Sigma rules: 3g

title: Adwind RAT / JRAT
id: 1fac1481-2dbc-48b2-9096-753c49b4ec71
status: test
description: Detects javaw.exe in AppData folder as used by Adwind / JRAT
references:
    - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
    - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
date: 2017-11-10
modified: 2022-10-09
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains|all:
              - '\AppData\Roaming\Oracle'
              - '\java'
              - '.exe '
        - CommandLine|contains|all:
              - 'cscript.exe'
              - 'Retrive'
              - '.vbs '
    condition: selection
level: high

title: Azure Device or Configuration Modified or Deleted
id: 46530378-f9db-4af9-a9e5-889c177d3881
status: test
description: Identifies when a device or device configuration in azure is modified or deleted.
references:
    - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
author: Austin Songer @austinsonger
date: 2021-09-03
modified: 2022-10-09
tags:
    - attack.impact
    - attack.t1485
    - attack.t1565.001
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        properties.message:
            - Delete device
            - Delete device configuration
            - Update device
            - Update device configuration
    condition: selection
falsepositives:
    - Device or device configuration being modified or deleted may be performed by a system administrator.
    - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

title: Azure Network Security Configuration Modified or Deleted
id: d22b4df4-5a67-4859-a578-8c9a0b5af9df
status: test
description: Identifies when a network security configuration is modified or deleted.
references:
    - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
author: Austin Songer @austinsonger
date: 2021-08-08
modified: 2022-08-23
tags:
    - attack.impact
logsource:
    product: azure
    service: activitylogs
detection:
    selection:
        operationName:
            - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/WRITE
            - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/DELETE
            - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE
            - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/DELETE
            - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/JOIN/ACTION
            - MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE
    condition: selection
falsepositives:
    - Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

title: Brutforce on Windows OpenSSH server with valid users
name: bruteforce_openssh_vaild_users
description: Detects scenarios where an attacker attempts to SSH brutforce a Windows OpenSSH server with a valid user.
remarks: This requires to have previously enabled the builtin OpenSSH server or to have installed the "OpenSSH-Win64" component. IpAddress or Workstation fields may be empty. In case Workstation field is not empty, be aware that it may wrongly report the source host. Also note that SSH logins are reported with logon type 8 (clear text). For reliable source IP information, use the logs from the OpenSSH channel, event ID 4.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://winaero.com/enable-openssh-server-windows-10/
  - https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
  - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    SubStatus: "0xc000006A" # invalid password | Failure code can be defined in "Status" or "Substatus" fields. Usually, if Substatus == 0x0, refers to Status.
    ProcessName|endswith: # Can be "C:\Program Files\OpenSSH-Win64\sshd.exe" or "C:\Windows\system32\OpenSSH\sshd.exe"
      - '\sshd.exe'
      - '\ssh.exe'
  condition: selection
falsepositives:
  - None
level: high

---
title: Brutforce on Windows OpenSSH server with valid users Count
status: experimental
correlation:
  type: value_count
  rules:
    - bruteforce_openssh_vaild_users # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: EventRecordID
level: high

title: Creation of an Executable by an Executable
id: 297afac9-5d02-4138-8c58-b977bac60556
status: test
description: Detects the creation of an executable by another executable.
references:
    - Internal Research
author: frack113
date: 2022-03-09
modified: 2025-02-24
tags:
    - attack.resource-development
    - attack.t1587.001
    - detection.threat-hunting
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '.exe'
        TargetFilename|endswith: '.exe'
    filter_main_generic_1:
        Image|endswith:
            - ':\Windows\System32\msiexec.exe'
            - ':\Windows\system32\cleanmgr.exe'
            - ':\Windows\explorer.exe'
            - ':\WINDOWS\system32\dxgiadaptercache.exe'
            - ':\WINDOWS\system32\Dism.exe'
            - ':\Windows\System32\wuauclt.exe'
    filter_main_update:
        # Security_UserID: S-1-5-18
        # Example:
        #   TargetFilename: C:\Windows\SoftwareDistribution\Download\803d1df4c931df4f3e50a022cda56e88\WindowsUpdateBox.exe
        Image|endswith: ':\WINDOWS\system32\svchost.exe'
        TargetFilename|contains: ':\Windows\SoftwareDistribution\Download\'
    filter_main_upgrade:
        Image|endswith: ':\Windows\system32\svchost.exe'
        TargetFilename|contains|all:
            # Example:
            #   This example was seen during windows upgrade
            #   TargetFilename: :\WUDownloadCache\803d1df4c931df4f3e50a022cda56e29\WindowsUpdateBox.exe
            - ':\WUDownloadCache\'
            - '\WindowsUpdateBox.exe'
    filter_main_windows_update_box:
        # This FP was seen during Windows Upgrade
        # ParentCommandLine: C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauserv
        Image|contains: ':\WINDOWS\SoftwareDistribution\Download\'
        Image|endswith: '\WindowsUpdateBox.Exe'
        TargetFilename|contains: ':\$WINDOWS.~BT\Sources\'
    filter_main_tiworker:
        Image|contains: ':\Windows\WinSxS\'
        Image|endswith: '\TiWorker.exe'
    filter_main_programfiles:
        - Image|contains:
              - ':\Program Files\'
              - ':\Program Files (x86)\'
        - TargetFilename|contains:
              - ':\Program Files\'
              - ':\Program Files (x86)\'
    filter_main_defender:
        Image|contains:
            - ':\ProgramData\Microsoft\Windows Defender\'
            - ':\Program Files\Windows Defender\'
    filter_main_windows_apps:
        TargetFilename|contains: '\AppData\Local\Microsoft\WindowsApps\'
    filter_main_teams:
        Image|endswith: '\AppData\Local\Microsoft\Teams\Update.exe'
        TargetFilename|endswith:
            - '\AppData\Local\Microsoft\Teams\stage\Teams.exe'
            - '\AppData\Local\Microsoft\Teams\stage\Squirrel.exe'
            - '\AppData\Local\Microsoft\SquirrelTemp\tempb\'
    filter_main_mscorsvw:
        # Example:
        #   ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" ExecuteQueuedItems /LegacyServiceBehavior
        #   Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
        #       TargetFilename: C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\4f8c-0\MSBuild.exe
        #       TargetFilename: C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\49bc-0\testhost.net47.x86.exe
        #       TargetFilename: C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\39d8-0\fsc.exe
        Image|contains:
            - ':\Windows\Microsoft.NET\Framework\'
            - ':\Windows\Microsoft.NET\Framework64\'
            - ':\Windows\Microsoft.NET\FrameworkArm\'
            - ':\Windows\Microsoft.NET\FrameworkArm64\'
        Image|endswith: '\mscorsvw.exe'
        TargetFilename|contains: ':\Windows\assembly\NativeImages_'
    filter_main_vscode:
        Image|contains: '\AppData\Local\'
        Image|endswith: '\Microsoft VS Code\Code.exe'
        TargetFilename|contains: '\.vscode\extensions\'
    filter_main_githubdesktop:
        Image|endswith: '\AppData\Local\GitHubDesktop\Update.exe'
        # Example TargetFileName:
        #   \AppData\Local\SquirrelTemp\tempb\lib\net45\GitHubDesktop_ExecutionStub.exe
        #   \AppData\Local\SquirrelTemp\tempb\lib\net45\squirrel.exe
        TargetFilename|contains: '\AppData\Local\SquirrelTemp\'
    filter_main_windows_temp:
        - Image|contains: ':\WINDOWS\TEMP\'
        - TargetFilename|contains: ':\WINDOWS\TEMP\'
    filter_optional_python:
        Image|contains: '\Python27\python.exe'
        TargetFilename|contains:
            - '\Python27\Lib\site-packages\'
            - '\Python27\Scripts\'
            - '\AppData\Local\Temp\'
    filter_optional_squirrel:
        Image|contains: '\AppData\Local\SquirrelTemp\Update.exe'
        TargetFilename|contains: '\AppData\Local'
    filter_main_temp_installers:
        - Image|contains: '\AppData\Local\Temp\'
        - TargetFilename|contains: '\AppData\Local\Temp\'
    filter_optional_chrome:
        Image|endswith: '\ChromeSetup.exe'
        TargetFilename|contains: '\Google'
    filter_main_dot_net:
        Image|contains: ':\Windows\Microsoft.NET\Framework'
        Image|endswith: '\mscorsvw.exe'
        TargetFilename|contains: ':\Windows\assembly'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    # Please contribute to FP to increase the level
    - Software installers
    - Update utilities
    - 32bit applications launching their 64bit versions
level: low

title: Data Compressed
id: a3b5e3e9-1b49-4119-8b8e-0344a01f21ee
status: test
description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/a78b9ed805ab9ea2e422e1aa7741e9407d82d7b1/atomics/T1560.001/T1560.001.md
author: Timur Zinniatullin, oscd.community
date: 2019-10-21
modified: 2023-07-28
tags:
    - attack.exfiltration
    - attack.collection
    - attack.t1560.001
logsource:
    product: linux
    service: auditd
detection:
    selection1:
        type: 'execve'
        a0: 'zip'
    selection2:
        type: 'execve'
        a0: 'gzip'
        a1: '-k'
    selection3:
        type: 'execve'
        a0: 'tar'
        a1|contains: '-c'
    condition: 1 of selection*
falsepositives:
    - Legitimate use of archiving tools by legitimate user.
level: low

title: DD File Overwrite
id: 2953194b-e33c-4859-b9e8-05948c167447
status: test
description: Detects potential overwriting and deletion of a file using DD.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2022-07-07
tags:
    - attack.impact
    - attack.t1485
logsource:
    product: linux
    category: process_creation
detection:
    selection1:
        Image:
            - '/bin/dd'
            - '/usr/bin/dd'
    selection2:
        CommandLine|contains: 'of='
    selection3:
        CommandLine|contains:
            - 'if=/dev/zero'
            - 'if=/dev/null'
    condition: all of selection*
falsepositives:
    - Any user deleting files that way.
level: low

title: DLL Load via LSASS
id: b3503044-60ce-4bf4-bbcb-e3db98788823
status: test
description: Detects a method to load DLL via LSASS process using an undocumented Registry key
references:
    - https://blog.xpnsec.com/exploring-mimikatz-part-1/
    - https://twitter.com/SBousseaden/status/1183745981189427200
author: Florian Roth (Nextron Systems)
date: 2019-10-16
modified: 2022-04-21
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1547.008
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\CurrentControlSet\Services\NTDS\DirectoryServiceExtPt'
            - '\CurrentControlSet\Services\NTDS\LsaDbExtPt'
    filter_domain_controller:
        Image: 'C:\Windows\system32\lsass.exe'
        Details:
            - '%%systemroot%%\system32\ntdsa.dll'
            - '%%systemroot%%\system32\lsadb.dll'
    condition: selection and not 1 of filter_*
falsepositives:
    - Unknown
level: high

title: DNS Query To Ufile.io - DNS Client
id: 090ffaad-c01a-4879-850c-6d57da98452d
related:
    - id: 1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b
      type: similar
status: test
description: Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration
references:
    - https://thedfirreport.com/2021/12/13/diavol-ransomware/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-16
modified: 2023-09-18
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    service: dns-client
    definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.'
detection:
    selection:
        EventID: 3008
        QueryName|contains: 'ufile.io'
    condition: selection
falsepositives:
    - DNS queries for "ufile" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take
level: low

title: Google Cloud Kubernetes Secrets Modified or Deleted
id: 2f0bae2d-bf20-4465-be86-1311addebaa3
status: test
description: Identifies when the Secrets are Modified or Deleted.
references:
    - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging
author: Austin Songer @austinsonger
date: 2021-08-09
modified: 2022-10-09
tags:
    - attack.credential-access
logsource:
    product: gcp
    service: gcp.audit
detection:
    selection:
        gcp.audit.method_name:
            - io.k8s.core.v*.secrets.create
            - io.k8s.core.v*.secrets.update
            - io.k8s.core.v*.secrets.patch
            - io.k8s.core.v*.secrets.delete
    condition: selection
falsepositives:
    - Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.
    - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule.
level: medium

title: Hijack Legit RDP Session to Move Laterally
id: 52753ea4-b3a0-4365-910d-36cff487b789
status: test
description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
author: Samir Bousseaden
references:
    - Internal Research
date: 2019-02-21
modified: 2021-11-27
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\mstsc.exe'
        TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Import PowerShell Modules From Suspicious Directories - ProcCreation
id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3
related:
    - id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab
      type: similar
status: test
description: Detects powershell scripts that import modules from suspicious directories
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-10
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Import-Module "$Env:Temp\'
            - Import-Module '$Env:Temp\
            - 'Import-Module $Env:Temp\'
            - 'Import-Module "$Env:Appdata\'
            - Import-Module '$Env:Appdata\
            - 'Import-Module $Env:Appdata\'
            - 'Import-Module C:\Users\Public\'
            # Import-Module alias is "ipmo"
            - 'ipmo "$Env:Temp\'
            - ipmo '$Env:Temp\
            - 'ipmo $Env:Temp\'
            - 'ipmo "$Env:Appdata\'
            - ipmo '$Env:Appdata\
            - 'ipmo $Env:Appdata\'
            - 'ipmo C:\Users\Public\'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Invoke-Obfuscation STDIN+ Launcher - Security
id: 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974
related:
    - id: 72862bf2-0eb1-11eb-adc1-0242ac120002
      type: derived
status: test
description: Detects Obfuscated use of stdin to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 25)
author: Jonathan Cheong, oscd.community
date: 2020-10-15
modified: 2022-11-29
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains|all:
            - 'cmd'
            - 'powershell'
    selection2:
        ServiceFileName|contains:
            - '${input}'
            - 'noexit'
    selection3:
        ServiceFileName|contains:
            - ' /c '
            - ' /r '
    condition: all of selection*
falsepositives:
    - Unknown
level: high

title: macOS SSH Connection Detection
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: 'Detects execution of SSH client or SSH daemon processes which may indicate

  initial access attempts or remote connections. Monitor for unauthorized SSH

  connections, especially from unexpected users or to sensitive systems.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1078/004/
- https://attack.mitre.org/techniques/T1021/004/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /ssh
    - /sshd
  condition: selection_event and selection_process
falsepositives:
- Legitimate SSH usage by administrators
- Automated scripts using SSH for remote management
- CI/CD pipelines using SSH for deployments
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.initial_access
- attack.t1078.004
- attack.lateral_movement
- attack.t1021.004
level: medium

title: Microsoft 365 - Impossible Travel Activity
id: d7eab125-5f94-43df-8710-795b80fa1189
status: test
description: Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
references:
    - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
    - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
author: Austin Songer @austinsonger
date: 2020-07-06
modified: 2021-11-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    service: threat_management
    product: m365
detection:
    selection:
        eventSource: SecurityComplianceCenter
        eventName: 'Impossible travel activity'
        status: success
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Mstsc.EXE Execution From Uncommon Parent
id: ff3b6b39-e765-42f9-bb2c-ea6761e0e0f6
status: test
description: Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
references:
    - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
    - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-18
tags:
    - attack.lateral-movement
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            # Covers potential downloads/clicks from browsers
            - '\brave.exe'
            - '\CCleanerBrowser.exe'
            - '\chrome.exe'
            - '\chromium.exe'
            - '\firefox.exe'
            - '\iexplore.exe'
            - '\microsoftedge.exe'
            - '\msedge.exe'
            - '\opera.exe'
            - '\vivaldi.exe'
            - '\whale.exe'
            # Covers potential downloads/clicks from email clients
            - '\outlook.exe'
    selection_img:
        - Image|endswith: '\mstsc.exe'
        - OriginalFileName: 'mstsc.exe'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

title: Multifactor Authentication Denied
id: e40f4962-b02b-4192-9bfe-245f7ece1f99
status: test
description: User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.
references:
    - https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
author: AlertIQ
date: 2022-03-24
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
    - attack.t1621
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        AuthenticationRequirement: 'multiFactorAuthentication'
        Status|contains: 'MFA Denied'
    condition: selection
falsepositives:
    - Users actually login but miss-click into the Deny button when MFA prompt.
level: medium

title: Netsh helper DLL abuse (process)
description: Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution. 
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1546-Event%20Triggered%20Execution
- https://www.hackingarticles.in/windows-persistence-using-netsh/
- https://liberty-shell.com/sec/2018/07/28/netshlep/
- https://github.com/outflanknl/NetshHelperBeacon
- https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
- https://lolbas-project.github.io/lolbas/Binaries/Netsh/
- https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
tags:
- attack.persistence
- attack.t1546.007
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    EventID: 4688
    NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
    Commandline|contains|all: # full command 'netsh add helper virus.dll'
      - netsh
      - add
      - helper
  condition: selection
falsepositives:
- Administrator activity
level: high

title: New Kubernetes Service Account Created
id: e31bae15-83ed-473e-bf31-faf4f8a17d36
related:
    - id: 12d027c3-b48c-4d9d-8bb6-a732200034b2
      type: derived
status: test
description: |
    Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.
references:
    - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
    - attack.persistence
    - attack.t1136
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'create'
        objectRef.resource: 'serviceaccounts'
    condition: selection
falsepositives:
    - Unknown
level: low

title: Okta New Admin Console Behaviours
id: a0b38b70-3cb5-484b-a4eb-c4d8e7bcc0a9
status: test
description: Detects when Okta identifies new activity in the Admin Console.
references:
    - https://developer.okta.com/docs/reference/api/system-log/
    - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
author: kelnage
date: 2023-09-07
modified: 2026-04-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078.004
logsource:
    product: okta
    service: okta
detection:
    selection_event:
        eventType: 'policy.evaluate_sign_on'
        target.displayName: 'Okta Admin Console'
    selection_positive:
        - debugContext.debugData.behaviors|contains: 'POSITIVE'
        - debugContext.debugData.logOnlySecurityData|contains: 'POSITIVE'
    condition: all of selection_*
falsepositives:
    - When an admin begins using the Admin Console and one of Okta's heuristics incorrectly identifies the behavior as being unusual.
level: high

title: Potential CVE-2023-27363 Exploitation - HTA File Creation By FoxitPDFReader
id: 9cae055f-e1d2-4f81-b8a5-1986a68cdd84
status: test
description: Detects suspicious ".hta" file creation in the startup folder by Foxit Reader. This can be an indication of CVE-2023-27363 exploitation.
references:
    - https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
    - https://www.zerodayinitiative.com/advisories/ZDI-23-491/
    - https://www.tarlogic.com/blog/cve-2023-27363-foxit-reader/
author: Gregory
date: 2023-10-11
tags:
    - attack.persistence
    - attack.t1505.001
    - cve.2023-27363
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\FoxitPDFReader.exe'
        TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
        TargetFilename|endswith: '.hta'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential CVE-2026-33829 Exploitation - Windows Snipping Tool Remote File Path URI
id: 7c3a5b1d-9e2f-4a8c-b5d7-1e0f3c6a9b2d
status: test
description: |
    Detects potential exploitation of CVE-2026-33829, a vulnerability in the Windows Snipping Tool URI handler (ms-screensketch:).
    An attacker can abuse the 'filePath' parameter to supply a UNC path or HTTP URL, causing SnippingTool.exe to initiate a connection to a remote resource.
    When a UNC path is used (e.g. \\attacker.com\share), this triggers an outbound NTLM authentication attempt, allowing the attacker to capture or relay the victim's Net-NTLMv2 hash.
    HTTP-based paths may result in remote file loading or server-side request forgery (SSRF)-style access.
    The URI can be delivered via a malicious hyperlink, phishing email, or web page.
references:
    - https://x.com/BlackArrowSec/status/2044374743491424508
    - https://x.com/SBousseaden/status/2044417029721997635
author: Samir Bousseaden, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-28
tags:
    - attack.credential-access
    - attack.t1187
    - detection.emerging-threats
    - cve.2026-33829
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\SnippingTool.exe'
        CommandLine|contains:
            # '\\\\'  = literal double backslash (UNC path start); '%5C' and '%%5C' are URL-encoded variations of the same backslash character
            - 'ms-screensketch:edit?&filePath=\\\\'
            - 'ms-screensketch:edit?&filePath=%%5C'
            - 'ms-screensketch:edit?&filePath=%5C'
            - 'ms-screensketch:edit?&filePath=http'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules-emerging-threats/2026/Exploits/CVE-2026-33829/proc_creation_win_exploit_cve_2026_33829/info.yml

title: Potential Fake Instance Of Hxtsr.EXE Executed
id: 4e762605-34a8-406d-b72e-c1a089313320
status: test
description: |
    HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
    HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
    Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
references:
    - Internal Research
author: Sreeman
date: 2020-04-17
modified: 2024-02-08
tags:
    - attack.stealth
    - attack.t1036
logsource:
    product: windows
    category: process_creation
detection:
    # TODO: Link this to the more generic system process rule
    selection:
        Image|endswith: '\hxtsr.exe'
    filter_main_hxtsr:
        Image|contains: ':\program files\windowsapps\microsoft.windowscommunicationsapps_'
        Image|endswith: '\hxtsr.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

title: Potential RDP Tunneling Via Plink
id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da
related:
    - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d # ssh.exe
      type: similar
status: test
description: Execution of plink to perform data exfiltration and tunneling
references:
    - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
author: Florian Roth (Nextron Systems)
date: 2022-08-04
modified: 2023-01-27
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_a:
        Image|endswith: '\plink.exe'
        CommandLine|contains: ':127.0.0.1:3389'
    selection_b1:
        Image|endswith: '\plink.exe'
        CommandLine|contains: ':3389'
    selection_b2:
        CommandLine|contains:
            - ' -P 443'
            - ' -P 22'
    condition: selection_a or all of selection_b*
falsepositives:
    - Unknown
level: high

title: PowerShell Get-Clipboard Cmdlet Via CLI
id: b9aeac14-2ffd-4ad3-b967-1354a4e628c3
related:
    - id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78
      type: derived
status: test
description: Detects usage of the 'Get-Clipboard' cmdlet via CLI
references:
    - https://github.com/OTRF/detection-hackathon-apt29/issues/16
    - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2020-05-02
modified: 2022-12-25
tags:
    - attack.collection
    - attack.t1115
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'Get-Clipboard'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Powershell Sensitive File Discovery
id: 7d416556-6502-45b2-9bad-9d2f05f38997
related:
    - id: d23f2ba5-9da0-4463-8908-8ee47f614bb9
      type: derived
status: test
description: Detect adversaries enumerate sensitive files
references:
    - https://twitter.com/malmoeb/status/1570814999370801158
author: frack113
date: 2022-09-16
tags:
    - attack.discovery
    - attack.t1083
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_action:
        ScriptBlockText|contains:
            - ls
            - get-childitem
            - gci
    selection_recurse:
        ScriptBlockText|contains: '-recurse'
    selection_file:
        ScriptBlockText|contains:
            - '.pass'
            - '.kdbx'
            - '.kdb'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery/info.yml

title: RDP shadow session started (command)
description: Detects scenarios where an attacker would attempt to shadow a RDP session.
references:
- http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
- https://www.elastic.co/guide/en/security/current/potential-remote-desktop-shadowing-activity.html
- https://bitsadm.in/blog/spying-on-users-using-rdp-shadowing
- https://swarm.ptsecurity.com/remote-desktop-services-shadowing/
tags:
- attack.lateral_movement
- attack.t1021.001 # remote services: RDP
- attack.collection
- attack.t1113 # screen capture
- attack.t1125 # video capture
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: process_creation
detection: # full command: mstsc /shadow:1 /v:<computer_name> /control /noConsentPrompt
  selection:
    NewProcessName|endswith: \mstsc.exe
    CommandLine|contains|all:
    - mstsc
    - '/shadow'
  condition: selection
falsepositives:
- administrative source host used for shadowing
level: high

title: Remote Access Tool - AnyDesk Incoming Connection
id: d58ba5c6-0ed7-4b9d-a433-6878379efda9
status: experimental
description: |
    Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
    - https://asec.ahnlab.com/en/40263/
author: '@d4ns4n_ (Wuerth-Phoenix)'
date: 2024-09-02
modified: 2025-02-24
tags:
    - attack.persistence
    - attack.command-and-control
    - attack.t1219.002
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith:
            - '\AnyDesk.exe'
            - '\AnyDeskMSI.exe'
        Initiated: 'false' # If the network connection is initiated remotely (incoming), the field is set to false.
    condition: selection
falsepositives:
    - Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally).
level: medium

title: Ruby on Rails Framework Exceptions
id: 0d2c3d4c-4b48-4ac3-8f23-ea845746bb1a
status: stable
description: Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
references:
    - http://edgeguides.rubyonrails.org/security.html
    - http://guides.rubyonrails.org/action_controller_overview.html
    - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
    - https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
author: Thomas Patzke
date: 2017-08-06
modified: 2020-09-01
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: ruby_on_rails
detection:
    keywords:
        - ActionController::InvalidAuthenticityToken
        - ActionController::InvalidCrossOriginRequest
        - ActionController::MethodNotAllowed
        - ActionController::BadRequest
        - ActionController::ParameterMissing
    condition: keywords
falsepositives:
    - Application bugs
level: medium

title: Screen Capture - macOS
id: 0877ed01-da46-4c49-8476-d49cdd80dfa7
status: test
description: Detects attempts to use screencapture to collect macOS screenshots
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md
    - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py
author: remotephone, oscd.community
date: 2020-10-13
modified: 2021-11-27
tags:
    - attack.collection
    - attack.t1113
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image: '/usr/sbin/screencapture'
    condition: selection
falsepositives:
    - Legitimate user activity taking screenshots
level: low