Detection rules › Sigma
Stickey key called CMD via command execution (hash detection)
Detects scenarios where an attacker calls the stickey key and execute CMD.
Known false positives
- None
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: Stickey key called CMD via command execution (hash detection)
description: Detects scenarios where an attacker calls the stickey key and execute CMD.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0004-Privilege%20Escalation/T1546-Image%20File%20Execution%20Options%20Injection
- https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
- https://www.mandiant.com/resources/apt29-domain-frontin
- https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
requirements: have an up to date inventory for CMD hashes of your environment
tags:
- attack.privilege_escalation
- attack.t1546.008
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
EventID: 1
ParentImage|endswith: \winlogon.exe
Hashes|contains: # SHA1 hash of CMD.exe
- 99AE9C73E9BEE6F9C76D6F4093A9882DF06832CF # Windows 10 x64 v10.0.14393.0
- 8C5437CD76A89EC983E3B364E219944DA3DAB464 # Windows 10 x64 v10.0.17763.0
- 8DCA9749CD48D286950E7A9FA1088C937CBCCAD4 # Windows 10 x64 v10.0.18363.0
- F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D # Windows 10 x64 v10.0.18363.0
condition: selection
falsepositives:
- None
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 1
ParentImage|endswith: \winlogon.exe
Hashes|contains:
- 99AE9C73E9BEE6F9C76D6F4093A9882DF06832CF
- 8C5437CD76A89EC983E3B364E219944DA3DAB464
- 8DCA9749CD48D286950E7A9FA1088C937CBCCAD4
- F1EFB0FDDC156E4C61C5F78A54700E4E7984D55D
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
Hashes | match |
| field:"Hashes" kind:match |
ParentImage | ends_with |
| field:"ParentImage" kind:ends_with value:"\winlogon.exe" |