Sigma rules: 3h

title: AppX Located in Uncommon Directory Added to Deployment Pipeline
id: c977cb50-3dff-4a9f-b873-9290f56132f1
status: test
description: |
    Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.
references:
    - Internal Research
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
    - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
    - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-11
modified: 2025-12-03
tags:
    - attack.stealth
logsource:
    product: windows
    service: appxdeployment-server
detection:
    selection:
        EventID: 854
    filter_main_generic:
        Path|contains:
            # Paths can be written using forward slash if the "file://" protocol is used
            - ':/Program%20Files' # Also covers 'file:///C:/Program%20Files%20(x86)/'
            - ':/Windows/System32/'
            - ':\Program Files (x86)\'
            - ':\Program Files\'
            - ':\Windows\ImmersiveControlPanel\'
            - ':\Windows\PrintDialog\'
            - ':\Windows\SystemApps\'
            - 'AppData/Local/Temp/WinGet/Microsoft.Winget.Source'
            - 'x-windowsupdate://'
    filter_main_specific:
        Path|contains:
            - 'https://installer.teams.static.microsoft/'
            - 'https://res.cdn.office.net' # Example https://res.cdn.office.net/nativehost/5mttl/installer/v2/1.2025.617.100/Microsoft.OutlookForWindows_x64.msix
            - 'https://statics.teams.cdn.live.net/'
            - 'https://statics.teams.cdn.office.net/'
            - 'microsoft.com' # Example: https://go.microsoft.com/fwlink/?linkid=2160968
    filter_optional_onedrive:
        Path|contains: 'AppData\Local\Microsoft\OneDrive\'
    filter_optional_winget:
        Path|contains:
            - 'AppData/Local/Temp/WinGet/Microsoft.Winget.Source'
            - 'AppData\Local\Temp\WinGet\Microsoft.Winget.Source'
    filter_optional_x_windowsupdate:
        Path|contains: 'x-windowsupdate://'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations/info.yml

title: Arbitrary Binary Execution Using GUP Utility
id: d65aee4d-2292-4cea-b832-83accd6cfa43
status: test
description: Detects execution of the Notepad++ updater (gup) to launch other commands or executables
references:
    - https://twitter.com/nas_bench/status/1535322445439180803
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-10
modified: 2023-03-02
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\gup.exe'
        Image|endswith: '\explorer.exe'
    filter:
        Image|endswith: '\explorer.exe'
        CommandLine|contains: '\Notepad++\notepad++.exe'
    filter_parent:
        ParentImage|contains: '\Notepad++\updater\'
    filter_null:
        CommandLine: null
    condition: selection and not 1 of filter*
falsepositives:
    - Other parent binaries using GUP not currently identified
level: medium

title: Arbitrary File Download Via ConfigSecurityPolicy.EXE
id: 1f0f6176-6482-4027-b151-00071af39d7e
status: test
description: |
    Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
    Users can configure different pilot collections for each of the co-management workloads.
    It can be abused by attackers in order to upload or download files.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/
author: frack113
date: 2021-11-26
modified: 2022-05-16
tags:
    - attack.exfiltration
    - attack.t1567
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - CommandLine|contains: ConfigSecurityPolicy.exe
        - Image|endswith: '\ConfigSecurityPolicy.exe'
        - OriginalFileName: 'ConfigSecurityPolicy.exe'
    selection_url:
        CommandLine|contains:
            - 'ftp://'
            - 'http://'
            - 'https://'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: Azure Unusual Authentication Interruption
id: 8366030e-7216-476b-9927-271d79f13cf3
status: test
description: Detects when there is a interruption in the authentication process.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts
author: Austin Songer @austinsonger
date: 2021-11-26
modified: 2022-12-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078
logsource:
    product: azure
    service: signinlogs
detection:
    selection_50097:
        ResultType: 50097
        ResultDescription: 'Device authentication is required'
    selection_50155:
        ResultType: 50155
        ResultDescription: 'DeviceAuthenticationFailed'
    selection_50158:
        ResultType: 50158
        ResultDescription: 'ExternalSecurityChallenge - External security challenge was not satisfied'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

title: Cscript/Wscript Uncommon Script Extension Execution
id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee
status: test
description: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
references:
    - Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-15
modified: 2023-06-19
tags:
    - attack.execution
    - attack.t1059.005
    - attack.t1059.007
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName:
              - 'wscript.exe'
              - 'cscript.exe'
        - Image|endswith:
              - '\wscript.exe'
              - '\cscript.exe'
    selection_extension:
        CommandLine|contains:
            # Note: add additional potential suspicious extension
            # We could specify the "//E:" flag to avoid typos by admin. But since that's prone to blind spots via the creation of assoc it's better not to include it
            - '.csv'
            - '.dat'
            - '.doc'
            - '.gif'
            - '.jpeg'
            - '.jpg'
            - '.png'
            - '.ppt'
            - '.txt'
            - '.xls'
            - '.xml'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wscript_cscript_uncommon_extension_exec/info.yml

title: DNS Server Discovery Via LDAP Query
id: a21bcd7e-38ec-49ad-b69a-9ea17e69509e
status: test
description: Detects DNS server discovery via LDAP query requests from uncommon applications
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04
author: frack113
date: 2022-08-20
modified: 2023-09-18
tags:
    - attack.discovery
    - attack.t1482
logsource:
    product: windows
    category: dns_query
detection:
    selection:
        QueryName|startswith: '_ldap.'
    filter_main_generic:
        Image|contains:
            - ':\Program Files\'
            - ':\Program Files (x86)\'
            - ':\Windows\'
    filter_main_defender:
        Image|contains: ':\ProgramData\Microsoft\Windows Defender\Platform\'
        Image|endswith: '\MsMpEng.exe'
    filter_main_unknown:
        Image: '<unknown process>'
    filter_optional_azure:
        Image|startswith: 'C:\WindowsAzure\GuestAgent'
    filter_main_null:
        Image: null
    filter_optional_browsers:
        # Note: This list is for browsers installed in the user context. To avoid basic evasions based on image name. Best to baseline this list with the browsers you use internally and add their full paths.
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\opera.exe'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Likely
# Note: Incrase the level once a baseline is established
level: low

title: EventLog Query Requests By Builtin Utilities
id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f
related:
    - id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf
      type: derived
status: test
description: |
    Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.
references:
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
    - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
    - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
date: 2023-11-20
modified: 2024-01-24
tags:
    - attack.t1552
    - attack.credential-access
    - detection.threat-hunting
logsource:
    product: windows
    category: process_creation
detection:
    selection_wmi:
        CommandLine|contains|all:
            - 'Select'
            - 'Win32_NTLogEvent'
    selection_wevtutil_img:
        - Image|endswith: '\wevtutil.exe'
        - OriginalFileName: 'wevtutil.exe'
    selection_wevtutil_cli:
        CommandLine|contains:
            - ' qe '
            - ' query-events '
    selection_wmic_img:
        - Image|endswith: '\wmic.exe'
        - OriginalFileName: 'wmic.exe'
    selection_wmic_cli:
        CommandLine|contains: ' ntevent'
    selection_cmdlet:
        CommandLine|contains:
            - 'Get-WinEvent '
            - 'get-eventlog '
    condition: selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet
falsepositives:
    - Legitimate log access by administrators or troubleshooting tools
level: medium
regression_tests_path: regression_data/rules-threat-hunting/windows/process_creation/proc_creation_win_susp_event_log_query/info.yml

title: File Decryption Using Gpg4win
id: 037dcd71-33a8-4392-bb01-293c94663e5a
status: test
description: Detects usage of Gpg4win to decrypt files
references:
    - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
    - https://www.gpg4win.de/documentation.html
    - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-09
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_metadata:
        - Image|endswith:
              - '\gpg.exe'
              - '\gpg2.exe'
        - Description: 'GnuPG’s OpenPGP tool'
    selection_cli:
        CommandLine|contains|all:
            - ' -d '
            - 'passphrase'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: Google Workspace Role Modified or Deleted
id: 6aef64e3-60c6-4782-8db3-8448759c714e
status: test
description: Detects when an a role is modified or deleted in Google Workspace.
references:
    - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3
    - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings
author: Austin Songer
date: 2021-08-24
modified: 2023-10-11
tags:
    - attack.impact
logsource:
    product: gcp
    service: google_workspace.admin
detection:
    selection:
        eventService: admin.googleapis.com
        eventName:
            - DELETE_ROLE
            - RENAME_ROLE
            - UPDATE_ROLE
    condition: selection
falsepositives:
    - Unknown

level: medium

title: Hypervisor Enforced Paging Translation Disabled
id: 7f2954d2-99c2-4d42-a065-ca36740f187b
status: test
description: |
    Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.
references:
    - https://twitter.com/standa_t/status/1808868985678803222
    - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-05
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\DisableHypervisorEnforcedPagingTranslation'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Insecure Transfer Via Curl.EXE
id: cb9cc1d1-e84e-4bdc-b7ad-c31b1b7908ec
status: test
description: Detects execution of "curl.exe" with the "--insecure" flag.
references:
    - https://curl.se/docs/manpage.html
author: X__Junior (Nextron Systems)
date: 2023-06-30
tags:
    - attack.execution
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\curl.exe'
        - OriginalFileName: 'curl.exe'
    selection_cli:
        - CommandLine|re: '\s-k\s'
        - CommandLine|contains: '--insecure'
    condition: all of selection_*
falsepositives:
    - Access to badly maintained internal or development systems
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_insecure_connection/info.yml

title: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
id: ea207a23-b441-4a17-9f76-ad5be47d51d3
status: test
description: Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
references:
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
    - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
date: 2023-07-13
tags:
    - detection.threat-hunting
    - attack.discovery
    - attack.t1518.001
    - attack.t1016
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_payload:
        Payload|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    selection_contextinfo:
        ContextInfo|contains:
            - 'Get-NetFirewallRule'
            - 'Show-NetFirewallRule'
    condition: 1 of selection_*
falsepositives:
    - Administration scripts
level: low

title: Microsoft Defender Blocked from Loading Unsigned DLL
id: 0b0ea3cc-99c8-4730-9c53-45deee2a4c86
status: test
description: Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
author: Bhabesh Raj
date: 2022-08-02
modified: 2022-09-28
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    service: security-mitigations
detection:
    selection:
        EventID:
            - 11
            - 12 # MDE: ExploitGuardNonMicrosoftSignedBlocked
        ProcessPath|endswith:
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Mimikatz Pass-the-hash login
description: Detects scenarios where an attacker uses the Mimikatz Pass-the-hash feature to move laterally. Correlation with others event IDs can be done in the following way:| ID 4624 TargetLogonId + ID 4672 SubjectLogonId + ID 4688 TargetLogonId. Having those 3 elements together allows to bring in light what was exactly done.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1550-Use%20Alternate%20Authentication%20Material
- https://stealthbits.com/blog/passing-the-hash-with-mimikatz/
- https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/
- https://thedfirreport.com/2022/11/14/bumblebee-zeros-in-on-meterpreter/
- https://thedfirreport.com/2023/06/12/a-truly-graceful-wipe-out/
tags:
- attack.lateral_movement
- attack.t1550.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection: # command: 'privilege::debug' + 'sekurlsa::pth /user:<user> /domain:<domain> /ntlm:<hash> /run:<command>'
  selection:
    EventID: 4624
    LogonType: 9 # New credentials
    LogonProcessName: seclogo
    AuthenticationPackageName: Negotiate
    ProcessName: 'C:\Windows\System32\svchost.exe'
    IpAddress: '::1'
  #filter: # if 'token::elevate' command is used, both Subject and Target will be related to SYSTEM account. Therefore the filter needs to be removed.
    #SubjectUserName|endswith: '$'
    #TargetUserName|endswith: '$'
  condition: selection and not filter
falsepositives:
- Runas.exe executed with /netonly parameter
level: high

title: New network file share created
description: Detects scenarios when a new file share is created.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.002%20-SMB%20Windows%20Admin%20Shares
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
tags:
- attack.lateral_movement
- attack.t1021.002
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 5142
  filter:
    SubjectUserName|endswith: '$' # Share created by the system are ignored
  condition: selection and not filter
falsepositives:
- Administrator actvity
level: medium

title: Potential GobRAT File Discovery Via Grep
id: e34cfa0c-0a50-4210-9cb3-5632d08eb041
status: test
description: Detects the use of grep to discover specific files created by the GobRAT malware
references:
    - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html
    - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection
    - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-06-02
tags:
    - attack.discovery
    - attack.t1082
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/grep'
        CommandLine|contains:
            - 'apached'
            - 'frpc'
            - 'sshd.sh'
            - 'zone.arm'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
id: 0900463c-b33b-49a8-be1d-552a3b553dae
related:
    - id: a8f866e1-bdd4-425e-a27a-37619238d9c7
      type: similar
status: test
description: |
    Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"
references:
    - https://twitter.com/pfiatde/status/1681977680688738305
    - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
    - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
    - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
author: Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)
date: 2023-10-09
tags:
    - attack.stealth
    - attack.t1564.004
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        # Note: Both Sysmon and ETW are unable to log the presence of such stream in the CommandLine. But EDRs such as Crowdstrike are able to using for example CMD console history. Users are advised to test this before usage
        CommandLine|contains: '::$index_allocation'
    condition: selection
falsepositives:
    - Unlikely
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation/info.yml

title: Potential Lateral Movement via Windows Remote Shell
id: 79df3f68-dccb-48e9-9171-b75cbc37c51d
status: experimental
description: |
    Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.
references:
    - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
    - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
author: Liran Ravich
date: 2025-10-22
tags:
    - attack.lateral-movement
    - attack.t1021.006
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Note: Example of command to simulate (winrm needs to be enabled): "c:\Windows\System32\winrs.exe" powershell
        ParentImage|endswith: '\winrshost.exe'
    filter_main_conhost:
        Image: 'C:\Windows\System32\conhost.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate use of WinRM within the organization
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_winrshost_command_execution/info.yml

title: Potential Persistence Via Microsoft Compatibility Appraiser
id: f548a603-c9f2-4c89-b511-b089f7e94549
related:
    - id: 73a883d0-0348-4be4-a8d8-51031c2564f8
      type: derived
status: test
description: |
    Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks.
    In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.
references:
    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
author: Sreeman
date: 2020-09-29
modified: 2023-02-10
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_cli:
        CommandLine|contains|all:
            - 'run '
            - '\Application Experience\Microsoft Compatibility Appraiser'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: Potential SAP NetWeaver Webshell Creation - Linux
id: 5b91409c-cb18-4ab6-ac75-c5759f998409
status: experimental
description: |
    Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories,
    which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
    - https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
    - https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
author: Elastic (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-04-28
tags:
    - attack.execution
    - attack.initial-access
    - attack.t1190
    - attack.persistence
    - attack.t1059.003
    - cve.2025-31324
    - detection.emerging-threats
logsource:
    product: linux
    category: file_event
detection:
    selection_path:
        TargetFilename|contains:
            - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/work/'
            - '/j2ee/cluster/apps/sap.com/irj/servlet_jsp/irj/root/'
    selection_ext:
        TargetFilename|endswith:
            - '.jsp'
            - '.java'
            - '.class'
    condition: all of selection_*
falsepositives:
    - Legitimate creation of jsc or java files in these locations
level: medium

title: Potential SpEL Injection In Spring Framework
id: e9edd087-89d8-48c9-b0b4-5b9bb10896b8
status: test
description: Detects potential SpEL Injection exploitation, which may lead to RCE.
references:
    - https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
author: Moti Harmats
date: 2023-02-11
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: spring
    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'
detection:
    keywords:
        - 'org.springframework.expression.ExpressionException'
    condition: keywords
falsepositives:
    - Application bugs
level: high

title: Potential Suspicious Winget Package Installation
id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2
status: test
description: Detects potential suspicious winget package installation from a suspicious source.
references:
    - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-18
tags:
    - attack.persistence
    - attack.stealth
logsource:
    product: windows
    category: create_stream_hash
detection:
    selection:
        Contents|startswith: '[ZoneTransfer]  ZoneId=3'
        Contents|contains:
            # Note: Add any untrusted sources that are custom to your env
            - '://1'
            - '://2'
            - '://3'
            - '://4'
            - '://5'
            - '://6'
            - '://7'
            - '://8'
            - '://9'
        TargetFilename|endswith: ':Zone.Identifier'
        TargetFilename|contains: '\AppData\Local\Temp\WinGet\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Long Filename Pattern - Linux
id: 11629c4d-0fe6-465b-be62-b39a1c442aad
status: experimental
description: |
    Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.
    This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.
    Adjust the threshold of filename length as needed based on your environment.
references:
    - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
author: '@kostastsale'
date: 2025-11-22
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.004
    - attack.t1027
    - detection.threat-hunting
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|re: '[^/]{100,}$'
    filter_optional_known_good:
        TargetFilename|startswith:
            - '/run/systemd/units/invocation:systemd-fsck@'
            - '/sys/firmware/'
            - '/var/log/journal/'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Legitimate files with long filenames.
level: low

title: RBAC Permission Enumeration Attempt
id: 84b777bd-c946-4d17-aa2e-c39f5a454325
status: test
description: |
    Detects identities attempting to enumerate their Kubernetes RBAC permissions.
    In the early stages of a breach, attackers will aim to list the permissions they have within the compromised environment.
    In a Kubernetes cluster, this can be achieved by interacting with the API server, and querying the SelfSubjectAccessReview API via e.g. a "kubectl auth can-i --list" command.
    This will enumerate the Role-Based Access Controls (RBAC) rules defining the compromised user's authorization.
references:
    - https://www.elastic.co/guide/en/security/current/kubernetes-suspicious-self-subject-review.html
author: Leo Tsaousis (@laripping)
date: 2024-03-26
tags:
    - attack.t1069.003
    - attack.t1087.004
    - attack.discovery
logsource:
    category: application
    product: kubernetes
    service: audit
detection:
    selection:
        verb: 'create'
        apiGroup: 'authorization.k8s.io'
        objectRef.resource: 'selfsubjectrulesreviews'
    condition: selection
falsepositives:
    - Unknown
level: low

title: Rhadamanthys Stealer Module Launch Via Rundll32.EXE
id: 5cdbc2e8-86dd-43df-9a1a-200d4745fba5
status: test
description: Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023
references:
    - https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88
    - https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/
    - https://www.joesandbox.com/analysis/790122/0/html
    - https://twitter.com/anfam17/status/1607477672057208835
author: TropChaud
date: 2023-01-26
modified: 2023-02-05
tags:
    - attack.stealth
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_rundll32:
        - OriginalFileName: 'RUNDLL32.EXE'
        - Image|endswith: '\rundll32.exe'
    selection_dll:
        CommandLine|contains: 'nsis_uns'
    selection_export_function:
        CommandLine|contains: 'PrintUIEntry'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

title: SMB over QUIC Via Net.EXE
id: 2238d337-42fb-4971-9a68-63570f2aede4
related:
    - id: 6df07c3b-8456-4f8b-87bb-fe31ec964cae
      type: similar
status: test
description: Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1570/T1570.md
    - https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
author: frack113
date: 2023-07-21
tags:
    - attack.lateral-movement
    - attack.t1570
    - detection.threat-hunting
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\net.exe'
              - '\net1.exe'
        - OriginalFileName:
              - 'net.exe'
              - 'net1.exe'
    selection_cli:
        CommandLine|contains: '/TRANSPORT:QUIC'
    condition: all of selection_*
falsepositives:
    - Administrative activity
level: medium

title: Startup/Logon Script Added to Group Policy Object
id: 123e4e6d-b123-48f8-b261-7214938acaf0
status: test
description: |
    Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
references:
    - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html
author: Elastic, Josh Nickels, Marius Rothenbücher
date: 2024-09-06
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.defense-impairment
    - attack.t1484.001
    - attack.t1547
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
    selection_eventid:
        EventID:
            - 5136
            - 5145
    selection_attributes_main:
        AttributeLDAPDisplayName:
            - 'gPCMachineExtensionNames'
            - 'gPCUserExtensionNames'
        AttributeValue|contains: '42B5FAAE-6536-11D2-AE5A-0000F87571E3'
    selection_attributes_optional:
        AttributeValue|contains:
            - '40B6664F-4972-11D1-A7CA-0000F87571E3'
            - '40B66650-4972-11D1-A7CA-0000F87571E3'
    selection_share:
        ShareName|endswith: '\SYSVOL'
        RelativeTargetName|endswith:
            - '\scripts.ini'
            - '\psscripts.ini'
        AccessList|contains: '%%4417'
    condition: selection_eventid and (all of selection_attributes_* or selection_share)
falsepositives:
    - Legitimate execution by system administrators.
level: medium

title: Suspicious FromBase64String Usage On Gzip Archive - Ps Script
id: df69cb1d-b891-4cd9-90c7-d617d90100ce
related:
    - id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
      type: similar
status: test
description: Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
author: frack113
date: 2022-12-23
tags:
    - attack.command-and-control
    - attack.t1132.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'FromBase64String'
            - 'MemoryStream'
            - 'H4sI'
    condition: selection
falsepositives:
    - Legitimate administrative script
level: medium
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive/info.yml

title: System Information Discovery Using Ioreg
id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0
status: test
description: |
    Detects the use of "ioreg" which will show I/O Kit registry information.
    This process is used for system information discovery.
    It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
references:
    - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
    - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior
    - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
    - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-12-20
modified: 2024-01-02
tags:
    - attack.discovery
    - attack.t1082
logsource:
    product: macos
    category: process_creation
detection:
    # Examples:
    #   /bin/bash /bin/sh -c ioreg -l | grep -e 'VirtualBox' -e 'Oracle' -e 'VMware' -e 'Parallels' | wc -l
    #   /usr/sbin/ioreg ioreg -rd1 -w0 -c AppleAHCIDiskDriver
    #   /bin/bash /bin/sh -c ioreg -l | grep -e 'USB Vendor Name'
    #   ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, \"\\\"\"); printf(\"%s\", line[4]); }
    selection_img:
        - Image|endswith: '/ioreg'
        - CommandLine|contains: 'ioreg'
    selection_cmd1:
        CommandLine|contains:
            - '-l'
            - '-c'
    selection_cmd2:
        CommandLine|contains:
            - 'AppleAHCIDiskDriver'
            - 'IOPlatformExpertDevice'
            - 'Oracle'
            - 'Parallels'
            - 'USB Vendor Name'
            - 'VirtualBox'
            - 'VMware'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative activities
level: medium

title: UAC Bypass Using WOW64 Logger DLL Hijack
id: 4f6c43e2-f989-4ea5-bcd8-843b49a0317c
status: test
description: Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_access
    product: windows
detection:
    selection:
        SourceImage|contains: ':\Windows\SysWOW64\'
        GrantedAccess: '0x1fffff'
        CallTrace|startswith: 'UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Uncommon GrantedAccess Flags On LSASS
id: 678dfc63-fefb-47a5-a04c-26bcf8cc9f65
related:
    - id: 32d0d3e2-e58d-4d41-926b-18b520b2b32d
      type: obsolete
status: test
description: Detects process access to LSASS memory with uncommon access flags 0x410 and 0x01410
references:
    - https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
    - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
    - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
    - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
    - https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
author: Florian Roth (Nextron Systems)
date: 2022-03-13
modified: 2023-11-30
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.s0002
    - detection.threat-hunting
logsource:
    category: process_access
    product: windows
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        GrantedAccess|endswith: '10'
    # Absolute paths to programs that cause false positives
    filter1:
        SourceImage:
            - 'C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHOST.exe'
            - 'C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe'
            - 'C:\Program Files\Windows Defender\MsMpEng.exe'
            - 'C:\PROGRAMDATA\MALWAREBYTES\MBAMSERVICE\ctlrupdate\mbupdatr.exe'
            - 'C:\Windows\System32\lsass.exe'
            - 'C:\Windows\System32\msiexec.exe'
            - 'C:\WINDOWS\System32\perfmon.exe'
            - 'C:\WINDOWS\system32\taskhostw.exe'
            - 'C:\WINDOWS\system32\taskmgr.exe'
            - 'C:\WINDOWS\system32\wbem\wmiprvse.exe'
            - 'C:\Windows\SysWOW64\msiexec.exe'
            - 'C:\Windows\sysWOW64\wbem\wmiprvse.exe'
    # Windows Defender
    filter2:
        SourceImage|startswith: 'C:\ProgramData\Microsoft\Windows Defender\'
        SourceImage|endswith: '\MsMpEng.exe'
    # Microsoft Gaming Services
    filter3:
        SourceImage|startswith: 'C:\Program Files\WindowsApps\'
        SourceImage|endswith: '\GamingServices.exe'
    # Process Explorer
    filter4:
        SourceImage|endswith:
            - '\PROCEXP64.EXE'
            - '\PROCEXP.EXE'
    # VMware Tools
    filter5:
        SourceImage|startswith: 'C:\ProgramData\VMware\VMware Tools\'
        SourceImage|endswith: '\vmtoolsd.exe'
    # Antivirus and EDR agents
    filter6:
        SourceImage|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
        SourceImage|contains: 'Antivirus'
    filter_nextron:
        # SourceImage|startswith: 'C:\Windows\Temp\asgard2-agent\'  # Can be a manual THOR installation
        SourceImage|endswith:
            - '\thor64.exe'
            - '\thor.exe'
            - '\aurora-agent-64.exe'
            - '\aurora-agent.exe'
    filter_ms_products:
        SourceImage|contains|all:
            - '\AppData\Local\Temp\'
            - '\vs_bootstrapper_'
        GrantedAccess: '0x1410'
    # Generic Filter for 0x1410 filter (caused by so many programs like DropBox updates etc.)
    filter_generic:
        SourceImage|startswith:
            - 'C:\Program Files\'
            - 'C:\Program Files (x86)\'
            - 'C:\WINDOWS\system32\'
    filter_wer:
        SourceCommandLine: 'C:\WINDOWS\system32\wermgr.exe -upload'
    filter_localappdata:
        SourceImage|contains|all:
            - 'C:\Users\'
            - '\AppData\Local\'
        SourceImage|endswith:
            - '\Microsoft VS Code\Code.exe'
            - '\software_reporter_tool.exe'
            - '\DropboxUpdate.exe'
            - '\MBAMInstallerService.exe'
            - '\WebEx\WebexHost.exe'
            - '\Programs\Microsoft VS Code\Code.exe'
            - '\JetBrains\Toolbox\bin\jetbrains-toolbox.exe'
    filter_xampp:
        SourceImage|endswith: '\xampp-control.exe'
        GrantedAccess: '0x410'
    filter_games:
        SourceImage|contains: '\SteamLibrary\steamapps\'
        GrantedAccess:
            - '0x410'
            - '0x10'
    condition: selection and not 1 of filter*
falsepositives:
    - Legitimate software accessing LSASS process for legitimate reason
level: medium