Detection rules › Sigma
User enumeration and creation related to Manic Menagerie 2.0 (via cmdline)
Detects user enumeration and/or creation performed by Manic Menagerie.
Known false positives
- Administrator activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
| Security-Auditing | Event ID 4688: A new process has been created. |
Rule body
title: User enumeration and creation related to Manic Menagerie 2.0 (via cmdline)
description: Detects user enumeration and/or creation performed by Manic Menagerie.
references:
- https://unit42.paloaltonetworks.com/manic-menagerie-targets-web-hosting-and-it/
- https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf
- https://csl.com.co/rid-hijacking/
tags:
- attack.persistence
- attack.t1136.001
author: mdecrevoisier
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith:
- \net1.exe
- \net.exe
CommandLine|contains:
- iis_uses
- iis_user
condition: selection
falsepositives:
- Administrator activity
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Image|endswith:
- \net1.exe
- \net.exe
CommandLine|contains:
- iis_uses
- iis_user
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with |