Detection rules › Sigma

Suspicious Use of PsLogList

Status
test
Severity
medium
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

MITRE ATT&CK coverage

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Suspicious Use of PsLogList
id: aae1243f-d8af-40d8-ab20-33fc6d0c55bc
status: test
description: Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs
references:
    - https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
    - https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList
    - https://twitter.com/EricaZelic/status/1614075109827874817
author: Nasreddine Bencherchali (Nextron Systems)
date: 2021-12-18
modified: 2024-03-05
tags:
    - attack.discovery
    - attack.t1087
    - attack.t1087.001
    - attack.t1087.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'psloglist.exe'
        - Image|endswith:
              - '\psloglist.exe'
              - '\psloglist64.exe'
    selection_cli_eventlog:
        CommandLine|contains:
            - ' security'
            - ' application'
            - ' system'
    selection_cli_flags:
        CommandLine|contains|windash:
            - ' -d'
            - ' -x'
            - ' -s'
            - ' -c' # Clear event log after displaying
            - ' -g' # Export an event log as an evt file.
    condition: all of selection_*
falsepositives:
    - Another tool that uses the command line switches of PsLogList
    - Legitimate use of PsLogList by an administrator
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_img

selection_img:
    - OriginalFileName: 'psloglist.exe'
    - Image|endswith:
          - '\psloglist.exe'
          - '\psloglist64.exe'

Stage 2: selection_cli_eventlog

selection_cli_eventlog:
    CommandLine|contains:
        - ' security'
        - ' application'
        - ' system'

Stage 3: selection_cli_flags

selection_cli_flags:
    CommandLine|contains|windash:
        - ' -d'
        - ' -x'
        - ' -s'
        - ' -c'
        - ' -g'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -c transforms: windash corpus 5 (sigma 5)
  • -d transforms: windash corpus 2 (sigma 2)
  • -g transforms: windash corpus 2 (sigma 2)
  • -s transforms: windash corpus 3 (sigma 3)
  • -x transforms: windash
  • application
  • security
  • system corpus 2 (sigma 2)
Imageends_with
  • \psloglist.exe corpus 2 (sigma 2)
  • \psloglist64.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • psloglist.exe