Detection rules › Sigma

User enumeration and creation related to Manic Menagerie 2.0 (via cmdline)

Severity
medium
Log source
category process_creation, product windows
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects user enumeration and/or creation performed by Manic Menagerie.

Known false positives

  • Administrator activity

MITRE ATT&CK coverage

TacticTechniques
Persistence

Telemetry coverage

Rule body

title: User enumeration and creation related to Manic Menagerie 2.0 (via cmdline)
description: Detects user enumeration and/or creation performed by Manic Menagerie.
references:
- https://unit42.paloaltonetworks.com/manic-menagerie-targets-web-hosting-and-it/
- https://www.cyber.gov.au/sites/default/files/2023-03/report_manic_menagerie.pdf
- https://csl.com.co/rid-hijacking/
tags:
- attack.persistence
- attack.t1136.001
author: mdecrevoisier
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - \net1.exe
      - \net.exe
    CommandLine|contains:
      - iis_uses
      - iis_user
  condition: selection
falsepositives:
- Administrator activity 
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  Image|endswith:
    - \net1.exe
    - \net.exe
  CommandLine|contains:
    - iis_uses
    - iis_user

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • iis_user
  • iis_uses
field:"CommandLine" kind:match
Imageends_with
  • \net.exe corpus 49 (sigma 49)
  • \net1.exe corpus 47 (sigma 47)
field:"Image" kind:ends_with