            - 'http'
    selection_child_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\powershell_ise.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Invoke-WebRequest '
            - 'IWR '
            - '.DownloadFile'
            - '.DownloadString'
    # Add more child process patterns as needed
    condition: selection_parent and 1 of selection_child_*
falsepositives:
    - Legitimate administrators or incident responders might use Velociraptor to execute scripts or tools. However, the combination of Velociraptor spawning these specific processes with these command lines is suspicious. Tuning may be required to exclude known administrative actions or specific scripts.
level: high

title: Tap Driver Installation - Security
id: 9c8afa4d-0022-48f0-9456-3712466f9701
related:
    - id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9
      type: derived
status: test
description: |
    Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.
references:
    - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
author: Daniil Yugoslavskiy, Ian Davis, oscd.community
date: 2019-10-24
modified: 2022-11-29
tags:
    - attack.exfiltration
    - attack.t1048
logsource:
    product: windows
    service: security
    definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697'
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains: 'tap0901'
    condition: selection
falsepositives:
    - Legitimate OpenVPN TAP installation
level: low

title: Usage Of Web Request Commands And Cmdlets - ScriptBlock
id: 1139d2e2-84b1-4226-b445-354492eba8ba
related:
    - id: 9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d
      type: derived
status: test
description: Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs
references:
    - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
    - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
author: James Pemberton / @4A616D6573
date: 2019-10-24
modified: 2025-10-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - '[System.Net.WebRequest]::create'
            - 'curl '
            - 'Invoke-RestMethod'
            - 'Invoke-WebRequest'
            - ' irm ' # Space before and after to avoid false positives with 'irm' as a substring
            - 'iwr '
            # - 'Net.WebClient' # There are various other rules that cover this, so it is commented out
            - 'Resume-BitsTransfer'
            - 'Start-BitsTransfer'
            - 'wget '
            - 'WinHttp.WinHttpRequest'
    filter:
        Path|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
    condition: selection and not filter
falsepositives:
    - Use of Get-Command and Get-Help modules to reference Invoke-WebRequest and Start-BitsTransfer.
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets/info.yml