# custom_values

customized_type: Issue
value:
  Network shares with loose access controls are common places that leak sensitive information. This play proactively looks for newly shared resources that likely contain sensitive data. Follow-up will be needed to confirm that appropriate access control is in place.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((osquery.columns.qid:601 AND osquery.columns.name:(*hr* OR *finance*
          OR *backup* OR *www* OR *scan*)) AND (NOT (osquery.counter:0)))
  index: logstash-osquery-*
  name: New Sensitive Shared Resource
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: New Sensitive Shared Resource
  description: Network shares with loose access controls are common places that leak
    sensitive information. This play proactively looks for newly shared resources that
    likely contain sensitive data. Follow-up will be needed to confirm that appropriate
    access control is in place.
  status: experimental
  author: Josh Brower
  tags:
  - attack.discovery
  - attack.t1135
  logsource:
    product: osquery
    definition: select Description,Name,Path, "601" AS qid  from shared_resources where
      type = 0 AND name <> "print$";
    qid: 601
  detection:
    selection:
      qid: 601
      column_name:
      - '*hr*'
      - '*finance*'
      - '*backup*'
      - '*www*'
      - '*scan*'
    filter:
      counter: 0
    condition: selection and not filter
  falsepositives:
  - unknown
  level: medium
  tasks:
    1 - Check Share Permissions: Are share permissions set to an appropriate level?
      They should be tied to the relevant AD Security Group.
    2 - Contact System/Service Owner: If share permissions are not appropriate, contact
      the system/service owner for remediation.

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          event_data.Initiated:true AND event_data.DestinationHostname:(*dl.dropboxusercontent.com
          OR *.pastebin.com OR *.githubusercontent.com) AND image_path:C\:\\Windows\\\\*)
  index: logstash-beats-*
  name: Microsoft Binary Suspicious Communication Endpoint
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/M_haggis/status/900741347035889665
  https://twitter.com/M_haggis/status/1032799638213066752


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Microsoft Binary Suspicious Communication Endpoint
  id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97
  status: experimental
  description: Detects an executable in the Windows folder accessing suspicious domains
  references:
  - https://twitter.com/M_haggis/status/900741347035889665
  - https://twitter.com/M_haggis/status/1032799638213066752
  author: Florian Roth
  date: 2018/08/30
  tags:
  - attack.lateral_movement
  - attack.t1105
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 3
      Initiated: 'true'
      DestinationHostname:
      - '*dl.dropboxusercontent.com'
      - '*.pastebin.com'
      - '*.githubusercontent.com'
      Image: C:\Windows\\*
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:7 AND
          image_path:(*\\winword.exe OR *\\powerpnt.exe OR *\\excel.exe OR *\\outlook.exe)
          AND event_data.ImageLoaded:(*\\wmiutils.dll OR *\\wbemcomn.dll OR *\\wbemprox.dll
          OR *\\wbemdisp.dll OR *\\wbemsvc.dll))
  index: logstash-beats-*
  name: Windows Mangement Instrumentation DLL Loaded Via Microsoft Word
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/
  https://media.cert.europa.eu/static/SecurityAdvisories/2019/CERT-EU-SA2019-021.pdf


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Mangement Instrumentation DLL Loaded Via Microsoft Word
  id: a457f232-7df9-491d-898f-b5aabd2cbe2f
  status: experimental
  description: Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands
  references:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://www.carbonblack.com/2019/04/24/cb-tau-threat-intelligence-notification-emotet-utilizing-wmi-to-launch-powershell-encoded-code/
  - https://media.cert.europa.eu/static/SecurityAdvisories/2019/CERT-EU-SA2019-021.pdf
  author: Michael R. (@nahamike01)
  date: 2019/12/26
  tags:
  - attack.execution
  - attack.t1047
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 7
      Image:
      - '*\winword.exe'
      - '*\powerpnt.exe'
      - '*\excel.exe'
      - '*\outlook.exe'
      ImageLoaded:
      - '*\wmiutils.dll'
      - '*\wbemcomn.dll'
      - '*\wbemprox.dll'
      - '*\wbemdisp.dll'
      - '*\wbemsvc.dll'
    condition: selection
  falsepositives:
  - Possible. Requires further testing.
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Communication to other corporate systems that use IP addresses from public address spaces


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          image_path:*\\rundll32.exe AND event_data.Initiated:true) AND (NOT (destination_ip:(10.*
          OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR
          172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.*
          OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.*))))
  index: logstash-beats-*
  name: Rundll32 Internet Connection
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Rundll32 Internet Connection
  id: cdc8da7d-c303-42f8-b08c-b4ab47230263
  status: experimental
  description: Detects a rundll32 that communicates with public IP addresses
  references:
  - https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100
  author: Florian Roth
  date: 2017/11/04
  tags:
  - attack.t1085
  - attack.defense_evasion
  - attack.execution
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 3
      Image: '*\rundll32.exe'
      Initiated: 'true'
    filter:
      DestinationIp:
      - 10.*
      - 192.168.*
      - 172.16.*
      - 172.17.*
      - 172.18.*
      - 172.19.*
      - 172.20.*
      - 172.21.*
      - 172.22.*
      - 172.23.*
      - 172.24.*
      - 172.25.*
      - 172.26.*
      - 172.27.*
      - 172.28.*
      - 172.29.*
      - 172.30.*
      - 172.31.*
      - 127.*
    condition: selection and not filter
  falsepositives:
  - Communication to other corporate systems that use IP addresses from public address
    spaces
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          image_path:*\\svchost.exe AND event_data.Initiated:true AND SourcePort:3389
          AND destination_ip:(127.* OR \:\:1))
  index: logstash-beats-*
  name: RDP Over Reverse SSH Tunnel
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: RDP Over Reverse SSH Tunnel
  id: 5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4
  status: experimental
  description: Detects svchost hosting RDP termsvcs communicating with the loopback
    address and on TCP port 3389
  references:
  - https://twitter.com/SBousseaden/status/1096148422984384514
  author: Samir Bousseaden
  date: 2019/02/16
  tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1076
  - car.2013-07-002
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 3
      Image: '*\svchost.exe'
      Initiated: 'true'
      SourcePort: 3389
      DestinationIp:
      - 127.*
      - ::1
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:HKEY_USERS\\\\*\\Classes\\exefile\\shell\\runas\\command\\isolatedCommand)
  index: logstash-beats-*
  name: UAC Bypass via Sdclt
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: UAC Bypass via Sdclt
  id: 5b872a46-3b90-45c1-8419-f675db8053aa
  status: experimental
  description: Detects changes to HKCU:\Software\Classes\exefile\shell\runas\command\isolatedCommand
  references:
  - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
  author: Omer Yampel
  date: 2017/03/17
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 13
      TargetObject: HKEY_USERS\\*\Classes\exefile\shell\runas\command\isolatedCommand
    condition: selection
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1088
  - car.2019-04-001
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.TargetFilename:*\\AppData\\Local\\Temp\\SAM\-*.dmp*)
  index: logstash-beats-*
  name: QuarksPwDump Dump File
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: QuarksPwDump Dump File
  id: 847def9e-924d-4e90-b7c4-5f581395a2b4
  status: experimental
  description: Detects a dump file written by QuarksPwDump password dumper
  references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
  author: Florian Roth
  date: 2018/02/10
  tags:
  - attack.credential_access
  - attack.t1003
  level: critical
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 11
      TargetFilename: '*\AppData\Local\Temp\SAM-*.dmp*'
    condition: selection
  falsepositives:
  - Unknown

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a Powershell process that opens network connections - check for suspicious target ports and target systems - adjust to your environment (e.g. extend filters with company's ip range')


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          image_path:*\\powershell.exe AND event_data.Initiated:true) AND (NOT (destination_ip:(10.*
          OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.* OR 172.19.* OR 172.20.* OR
          172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR 172.25.* OR 172.26.* OR 172.27.*
          OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.* OR 127.0.0.1) AND event_data.DestinationIsIpv6:false
          AND event_data.User:NT\ AUTHORITY\\SYSTEM)))
  index: logstash-beats-*
  name: PowerShell Network Connections
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Network Connections
  id: 1f21ec3f-810d-4b0e-8045-322202e22b4b
  status: experimental
  description: Detects a Powershell process that opens network connections - check for
    suspicious target ports and target systems - adjust to your environment (e.g. extend
    filters with company's ip range')
  author: Florian Roth
  date: 2017/03/13
  references:
  - https://www.youtube.com/watch?v=DLtJTxMWZ2o
  tags:
  - attack.execution
  - attack.t1086
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 3
      Image: '*\powershell.exe'
      Initiated: 'true'
    filter:
      DestinationIp:
      - 10.*
      - 192.168.*
      - 172.16.*
      - 172.17.*
      - 172.18.*
      - 172.19.*
      - 172.20.*
      - 172.21.*
      - 172.22.*
      - 172.23.*
      - 172.24.*
      - 172.25.*
      - 172.26.*
      - 172.27.*
      - 172.28.*
      - 172.29.*
      - 172.30.*
      - 172.31.*
      - 127.0.0.1
      DestinationIsIpv6: 'false'
      User: NT AUTHORITY\SYSTEM
    condition: selection and not filter
  falsepositives:
  - Administrative scripts
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  Detects process access to LSASS which is typical for Mimikatz (0x1000 PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old versions", 0x0010 PROCESS_VM_READ)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:C\:\\windows\\system32\\lsass.exe AND event_data.GrantedAccess:(0x1410
          OR 0x1010))
  index: logstash-beats-*
  name: Mimikatz Detection LSASS Access
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz Detection LSASS Access
  id: 0d894093-71bc-43c3-8c4d-ecfc28dcf5d9
  status: experimental
  description: Detects process access to LSASS which is typical for Mimikatz (0x1000
    PROCESS_QUERY_ LIMITED_INFORMATION, 0x0400 PROCESS_QUERY_ INFORMATION "only old
    versions", 0x0010 PROCESS_VM_READ)
  references:
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  tags:
  - attack.t1003
  - attack.s0002
  - attack.credential_access
  - car.2019-04-004
  author: Sherif Eldeeb
  date: 2017/10/18
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 10
      TargetImage: C:\windows\system32\lsass.exe
      GrantedAccess:
      - '0x1410'
      - '0x1010'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Procdump illegaly bundled with legitimate software
  Weird admins who renamed binaries


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND OriginalFileName:procdump
          AND (NOT (image_path:(*\\procdump.exe OR *\\procdump64.exe))))
  index: logstash-beats-*
  name: Renamed ProcDump
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed ProcDump
  id: 4a0b2c7e-7cb2-495d-8b63-5f268e7bfd67
  status: experimental
  description: Detects the execution of a renamed ProcDump executable often used by
    attackers or malware
  references:
  - https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
  author: Florian Roth
  date: 2019/11/18
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      OriginalFileName: procdump
    filter:
      Image:
      - '*\procdump.exe'
      - '*\procdump64.exe'
    condition: selection and not filter
  falsepositives:
  - Procdump illegaly bundled with legitimate software
  - Weird admins who renamed binaries
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\services\\TermService\\Parameters\\ServiceDll*
          OR *\\Control\\Terminal\ Server\\fSingleSessionPerUser* OR *\\Control\\Terminal\
          Server\\fDenyTSConnections*))
  index: logstash-beats-*
  name: RDP Sensitive Settings Changed
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: RDP Sensitive Settings Changed
  id: 171b67e1-74b4-460e-8d55-b331f3e32d67
  description: Detects changes to RDP terminal service sensitive settings
  references:
  - https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html
  date: 2019/04/03
  author: Samir Bousseaden
  logsource:
    product: windows
    service: sysmon
  detection:
    selection_reg:
      EventID: 13
      TargetObject:
      - '*\services\TermService\Parameters\ServiceDll*'
      - '*\Control\Terminal Server\fSingleSessionPerUser*'
      - '*\Control\Terminal Server\fDenyTSConnections*'
    condition: selection_reg
  tags:
  - attack.defense_evasion
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects process LSASS memory dump using procdump or taskmgr based on the CallTrace pointing to dbghelp.dll or dbgcore.dll for win10


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:C\:\\windows\\system32\\lsass.exe AND event_data.GrantedAccess:0x1fffff
          AND event_data.CallTrace:(*dbghelp.dll* OR *dbgcore.dll*))
  index: logstash-beats-*
  name: LSASS Memory Dump
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: LSASS Memory Dump
  id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da
  status: experimental
  description: Detects process LSASS memory dump using procdump or taskmgr based on
    the CallTrace pointing to dbghelp.dll or dbgcore.dll for win10
  author: Samir Bousseaden
  date: 2019/04/03
  references:
  - https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
  tags:
  - attack.t1003
  - attack.s0002
  - attack.credential_access
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 10
      TargetImage: C:\windows\system32\lsass.exe
      GrantedAccess: '0x1fffff'
      CallTrace:
      - '*dbghelp.dll*'
      - '*dbgcore.dll*'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*
          OR *\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\\\*) AND event_data.Details:(*C\:\\Windows\\Temp\\\\*
          OR *\\AppData\\\\* OR %AppData%\\\\* OR *C\:\\$Recycle.bin\\\\* OR *C\:\\Temp\\\\*
          OR *C\:\\Users\\Public\\\\* OR %Public%\\\\* OR *C\:\\Users\\Default\\\\*
          OR *C\:\\Users\\Desktop\\\\* OR wscript* OR cscript*))
  index: logstash-beats-*
  name: New RUN Key Pointing to Suspicious Folder
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: New RUN Key Pointing to Suspicious Folder
  id: 02ee49e2-e294-4d0f-9278-f5b3212fc588
  status: experimental
  description: Detects suspicious new RUN key element pointing to an executable in a
    suspicious folder
  references:
  - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
  author: Florian Roth, Markus Neis
  tags:
  - attack.persistence
  - attack.t1060
  date: 2018/25/08
  modified: 2019/10/01
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 13
      TargetObject:
      - '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
      - '*\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\\*'
      Details:
      - '*C:\Windows\Temp\\*'
      - '*\AppData\\*'
      - '%AppData%\\*'
      - '*C:\$Recycle.bin\\*'
      - '*C:\Temp\\*'
      - '*C:\Users\Public\\*'
      - '%Public%\\*'
      - '*C:\Users\Default\\*'
      - '*C:\Users\Desktop\\*'
      - wscript*
      - cscript*
    condition: selection
  fields:
  - Image
  falsepositives:
  - Software with rare behaviour
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (event_data.Description:Java\
          Update\ Scheduler OR event_data.Description:Java\(TM\)\ Update\ Scheduler))
          AND (NOT (image_path:(*\\\\jusched.exe))))
  index: logstash-beats-*
  name: Renamed jusched.exe
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed jusched.exe
  status: experimental
  id: edd8a48c-1b9f-4ba1-83aa-490338cd1ccb
  description: Detects renamed jusched.exe used by cobalt group
  references:
  - https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
  tags:
  - attack.t1036
  - attack.execution
  author: Markus Neis, Swisscom
  date: 2019/06/04
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Description: Java Update Scheduler
    selection2:
      Description: Java(TM) Update Scheduler
    filter:
      Image:
      - '*\\jusched.exe'
    condition: (selection1 or selection2) and not filter
  falsepositives:
  - penetration tests, red teaming
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a possible remote threat creation with certain characteristics which are typical for Cobalt Strike beacons


customized_type: Issue
value:
  https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
  https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: CobaltStrike Process Injection
  id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42
  description: Detects a possible remote threat creation with certain characteristics
    which are typical for Cobalt Strike beacons
  references:
  - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
  - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
  tags:
  - attack.defense_evasion
  - attack.t1055
  status: experimental
  author: Olaf Hartong, Florian Roth, Aleksey Potapov, oscd.community
  date: 2018/11/30
  modified: 2019/11/08
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 8
      TargetProcessAddress|endswith:
      - 0B80
      - 0C7C
      - 0C88
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:8 AND
          event_data.SourceImage:*\\powershell.exe AND event_data.TargetImage:*\\rundll32.exe)
  index: logstash-beats-*
  name: PowerShell Rundll32 Remote Thread Creation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Rundll32 Remote Thread Creation
  id: 99b97608-3e21-4bfe-8217-2a127c396a0e
  status: experimental
  description: Detects PowerShell remote thread creation in Rundll32.exe
  author: Florian Roth
  references:
  - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
  date: 2018/06/25
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 8
      SourceImage: '*\powershell.exe'
      TargetImage: '*\rundll32.exe'
    condition: selection
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1085
  - attack.t1086
  falsepositives:
  - Unkown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(12 OR
          13) AND event_data.TargetObject:(*\\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt*
          OR *\\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt*))
  index: logstash-beats-*
  name: DLL Load via LSASS
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blog.xpnsec.com/exploring-mimikatz-part-1/
  https://twitter.com/SBousseaden/status/1183745981189427200


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: DLL Load via LSASS
  id: b3503044-60ce-4bf4-bbcb-e3db98788823
  status: experimental
  description: Detects a method to load DLL via LSASS process using an undocumented
    Registry key
  author: Florian Roth
  date: 2019/10/16
  references:
  - https://blog.xpnsec.com/exploring-mimikatz-part-1/
  - https://twitter.com/SBousseaden/status/1183745981189427200
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID:
      - 12
      - 13
      TargetObject:
      - '*\CurrentControlSet\Services\NTDS\DirectoryServiceExtPt*'
      - '*\CurrentControlSet\Services\NTDS\LsaDbExtPt*'
    condition: selection
  tags:
  - attack.execution
  - attack.t1177
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\Services\\DHCPServer\\Parameters\\CalloutDlls
          OR *\\Services\\DHCPServer\\Parameters\\CalloutEnabled))
  index: logstash-beats-*
  name: DHCP Callout DLL Installation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: DHCP Callout DLL Installation
  id: 9d3436ef-9476-4c43-acca-90ce06bdf33a
  status: experimental
  description: Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled
    parameter in Registry, which can be used to execute code in context of the DHCP
    server (restart required)
  references:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
  date: 2017/05/15
  author: Dimitrios Slamaris
  tags:
  - attack.defense_evasion
  - attack.t1073
  - attack.t1112
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 13
      TargetObject:
      - '*\Services\DHCPServer\Parameters\CalloutDlls'
      - '*\Services\DHCPServer\Parameters\CalloutEnabled'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz In-Memory
  id: c0478ead-5336-46c2-bd5e-b4c84bc3a36e
  status: experimental
  description: Detects certain DLL loads when Mimikatz gets executed
  references:
  - https://securityriskadvisors.com/blog/post/detecting-in-memory-mimikatz/
  tags:
  - attack.s0002
  - attack.t1003
  - attack.lateral_movement
  - attack.credential_access
  - car.2019-04-004
  logsource:
    product: windows
    service: sysmon
  date: 2017/03/13
  detection:
    selector:
      EventID: 7
      Image: C:\Windows\System32\rundll32.exe
    dllload1:
      ImageLoaded: '*\vaultcli.dll'
    dllload2:
      ImageLoaded: '*\wlanapi.dll'
    exclusion:
      ImageLoaded:
      - ntdsapi.dll
      - netapi32.dll
      - imm32.dll
      - samlib.dll
      - combase.dll
      - srvcli.dll
      - shcore.dll
      - ntasn1.dll
      - cryptdll.dll
      - logoncli.dll
    timeframe: 30s
    condition: selector | near dllload1 and dllload2 and not exclusion
  falsepositives:
  - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(17 OR
          18) AND event_data.PipeName:(\\atctl OR \\\userpipe OR \\iehelper OR \\sdlrpc
          OR \\comnap))
  index: logstash-beats-*
  name: Turla Group Named Pipes
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Turla Group Named Pipes
  id: 739915e4-1e70-4778-8b8a-17db02f66db1
  status: experimental
  description: Detects a named pipe used by Turla group samples
  references:
  - Internal Research
  date: 2017/11/06
  tags:
  - attack.g0010
  author: Markus Neis
  logsource:
    product: windows
    service: sysmon
    definition: Note that you have to configure logging for PipeEvents in Symson config
  detection:
    selection:
      EventID:
      - 17
      - 18
      PipeName:
      - \atctl
      - \userpipe
      - \iehelper
      - \sdlrpc
      - \comnap
    condition: selection
  falsepositives:
  - Unkown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_data.Description:Windows\
          PowerShell AND event_data.Company:Microsoft\ Corporation) AND (NOT (image_path:(*\\powershell.exe
          OR *\\powershell_ise.exe))))
  index: logstash-beats-*
  name: Renamed PowerShell
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed PowerShell
  id: d178a2d7-129a-4ba4-8ee6-d6e1fecd5d20
  status: experimental
  description: Detects the execution of a renamed PowerShell often used by attackers
    or malware
  references:
  - https://twitter.com/christophetd/status/1164506034720952320
  author: Florian Roth
  date: 2019/08/22
  tags:
  - car.2013-05-009
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      Description: Windows PowerShell
      Company: Microsoft Corporation
    filter:
      Image:
      - '*\powershell.exe'
      - '*\powershell_ise.exe'
    condition: selection and not filter
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.TargetFilename:*\\Temp\\debug.bin)
  index: logstash-beats-*
  name: Detection of SafetyKatz
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Detection of SafetyKatz
  id: e074832a-eada-4fd7-94a1-10642b130e16
  status: experimental
  description: Detects possible SafetyKatz Behaviour
  references:
  - https://github.com/GhostPack/SafetyKatz
  tags:
  - attack.credential_access
  - attack.t1003
  author: Markus Neis
  date: 2018/07/24
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 11
      TargetFilename: '*\Temp\debug.bin'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:C\:\\windows\\system32\\lsass.exe AND event_data.SourceImage:C\:\\Windows\\system32\\wsmprovhost.exe)
  index: logstash-beats-*
  name: Mimikatz through Windows Remote Management
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mimikatz through Windows Remote Management
  id: aa35a627-33fb-4d04-a165-d33b4afca3e8
  description: Detects usage of mimikatz through WinRM protocol by monitoring access
    to lsass process by wsmprovhost.exe.
  references:
  - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
  status: stable
  author: Patryk Prauze - ING Tech
  date: 2019/05/20
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 10
      TargetImage: C:\windows\system32\lsass.exe
      SourceImage: C:\Windows\system32\wsmprovhost.exe
    condition: selection
  tags:
  - attack.credential_access
  - attack.execution
  - attack.t1003
  - attack.t1028
  - attack.s0005
  falsepositives:
  - low
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_data.Description:\\?
          AND (event_data.FileVersion:\\? OR event_data.Product:\\? OR event_data.Company:\\?))
  index: logstash-beats-*
  name: Suspicious File Characteristics Due to Missing Fields
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securelist.com/muddywater/88059/
  https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious File Characteristics Due to Missing Fields
  id: 9637e8a5-7131-4f7f-bdc7-2b05d8670c43
  description: Detects Executables without FileVersion,Description,Product,Company likely
    created with py2exe
  status: experimental
  references:
  - https://securelist.com/muddywater/88059/
  - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
  author: Markus Neis
  date: 2018/11/22
  modified: 2019/11/09
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1064
  logsource:
    product: windows
    service: sysmon
  detection:
    selection1:
      Description: \?
      FileVersion: \?
    selection2:
      Description: \?
      Product: \?
    selection3:
      Description: \?
      Company: \?
    condition: 1 of them
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Maybe some system utilities in rare cases use linking keys for backward compability


customized_type: Issue
value:
  https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Registry Persistence COM Key Linking
  id: 9b0f8a61-91b2-464f-aceb-0527e0a45020
  status: experimental
  description: Detects COM object hijacking via TreatAs subkey
  references:
  - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
  author: Kutepov Anton, oscd.community
  date: 2019/10/23
  modified: 2019/11/07
  tags:
  - attack.persistence
  - attack.t1122
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 12
      TargetObject|startswith: HKU\
      TargetObject|contains: _Classes\CLSID\
      TargetObject|endswith: \TreatAs
    condition: selection
  falsepositives:
  - Maybe some system utilities in rare cases use linking keys for backward compability
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:7 AND
          image_path:C\:\\Windows\\System32\\wbem\\WmiPrvSE.exe AND event_data.ImageLoaded:wbemcons.dll)
  index: logstash-beats-*
  name: WMI Persistence - Command Line Event Consumer
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Persistence - Command Line Event Consumer
  id: 05936ce2-ee05-4dae-9d03-9a391cf2d2c6
  status: experimental
  description: Detects WMI command line event consumers
  references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
  - attack.t1084
  - attack.persistence
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 7
      Image: C:\Windows\System32\wbem\WmiPrvSE.exe
      ImageLoaded: wbemcons.dll
    condition: selection
  falsepositives:
  - Unknown (data set is too small; further testing needed)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\SOFTWARE\\Classes\\CLSID\\\{E08A0F4B\-1F65\-4D4D\-9A09\-BD4625B9C5A1\}\\Model
          OR *\\SOFTWARE\\App\\AppXbf13d4ea2945444d8b13e2121cb6b663\\Application OR
          *\\SOFTWARE\\App\\AppXbf13d4ea2945444d8b13e2121cb6b663\\DefaultIcon OR *\\SOFTWARE\\App\\AppX70162486c7554f7f80f481985d67586d\\Application
          OR *\\SOFTWARE\\App\\AppX70162486c7554f7f80f481985d67586d\\DefaultIcon OR
          *\\SOFTWARE\\App\\AppX37cc7fdccd644b4f85f4b22d5a3f105a\\Application OR *\\SOFTWARE\\App\\AppX37cc7fdccd644b4f85f4b22d5a3f105a\\DefaultIcon))
  index: logstash-beats-*
  name: OceanLotus Registry Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: OceanLotus Registry Activity
  id: 4ac5fc44-a601-4c06-955b-309df8c4e9d4
  status: experimental
  description: Detects registry keys created in OceanLotus (also known as APT32) attacks
  references:
  - https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
  tags:
  - attack.t1112
  author: megan201296
  date: 2019/04/14
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 13
      TargetObject:
      - '*\SOFTWARE\Classes\CLSID\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\Model'
      - '*\SOFTWARE\App\AppXbf13d4ea2945444d8b13e2121cb6b663\Application'
      - '*\SOFTWARE\App\AppXbf13d4ea2945444d8b13e2121cb6b663\DefaultIcon'
      - '*\SOFTWARE\App\AppX70162486c7554f7f80f481985d67586d\Application'
      - '*\SOFTWARE\App\AppX70162486c7554f7f80f481985d67586d\DefaultIcon'
      - '*\SOFTWARE\App\AppX37cc7fdccd644b4f85f4b22d5a3f105a\Application'
      - '*\SOFTWARE\App\AppX37cc7fdccd644b4f85f4b22d5a3f105a\DefaultIcon'
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          image_path:C\:\\WINDOWS\\system32\\wbem\\scrcons.exe)
  index: logstash-beats-*
  name: WMI Persistence - Script Event Consumer File Write
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Persistence - Script Event Consumer File Write
  id: 33f41cdd-35ac-4ba8-814b-c6a4244a1ad4
  status: experimental
  description: Detects file writes of WMI script event consumer
  references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
  - attack.t1084
  - attack.persistence
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 11
      Image: C:\WINDOWS\system32\wbem\scrcons.exe
    condition: selection
  falsepositives:
  - Unknown (data set is too small; further testing needed)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          image_path:*\\mstsc.exe AND TargetFileName:*\\Microsoft\\Windows\\Start\ Menu\\Programs\\Startup\\\\*)
  index: logstash-beats-*
  name: Hijack Legit RDP Session to Move Laterally
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Hijack Legit RDP Session to Move Laterally
  id: 52753ea4-b3a0-4365-910d-36cff487b789
  status: experimental
  description: Detects the usage of tsclient share to place a backdoor on the RDP source
    machine's startup folder
  date: 2019/02/21
  author: Samir Bousseaden
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 11
      Image: '*\mstsc.exe'
      TargetFileName: '*\Microsoft\Windows\Start Menu\Programs\Startup\\*'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default. An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:7 AND
          image_path:(*\\svchost.exe) AND event_data.ImageLoaded:(*\\tsmsisrv.dll OR
          *\\tsvipsrv.dll OR *\\wlbsctrl.dll)) AND (NOT (event_id:7 AND image_path:(*\\svchost.exe)
          AND event_data.ImageLoaded:(C\:\\Windows\\WinSxS\\*))))
  index: logstash-beats-*
  name: Svchost DLL Search Order Hijack
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Svchost DLL Search Order Hijack
  id: 602a1f13-c640-4d73-b053-be9a2fa58b77
  status: experimental
  description: IKEEXT and SessionEnv service, as they call LoadLibrary on files that
    do not exist within C:\Windows\System32\ by default. An attacker can place their
    malicious logic within the PROCESS_ATTACH block of their library and restart the
    aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote
    machine.
  references:
  - https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
  author: SBousseaden
  date: 2019/10/28
  tags:
  - attack.persistence
  - attack.defense_evasion
  - attack.t1073
  - attack.t1038
  - attack.t1112
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 7
      Image:
      - '*\svchost.exe'
      ImageLoaded:
      - '*\tsmsisrv.dll'
      - '*\tsvipsrv.dll'
      - '*\wlbsctrl.dll'
    filter:
      EventID: 7
      Image:
      - '*\svchost.exe'
      ImageLoaded:
      - C:\Windows\WinSxS\*
    condition: selection and not filter
  falsepositives:
  - Pentest
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a possible persistence mechanism using RUN key for Windows Explorer and poiting to a suspicious folder


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:*\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run
          AND event_data.Details:(C\:\\Windows\\Temp\\\\* OR C\:\\ProgramData\\\\* OR
          *\\AppData\\\\* OR C\:\\$Recycle.bin\\\\* OR C\:\\Temp\\\\* OR C\:\\Users\\Public\\\\*
          OR C\:\\Users\\Default\\\\*))
  index: logstash-beats-*
  name: Registry Persistence via Explorer Run Key
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Registry Persistence via Explorer Run Key
  id: b7916c2a-fa2f-4795-9477-32b731f70f11
  status: experimental
  description: Detects a possible persistence mechanism using RUN key for Windows Explorer
    and poiting to a suspicious folder
  author: Florian Roth
  date: 2018/07/18
  references:
  - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 13
      TargetObject: '*\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run'
      Details:
      - C:\Windows\Temp\\*
      - C:\ProgramData\\*
      - '*\AppData\\*'
      - C:\$Recycle.bin\\*
      - C:\Temp\\*
      - C:\Users\Public\\*
      - C:\Users\Default\\*
    condition: selection
  tags:
  - attack.persistence
  - attack.t1060
  - capec.270
  fields:
  - Image
  - ParentImage
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          image_path:(*\\Downloads\\\\* OR *\\Temporary\ Internet\ Files\\Content.Outlook\\\\*
          OR *\\Local\ Settings\\Temporary\ Internet\ Files\\\\*) AND event_data.TargetObject:*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\\\*)
  index: logstash-beats-*
  name: Suspicious RUN Key from Download
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious RUN Key from Download
  id: 9c5037d1-c568-49b3-88c7-9846a5bdc2be
  status: experimental
  description: Detects the suspicious RUN keys created by software located in Download
    or temporary Outlook/Internet Explorer directories
  references:
  - https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/
  author: Florian Roth
  date: 2019/10/01
  tags:
  - attack.persistence
  - attack.t1060
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 13
      Image:
      - '*\Downloads\\*'
      - '*\Temporary Internet Files\Content.Outlook\\*'
      - '*\Local Settings\Temporary Internet Files\\*'
      TargetObject: '*\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\*'
    condition: selection
  falsepositives:
  - Software installers downloaded and used by users
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:8 AND
          event_data.SourceImage:(*\\System32\\cscript.exe OR *\\System32\\wscript.exe
          OR *\\System32\\mshta.exe OR *\\winword.exe OR *\\excel.exe) AND event_data.TargetImage:*\\SysWOW64\\\\*
          AND event_data.StartModule:None)
  index: logstash-beats-*
  name: CACTUSTORCH Remote Thread Creation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/SBousseaden/status/1090588499517079552
  https://github.com/mdsecactivebreach/CACTUSTORCH


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: CACTUSTORCH Remote Thread Creation
  id: 2e4e488a-6164-4811-9ea1-f960c7359c40
  description: Detects remote thread creation from CACTUSTORCH as described in references.
  references:
  - https://twitter.com/SBousseaden/status/1090588499517079552
  - https://github.com/mdsecactivebreach/CACTUSTORCH
  status: experimental
  author: '@SBousseaden (detection), Thomas Patzke (rule)'
  date: 2019/02/01
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 8
      SourceImage:
      - '*\System32\cscript.exe'
      - '*\System32\wscript.exe'
      - '*\System32\mshta.exe'
      - '*\winword.exe'
      - '*\excel.exe'
      TargetImage: '*\SysWOW64\\*'
      StartModule:
    condition: selection
  tags:
  - attack.execution
  - attack.t1055
  - attack.t1064
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          event_data.Initiated:true AND event_data.DestinationHostname:(*.github.com
          OR *.githubusercontent.com) AND image_path:C\:\\Windows\\\\*)
  index: logstash-beats-*
  name: Microsoft Binary Github Communication
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Microsoft Binary Github Communication
  id: 635dbb88-67b3-4b41-9ea5-a3af2dd88153
  status: experimental
  description: Detects an executable in the Windows folder accessing github.com
  references:
  - https://twitter.com/M_haggis/status/900741347035889665
  - https://twitter.com/M_haggis/status/1032799638213066752
  author: Michael Haag (idea), Florian Roth (rule)
  date: 2017/08/24
  tags:
  - attack.lateral_movement
  - attack.t1105
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 3
      Initiated: 'true'
      DestinationHostname:
      - '*.github.com'
      - '*.githubusercontent.com'
      Image: C:\Windows\\*
    condition: selection
  falsepositives:
  - Unknown
  - '@subTee in your network'
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:20 AND
          Destination:(*new\-object\ system.net.webclient\).downloadstring\(* OR *new\-object\
          system.net.webclient\).downloadfile\(* OR *new\-object\ net.webclient\).downloadstring\(*
          OR *new\-object\ net.webclient\).downloadfile\(* OR *\ iex\(* OR *WScript.shell*
          OR *\ \-nop\ * OR *\ \-noprofile\ * OR *\ \-decode\ * OR *\ \-enc\ *))
  index: logstash-beats-*
  name: Suspicious Scripting in a WMI Consumer
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
  https://github.com/Neo23x0/signature-base/blob/master/yara/gen_susp_lnk_files.yar#L19


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Scripting in a WMI Consumer
  id: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0
  status: experimental
  description: Detects suspicious scripting in WMI Event Consumers
  author: Florian Roth
  references:
  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
  - https://github.com/Neo23x0/signature-base/blob/master/yara/gen_susp_lnk_files.yar#L19
  date: 2019/04/15
  tags:
  - attack.t1086
  - attack.execution
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 20
      Destination:
      - '*new-object system.net.webclient).downloadstring(*'
      - '*new-object system.net.webclient).downloadfile(*'
      - '*new-object net.webclient).downloadstring(*'
      - '*new-object net.webclient).downloadfile(*'
      - '* iex(*'
      - '*WScript.shell*'
      - '* -nop *'
      - '* -noprofile *'
      - '* -decode *'
      - '* -enc *'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Administrative scripts
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:3 AND
          image_path:(*\\$Recycle.bin OR *\\Users\\All\ Users\\\\* OR *\\Users\\Default\\\\*
          OR *\\Users\\Public\\\\* OR *\\Users\\Contacts\\\\* OR *\\Users\\Searches\\\\*
          OR C\:\\Perflogs\\\\* OR *\\config\\systemprofile\\\\* OR *\\Windows\\Fonts\\\\*
          OR *\\Windows\\IME\\\\* OR *\\Windows\\addins\\\\*))
  index: logstash-beats-*
  name: Suspicious Program Location with Network Connections
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Program Location with Network Connections
  id: 7b434893-c57d-4f41-908d-6a17bf1ae98f
  status: experimental
  description: Detects programs with network connections running in suspicious files
    system locations
  references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  author: Florian Roth
  date: 2017/03/19
  logsource:
    product: windows
    service: sysmon
    definition: Use the following config to generate the necessary Event ID 3 Network
      Connection events
  detection:
    selection:
      EventID: 3
      Image:
      - '*\$Recycle.bin'
      - '*\Users\All Users\\*'
      - '*\Users\Default\\*'
      - '*\Users\Public\\*'
      - '*\Users\Contacts\\*'
      - '*\Users\Searches\\*'
      - C:\Perflogs\\*
      - '*\config\systemprofile\\*'
      - '*\Windows\Fonts\\*'
      - '*\Windows\IME\\*'
      - '*\Windows\addins\\*'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only


customized_type: Issue
value:
  _False Positives_
  Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\Keyboard\ Layout\\Preload\\* OR *\\Keyboard\ Layout\\Substitutes\\*)
          AND event_data.Details:(429 OR 50429 OR 0000042a))
  index: logstash-beats-*
  name: Suspicious Keyboard Layout Load
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
  https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Keyboard Layout Load
  id: 34aa0252-6039-40ff-951f-939fd6ce47d8
  description: Detects the keyboard preload installation with a suspicious keyboard
    layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems
    maintained by US staff only
  references:
  - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index
  - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files
  author: Florian Roth
  date: 2019/10/12
  modified: 2019/10/15
  logsource:
    product: windows
    service: sysmon
    definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload
      subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files'
  detection:
    selection_registry:
      EventID: 13
      TargetObject:
      - '*\Keyboard Layout\Preload\*'
      - '*\Keyboard Layout\Substitutes\*'
      Details:
      - 429
      - 50429
      - 0000042a
    condition: selection_registry
  falsepositives:
  - Administrators or users that actually use the selected keyboard layouts (heavily
    depends on the organisation's user base)
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:15 AND
          (NOT (event_data.Imphash:(00000000000000000000000000000000 OR None))))
  index: logstash-beats-*
  name: Executable in ADS
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Executable in ADS
  id: b69888d4-380c-45ce-9cf9-d9ce46e67821
  status: experimental
  description: Detects the creation of an ADS data stream that contains an executable
    (non-empty imphash)
  references:
  - https://twitter.com/0xrawsec/status/1002478725605273600?s=21
  tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.s0139
  author: Florian Roth, @0xrawsec
  date: 2018/06/03
  logsource:
    product: windows
    service: sysmon
    definition: 'Requirements: Sysmon config with Imphash logging activated'
  detection:
    selection:
      EventID: 15
    filter:
      Imphash:
      - '00000000000000000000000000000000'
      - 
    condition: selection and not filter
  fields:
  - TargetFilename
  - Image
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(17 OR
          18) AND event_data.PipeName:(\\isapi_http OR \\isapi_dg OR \\isapi_dg2 OR
          \\sdlrpc OR \\ahexec OR \\winsession OR \\lsassw OR \\46a676ab7f179e511e30dd2dc41bd388
          OR \\9f81f59bc58452127884ce513865ed20 OR \\e710f28d59aa529d6792ca6ff0ca1b34
          OR \\rpchlp_3 OR \\NamePipe_MoreWindows OR \\pcheap_reuse OR \\msagent_* OR
          \\gruntsvc))
  index: logstash-beats-*
  name: Malicious Named Pipe
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malicious Named Pipe
  id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a
  status: experimental
  description: Detects the creation of a named pipe used by known APT malware
  references:
  - Various sources
  date: 2017/11/06
  author: Florian Roth
  logsource:
    product: windows
    service: sysmon
    definition: Note that you have to configure logging for PipeEvents in Symson config
  detection:
    selection:
      EventID:
      - 17
      - 18
      PipeName:
      - \isapi_http
      - \isapi_dg
      - \isapi_dg2
      - \sdlrpc
      - \ahexec
      - \winsession
      - \lsassw
      - \46a676ab7f179e511e30dd2dc41bd388
      - \9f81f59bc58452127884ce513865ed20
      - \e710f28d59aa529d6792ca6ff0ca1b34
      - \rpchlp_3
      - \NamePipe_MoreWindows
      - \pcheap_reuse
      - \msagent_*
      - \gruntsvc
    condition: selection
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055
  falsepositives:
  - Unkown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          destination_port:3389 AND event_data.Initiated:true) AND (NOT (image_path:(*\\mstsc.exe
          OR *\\RTSApp.exe OR *\\RTS2App.exe OR *\\RDCMan.exe OR *\\ws_TunnelService.exe
          OR *\\RSSensor.exe OR *\\RemoteDesktopManagerFree.exe OR *\\RemoteDesktopManager.exe
          OR *\\RemoteDesktopManager64.exe OR *\\mRemoteNG.exe OR *\\mRemote.exe OR
          *\\Terminals.exe OR *\\spiceworks\-finder.exe OR *\\FSDiscovery.exe OR *\\FSAssessment.exe
          OR *\\MobaRTE.exe OR *\\chrome.exe OR *\\thor.exe OR *\\thor64.exe))))
  index: logstash-beats-*
  name: Suspicious Outbound RDP Connections
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Outbound RDP Connections
  id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23
  status: experimental
  description: Detects Non-Standard Tools Connecting to TCP port 3389 indicating possible
    lateral movement
  references:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
  author: Markus Neis - Swisscom
  date: 2019/05/15
  tags:
  - attack.lateral_movement
  - attack.t1210
  - car.2013-07-002
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 3
      DestinationPort: 3389
      Initiated: 'true'
    filter:
      Image:
      - '*\mstsc.exe'
      - '*\RTSApp.exe'
      - '*\RTS2App.exe'
      - '*\RDCMan.exe'
      - '*\ws_TunnelService.exe'
      - '*\RSSensor.exe'
      - '*\RemoteDesktopManagerFree.exe'
      - '*\RemoteDesktopManager.exe'
      - '*\RemoteDesktopManager64.exe'
      - '*\mRemoteNG.exe'
      - '*\mRemote.exe'
      - '*\Terminals.exe'
      - '*\spiceworks-finder.exe'
      - '*\FSDiscovery.exe'
      - '*\FSAssessment.exe'
      - '*\MobaRTE.exe'
      - '*\chrome.exe'
      - '*\thor.exe'
      - '*\thor64.exe'
    condition: selection and not filter
  falsepositives:
  - Other Remote Desktop RDP tools
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:13 AND
          event_data.TargetObject:(*\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\Image\
          File\ Execution\ Options\\\\*\\GlobalFlag OR *\\SOFTWARE\\Microsoft\\Windows\
          NT\\CurrentVersion\\SilentProcessExit\\\\*\\ReportingMode OR *\\SOFTWARE\\Microsoft\\Windows\
          NT\\CurrentVersion\\SilentProcessExit\\\\*\\MonitorProcess) AND event_data.EventType:SetValue)
  index: logstash-beats-*
  name: Registry Persistence Mechanisms
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Registry Persistence Mechanisms
  id: 36803969-5421-41ec-b92f-8500f79c23b0
  description: Detects persistence registry keys
  references:
  - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
  date: 2018/04/11
  author: Karneades
  logsource:
    product: windows
    service: sysmon
  detection:
    selection_reg1:
      EventID: 13
      TargetObject:
      - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\\*\GlobalFlag'
      - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\\*\ReportingMode'
      - '*\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\\*\MonitorProcess'
      EventType: SetValue
    condition: selection_reg1
  tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.defense_evasion
  - attack.t1183
  - car.2013-01-002
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:10 AND
          event_data.TargetImage:*\\verclsid.exe AND event_data.GrantedAccess:0x1FFFFF)
          AND (event_data.CallTrace:*|UNKNOWN\(*VBE7.DLL* OR (event_data.SourceImage:*\\Microsoft\
          Office\\\\* AND event_data.CallTrace:*|UNKNOWN*)))
  index: logstash-beats-*
  name: Malware Shellcode in Verclsid Target Process
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malware Shellcode in Verclsid Target Process
  id: b7967e22-3d7e-409b-9ed5-cdae3f9243a1
  status: experimental
  description: Detects a process access to verclsid.exe that injects shellcode from
    a Microsoft Office application / VBA macro
  references:
  - https://twitter.com/JohnLaTwC/status/837743453039534080
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055
  author: John Lambert (tech), Florian Roth (rule)
  date: 2017/03/04
  logsource:
    product: windows
    service: sysmon
    definition: 'Use the following config to generate the necessary Event ID 10 Process
      Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess
      onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  detection:
    selection:
      EventID: 10
      TargetImage: '*\verclsid.exe'
      GrantedAccess: '0x1FFFFF'
    combination1:
      CallTrace: '*|UNKNOWN(*VBE7.DLL*'
    combination2:
      SourceImage: '*\Microsoft Office\\*'
      CallTrace: '*|UNKNOWN*'
    condition: selection and 1 of combination*
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:(19 OR
          20 OR 21))
  index: logstash-beats-*
  name: WMI Event Subscription
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Event Subscription
  id: 0f06a3a5-6a09-413f-8743-e6cf35561297
  status: experimental
  description: Detects creation of WMI event subscription persistence method
  references:
  - https://attack.mitre.org/techniques/T1084/
  tags:
  - attack.t1084
  - attack.persistence
  author: Tom Ueltschi (@c_APT_ure)
  date: 2019/01/12
  logsource:
    product: windows
    service: sysmon
  detection:
    selector:
      EventID:
      - 19
      - 20
      - 21
    condition: selector
  falsepositives:
  - exclude legitimate (vetted) use of WMI event subscription in your network
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:8 AND
          event_data.TargetImage:C\:\\Windows\\System32\\lsass.exe AND event_data.StartModule:None)
  index: logstash-beats-*
  name: Password Dumper Remote Thread in LSASS
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Password Dumper Remote Thread in LSASS
  id: f239b326-2f41-4d6b-9dfa-c846a60ef505
  description: Detects password dumper activity by monitoring remote thread creation
    EventID 8 in combination with the lsass.exe process as TargetImage. The process
    in field Process is the malicious program. A single execution can lead to hundreds
    of events.
  references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
  status: stable
  author: Thomas Patzke
  date: 2017/02/19
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 8
      TargetImage: C:\Windows\System32\lsass.exe
      StartModule:
    condition: selection
  tags:
  - attack.credential_access
  - attack.t1003
  - attack.s0005
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:13 AND
          event_data.TargetObject:(HKLM\\System\\CurrentControlSet\\Control\\Lsa\\Security\
          Packages OR HKLM\\System\\CurrentControlSet\\Control\\Lsa\\OSConfig\\Security\
          Packages)) AND (NOT (image_path:C\:\\Windows\\system32\\msiexec.exe OR image_path:C\:\\Windows\\syswow64\\MsiExec.exe)))
  index: logstash-beats-*
  name: Security Support Provider (SSP) Added to LSA Configuration
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://attack.mitre.org/techniques/T1101/
  https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Security Support Provider (SSP) Added to LSA Configuration
  id: eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc
  status: experimental
  description: Detects the addition of a SSP to the registry. Upon a reboot or API call,
    SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.
  references:
  - https://attack.mitre.org/techniques/T1101/
  - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
  tags:
  - attack.persistence
  - attack.t1011
  author: iwillkeepwatch
  date: 2019/01/18
  logsource:
    product: windows
    service: sysmon
  detection:
    selection_registry:
      EventID: 13
      TargetObject:
      - HKLM\System\CurrentControlSet\Control\Lsa\Security Packages
      - HKLM\System\CurrentControlSet\Control\Lsa\OSConfig\Security Packages
    exclusion_images:
    - Image: C:\Windows\system32\msiexec.exe
    - Image: C:\Windows\syswow64\MsiExec.exe
    condition: selection_registry and not exclusion_images
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Software that illegaly integrates PsExec in a renamed form
  Administrators that have renamed PsExec and no one knows why


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_data.Description:Execute\
          processes\ remotely AND event_data.Product:Sysinternals\ PsExec) AND (NOT
          (image_path:(*\\PsExec.exe OR *\\PsExec64.exe))))
  index: logstash-beats-*
  name: Renamed PsExec
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed PsExec
  id: a7a7e0e5-1d57-49df-9c58-9fe5bc0346a2
  status: experimental
  description: Detects the execution of a renamed PsExec often used by attackers or
    malware
  references:
  - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks
  author: Florian Roth
  date: 2019/05/21
  tags:
  - car.2013-05-009
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      Description: Execute processes remotely
      Product: Sysinternals PsExec
    filter:
      Image:
      - '*\PsExec.exe'
      - '*\PsExec64.exe'
    condition: selection and not filter
  falsepositives:
  - Software that illegaly integrates PsExec in a renamed form
  - Administrators that have renamed PsExec and no one knows why
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspect access to svchost process memory such as that used by Invoke-Phantom to kill the winRM windows event logging service.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:10 AND
          event_data.TargetImage:*\\windows\\system32\\svchost.exe AND event_data.GrantedAccess:0x1f3fff
          AND event_data.CallTrace:(*unknown*))
  index: logstash-beats-*
  name: Suspect Svchost Memory Asccess
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspect Svchost Memory Asccess
  id: 166e9c50-8cd9-44af-815d-d1f0c0e90dde
  status: experimental
  description: Detects suspect access to svchost process memory such as that used by
    Invoke-Phantom to kill the winRM windows event logging service.
  author: Tim Burrell
  date: 2020/01/02
  references:
  - https://github.com/hlldz/Invoke-Phant0m
  - https://twitter.com/timbmsft/status/900724491076214784
  tags:
  - attack.t1089
  - attack.defense_evasion
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 10
      TargetImage: '*\windows\system32\svchost.exe'
      GrantedAccess: '0x1f3fff'
      CallTrace:
      - '*unknown*'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  there is a relevant set of false positives depending on applications in the environment


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:6 AND
          event_data.ImageLoaded:*\\Temp\\\\*)
  index: logstash-beats-*
  name: Suspicious Driver Load from Temp
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Driver Load from Temp
  id: 2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
  description: Detects a driver load from a temporary directory
  author: Florian Roth
  date: 2017/02/12
  tags:
  - attack.persistence
  - attack.t1050
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 6
      ImageLoaded: '*\Temp\\*'
    condition: selection
  falsepositives:
  - there is a relevant set of false positives depending on applications in the environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects programs that connect to typical malware back connect ports based on statistical analysis from two different sandbox system databases


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:3 AND
          event_data.Initiated:true AND destination_port:(4443 OR 2448 OR 8143 OR 1777
          OR 1443 OR 243 OR 65535 OR 13506 OR 3360 OR 200 OR 198 OR 49180 OR 13507 OR
          6625 OR 4444 OR 4438 OR 1904 OR 13505 OR 13504 OR 12102 OR 9631 OR 5445 OR
          2443 OR 777 OR 13394 OR 13145 OR 12103 OR 5552 OR 3939 OR 3675 OR 666 OR 473
          OR 5649 OR 4455 OR 4433 OR 1817 OR 100 OR 65520 OR 1960 OR 1515 OR 743 OR
          700 OR 14154 OR 14103 OR 14102 OR 12322 OR 10101 OR 7210 OR 4040 OR 9943))
          AND (NOT ((log_name:Microsoft\-Windows\-Sysmon\/Operational AND (image_path:*\\Program\
          Files* OR (destination_ip:(10.* OR 192.168.* OR 172.16.* OR 172.17.* OR 172.18.*
          OR 172.19.* OR 172.20.* OR 172.21.* OR 172.22.* OR 172.23.* OR 172.24.* OR
          172.25.* OR 172.26.* OR 172.27.* OR 172.28.* OR 172.29.* OR 172.30.* OR 172.31.*
          OR 127.*) AND event_data.DestinationIsIpv6:false))))))
  index: logstash-beats-*
  name: Suspicious Typical Malware Back Connect Ports
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Typical Malware Back Connect Ports
  id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382
  status: experimental
  description: Detects programs that connect to typical malware back connect ports based
    on statistical analysis from two different sandbox system databases
  references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  author: Florian Roth
  date: 2017/03/19
  tags:
  - attack.command_and_control
  - attack.t1043
  logsource:
    product: windows
    service: sysmon
    definition: 'Use the following config to generate the necessary Event ID 10 Process
      Access events: <ProcessAccess onmatch="include"><CallTrace condition="contains">VBE7.DLL</CallTrace></ProcessAccess><ProcessAccess
      onmatch="exclude"><CallTrace condition="excludes">UNKNOWN</CallTrace></ProcessAccess>'
  detection:
    selection:
      EventID: 3
      Initiated: 'true'
      DestinationPort:
      - '4443'
      - '2448'
      - '8143'
      - '1777'
      - '1443'
      - '243'
      - '65535'
      - '13506'
      - '3360'
      - '200'
      - '198'
      - '49180'
      - '13507'
      - '6625'
      - '4444'
      - '4438'
      - '1904'
      - '13505'
      - '13504'
      - '12102'
      - '9631'
      - '5445'
      - '2443'
      - '777'
      - '13394'
      - '13145'
      - '12103'
      - '5552'
      - '3939'
      - '3675'
      - '666'
      - '473'
      - '5649'
      - '4455'
      - '4433'
      - '1817'
      - '100'
      - '65520'
      - '1960'
      - '1515'
      - '743'
      - '700'
      - '14154'
      - '14103'
      - '14102'
      - '12322'
      - '10101'
      - '7210'
      - '4040'
      - '9943'
    filter1:
      Image: '*\Program Files*'
    filter2:
      DestinationIp:
      - 10.*
      - 192.168.*
      - 172.16.*
      - 172.17.*
      - 172.18.*
      - 172.19.*
      - 172.20.*
      - 172.21.*
      - 172.22.*
      - 172.23.*
      - 172.24.*
      - 172.25.*
      - 172.26.*
      - 172.27.*
      - 172.28.*
      - 172.29.*
      - 172.30.*
      - 172.31.*
      - 127.*
      DestinationIsIpv6: 'false'
    condition: selection and not ( filter1 or filter2 )
  falsepositives:
  - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          event_data.TargetFilename:(*\\Invoke\-DllInjection.ps1 OR *\\Invoke\-WmiCommand.ps1
          OR *\\Get\-GPPPassword.ps1 OR *\\Get\-Keystrokes.ps1 OR *\\Get\-VaultCredential.ps1
          OR *\\Invoke\-CredentialInjection.ps1 OR *\\Invoke\-Mimikatz.ps1 OR *\\Invoke\-NinjaCopy.ps1
          OR *\\Invoke\-TokenManipulation.ps1 OR *\\Out\-Minidump.ps1 OR *\\VolumeShadowCopyTools.ps1
          OR *\\Invoke\-ReflectivePEInjection.ps1 OR *\\Get\-TimedScreenshot.ps1 OR
          *\\Invoke\-UserHunter.ps1 OR *\\Find\-GPOLocation.ps1 OR *\\Invoke\-ACLScanner.ps1
          OR *\\Invoke\-DowngradeAccount.ps1 OR *\\Get\-ServiceUnquoted.ps1 OR *\\Get\-ServiceFilePermission.ps1
          OR *\\Get\-ServicePermission.ps1 OR *\\Invoke\-ServiceAbuse.ps1 OR *\\Install\-ServiceBinary.ps1
          OR *\\Get\-RegAutoLogon.ps1 OR *\\Get\-VulnAutoRun.ps1 OR *\\Get\-VulnSchTask.ps1
          OR *\\Get\-UnattendedInstallFile.ps1 OR *\\Get\-WebConfig.ps1 OR *\\Get\-ApplicationHost.ps1
          OR *\\Get\-RegAlwaysInstallElevated.ps1 OR *\\Get\-Unconstrained.ps1 OR *\\Add\-RegBackdoor.ps1
          OR *\\Add\-ScrnSaveBackdoor.ps1 OR *\\Gupt\-Backdoor.ps1 OR *\\Invoke\-ADSBackdoor.ps1
          OR *\\Enabled\-DuplicateToken.ps1 OR *\\Invoke\-PsUaCme.ps1 OR *\\Remove\-Update.ps1
          OR *\\Check\-VM.ps1 OR *\\Get\-LSASecret.ps1 OR *\\Get\-PassHashes.ps1 OR
          *\\Show\-TargetScreen.ps1 OR *\\Port\-Scan.ps1 OR *\\Invoke\-PoshRatHttp.ps1
          OR *\\Invoke\-PowerShellTCP.ps1 OR *\\Invoke\-PowerShellWMI.ps1 OR *\\Add\-Exfiltration.ps1
          OR *\\Add\-Persistence.ps1 OR *\\Do\-Exfiltration.ps1 OR *\\Start\-CaptureServer.ps1
          OR *\\Invoke\-ShellCode.ps1 OR *\\Get\-ChromeDump.ps1 OR *\\Get\-ClipboardContents.ps1
          OR *\\Get\-FoxDump.ps1 OR *\\Get\-IndexedItem.ps1 OR *\\Get\-Screenshot.ps1
          OR *\\Invoke\-Inveigh.ps1 OR *\\Invoke\-NetRipper.ps1 OR *\\Invoke\-EgressCheck.ps1
          OR *\\Invoke\-PostExfil.ps1 OR *\\Invoke\-PSInject.ps1 OR *\\Invoke\-RunAs.ps1
          OR *\\MailRaider.ps1 OR *\\New\-HoneyHash.ps1 OR *\\Set\-MacAttribute.ps1
          OR *\\Invoke\-DCSync.ps1 OR *\\Invoke\-PowerDump.ps1 OR *\\Exploit\-Jboss.ps1
          OR *\\Invoke\-ThunderStruck.ps1 OR *\\Invoke\-VoiceTroll.ps1 OR *\\Set\-Wallpaper.ps1
          OR *\\Invoke\-InveighRelay.ps1 OR *\\Invoke\-PsExec.ps1 OR *\\Invoke\-SSHCommand.ps1
          OR *\\Get\-SecurityPackages.ps1 OR *\\Install\-SSP.ps1 OR *\\Invoke\-BackdoorLNK.ps1
          OR *\\PowerBreach.ps1 OR *\\Get\-SiteListPassword.ps1 OR *\\Get\-System.ps1
          OR *\\Invoke\-BypassUAC.ps1 OR *\\Invoke\-Tater.ps1 OR *\\Invoke\-WScriptBypassUAC.ps1
          OR *\\PowerUp.ps1 OR *\\PowerView.ps1 OR *\\Get\-RickAstley.ps1 OR *\\Find\-Fruit.ps1
          OR *\\HTTP\-Login.ps1 OR *\\Find\-TrustedDocuments.ps1 OR *\\Invoke\-Paranoia.ps1
          OR *\\Invoke\-WinEnum.ps1 OR *\\Invoke\-ARPScan.ps1 OR *\\Invoke\-PortScan.ps1
          OR *\\Invoke\-ReverseDNSLookup.ps1 OR *\\Invoke\-SMBScanner.ps1 OR *\\Invoke\-Mimikittenz.ps1))
  index: logstash-beats-*
  name: Malicious PowerShell Commandlet Names
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://raw.githubusercontent.com/Neo23x0/sigma/f35c50049fa896dff91ff545cb199319172701e8/rules/windows/powershell/powershell_malicious_commandlets.yml


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malicious PowerShell Commandlet Names
  id: f331aa1f-8c53-4fc3-b083-cc159bc971cb
  status: experimental
  description: Detects the creation of known powershell scripts for exploitation
  references:
  - https://raw.githubusercontent.com/Neo23x0/sigma/f35c50049fa896dff91ff545cb199319172701e8/rules/windows/powershell/powershell_malicious_commandlets.yml
  tags:
  - attack.execution
  - attack.t1086
  author: Markus Neis
  date: 2018/04/07
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 11
      TargetFilename:
      - '*\Invoke-DllInjection.ps1'
      - '*\Invoke-WmiCommand.ps1'
      - '*\Get-GPPPassword.ps1'
      - '*\Get-Keystrokes.ps1'
      - '*\Get-VaultCredential.ps1'
      - '*\Invoke-CredentialInjection.ps1'
      - '*\Invoke-Mimikatz.ps1'
      - '*\Invoke-NinjaCopy.ps1'
      - '*\Invoke-TokenManipulation.ps1'
      - '*\Out-Minidump.ps1'
      - '*\VolumeShadowCopyTools.ps1'
      - '*\Invoke-ReflectivePEInjection.ps1'
      - '*\Get-TimedScreenshot.ps1'
      - '*\Invoke-UserHunter.ps1'
      - '*\Find-GPOLocation.ps1'
      - '*\Invoke-ACLScanner.ps1'
      - '*\Invoke-DowngradeAccount.ps1'
      - '*\Get-ServiceUnquoted.ps1'
      - '*\Get-ServiceFilePermission.ps1'
      - '*\Get-ServicePermission.ps1'
      - '*\Invoke-ServiceAbuse.ps1'
      - '*\Install-ServiceBinary.ps1'
      - '*\Get-RegAutoLogon.ps1'
      - '*\Get-VulnAutoRun.ps1'
      - '*\Get-VulnSchTask.ps1'
      - '*\Get-UnattendedInstallFile.ps1'
      - '*\Get-WebConfig.ps1'
      - '*\Get-ApplicationHost.ps1'
      - '*\Get-RegAlwaysInstallElevated.ps1'
      - '*\Get-Unconstrained.ps1'
      - '*\Add-RegBackdoor.ps1'
      - '*\Add-ScrnSaveBackdoor.ps1'
      - '*\Gupt-Backdoor.ps1'
      - '*\Invoke-ADSBackdoor.ps1'
      - '*\Enabled-DuplicateToken.ps1'
      - '*\Invoke-PsUaCme.ps1'
      - '*\Remove-Update.ps1'
      - '*\Check-VM.ps1'
      - '*\Get-LSASecret.ps1'
      - '*\Get-PassHashes.ps1'
      - '*\Show-TargetScreen.ps1'
      - '*\Port-Scan.ps1'
      - '*\Invoke-PoshRatHttp.ps1'
      - '*\Invoke-PowerShellTCP.ps1'
      - '*\Invoke-PowerShellWMI.ps1'
      - '*\Add-Exfiltration.ps1'
      - '*\Add-Persistence.ps1'
      - '*\Do-Exfiltration.ps1'
      - '*\Start-CaptureServer.ps1'
      - '*\Invoke-ShellCode.ps1'
      - '*\Get-ChromeDump.ps1'
      - '*\Get-ClipboardContents.ps1'
      - '*\Get-FoxDump.ps1'
      - '*\Get-IndexedItem.ps1'
      - '*\Get-Screenshot.ps1'
      - '*\Invoke-Inveigh.ps1'
      - '*\Invoke-NetRipper.ps1'
      - '*\Invoke-EgressCheck.ps1'
      - '*\Invoke-PostExfil.ps1'
      - '*\Invoke-PSInject.ps1'
      - '*\Invoke-RunAs.ps1'
      - '*\MailRaider.ps1'
      - '*\New-HoneyHash.ps1'
      - '*\Set-MacAttribute.ps1'
      - '*\Invoke-DCSync.ps1'
      - '*\Invoke-PowerDump.ps1'
      - '*\Exploit-Jboss.ps1'
      - '*\Invoke-ThunderStruck.ps1'
      - '*\Invoke-VoiceTroll.ps1'
      - '*\Set-Wallpaper.ps1'
      - '*\Invoke-InveighRelay.ps1'
      - '*\Invoke-PsExec.ps1'
      - '*\Invoke-SSHCommand.ps1'
      - '*\Get-SecurityPackages.ps1'
      - '*\Install-SSP.ps1'
      - '*\Invoke-BackdoorLNK.ps1'
      - '*\PowerBreach.ps1'
      - '*\Get-SiteListPassword.ps1'
      - '*\Get-System.ps1'
      - '*\Invoke-BypassUAC.ps1'
      - '*\Invoke-Tater.ps1'
      - '*\Invoke-WScriptBypassUAC.ps1'
      - '*\PowerUp.ps1'
      - '*\PowerView.ps1'
      - '*\Get-RickAstley.ps1'
      - '*\Find-Fruit.ps1'
      - '*\HTTP-Login.ps1'
      - '*\Find-TrustedDocuments.ps1'
      - '*\Invoke-Paranoia.ps1'
      - '*\Invoke-WinEnum.ps1'
      - '*\Invoke-ARPScan.ps1'
      - '*\Invoke-PortScan.ps1'
      - '*\Invoke-ReverseDNSLookup.ps1'
      - '*\Invoke-SMBScanner.ps1'
      - '*\Invoke-Mimikittenz.ps1'
    condition: selection
  falsepositives:
  - Penetration Tests
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:7 AND
          image_path:(*\\notepad.exe) AND event_data.ImageLoaded:(*\\samlib.dll OR *\\WinSCard.dll))
  index: logstash-beats-*
  name: Possible Process Hollowing Image Loading
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible Process Hollowing Image Loading
  id: e32ce4f5-46c6-4c47-ba69-5de3c9193cd7
  status: experimental
  description: Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g.
    through process hollowing by Mimikatz
  references:
  - https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html
  author: Markus Neis
  date: 2018/01/07
  tags:
  - attack.defense_evasion
  - attack.t1073
  logsource:
    product: windows
    service: sysmon
  detection:
    selection:
      EventID: 7
      Image:
      - '*\notepad.exe'
      ImageLoaded:
      - '*\samlib.dll'
      - '*\WinSCard.dll'
    condition: selection
  falsepositives:
  - Very likely, needs more tuning
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND ((event_id:13 AND
          event_data.TargetObject:HKEY_USERS\\\\*\\mscfile\\shell\\open\\command) OR
          (log_name:Microsoft\-Windows\-Sysmon\/Operational AND (event_id:1 AND event_data.ParentImage:*\\eventvwr.exe)
          AND (NOT (image_path:*\\mmc.exe)))))
  index: logstash-beats-*
  name: UAC Bypass via Event Viewer
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: UAC Bypass via Event Viewer
  id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
  status: experimental
  description: Detects UAC bypass method using Windows event viewer
  references:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
  author: Florian Roth
  date: 2017/03/19
  logsource:
    product: windows
    service: sysmon
  detection:
    methregistry:
      EventID: 13
      TargetObject: HKEY_USERS\\*\mscfile\shell\open\command
    methprocess:
      EventID: 1
      ParentImage: '*\eventvwr.exe'
    filterprocess:
      Image: '*\mmc.exe'
    condition: methregistry or ( methprocess and not filterprocess )
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1088
  - car.2019-04-001
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Legitimate administrator or developer creating legitimate executable files in a web application folder


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_id:11 AND
          ((log_name:Microsoft\-Windows\-Sysmon\/Operational AND ((event_data.TargetFilename:*\\inetpub\\wwwroot\\*
          AND event_data.TargetFilename:(*.asp* OR *.ashx* OR *.ph*)) OR (event_data.TargetFilename:(*\\www\\*
          OR *\\htdocs\\* OR *\\html\\*) AND event_data.TargetFilename:*.ph*))) OR ((event_data.TargetFilename:*\\*
          AND event_data.TargetFilename:*.jsp*) OR (event_data.TargetFilename:*\\cgi\-bin\\*
          AND event_data.TargetFilename:*.pl*))))
  index: logstash-beats-*
  name: Windows Webshell Creation
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Webshell Creation
  id: 39f1f9f2-9636-45de-98f6-a4046aa8e4b9
  status: experimental
  description: Posible webshell file creation on a static web site
  references:
  - PT ESC rule and personal experience
  author: Beyu Denis, oscd.community
  date: 2019/10/22
  modified: 2019/11/04
  tags:
  - attack.persistence
  - attack.t1100
  level: critical
  logsource:
    product: windows
    service: sysmon
  detection:
    selection_1:
      EventID: 11
    selection_2:
      TargetFilename|contains: \inetpub\wwwroot\
    selection_3:
      TargetFilename|contains:
      - .asp
      - .ashx
      - .ph
    selection_4:
      TargetFilename|contains:
      - \www\
      - \htdocs\
      - \html\
    selection_5:
      TargetFilename|contains: .ph
    selection_6:
    - TargetFilename|contains|all:
      - \
      - .jsp
    - TargetFilename|contains|all:
      - \cgi-bin\
      - .pl
    condition: selection_1 and ( selection_2 and selection_3 ) or selection_1 and (
      selection_4 and selection_5 ) or selection_1 and selection_6
  falsepositives:
  - Legitimate administrator or developer creating legitimate executable files in a
    web application folder

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Some legitimate apps use this, but limited.

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((image_path:(*\\bitsadmin.exe) AND event_data.CommandLine:(*\ \/transfer\
          *)) OR event_data.CommandLine:(*copy\ bitsadmin.exe*)))
  index: logstash-beats-*
  name: Bitsadmin Download
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Bitsadmin Download
  id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede
  status: experimental
  description: Detects usage of bitsadmin downloading a file
  references:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1197
  - attack.s0190
  date: 2017/03/09
  modified: 2019/12/06
  author: Michael Haag
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image:
      - '*\bitsadmin.exe'
      CommandLine:
      - '* /transfer *'
    selection2:
      CommandLine:
      - '*copy bitsadmin.exe*'
    condition: selection1 or selection2
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Some legitimate apps use this, but limited.
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious use of calc.exe with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:*\\calc.exe\ * OR (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational
          AND image_path:*\\calc.exe AND (NOT (image_path:*\\Windows\\Sys*)))))
  index: logstash-beats-*
  name: Suspicious Calculator Usage
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Calculator Usage
  id: 737e618a-a410-49b5-bec3-9e55ff7fbc15
  description: Detects suspicious use of calc.exe with command line parameters or in
    a suspicious directory, which is likely caused by some PoC or detection evasion
  status: experimental
  references:
  - https://twitter.com/ItsReallyNick/status/1094080242686312448
  author: Florian Roth
  date: 2019/02/09
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine: '*\calc.exe *'
    selection2:
      Image: '*\calc.exe'
    filter2:
      Image: '*\Windows\Sys*'
    condition: selection1 or ( selection2 and not filter2 )
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious uses of the SysInternals Procdump utility by using a special command line parameter in combination with the lsass.exe process. This way we're also able to catch cases in which the attacker has renamed the procdump executable.


customized_type: Issue
value:
  _False Positives_
  Unlikely, because no one should dump an lsass process memory
  Another tool that uses the command line switches of Procdump


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_data.CommandLine:(*\
          \-ma\ *) AND event_data.CommandLine:(*\ lsass*)) OR event_data.CommandLine:(*\
          \-ma\ ls*)))
  index: logstash-beats-*
  name: Suspicious Use of Procdump
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Use of Procdump
  id: 5afee48e-67dd-4e03-a783-f74259dcf998
  description: Detects suspicious uses of the SysInternals Procdump utility by using
    a special command line parameter in combination with the lsass.exe process. This
    way we're also able to catch cases in which the attacker has renamed the procdump
    executable.
  status: experimental
  references:
  - Internal Research
  author: Florian Roth
  date: 2018/10/30
  modified: 2019/10/14
  tags:
  - attack.defense_evasion
  - attack.t1036
  - attack.credential_access
  - attack.t1003
  - car.2013-05-009
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine:
      - '* -ma *'
    selection2:
      CommandLine:
      - '* lsass*'
    selection3:
      CommandLine:
      - '* -ma ls*'
    condition: ( selection1 and selection2 ) or selection3
  falsepositives:
  - Unlikely, because no one should dump an lsass process memory
  - Another tool that uses the command line switches of Procdump
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  False positives depend on scripts and administrative tools used in the monitored environment


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(\^h\^t\^t\^p OR h\"t\"t\"p))
  index: logstash-beats-*
  name: Suspicious Commandline Escape
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/vysecurity/status/885545634958385153
  https://twitter.com/Hexacorn/status/885553465417756673
  https://twitter.com/Hexacorn/status/885570278637678592
  https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
  http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Commandline Escape
  id: f0cdd048-82dc-4f7a-8a7a-b87a52b6d0fd
  description: Detects suspicious process that use escape characters
  status: experimental
  references:
  - https://twitter.com/vysecurity/status/885545634958385153
  - https://twitter.com/Hexacorn/status/885553465417756673
  - https://twitter.com/Hexacorn/status/885570278637678592
  - https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
  - http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
  author: juju4
  date: 2018/12/11
  tags:
  - attack.defense_evasion
  - attack.t1140
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - ^h^t^t^p
      - h"t"t"p
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  Trickbot enumerates domain/network topology and executes certain commands automatically every few minutes. This detectors attempts to identify that activity based off a command rarely observed in an enterprise network.


customized_type: Issue
value:
  _False Positives_
  Rare System Admin Activity

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\nltest.exe) AND event_data.CommandLine:(\/domain_trusts\ \/all_trusts
          OR \/domain_trusts))
  index: logstash-beats-*
  name: Trickbot Malware Recon Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Trickbot Malware Recon Activity
  id: 410ad193-a728-4107-bc79-4419789fcbf8
  status: experimental
  description: Trickbot enumerates domain/network topology and executes certain commands
    automatically every few minutes. This detectors attempts to identify that activity
    based off a command rarely observed in an enterprise network.
  references:
  - https://www.sneakymonkey.net/2019/05/22/trickbot-analysis/
  author: David Burkett
  date: 12/28/2019
  tags:
  - attack.t1482
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\nltest.exe'
      CommandLine:
      - /domain_trusts /all_trusts
      - /domain_trusts
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Rare System Admin Activity
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\crackmapexec.exe))
  index: logstash-beats-*
  name: CrackMapExecWin
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: CrackMapExecWin
  id: 04d9079e-3905-4b70-ad37-6bdf11304965
  description: Detects CrackMapExecWin Activity as Described by NCSC
  status: experimental
  references:
  - https://www.ncsc.gov.uk/alerts/hostile-state-actors-compromising-uk-organisations-focus-engineering-and-industrial-control
  tags:
  - attack.g0035
  author: Markus Neis
  date: 2018/04/08
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\crackmapexec.exe'
    condition: selection
  falsepositives:
  - None
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size..). Might be used by ransomwares during the attack (seen by NotPetya and others)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (image_path:*\\fsutil.exe
          OR OriginalFileName:fsutil.exe) AND event_data.CommandLine:(*\ deletejournal\
          * OR *\ createjournal\ *))
  index: logstash-beats-*
  name: Fsutil Suspicious Invocation
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Fsutil Suspicious Invocation
  id: add64136-62e5-48ea-807e-88638d02df1e
  description: Detects suspicious parameters of fsutil (deleting USN journal, configuring
    it with small size..). Might be used by ransomwares during the attack (seen by NotPetya
    and others)
  author: Ecco
  date: 2019/09/26
  level: high
  references:
  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
  logsource:
    category: process_creation
    product: windows
  detection:
    binary_1:
      Image: '*\fsutil.exe'
    binary_2:
      OriginalFileName: fsutil.exe
    selection:
      CommandLine:
      - '* deletejournal *'
      - '* createjournal *'
    condition: (1 of binary_*) and selection
  falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ asreproast\ * OR *\ dump\ \/service\:krbtgt\ *
          OR *\ kerberoast\ * OR *\ createnetonly\ \/program\:* OR *\ ptt\ \/ticket\:*
          OR *\ \/impersonateuser\:* OR *\ renew\ \/ticket\:* OR *\ asktgt\ \/user\:*
          OR *\ harvest\ \/interval\:*))
  index: logstash-beats-*
  name: Rubeus Hack Tool
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Rubeus Hack Tool
  id: 7ec2c172-dceb-4c10-92c9-87c1881b7e18
  description: Detects command line parameters used by Rubeus hack tool
  author: Florian Roth
  references:
  - https://www.harmj0y.net/blog/redteaming/from-kekeo-to-rubeus/
  date: 2018/12/19
  tags:
  - attack.credential_access
  - attack.t1003
  - attack.s0005
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* asreproast *'
      - '* dump /service:krbtgt *'
      - '* kerberoast *'
      - '* createnetonly /program:*'
      - '* ptt /ticket:*'
      - '* /impersonateuser:*'
      - '* renew /ticket:*'
      - '* asktgt /user:*'
      - '* harvest /interval:*'
    condition: selection
  falsepositives:
  - unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          ProcessCommandLine:C\:\\Windows\\PSEXESVC.exe)
  index: logstash-beats-*
  name: PsExec Service Start
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PsExec Service Start
  id: 3ede524d-21cc-472d-a3ce-d21b568d8db7
  description: Detects a PsExec service start
  author: Florian Roth
  date: 2018/03/13
  modified: 2012/12/11
  tags:
  - attack.execution
  - attack.t1035
  - attack.s0029
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ProcessCommandLine: C:\Windows\PSEXESVC.exe
    condition: selection
  falsepositives:
  - Administrative activity
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \-e*\ PAA* OR *JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ*
          OR *QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA* OR *kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA*
          OR *IgAoACcAKgAnACkAOwAkA* OR *IAKAAnACoAJwApADsAJA* OR *iACgAJwAqACcAKQA7ACQA*
          OR *JABGAGwAeAByAGgAYwBmAGQ*))
  index: logstash-beats-*
  name: Emotet Process Creation
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
  https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
  https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
  https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Emotet Process Creation
  id: d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18
  status: experimental
  description: Detects all Emotet like process executions that are not covered by the
    more generic rules
  author: Florian Roth
  date: 2019/09/30
  modified: 2019/10/16
  references:
  - https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
  - https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
  - https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
  - https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* -e* PAA*'
      - '*JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ*'
      - '*QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA*'
      - '*kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA*'
      - '*IgAoACcAKgAnACkAOwAkA*'
      - '*IAKAAnACoAJwApADsAJA*'
      - '*iACgAJwAqACcAKQA7ACQA*'
      - '*JABGAGwAeAByAGgAYwBmAGQ*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_data.ParentImage:*\\System32\\control.exe AND event_data.CommandLine:*\\rundll32.exe\
          *) AND (NOT (event_data.CommandLine:*Shell32.dll*)))
  index: logstash-beats-*
  name: Suspicious Control Panel DLL Load
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Control Panel DLL Load
  id: d7eb979b-c2b5-4a6f-a3a7-c87ce6763819
  status: experimental
  description: Detects suspicious Rundll32 execution from control.exe as used by Equation
    Group and Exploit Kits
  author: Florian Roth
  date: 2017/04/15
  references:
  - https://twitter.com/rikvduijn/status/853251879320662017
  tags:
  - attack.defense_evasion
  - attack.t1073
  - attack.t1085
  - car.2013-10-002
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\System32\control.exe'
      CommandLine: '*\rundll32.exe *'
    filter:
      CommandLine: '*Shell32.dll*'
    condition: selection and not filter
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\csc.exe* AND event_data.ParentImage:(*\\wscript.exe OR *\\cscript.exe
          OR *\\mshta.exe))
  index: logstash-beats-*
  name: Suspicious Parent of Csc.exe
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Parent of Csc.exe
  id: b730a276-6b63-41b8-bcf8-55930c8fc6ee
  description: Detects a suspicious parent of csc.exe, which could by a sign of payload
    delivery
  status: experimental
  references:
  - https://twitter.com/SBousseaden/status/1094924091256176641
  author: Florian Roth
  date: 2019/02/11
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\csc.exe*'
      ParentImage:
      - '*\wscript.exe'
      - '*\cscript.exe'
      - '*\mshta.exe'
    condition: selection
  falsepositives:
  - Unkown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious a certutil command that used to encode files, which is sometimes used for data exfiltration


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(certutil\ \-f\ \-encode\ * OR certutil.exe\ \-f\ \-encode\
          * OR certutil\ \-encode\ \-f\ * OR certutil.exe\ \-encode\ \-f\ *))
  index: logstash-beats-*
  name: Certutil Encode
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Certutil Encode
  id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a
  status: experimental
  description: Detects suspicious a certutil command that used to encode files, which
    is sometimes used for data exfiltration
  references:
  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  author: Florian Roth
  date: 2019/02/24
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - certutil -f -encode *
      - certutil.exe -f -encode *
      - certutil -encode -f *
      - certutil.exe -encode -f *
    condition: selection
  falsepositives:
  - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \-e\ JAB* OR *\ \-e\ \ JAB* OR *\ \-e\ \ \ JAB*
          OR *\ \-e\ \ \ \ JAB* OR *\ \-e\ \ \ \ \ JAB* OR *\ \-e\ \ \ \ \ \ JAB* OR
          *\ \-en\ JAB* OR *\ \-enc\ JAB* OR *\ \-enc*\ JAB* OR *\ \-w\ hidden\ \-e*\
          JAB* OR *\ BA\^J\ e\- OR *\ \-e\ SUVYI* OR *\ \-e\ aWV4I* OR *\ \-e\ SQBFAFgA*
          OR *\ \-e\ aQBlAHgA* OR *\ \-enc\ SUVYI* OR *\ \-enc\ aWV4I* OR *\ \-enc\
          SQBFAFgA* OR *\ \-enc\ aQBlAHgA*) AND (NOT (event_data.CommandLine:*\ \-ExecutionPolicy\
          remotesigned\ *)))
  index: logstash-beats-*
  name: Suspicious Encoded PowerShell Command Line
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Encoded PowerShell Command Line
  id: ca2092a1-c273-4878-9b4b-0d60115bf5ea
  description: Detects suspicious powershell process starts with base64 encoded commands
    (e.g. Emotet)
  status: experimental
  references:
  - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
  author: Florian Roth, Markus Neis
  date: 2018/09/03
  modified: 2019/12/16
  tags:
  - attack.execution
  - attack.t1086
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* -e JAB*'
      - '* -e  JAB*'
      - '* -e   JAB*'
      - '* -e    JAB*'
      - '* -e     JAB*'
      - '* -e      JAB*'
      - '* -en JAB*'
      - '* -enc JAB*'
      - '* -enc* JAB*'
      - '* -w hidden -e* JAB*'
      - '* BA^J e-'
      - '* -e SUVYI*'
      - '* -e aWV4I*'
      - '* -e SQBFAFgA*'
      - '* -e aQBlAHgA*'
      - '* -enc SUVYI*'
      - '* -enc aWV4I*'
      - '* -enc SQBFAFgA*'
      - '* -enc aQBlAHgA*'
    falsepositive1:
      CommandLine: '* -ExecutionPolicy remotesigned *'
    condition: selection and not falsepositive1
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc*)
  index: logstash-beats-*
  name: TropicTrooper Campaign November 2018
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://cloudblogs.microsoft.com/microsoftsecure/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: TropicTrooper Campaign November 2018
  id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
  author: '@41thexplorer, Windows Defender ATP'
  status: stable
  date: 2019/11/12
  description: Detects TropicTrooper activity, an actor who targeted high-profile organizations
    in the energy and food and beverage sectors in Asia
  references:
  - https://cloudblogs.microsoft.com/microsoftsecure/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
  tags:
  - attack.execution
  - attack.t1085
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc*'
    condition: selection
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Bginfo.yml
  https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Application Whitelisting Bypass via Bginfo
  id: aaf46cdc-934e-4284-b329-34aa701e3771
  status: experimental
  description: Execute VBscript code that is referenced within the *.bgi file.
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Bginfo.yml
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
  author: Beyu Denis, oscd.community
  date: 2019/10/26
  modified: 2019/11/04
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \bginfo.exe
      CommandLine|contains|all:
      - /popup
      - /nolicprompt
    condition: selection
  falsepositives:
  - Unknown

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (image_path:(*\\svchost.exe OR *\\taskhost.exe OR *\\lsm.exe OR *\\lsass.exe
          OR *\\services.exe OR *\\lsaiso.exe OR *\\csrss.exe OR *\\wininit.exe OR *\\winlogon.exe)
          AND (NOT (event_data.ParentImage:(*\\System32\\\\* OR *\\SysWOW64\\\\* OR
          *\\SavService.exe OR *\\Windows\ Defender\\\\*\\MsMpEng.exe)))) AND (NOT (event_data.ParentImage:None)))
  index: logstash-beats-*
  name: Windows Processes Suspicious Parent Directory
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
  https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
  https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
  https://attack.mitre.org/techniques/T1036/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Processes Suspicious Parent Directory
  id: 96036718-71cc-4027-a538-d1587e0006a7
  status: experimental
  description: Detect suspicious parent processes of well-known Windows processes
  author: vburov
  references:
  - https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
  - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
  - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
  - https://attack.mitre.org/techniques/T1036/
  date: 2019/02/23
  modified: 2019/08/20
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\svchost.exe'
      - '*\taskhost.exe'
      - '*\lsm.exe'
      - '*\lsass.exe'
      - '*\services.exe'
      - '*\lsaiso.exe'
      - '*\csrss.exe'
      - '*\wininit.exe'
      - '*\winlogon.exe'
    filter:
      ParentImage:
      - '*\System32\\*'
      - '*\SysWOW64\\*'
      - '*\SavService.exe'
      - '*\Windows Defender\\*\MsMpEng.exe'
    filter_null:
      ParentImage:
    condition: selection and not filter and not filter_null
  falsepositives:
  - Some security products seem to spawn these
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\Temporary\ Internet\ Files\\Content.Outlook\\\\*)
  index: logstash-beats-*
  name: Execution in Outlook Temp Folder
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Execution in Outlook Temp Folder
  id: a018fdc3-46a3-44e5-9afb-2cd4af1d4b39
  status: experimental
  description: Detects a suspicious program execution in Outlook temp folder
  author: Florian Roth
  date: 2019/10/01
  tags:
  - attack.initial_access
  - attack.t1193
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\Temporary Internet Files\Content.Outlook\\*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\:\\RECYCLER\\\\* OR *\:\\SystemVolumeInformation\\\\* OR C\:\\\\Windows\\\\Tasks\\\\*
          OR C\:\\\\Windows\\\\debug\\\\* OR C\:\\\\Windows\\\\fonts\\\\* OR C\:\\\\Windows\\\\help\\\\*
          OR C\:\\\\Windows\\\\drivers\\\\* OR C\:\\\\Windows\\\\addins\\\\* OR C\:\\\\Windows\\\\cursors\\\\*
          OR C\:\\\\Windows\\\\system32\\tasks\\\\*))
  index: logstash-beats-*
  name: Suspicious Process Start Locations
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Process Start Locations
  id: 15b75071-74cc-47e0-b4c6-b43744a62a2b
  description: Detects suspicious process run from unusual locations
  status: experimental
  references:
  - https://car.mitre.org/wiki/CAR-2013-05-002
  author: juju4
  date: 2019/01/16
  tags:
  - attack.defense_evasion
  - attack.t1036
  - car.2013-05-002
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*:\RECYCLER\\*'
      - '*:\SystemVolumeInformation\\*'
      - C:\\Windows\\Tasks\\*
      - C:\\Windows\\debug\\*
      - C:\\Windows\\fonts\\*
      - C:\\Windows\\help\\*
      - C:\\Windows\\drivers\\*
      - C:\\Windows\\addins\\*
      - C:\\Windows\\cursors\\*
      - C:\\Windows\\system32\tasks\\*
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.


customized_type: Issue
value:
  _False Positives_
  rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_data.CommandLine:None
          AND image_path:*\\svchost.exe) AND (NOT (event_data.ParentImage:(*\\rpcnet.exe
          OR *\\rpcnetp.exe))))
  index: logstash-beats-*
  name: Suspect Svchost Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspect Svchost Activity
  id: 16c37b52-b141-42a5-a3ea-bbe098444397
  status: experimental
  description: It is extremely abnormal for svchost.exe to spawn without any CLI arguments
    and is normally observed when a malicious process spawns the process and injects
    code into the process memory space.
  references:
  - https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
  author: David Burkett
  date: 12/28/2019
  tags:
  - attack.t1055
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine:
    selection2:
      Image: '*\svchost.exe'
    filter:
      ParentImage:
      - '*\rpcnet.exe'
      - '*\rpcnetp.exe'
    condition: (selection1 and selection2) and not filter
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - rpcnet.exe / rpcnetp.exe which is a lojack style software. https://www.blackhat.com/docs/us-14/materials/us-14-Kamlyuk-Kamluk-Computrace-Backdoor-Revisited.pdf
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detection of child processes spawned with SYSTEM privileges by parents with non-SYSTEM privileges and Medium integrity level


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          ParentIntegrityLevel:Medium AND IntegrityLevel:System AND event_data.User:NT\
          AUTHORITY\\SYSTEM)
  index: logstash-beats-*
  name: Windows Kernel and 3rd-Party Drivers Exploits Token Stealing
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Kernel and 3rd-Party Drivers Exploits Token Stealing
  id: 8065b1b4-1778-4427-877f-6bf948b26d38
  description: Detection of child processes spawned with SYSTEM privileges by parents
    with non-SYSTEM privileges and Medium integrity level
  references:
  - https://www.slideshare.net/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  tags:
  - attack.privilege_escalation
  - attack.t1068
  status: experimental
  author: Teymur Kheirkhabarov (source), Daniil Yugoslavskiy (rule)
  date: 2019/06/03
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentIntegrityLevel: Medium
      IntegrityLevel: System
      User: NT AUTHORITY\SYSTEM
    condition: selection
  falsepositives:
  - Unknown
  level: critical
  enrichment:
  - EN_0001_cache_sysmon_event_id_1_info
  - EN_0002_enrich_sysmon_event_id_1_with_parent_info

  </code></pre>
  }}


customized_type: Issue
value:
  Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262


customized_type: Issue
value:
  _False Positives_
  Several false positives identified, check for suspicious file names or locations (e.g. Temp folders)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\WINWORD.EXE AND image_path:*\\FLTLDR.exe*)
  index: logstash-beats-*
  name: Exploit for CVE-2017-0261
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Exploit for CVE-2017-0261
  id: 864403a1-36c9-40a2-a982-4c9a45f7d833
  status: experimental
  description: Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits
    for CVE-2017-0261 and CVE-2017-0262
  references:
  - https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
  author: Florian Roth
  date: 2018/02/22
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\WINWORD.EXE'
      Image: '*\FLTLDR.exe*'
    condition: selection
  falsepositives:
  - Several false positives identified, check for suspicious file names or locations
    (e.g. Temp folders)
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND ((event_data.ParentImage:(*\\wmiprvse.exe
          OR *\\mmc.exe OR *\\explorer.exe OR *\\services.exe) AND event_data.CommandLine:(*cmd.exe*\
          \/Q\ \/c\ *\ \\\\\\\\127.0.0.1\\\\*&1*)) OR (event_data.ParentCommandLine:(*svchost.exe\
          \-k\ netsvcs OR taskeng.exe*) AND event_data.CommandLine:(cmd.exe\ \/C\ *Windows\\\\Temp\\\\*&1))))
  index: logstash-beats-*
  name: Impacket Lateralization Detection
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py
  https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py
  https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
  https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Impacket Lateralization Detection
  id: 10c14723-61c7-4c75-92ca-9af245723ad2
  status: experimental
  description: Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework
  references:
  - https://github.com/SecureAuthCorp/impacket/blob/master/examples/wmiexec.py
  - https://github.com/SecureAuthCorp/impacket/blob/master/examples/atexec.py
  - https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbexec.py
  - https://github.com/SecureAuthCorp/impacket/blob/master/examples/dcomexec.py
  author: Ecco
  date: 2019/09/03
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_other:
      ParentImage:
      - '*\wmiprvse.exe'
      - '*\mmc.exe'
      - '*\explorer.exe'
      - '*\services.exe'
      CommandLine:
      - '*cmd.exe* /Q /c * \\\\127.0.0.1\\*&1*'
    selection_atexec:
      ParentCommandLine:
      - '*svchost.exe -k netsvcs'
      - taskeng.exe*
      CommandLine:
      - cmd.exe /C *Windows\\Temp\\*&1
    condition: (1 of selection_*)
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.lateral_movement
  - attack.t1047
  - attack.t1175
  falsepositives:
  - pentesters
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/LOLUtilz/OSBinaries/Psr.yml
  https://www.sans.org/summit-archives/file/summit-archive-1493861893.pdf


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Psr.exe Capture Screenshots
  id: 2158f96f-43c2-43cb-952a-ab4580f32382
  status: experimental
  description: The psr.exe captures desktop screenshots and saves them on the local
    machine
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/LOLUtilz/OSBinaries/Psr.yml
  - https://www.sans.org/summit-archives/file/summit-archive-1493861893.pdf
  author: Beyu Denis, oscd.community
  date: 2019/10/12
  modified: 2019/11/04
  tags:
  - attack.persistence
  - attack.t1218
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \Psr.exe
      CommandLine|contains: /start
    condition: selection
  falsepositives:
  - Unknown

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(vssadmin.exe\ delete\ shadows* OR vssadmin\ delete\
          shadows* OR vssadmin\ create\ shadow\ \/for\=C\:* OR copy\ \\\\?\\GLOBALROOT\\Device\\\\*\\windows\\ntds\\ntds.dit*
          OR copy\ \\\\?\\GLOBALROOT\\Device\\\\*\\config\\SAM* OR copy\ \\\\?\\GLOBALROOT\\Device\\\\*\\config\\SYSTEM*
          OR type\ \\\\?\\GLOBALROOT\\Device\\\\*\\config\\SAM* OR type\ \\\\?\\GLOBALROOT\\Device\\\\*\\config\\SYSTEM*
          OR type\ \\\\?\\GLOBALROOT\\Device\\\\*\\windows\\ntds\\ntds.dit* OR reg\
          SAVE\ HKLM\\SYSTEM\ * OR reg\ SAVE\ HKLM\\SAM\ * OR *\ sekurlsa\:* OR net\
          localgroup\ administrators\ *\ \/add OR net\ group\ \"Domain\ Admins\"\ *\
          \/ADD\ \/DOMAIN OR certutil.exe\ *\-urlcache*\ http* OR certutil.exe\ *\-urlcache*\
          ftp* OR netsh\ advfirewall\ firewall\ *\\AppData\\\\* OR attrib\ \+S\ \+H\
          \+R\ *\\AppData\\\\* OR schtasks*\ \/create\ *\\AppData\\\\* OR schtasks*\
          \/sc\ minute* OR *\\Regasm.exe\ *\\AppData\\\\* OR *\\Regasm\ *\\AppData\\\\*
          OR *\\bitsadmin*\ \/transfer* OR *\\certutil.exe\ *\ \-decode\ * OR *\\certutil.exe\
          *\ \-decodehex\ * OR *\\certutil.exe\ \-ping\ * OR icacls\ *\ \/grant\ Everyone\:F\
          \/T\ \/C\ \/Q OR *\ wmic\ shadowcopy\ delete\ * OR *\ wmic\ shadowcopy\ call\
          create\ Volume\=* OR *\ wbadmin.exe\ delete\ catalog\ \-quiet* OR *\\wscript.exe\
          *.jse OR *\\wscript.exe\ *.js OR *\\wscript.exe\ *.vba OR *\\wscript.exe\
          *.vbe OR *\\cscript.exe\ *.jse OR *\\cscript.exe\ *.js OR *\\cscript.exe\
          *.vba OR *\\cscript.exe\ *.vbe OR *\\fodhelper.exe OR *waitfor*\/s* OR *waitfor*\/si\
          persist* OR *remote*\/s* OR *remote*\/c* OR *remote*\/q* OR *AddInProcess*
          OR *\ \/stext\ * OR *\ \/scomma\ * OR *\ \/stab\ * OR *\ \/stabular\ * OR
          *\ \/shtml\ * OR *\ \/sverhtml\ * OR *\ \/sxml\ *))
  index: logstash-beats-*
  name: Suspicious Process Creation
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/
  https://www.youtube.com/watch?v=H3t_kHQG1Js&feature=youtu.be&t=15m35s
  https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
  https://twitter.com/subTee/status/872244674609676288
  https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-tool-examples
  https://tyranidslair.blogspot.ca/2017/07/dg-on-windows-10-s-executing-arbitrary.html
  https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/
  https://subt0x10.blogspot.ca/2017/04/bypassing-application-whitelisting.html
  https://gist.github.com/subTee/7937a8ef07409715f15b84781e180c46#file-rat-bat
  https://twitter.com/vector_sec/status/896049052642533376
  http://security-research.dyndns.org/pub/slides/FIRST-TC-2018/FIRST-TC-2018_Tom-Ueltschi_Sysmon_PUBLIC.pdf


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Process Creation
  id: 5f0f47a5-cb16-4dbe-9e31-e8d976d73de3
  description: Detects suspicious process starts on Windows systems based on keywords
  status: experimental
  references:
  - https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/
  - https://www.youtube.com/watch?v=H3t_kHQG1Js&feature=youtu.be&t=15m35s
  - https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/
  - https://twitter.com/subTee/status/872244674609676288
  - https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/remote-tool-examples
  - https://tyranidslair.blogspot.ca/2017/07/dg-on-windows-10-s-executing-arbitrary.html
  - https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/
  - https://subt0x10.blogspot.ca/2017/04/bypassing-application-whitelisting.html
  - https://gist.github.com/subTee/7937a8ef07409715f15b84781e180c46#file-rat-bat
  - https://twitter.com/vector_sec/status/896049052642533376
  - http://security-research.dyndns.org/pub/slides/FIRST-TC-2018/FIRST-TC-2018_Tom-Ueltschi_Sysmon_PUBLIC.pdf
  author: Florian Roth
  date: 2018/01/01
  modified: 2018/12/11
  tags:
  - car.2013-07-001
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - vssadmin.exe delete shadows*
      - vssadmin delete shadows*
      - vssadmin create shadow /for=C:*
      - copy \\?\GLOBALROOT\Device\\*\windows\ntds\ntds.dit*
      - copy \\?\GLOBALROOT\Device\\*\config\SAM*
      - copy \\?\GLOBALROOT\Device\\*\config\SYSTEM*
      - type \\?\GLOBALROOT\Device\\*\config\SAM*
      - type \\?\GLOBALROOT\Device\\*\config\SYSTEM*
      - type \\?\GLOBALROOT\Device\\*\windows\ntds\ntds.dit*
      - reg SAVE HKLM\SYSTEM *
      - reg SAVE HKLM\SAM *
      - '* sekurlsa:*'
      - net localgroup administrators * /add
      - net group "Domain Admins" * /ADD /DOMAIN
      - certutil.exe *-urlcache* http*
      - certutil.exe *-urlcache* ftp*
      - netsh advfirewall firewall *\AppData\\*
      - attrib +S +H +R *\AppData\\*
      - schtasks* /create *\AppData\\*
      - schtasks* /sc minute*
      - '*\Regasm.exe *\AppData\\*'
      - '*\Regasm *\AppData\\*'
      - '*\bitsadmin* /transfer*'
      - '*\certutil.exe * -decode *'
      - '*\certutil.exe * -decodehex *'
      - '*\certutil.exe -ping *'
      - icacls * /grant Everyone:F /T /C /Q
      - '* wmic shadowcopy delete *'
      - '* wmic shadowcopy call create Volume=*'
      - '* wbadmin.exe delete catalog -quiet*'
      - '*\wscript.exe *.jse'
      - '*\wscript.exe *.js'
      - '*\wscript.exe *.vba'
      - '*\wscript.exe *.vbe'
      - '*\cscript.exe *.jse'
      - '*\cscript.exe *.js'
      - '*\cscript.exe *.vba'
      - '*\cscript.exe *.vbe'
      - '*\fodhelper.exe'
      - '*waitfor*/s*'
      - '*waitfor*/si persist*'
      - '*remote*/s*'
      - '*remote*/c*'
      - '*remote*/q*'
      - '*AddInProcess*'
      - '* /stext *'
      - '* /scomma *'
      - '* /stab *'
      - '* /stabular *'
      - '* /shtml *'
      - '* /sverhtml *'
      - '* /sxml *'
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentCommandLine:*\\svchost.exe*termsvcs AND (NOT (image_path:*\\rdpclip.exe)))
  index: logstash-beats-*
  name: Terminal Service Process Spawn
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Terminal Service Process Spawn
  id: 1012f107-b8f1-4271-af30-5aed2de89b39
  status: experimental
  description: Detects a process spawned by the terminal service server process (this
    could be an indicator for an exploitation of CVE-2019-0708)
  references:
  - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
  author: Florian Roth
  date: 2019/05/22
  tags:
  - car.2013-07-002
  logsource:
    product: windows
    category: process_creation
  detection:
    selection:
      ParentCommandLine: '*\svchost.exe*termsvcs'
    filter:
      Image: '*\rdpclip.exe'
    condition: selection and not filter
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Odbcconf.yml
  https://twitter.com/Hexacorn/status/1187143326673330176


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Application Whitelisting Bypass via DLL Loaded by odbcconf.exe
  id: 65d2be45-8600-4042-b4c0-577a1ff8a60e
  description: Detects defence evasion attempt via odbcconf.exe execution to load DLL
  status: experimental
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Odbcconf.yml
  - https://twitter.com/Hexacorn/status/1187143326673330176
  author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community
  date: 2019/10/25
  modified: 2019/11/07
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_1:
      Image|endswith: \odbcconf.exe
      CommandLine|contains:
      - -f
      - regsvr
    selection_2:
      ParentImage|endswith: \odbcconf.exe
      Image|endswith: \rundll32.exe
    condition: selection_1 or selection_2
  level: medium
  falsepositives:
  - Legitimate use of odbcconf.exe by legitimate user

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((event_data.ParentImage:*\\WinRAR.exe AND image_path:*\\wscript.exe) OR event_data.CommandLine:*\
          \/c\ ping.exe\ \-n\ 6\ 127.0.0.1\ &\ type\ *))
  index: logstash-beats-*
  name: QBot Process Creation
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/killamjr/status/1179034907932315648
  https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: QBot Process Creation
  id: 4fcac6eb-0287-4090-8eea-2602e4c20040
  status: experimental
  description: Detects QBot like process executions
  author: Florian Roth
  date: 2019/10/01
  references:
  - https://twitter.com/killamjr/status/1179034907932315648
  - https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      ParentImage: '*\WinRAR.exe'
      Image: '*\wscript.exe'
    selection2:
      CommandLine: '* /c ping.exe -n 6 127.0.0.1 & type *'
    condition: selection1 or selection2
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentCommandLine:(C\:\\Windows\\System32\\\\*.exe OR C\:\\Windows\\SysWOW64\\\\*.exe)
          AND event_data.CommandLine:(*\ \/c\ del\ \"C\:\\Users\\\\*\\AppData\\Local\\Temp\\\\*.exe
          OR *\ \/c\ del\ \"C\:\\Users\\\\*\\Desktop\\\\*.exe OR *\ \/C\ type\ nul\
          \ \"C\:\\Users\\\\*\\Desktop\\\\*.exe))
  index: logstash-beats-*
  name: Formbook Process Creation
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
  https://app.any.run/tasks/388d5802-aa48-4826-b069-250420504758/
  https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
  https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Formbook Process Creation
  id: 032f5fb3-d959-41a5-9263-4173c802dc2b
  status: experimental
  description: Detects Formbook like process executions that inject code into a set
    of files in the System32 folder, which executes a special command command line to
    delete the dropper from the AppData Temp folder. We avoid false positives by excluding
    all parent process with command line parameters.
  author: Florian Roth
  date: 2019/09/30
  modified: 2019/10/31
  references:
  - https://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
  - https://app.any.run/tasks/388d5802-aa48-4826-b069-250420504758/
  - https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
  - https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentCommandLine:
      - C:\Windows\System32\\*.exe
      - C:\Windows\SysWOW64\\*.exe
      CommandLine:
      - '* /c del "C:\Users\\*\AppData\Local\Temp\\*.exe'
      - '* /c del "C:\Users\\*\Desktop\\*.exe'
      - '* /C type nul > "C:\Users\\*\Desktop\\*.exe'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects an executable in the users directory started from Microsoft Word, Excel, Powerpoint, Publisher or Visio


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:(*\\WINWORD.EXE OR *\\EXCEL.EXE OR *\\POWERPNT.exe
          OR *\\MSPUB.exe OR *\\VISIO.exe OR *\\OUTLOOK.EXE) AND image_path:(C\:\\\users\\\\*.exe))
  index: logstash-beats-*
  name: MS Office Product Spawning Exe in User Dir
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  sha256=23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57c
  https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MS Office Product Spawning Exe in User Dir
  id: aa3a6f94-890e-4e22-b634-ffdfd54792cc
  status: experimental
  description: Detects an executable in the users directory started from Microsoft Word,
    Excel, Powerpoint, Publisher or Visio
  references:
  - sha256=23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57c
  - https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign
  tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059
  - attack.t1202
  - FIN7
  - car.2013-05-002
  author: Jason Lynch
  date: 2019/04/02
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\WINWORD.EXE'
      - '*\EXCEL.EXE'
      - '*\POWERPNT.exe'
      - '*\MSPUB.exe'
      - '*\VISIO.exe'
      - '*\OUTLOOK.EXE'
      Image:
      - C:\users\\*.exe
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\cscript.exe AND event_data.CommandLine:*.vbs\ \/shell\ *)
  index: logstash-beats-*
  name: WMIExec VBS Script
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMIExec VBS Script
  id: 966e4016-627f-44f7-8341-f394905c361f
  description: Detects suspicious file execution by wscript and cscript
  author: Florian Roth
  date: 2017/04/07
  references:
  - https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  tags:
  - attack.execution
  - attack.g0045
  - attack.t1064
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\cscript.exe'
      CommandLine: '*.vbs /shell *'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.


customized_type: Issue
value:
  _False Positives_
  Custom applications use renamed binaries adding slight change to binary name. Typically this is easy to spot and add to whitelist


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          OriginalFileName:(powershell.exe OR powershell_ise.exe OR psexec.exe OR psexec.c
          OR cscript.exe OR wscript.exe OR mshta.exe OR regsvr32.exe OR wmic.exe OR
          certutil.exe OR rundll32.exe OR cmstp.exe OR msiexec.exe) AND (NOT (image_path:(*\\powershell.exe
          OR *\\powershell_ise.exe OR *\\psexec.exe OR *\\psexec64.exe OR *\\cscript.exe
          OR *\\wscript.exe OR *\\mshta.exe OR *\\regsvr32.exe OR *\\wmic.exe OR *\\certutil.exe
          OR *\\rundll32.exe OR *\\cmstp.exe OR *\\msiexec.exe))))
  index: logstash-beats-*
  name: Highly Relevant Renamed Binary
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://attack.mitre.org/techniques/T1036/
  https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
  https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Highly Relevant Renamed Binary
  id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
  status: experimental
  description: Detects the execution of a renamed binary often used by attackers or
    malware leveraging new Sysmon OriginalFileName datapoint.
  author: Matthew Green - @mgreen27, Florian Roth
  date: 2019/06/15
  references:
  - https://attack.mitre.org/techniques/T1036/
  - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
  - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
  tags:
  - attack.t1036
  - attack.defense_evasion
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      OriginalFileName:
      - powershell.exe
      - powershell_ise.exe
      - psexec.exe
      - psexec.c
      - cscript.exe
      - wscript.exe
      - mshta.exe
      - regsvr32.exe
      - wmic.exe
      - certutil.exe
      - rundll32.exe
      - cmstp.exe
      - msiexec.exe
    filter:
      Image:
      - '*\powershell.exe'
      - '*\powershell_ise.exe'
      - '*\psexec.exe'
      - '*\psexec64.exe'
      - '*\cscript.exe'
      - '*\wscript.exe'
      - '*\mshta.exe'
      - '*\regsvr32.exe'
      - '*\wmic.exe'
      - '*\certutil.exe'
      - '*\rundll32.exe'
      - '*\cmstp.exe'
      - '*\msiexec.exe'
    condition: selection and not filter
  falsepositives:
  - Custom applications use renamed binaries adding slight change to binary name. Typically
    this is easy to spot and add to whitelist
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\\rundll32.exe\ *,InstallArcherSvc)
  index: logstash-beats-*
  name: Fireball Archer Install
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
  https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Fireball Archer Install
  id: 3d4aebe0-6d29-45b2-a8a4-3dfde586a26d
  status: experimental
  description: Detects Archer malware invocation via rundll32
  author: Florian Roth
  date: 2017/06/03
  references:
  - https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
  - https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100
  tags:
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1085
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*\rundll32.exe *,InstallArcherSvc'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*AAAAYInlM* AND event_data.CommandLine:(*OiCAAAAYInlM*
          OR *OiJAAAAYInlM*))
  index: logstash-beats-*
  name: PowerShell Base64 Encoded Shellcode
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Base64 Encoded Shellcode
  id: 2d117e49-e626-4c7c-bd1f-c3c0147774c8
  description: Detects Base64 encoded Shellcode
  status: experimental
  references:
  - https://twitter.com/cyb3rops/status/1063072865992523776
  author: Florian Roth
  date: 2018/11/17
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine: '*AAAAYInlM*'
    selection2:
      CommandLine:
      - '*OiCAAAAYInlM*'
      - '*OiJAAAAYInlM*'
    condition: selection1 and selection2
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(cmd.exe\ \/c\ *http\:\/\/*%AppData% OR cmd.exe\ \/c\
          *https\:\/\/*%AppData%))
  index: logstash-beats-*
  name: Command Line Execution with Suspicious URL and AppData Strings
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100
  https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Command Line Execution with Suspicious URL and AppData Strings
  id: 1ac8666b-046f-4201-8aba-1951aaec03a3
  status: experimental
  description: Detects a suspicious command line execution that includes an URL and
    AppData string in the command line parameters as used by several droppers (js/vbs
    > powershell)
  references:
  - https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100
  - https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100
  author: Florian Roth
  date: 2019/01/16
  tags:
  - attack.execution
  - attack.t1059
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - cmd.exe /c *http://*%AppData%
      - cmd.exe /c *https://*%AppData%
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - High
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  False positives depend on scripts and administrative tools used in the monitored environment
  Windows contol panel elements have been identified as source (mmc)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\\rundll32.exe\ *,#*)
  index: logstash-beats-*
  name: Suspicious Call by Ordinal
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
  https://github.com/Neo23x0/DLLRunner
  https://twitter.com/cyb3rops/status/1186631731543236608


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Call by Ordinal
  id: e79a9e79-eb72-4e78-a628-0e7e8f59e89c
  description: Detects suspicious calls of DLLs in rundll32.dll exports by ordinal
  status: experimental
  references:
  - https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
  - https://github.com/Neo23x0/DLLRunner
  - https://twitter.com/cyb3rops/status/1186631731543236608
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1085
  author: Florian Roth
  date: 2019/10/22
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*\rundll32.exe *,#*'
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  - Windows contol panel elements have been identified as source (mmc)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network


customized_type: Issue
value:
  _False Positives_
  highly likely if rar is default archiver in the monitored environment

  _Interesting Log Fields_
  Image
  CommandLine
  User
  LogonGuid
  Hashes
  ParentProcessGuid
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Data Compressed - rar.exe
  id: 6f3e2987-db24-4c78-a860-b4f4095a7095
  status: experimental
  description: An adversary may compress data (e.g., sensitive documents) that is collected
    prior to exfiltration in order to make it portable and minimize the amount of data
    sent over the network
  author: Timur Zinniatullin, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1002/T1002.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \rar.exe
      CommandLine|contains|all:
      - ' a '
      - -r
    condition: selection
  fields:
  - Image
  - CommandLine
  - User
  - LogonGuid
  - Hashes
  - ParentProcessGuid
  - ParentCommandLine
  falsepositives:
  - highly likely if rar is default archiver in the monitored environment
  level: low
  tags:
  - attack.exfiltration
  - attack.t1002

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\sllauncher.exe AND image_path:*\\svchost.exe)
  index: logstash-beats-*
  name: Emissary Panda Malware SLLauncher
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://app.any.run/tasks/579e7587-f09d-4aae-8b07-472833262965
  https://twitter.com/cyb3rops/status/1168863899531132929


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Emissary Panda Malware SLLauncher
  id: 9aa01d62-7667-4d3b-acb8-8cb5103e2014
  status: experimental
  description: Detects the execution of DLL side-loading malware used by threat group
    Emissary Panda aka APT27
  references:
  - https://app.any.run/tasks/579e7587-f09d-4aae-8b07-472833262965
  - https://twitter.com/cyb3rops/status/1168863899531132929
  author: Florian Roth
  date: 2018/09/03
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\sllauncher.exe'
      Image: '*\svchost.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.


customized_type: Issue
value:
  _False Positives_
  Admin activity

  _Interesting Log Fields_
  Image
  CommandLine
  User
  LogonGuid
  Hashes
  ParentProcessGuid
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*cmd* AND event_data.CommandLine:*\/c* AND event_data.CommandLine:*assoc*)
  index: logstash-beats-*
  name: Change Default File Association
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Change Default File Association
  id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061
  status: experimental
  description: When a file is opened, the default program used to open the file (also
    called the file association or handler) is checked. File association selections
    are stored in the Windows Registry and can be edited by users, administrators, or
    programs that have Registry access or by administrators using the built-in assoc
    utility. Applications can modify the file association for a given file extension
    to call an arbitrary program when a file with the given extension is opened.
  author: Timur Zinniatullin, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1042/T1042.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains|all:
      - cmd
      - /c
      - assoc
    condition: selection
  falsepositives:
  - Admin activity
  fields:
  - Image
  - CommandLine
  - User
  - LogonGuid
  - Hashes
  - ParentProcessGuid
  - ParentCommandLine
  level: low
  tags:
  - attack.persistence
  - attack.t1042

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the execution of whoami, which is often used by attackers after exloitation / privilege escalation but rarely used by administrators


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (image_path:*\\whoami.exe OR OriginalFileName:whoami.exe))
  index: logstash-beats-*
  name: Whoami Execution
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Whoami Execution
  id: e28a5a99-da44-436d-b7a0-2afc20a5f413
  status: experimental
  description: Detects the execution of whoami, which is often used by attackers after
    exloitation / privilege escalation but rarely used by administrators
  references:
  - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
  author: Florian Roth
  date: 2018/08/13
  tags:
  - attack.discovery
  - attack.t1033
  - car.2016-03-001
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\whoami.exe'
    selection2:
      OriginalFileName: whoami.exe
    condition: selection or selection2
  falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (OriginalFileName:(7z*.exe OR *rar.exe OR *Command*Line*RAR*) AND event_data.CommandLine:(*\
          \-p* OR *\ \-ta* OR *\ \-tb* OR *\ \-sdel* OR *\ \-dw* OR *\ \-hp*)) AND (NOT
          (event_data.ParentImage:C\:\\Program*)))
  index: logstash-beats-*
  name: Suspicious Compression Tool Parameters
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Compression Tool Parameters
  id: 27a72a60-7e5e-47b1-9d17-909c9abafdcd
  status: experimental
  description: Detects suspicious command line arguments of common data compression
    tools
  references:
  - https://twitter.com/SBousseaden/status/1184067445612535811
  tags:
  - attack.exfiltration
  - attack.t1020
  - attack.t1002
  author: Florian Roth, Samir Bousseaden
  date: 2019/10/15
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      OriginalFileName:
      - 7z*.exe
      - '*rar.exe'
      - '*Command*Line*RAR*'
      CommandLine:
      - '* -p*'
      - '* -ta*'
      - '* -tb*'
      - '* -sdel*'
      - '* -dw*'
      - '* -hp*'
    falsepositive:
      ParentImage: C:\Program*
    condition: selection and not falsepositive
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(arp.exe OR at.exe OR attrib.exe OR cscript.exe OR
          dsquery.exe OR hostname.exe OR ipconfig.exe OR mimikatz.exe OR nbtstat.exe
          OR net.exe OR netsh.exe OR nslookup.exe OR ping.exe OR quser.exe OR qwinsta.exe
          OR reg.exe OR runas.exe OR sc.exe OR schtasks.exe OR ssh.exe OR systeminfo.exe
          OR taskkill.exe OR telnet.exe OR tracert.exe OR wscript.exe OR xcopy.exe OR
          pscp.exe OR copy.exe OR robocopy.exe OR certutil.exe OR vssadmin.exe OR powershell.exe
          OR wevtutil.exe OR psexec.exe OR bcedit.exe OR wbadmin.exe OR icacls.exe OR
          diskpart.exe))
  index: logstash-beats-*
  max_threshold: 5
  metric_agg_key: _id
  metric_agg_type: cardinality
  name: Quick Execution of a Series of Suspicious Commands
  priority: 4
  query_key: MachineName
  realert:
    minutes: 0
  type: metric_aggregation
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Quick Execution of a Series of Suspicious Commands
  id: 61ab5496-748e-4818-a92f-de78e20fe7f1
  description: Detects multiple suspicious process in a limited timeframe
  status: experimental
  references:
  - https://car.mitre.org/wiki/CAR-2013-04-002
  author: juju4
  date: 2019/01/16
  tags:
  - car.2013-04-002
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - arp.exe
      - at.exe
      - attrib.exe
      - cscript.exe
      - dsquery.exe
      - hostname.exe
      - ipconfig.exe
      - mimikatz.exe
      - nbtstat.exe
      - net.exe
      - netsh.exe
      - nslookup.exe
      - ping.exe
      - quser.exe
      - qwinsta.exe
      - reg.exe
      - runas.exe
      - sc.exe
      - schtasks.exe
      - ssh.exe
      - systeminfo.exe
      - taskkill.exe
      - telnet.exe
      - tracert.exe
      - wscript.exe
      - xcopy.exe
      - pscp.exe
      - copy.exe
      - robocopy.exe
      - certutil.exe
      - vssadmin.exe
      - powershell.exe
      - wevtutil.exe
      - psexec.exe
      - bcedit.exe
      - wbadmin.exe
      - icacls.exe
      - diskpart.exe
    timeframe: 5m
    condition: selection | count() by MachineName > 5
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*Microsoft\\Windows\\CurrentVersion\\Run* AND event_data.CommandLine:*C\:\\\users\\Public\\*)
  index: logstash-beats-*
  name: Ryuk Ransomware
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Ryuk Ransomware
  id: c37510b8-2107-4b78-aa32-72f251e7a844
  status: experimental
  description: Detects Ryuk ransomware activity
  author: Florian Roth
  date: 2019/12/16
  references:
  - https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains|all:
      - Microsoft\Windows\CurrentVersion\Run
      - C:\users\Public\
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_data.ParentImage:*\\\userinit.exe AND (NOT (event_data.CommandLine:*\\\\netlogon\\\\*)))
          AND (NOT (image_path:*\\explorer.exe)))
  index: logstash-beats-*
  name: Suspicious Userinit Child Process
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Userinit Child Process
  id: b655a06a-31c0-477a-95c2-3726b83d649d
  status: experimental
  description: Detects a suspicious child process of userinit
  references:
  - https://twitter.com/SBousseaden/status/1139811587760562176
  author: Florian Roth (rule), Samir Bousseaden (idea)
  date: 2019/06/17
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\userinit.exe'
    filter1:
      CommandLine: '*\\netlogon\\*'
    filter2:
      Image: '*\explorer.exe'
    condition: selection and not filter1 and not filter2
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Administrative scripts
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \-NoP\ \-sta\ \-NonI\ \-W\ Hidden\ \-Enc\ * OR
          *\ \-noP\ \-sta\ \-w\ 1\ \-enc\ * OR *\ \-NoP\ \-NonI\ \-W\ Hidden\ \-enc\
          *))
  index: logstash-beats-*
  name: Empire PowerShell Launch Parameters
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165
  https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191
  https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178
  https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Empire PowerShell Launch Parameters
  id: 79f4ede3-402e-41c8-bc3e-ebbf5f162581
  description: Detects suspicious powershell command line parameters used in Empire
  status: experimental
  references:
  - https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64
  author: Florian Roth
  date: 2019/04/20
  tags:
  - attack.execution
  - attack.t1086
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* -NoP -sta -NonI -W Hidden -Enc *'
      - '* -noP -sta -w 1 -enc *'
      - '* -NoP -NonI -W Hidden -enc *'
    condition: selection
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\\ntdsutil*)
  index: logstash-beats-*
  name: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
  id: 2afafd61-6aae-4df4-baed-139fa1f4c345
  description: Detects execution of ntdsutil.exe, which can be used for various attacks
    against the NTDS database (NTDS.DIT)
  status: experimental
  references:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
  author: Thomas Patzke
  date: 2019/01/16
  tags:
  - attack.credential_access
  - attack.t1003
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*\ntdsutil*'
    condition: selection
  falsepositives:
  - NTDS maintenance
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\Powershell.exe) AND event_data.CommandLine:(\ \-windowstyle\
          h\  OR \ \-windowstyl\ h OR \ \-windowsty\ h OR \ \-windowst\ h OR \ \-windows\
          h OR \ \-windo\ h OR \ \-wind\ h OR \ \-win\ h OR \ \-wi\ h OR \ \-win\ h\  OR
          \ \-win\ hi\  OR \ \-win\ hid\  OR \ \-win\ hidd\  OR \ \-win\ hidde\  OR
          \ \-NoPr\  OR \ \-NoPro\  OR \ \-NoProf\  OR \ \-NoProfi\  OR \ \-NoProfil\  OR
          \ \-nonin\  OR \ \-nonint\  OR \ \-noninte\  OR \ \-noninter\  OR \ \-nonintera\  OR
          \ \-noninterac\  OR \ \-noninteract\  OR \ \-noninteracti\  OR \ \-noninteractiv\  OR
          \ \-ec\  OR \ \-encodedComman\  OR \ \-encodedComma\  OR \ \-encodedComm\  OR
          \ \-encodedCom\  OR \ \-encodedCo\  OR \ \-encodedC\  OR \ \-encoded\  OR
          \ \-encode\  OR \ \-encod\  OR \ \-enco\  OR \ \-en\ ))
  index: logstash-beats-*
  name: Suspicious PowerShell Parameter Substring
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious PowerShell Parameter Substring
  id: 36210e0d-5b19-485d-a087-c096088885f0
  status: experimental
  description: Detects suspicious PowerShell invocation with a parameter substring
  references:
  - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
  tags:
  - attack.execution
  - attack.t1086
  author: Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix)
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\Powershell.exe'
      CommandLine:
      - ' -windowstyle h '
      - ' -windowstyl h'
      - ' -windowsty h'
      - ' -windowst h'
      - ' -windows h'
      - ' -windo h'
      - ' -wind h'
      - ' -win h'
      - ' -wi h'
      - ' -win h '
      - ' -win hi '
      - ' -win hid '
      - ' -win hidd '
      - ' -win hidde '
      - ' -NoPr '
      - ' -NoPro '
      - ' -NoProf '
      - ' -NoProfi '
      - ' -NoProfil '
      - ' -nonin '
      - ' -nonint '
      - ' -noninte '
      - ' -noninter '
      - ' -nonintera '
      - ' -noninterac '
      - ' -noninteract '
      - ' -noninteracti '
      - ' -noninteractiv '
      - ' -ec '
      - ' -encodedComman '
      - ' -encodedComma '
      - ' -encodedComm '
      - ' -encodedCom '
      - ' -encodedCo '
      - ' -encodedC '
      - ' -encoded '
      - ' -encode '
      - ' -encod '
      - ' -enco '
      - ' -en '
    condition: selection
  falsepositives:
  - Penetration tests
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:(*\\ldifde.exe\ \-f\ \-n\ * OR *\\7za.exe\ a\ 1.7z\
          * OR *\ eprod.ldf OR *\\aaaa\\procdump64.exe* OR *\\aaaa\\netsess.exe* OR
          *\\aaaa\\7za.exe* OR *copy\ .\\1.7z\ \\\\* OR *copy\ \\\\client\\c$\\aaaa\\\\*)
          OR image_path:C\:\\Users\\Public\\7za.exe))
  index: logstash-beats-*
  name: Judgement Panda Exfil Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Judgement Panda Exfil Activity
  id: 03e2746e-2b31-42f1-ab7a-eb39365b2422
  description: Detects Judgement Panda activity as described in Global Threat Report
    2019 by Crowdstrike
  references:
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  author: Florian Roth
  date: 2019/02/21
  tags:
  - attack.lateral_movement
  - attack.g0010
  - attack.credential_access
  - attack.t1098
  - attack.exfiltration
  - attack.t1002
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine:
      - '*\ldifde.exe -f -n *'
      - '*\7za.exe a 1.7z *'
      - '* eprod.ldf'
      - '*\aaaa\procdump64.exe*'
      - '*\aaaa\netsess.exe*'
      - '*\aaaa\7za.exe*'
      - '*copy .\1.7z \\*'
      - '*copy \\client\c$\aaaa\\*'
    selection2:
      Image: C:\Users\Public\7za.exe
    condition: selection1 or selection2
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and windows eventlogs are cleared using wevtutil


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:*\\AppData\\Local\\Temp\\\\*\ \\\\.\\pipe\\\\* OR
          (image_path:*\\rundll32.exe AND event_data.CommandLine:*.dat,#1) OR *\\perfc.dat*))
  index: logstash-beats-*
  name: NotPetya Ransomware Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securelist.com/schroedingers-petya/78870/
  https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: NotPetya Ransomware Activity
  id: 79aeeb41-8156-4fac-a0cd-076495ab82a1
  status: experimental
  description: Detects NotPetya ransomware activity in which the extracted passwords
    are passed back to the main module via named pipe, the file system journal of drive
    C is deleted and windows eventlogs are cleared using wevtutil
  author: Florian Roth, Tom Ueltschi
  date: 2019/01/16
  references:
  - https://securelist.com/schroedingers-petya/78870/
  - https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
  tags:
  - attack.execution
  - attack.credential_access
  - attack.defense_evasion
  - attack.t1085
  - attack.t1070
  - attack.t1003
  - car.2016-04-002
  logsource:
    category: process_creation
    product: windows
  detection:
    pipe_com:
      CommandLine: '*\AppData\Local\Temp\\* \\.\pipe\\*'
    rundll32_dash1:
      Image: '*\rundll32.exe'
      CommandLine: '*.dat,#1'
    perfc_keyword:
    - '*\perfc.dat*'
    condition: 1 of them
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Admin activity
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious commands that could be related to activity that uses volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: '(event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(vssadmin.exe\ Delete\ Shadows OR vssadmin\ create\
          shadow\ \/for\=C\: OR copy\ \\\\?\\GLOBALROOT\\Device\\\\*\\windows\\ntds\\ntds.dit
          OR copy\ \\\\?\\GLOBALROOT\\Device\\\\*\\config\\SAM OR vssadmin\ delete\
          shadows\ \/for\=C\: OR reg\ SAVE\ HKLM\\SYSTEM\  OR esentutl.exe\ \/y\ \/vss\
          *\\ntds.dit* OR esentutl.exe\ \/y\ \/vss\ *\\SAM OR esentutl.exe\ \/y\ \/vss\
          *\\SYSTEM))'
  index: logstash-beats-*
  name: Activity Related to NTDS.dit Domain Hash Retrieval
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/
  https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
  https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/
  https://securingtomorrow.mcafee.com/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
  https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Activity Related to NTDS.dit Domain Hash Retrieval
  id: b932b60f-fdda-4d53-8eda-a170c1d97bbd
  status: experimental
  description: Detects suspicious commands that could be related to activity that uses
    volume shadow copy to steal and retrieve hashes from the NTDS.dit file remotely
  author: Florian Roth, Michael Haag
  date: 2019/01/16
  references:
  - https://www.swordshield.com/2015/07/getting-hashes-from-ntds-dit-file/
  - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
  - https://www.trustwave.com/Resources/SpiderLabs-Blog/Tutorial-for-NTDS-goodness-(VSSADMIN,-WMIS,-NTDS-dit,-SYSTEM)/
  - https://securingtomorrow.mcafee.com/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
  - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
  tags:
  - attack.credential_access
  - attack.t1003
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - vssadmin.exe Delete Shadows
      - 'vssadmin create shadow /for=C:'
      - copy \\?\GLOBALROOT\Device\\*\windows\ntds\ntds.dit
      - copy \\?\GLOBALROOT\Device\\*\config\SAM
      - 'vssadmin delete shadows /for=C:'
      - 'reg SAVE HKLM\SYSTEM '
      - esentutl.exe /y /vss *\ntds.dit*
      - esentutl.exe /y /vss *\SAM
      - esentutl.exe /y /vss *\SYSTEM
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Administrative activity
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Winnti Malware HK University Campaign
  id: 3121461b-5aa0-4a41-b910-66d25524edbb
  status: experimental
  description: Detects specific process characteristics of Winnti malware noticed in
    Dec/Jan 2020 in a campaign against Honk Kong universities
  references:
  - https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/
  tags:
  - attack.defense_evasion
  - attack.t1073
  - attack.g0044
  author: Florian Roth, Markus Neis
  date: 2020/02/01
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      ParentImage|contains:
      - C:\Windows\Temp
      - \hpqhvind.exe
      Image|startswith: C:\ProgramData\DRM
    selection2:
      ParentImage|startswith: C:\ProgramData\DRM
      Image|endswith: \wmplayer.exe
    selection3:
      ParentImage|endswith: \Test.exe
      Image|endswith: \wmplayer.exe
    selection4:
      Image: C:\ProgramData\DRM\CLR\CLR.exe
    selection5:
      ParentImage|startswith: C:\ProgramData\DRM\Windows
      Image|endswith: \SearchFilterHost.exe
    condition: 1 of them
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\ echo\ EEEE\ \ *)
  index: logstash-beats-*
  name: DTRACK Process Creation
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securelist.com/my-name-is-dtrack/93338/
  https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
  https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: DTRACK Process Creation
  id: f1531fa4-5b84-4342-8f68-9cf3fdbd83d4
  status: experimental
  description: Detects specific process parameters as seen in DTRACK infections
  author: Florian Roth
  date: 2019/10/30
  references:
  - https://securelist.com/my-name-is-dtrack/93338/
  - https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
  - https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '* echo EEEE > *'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a suspicious execution of csc.exe, which uses a source in a suspicious folder (e.g. AppData)


customized_type: Issue
value:
  _False Positives_
  https://twitter.com/gN3mes1s/status/1206874118282448897
  https://twitter.com/gabriele_pippi/status/1206907900268072962


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (image_path:*\\csc.exe AND event_data.CommandLine:(*\\AppData\\\\* OR *\\Windows\\Temp\\\\*))
          AND (NOT (event_data.ParentImage:(C\:\\Program\ Files* OR *\\sdiagnhost.exe
          OR *\\w3wp.exe))))
  index: logstash-beats-*
  name: Suspicious Csc.exe Source File Folder
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
  https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
  https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
  https://twitter.com/gN3mes1s/status/1206874118282448897


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Csc.exe Source File Folder
  id: dcaa3f04-70c3-427a-80b4-b870d73c94c4
  description: Detects a suspicious execution of csc.exe, which uses a source in a suspicious
    folder (e.g. AppData)
  status: experimental
  references:
  - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
  - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
  - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
  - https://twitter.com/gN3mes1s/status/1206874118282448897
  author: Florian Roth
  date: 2019/08/24
  modified: 2019/12/17
  tags:
  - attack.defense_evasion
  - attack.t1500
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\csc.exe'
      CommandLine:
      - '*\AppData\\*'
      - '*\Windows\Temp\\*'
    filter:
      ParentImage:
      - C:\Program Files*
      - '*\sdiagnhost.exe'
      - '*\w3wp.exe'
    condition: selection and not filter
  falsepositives:
  - https://twitter.com/gN3mes1s/status/1206874118282448897
  - https://twitter.com/gabriele_pippi/status/1206907900268072962
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\$Recycle.bin OR *\\Users\\Public\\\\* OR C\:\\Perflogs\\\\*
          OR *\\Windows\\Fonts\\\\* OR *\\Windows\\IME\\\\* OR *\\Windows\\addins\\\\*
          OR *\\Windows\\debug\\\\*))
  index: logstash-beats-*
  name: Suspicious Program Location Process Starts
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Program Location Process Starts
  id: f50bfd8b-e2a3-4c15-9373-7900b5a4c6d5
  status: experimental
  description: Detects programs running in suspicious files system locations
  references:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
  tags:
  - attack.defense_evasion
  - attack.t1036
  author: Florian Roth
  date: 2019/01/15
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\$Recycle.bin'
      - '*\Users\Public\\*'
      - C:\Perflogs\\*
      - '*\Windows\Fonts\\*'
      - '*\Windows\IME\\*'
      - '*\Windows\addins\\*'
      - '*\Windows\debug\\*'
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*.doc.exe OR *.docx.exe OR *.xls.exe OR *.xlsx.exe OR *.ppt.exe
          OR *.pptx.exe OR *.rtf.exe OR *.pdf.exe OR *.txt.exe OR *\ \ \ \ \ \ .exe
          OR *______.exe))
  index: logstash-beats-*
  name: Suspicious Double Extension
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html
  https://twitter.com/blackorbird/status/1140519090961825792


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Double Extension
  id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8
  description: Detects suspicious use of an .exe extension after a non-executable file
    extension like .pdf.exe, a set of spaces or underlines to cloak the executable file
    in spear phishing campaigns
  references:
  - https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html
  - https://twitter.com/blackorbird/status/1140519090961825792
  author: Florian Roth (rule), @blu3_team (idea)
  date: 2019/06/26
  tags:
  - attack.initial_access
  - attack.t1193
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*.doc.exe'
      - '*.docx.exe'
      - '*.xls.exe'
      - '*.xlsx.exe'
      - '*.ppt.exe'
      - '*.pptx.exe'
      - '*.rtf.exe'
      - '*.pdf.exe'
      - '*.txt.exe'
      - '*      .exe'
      - '*______.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:(*\\apache* OR *\\tomcat* OR *\\w3wp.exe OR *\\php\-cgi.exe
          OR *\\nginx.exe OR *\\httpd.exe) AND event_data.CommandLine:(*whoami* OR *net\
          user\ * OR *ping\ \-n\ * OR *systeminfo OR *&cd&echo* OR *cd\ \/d*))
  index: logstash-beats-*
  name: Webshell Detection With Command Line Keywords
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Webshell Detection With Command Line Keywords
  id: bed2a484-9348-4143-8a8a-b801c979301c
  description: Detects certain command line parameters often used during reconnaissance
    activity via web shells
  author: Florian Roth
  reference:
  - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html
  date: 2017/01/01
  modified: 2019/10/26
  tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1100
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\apache*'
      - '*\tomcat*'
      - '*\w3wp.exe'
      - '*\php-cgi.exe'
      - '*\nginx.exe'
      - '*\httpd.exe'
      CommandLine:
      - '*whoami*'
      - '*net user *'
      - '*ping -n *'
      - '*systeminfo'
      - '*&cd&echo*'
      - '*cd /d*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \/c\ powershell*\\AppData\\Local\\\\* OR *\ \/c\
          powershell*\\AppData\\Roaming\\\\*))
  index: logstash-beats-*
  name: PowerShell Script Run in AppData
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/JohnLaTwC/status/1082851155481288706
  https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Script Run in AppData
  id: ac175779-025a-4f12-98b0-acdaeb77ea85
  status: experimental
  description: Detects a suspicious command line execution that invokes PowerShell with
    reference to an AppData folder
  references:
  - https://twitter.com/JohnLaTwC/status/1082851155481288706
  - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03
  tags:
  - attack.execution
  - attack.t1086
  author: Florian Roth
  date: 2019/01/09
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* /c powershell*\AppData\Local\\*'
      - '* /c powershell*\AppData\Roaming\\*'
    condition: selection
  falsepositives:
  - Administrative scripts
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:*\\svchost.exe\ C\:\\Users\\\\*\\Desktop\\\\* OR (event_data.ParentImage:*\\svchost.exe*
          AND event_data.CommandLine:(*whoami.exe\ \/all OR *net.exe\ view))))
  index: logstash-beats-*
  name: Dridex Process Pattern
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Dridex Process Pattern
  id: e6eb5a96-9e6f-4a18-9cdd-642cfda21c8e
  status: experimental
  description: Detects typical Dridex process patterns
  references:
  - https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3
  author: Florian Roth
  date: 2019/01/10
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine: '*\svchost.exe C:\Users\\*\Desktop\\*'
    selection2:
      ParentImage: '*\svchost.exe*'
      CommandLine:
      - '*whoami.exe /all'
      - '*net.exe view'
    condition: 1 of them
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\$Recycle.bin OR *\\Users\\All\ Users\\\\* OR *\\Users\\Default\\\\*
          OR *\\Users\\Public\\\\* OR C\:\\Perflogs\\\\* OR *\\config\\systemprofile\\\\*
          OR *\\Windows\\Fonts\\\\* OR *\\Windows\\IME\\\\* OR *\\Windows\\addins\\\\*))
  index: logstash-beats-*
  name: Execution in Non-Executable Folder
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Execution in Non-Executable Folder
  id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4
  status: experimental
  description: Detects a suspicious exection from an uncommon folder
  author: Florian Roth
  date: 2019/01/16
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\$Recycle.bin'
      - '*\Users\All Users\\*'
      - '*\Users\Default\\*'
      - '*\Users\Public\\*'
      - C:\Perflogs\\*
      - '*\config\systemprofile\\*'
      - '*\Windows\Fonts\\*'
      - '*\Windows\IME\\*'
      - '*\Windows\addins\\*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\CurrentVersion\\Image\ File\ Execution\ Options\\sethc.exe*
          OR *\\CurrentVersion\\Image\ File\ Execution\ Options\\\utilman.exe* OR *\\CurrentVersion\\Image\
          File\ Execution\ Options\\osk.exe* OR *\\CurrentVersion\\Image\ File\ Execution\
          Options\\magnify.exe* OR *\\CurrentVersion\\Image\ File\ Execution\ Options\\narrator.exe*
          OR *\\CurrentVersion\\Image\ File\ Execution\ Options\\displayswitch.exe*
          OR *\\CurrentVersion\\Image\ File\ Execution\ Options\\atbroker.exe*))
  index: logstash-beats-*
  name: Suspicious Debugger Registration Cmdline
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Debugger Registration Cmdline
  id: ae215552-081e-44c7-805f-be16f975c8a2
  status: experimental
  description: Detects the registration of a debugger for a program that is available
    in the logon screen (sticky key backdoor).
  references:
  - https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
  tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1015
  author: Florian Roth
  date: 2019/09/06
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*\CurrentVersion\Image File Execution Options\sethc.exe*'
      - '*\CurrentVersion\Image File Execution Options\utilman.exe*'
      - '*\CurrentVersion\Image File Execution Options\osk.exe*'
      - '*\CurrentVersion\Image File Execution Options\magnify.exe*'
      - '*\CurrentVersion\Image File Execution Options\narrator.exe*'
      - '*\CurrentVersion\Image File Execution Options\displayswitch.exe*'
      - '*\CurrentVersion\Image File Execution Options\atbroker.exe*'
    condition: selection
  falsepositives:
  - Penetration Tests
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (image_path:(*\\Bloodhound.exe* OR *\\SharpHound.exe*) OR event_data.CommandLine:(*\
          \-CollectionMethod\ All\ * OR *.exe\ \-c\ All\ \-d\ * OR *Invoke\-Bloodhound*
          OR *Get\-BloodHoundData*) OR (event_data.CommandLine:*\ \-JsonFolder\ * AND
          event_data.CommandLine:*\ \-ZipFileName\ *) OR (event_data.CommandLine:*\
          DCOnly\ * AND event_data.CommandLine:*\ \-\-NoSaveCache\ *)))
  index: logstash-beats-*
  name: Bloodhound and Sharphound Hack Tool
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Bloodhound and Sharphound Hack Tool
  id: f376c8a7-a2d0-4ddc-aa0c-16c17236d962
  description: Detects command line parameters used by Bloodhound and Sharphound hack
    tools
  author: Florian Roth
  references:
  - https://github.com/BloodHoundAD/BloodHound
  - https://github.com/BloodHoundAD/SharpHound
  date: 2019/12/20
  modified: 2019/12/21
  tags:
  - attack.discovery
  - attack.t1087
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image|contains:
      - \Bloodhound.exe
      - \SharpHound.exe
    selection2:
      CommandLine|contains:
      - ' -CollectionMethod All '
      - '.exe -c All -d '
      - Invoke-Bloodhound
      - Get-BloodHoundData
    selection3:
      CommandLine|contains|all:
      - ' -JsonFolder '
      - ' -ZipFileName '
    selection4:
      CommandLine|contains|all:
      - ' DCOnly '
      - ' --NoSaveCache '
    condition: 1 of them
  falsepositives:
  - Other programs that use these command line option and accepts an 'All' parameter
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Legitimate administrative tasks.

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine
  User


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\cmdkey.exe AND event_data.CommandLine:*\ \/list\ *)
  index: logstash-beats-*
  name: Cmdkey Cached Credentials Recon
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
  https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Cmdkey Cached Credentials Recon
  id: 07f8bdc2-c9b3-472a-9817-5a670b872f53
  status: experimental
  description: Detects usage of cmdkey to look for cached credentials
  references:
  - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
  - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
  author: jmallette
  date: 2019/01/16
  tags:
  - attack.credential_access
  - attack.t1003
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\cmdkey.exe'
      CommandLine: '* /list *'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  - User
  falsepositives:
  - Legitimate administrative tasks.
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(C\:\\PerfLogs\\\\* OR C\:\\$Recycle.bin\\\\* OR C\:\\Intel\\Logs\\\\*
          OR C\:\\Users\\Default\\\\* OR C\:\\Users\\Public\\\\* OR C\:\\Users\\NetworkService\\\\*
          OR C\:\\Windows\\Fonts\\\\* OR C\:\\Windows\\Debug\\\\* OR C\:\\Windows\\Media\\\\*
          OR C\:\\Windows\\Help\\\\* OR C\:\\Windows\\addins\\\\* OR C\:\\Windows\\repair\\\\*
          OR C\:\\Windows\\security\\\\* OR *\\RSA\\MachineKeys\\\\* OR C\:\\Windows\\system32\\config\\systemprofile\\\\*
          OR C\:\\Windows\\Tasks\\\\* OR C\:\\Windows\\System32\\Tasks\\\\*))
  index: logstash-beats-*
  name: Executables Started in Suspicious Folder
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/mbevilacqua/appcompatprocessor/blob/master/AppCompatSearch.txt
  https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
  https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/suspicious_process_creation_via_windows_event_logs.md


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Executables Started in Suspicious Folder
  id: 7a38aa19-86a9-4af7-ac51-6bfe4e59f254
  status: experimental
  description: Detects process starts of binaries from a suspicious folder
  author: Florian Roth
  date: 2017/10/14
  modified: 2019/02/21
  references:
  - https://github.com/mbevilacqua/appcompatprocessor/blob/master/AppCompatSearch.txt
  - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  - https://github.com/ThreatHuntingProject/ThreatHunting/blob/master/hunts/suspicious_process_creation_via_windows_event_logs.md
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - C:\PerfLogs\\*
      - C:\$Recycle.bin\\*
      - C:\Intel\Logs\\*
      - C:\Users\Default\\*
      - C:\Users\Public\\*
      - C:\Users\NetworkService\\*
      - C:\Windows\Fonts\\*
      - C:\Windows\Debug\\*
      - C:\Windows\Media\\*
      - C:\Windows\Help\\*
      - C:\Windows\addins\\*
      - C:\Windows\repair\\*
      - C:\Windows\security\\*
      - '*\RSA\MachineKeys\\*'
      - C:\Windows\system32\config\systemprofile\\*
      - C:\Windows\Tasks\\*
      - C:\Windows\System32\Tasks\\*
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Administrative activity (adjust code pages according to your organisation's region)

  _Interesting Log Fields_
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(chcp*\ 936 OR chcp*\ 1258))
  index: logstash-beats-*
  name: Suspicious Code Page Switch
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  https://twitter.com/cglyer/status/1183756892952248325


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Code Page Switch
  id: c7942406-33dd-4377-a564-0f62db0593a3
  status: experimental
  description: Detects a code page switch in command line or batch scripts to a rare
    language
  author: Florian Roth
  date: 2019/10/14
  references:
  - https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://twitter.com/cglyer/status/1183756892952248325
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - chcp* 936
      - chcp* 1258
    condition: selection
  fields:
  - ParentCommandLine
  falsepositives:
  - Administrative activity (adjust code pages according to your organisation's region)
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*transport\=dt_socket,address\=* AND (NOT (event_data.CommandLine:*address\=127.0.0.1*
          OR event_data.CommandLine:*address\=localhost*)))
  index: logstash-beats-*
  name: Java Running with Remote Debugging
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Java Running with Remote Debugging
  id: 8f88e3f6-2a49-48f5-a5c4-2f7eedf78710
  description: Detects a JAVA process running with remote debugging allowing more than
    just localhost to connect
  author: Florian Roth
  date: 2019/01/16
  tags:
  - attack.discovery
  - attack.t1046
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*transport=dt_socket,address=*'
    exclusion:
    - CommandLine: '*address=127.0.0.1*'
    - CommandLine: '*address=localhost*'
    condition: selection and not exclusion
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\EQNEDT32.EXE)
  index: logstash-beats-*
  name: Droppers Exploiting CVE-2017-11882
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
  https://www.google.com/url?hl=en&q=https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about&source=gmail&ust=1511481120837000&usg=AFQjCNGdL7gVwLXaNSl2Td8ylDYbSJFmPw


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Droppers Exploiting CVE-2017-11882
  id: 678eb5f4-8597-4be6-8be7-905e4234b53a
  status: experimental
  description: Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other
    sub processes like mshta.exe
  references:
  - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
  - https://www.google.com/url?hl=en&q=https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-didnt-know-about&source=gmail&ust=1511481120837000&usg=AFQjCNGdL7gVwLXaNSl2Td8ylDYbSJFmPw
  author: Florian Roth
  date: 2017/11/23
  tags:
  - attack.defense_evasion
  - attack.t1211
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\EQNEDT32.EXE'
    condition: selection
  fields:
  - CommandLine
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((image_path:*\\xcopy.exe AND event_data.CommandLine:*\ \/S\ \/E\ \/C\ \/Q\
          \/H\ \\\\*) OR (image_path:*\\adexplorer.exe AND event_data.CommandLine:*\
          \-snapshot\ \"\"\ c\:\\\users\\\\*)))
  index: logstash-beats-*
  name: Judgement Panda Exfil Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Judgement Panda Exfil Activity
  id: b83f5166-9237-4b5e-9cd4-7b5d52f4d8ee
  description: Detects Russian group activity as described in Global Threat Report 2019
    by Crowdstrike
  references:
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  author: Florian Roth
  date: 2019/02/21
  tags:
  - attack.credential_access
  - attack.t1081
  - attack.t1003
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image: '*\xcopy.exe'
      CommandLine: '* /S /E /C /Q /H \\*'
    selection2:
      Image: '*\adexplorer.exe'
      CommandLine: '* -snapshot "" c:\users\\*'
    condition: selection1 or selection2
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the execution of an executable that is typically used by PlugX for DLL side loading started from an uncommon location


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          ((((((((((((image_path:*\\CamMute.exe AND (NOT (image_path:*\\Lenovo\\Communication\
          Utility\\\\*))) OR (image_path:*\\chrome_frame_helper.exe AND (NOT (image_path:*\\Google\\Chrome\\application\\\\*))))
          OR (image_path:*\\dvcemumanager.exe AND (NOT (image_path:*\\Microsoft\ Device\
          Emulator\\\\*)))) OR (image_path:*\\Gadget.exe AND (NOT (image_path:*\\Windows\
          Media\ Player\\\\*)))) OR (image_path:*\\hcc.exe AND (NOT (image_path:*\\HTML\
          Help\ Workshop\\\\*)))) OR (image_path:*\\hkcmd.exe AND (NOT (image_path:(*\\System32\\\\*
          OR *\\SysNative\\\\* OR *\\SysWowo64\\\\*))))) OR (image_path:*\\Mc.exe AND
          (NOT (image_path:(*\\Microsoft\ Visual\ Studio* OR *\\Microsoft\ SDK* OR *\\Windows\
          Kit*))))) OR (image_path:*\\MsMpEng.exe AND (NOT (image_path:(*\\Microsoft\
          Security\ Client\\\\* OR *\\Windows\ Defender\\\\* OR *\\AntiMalware\\\\*)))))
          OR (image_path:*\\msseces.exe AND (NOT (image_path:(*\\Microsoft\ Security\
          Center\\\\* OR *\\Microsoft\ Security\ Client\\\\* OR *\\Microsoft\ Security\
          Essentials\\\\*))))) OR (image_path:*\\OInfoP11.exe AND (NOT (image_path:*\\Common\
          Files\\Microsoft\ Shared\\\\*)))) OR (image_path:*\\OleView.exe AND (NOT (image_path:(*\\Microsoft\
          Visual\ Studio* OR *\\Microsoft\ SDK* OR *\\Windows\ Kit* OR *\\Windows\ Resource\
          Kit\\\\*))))) OR (image_path:*\\rc.exe AND (NOT (image_path:(*\\Microsoft\
          Visual\ Studio* OR *\\Microsoft\ SDK* OR *\\Windows\ Kit* OR *\\Windows\ Resource\
          Kit\\\\* OR *\\Microsoft.NET\\\\*))))))
  index: logstash-beats-*
  name: Executable Used by PlugX in Uncommon Location
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
  https://countuponsecurity.com/2017/06/07/threat-hunting-in-the-enterprise-with-appcompatprocessor/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Executable Used by PlugX in Uncommon Location
  id: aeab5ec5-be14-471a-80e8-e344418305c2
  status: experimental
  description: Detects the execution of an executable that is typically used by PlugX
    for DLL side loading started from an uncommon location
  references:
  - http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
  - https://countuponsecurity.com/2017/06/07/threat-hunting-in-the-enterprise-with-appcompatprocessor/
  author: Florian Roth
  date: 2017/06/12
  tags:
  - attack.s0013
  - attack.defense_evasion
  - attack.t1073
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_cammute:
      Image: '*\CamMute.exe'
    filter_cammute:
      Image: '*\Lenovo\Communication Utility\\*'
    selection_chrome_frame:
      Image: '*\chrome_frame_helper.exe'
    filter_chrome_frame:
      Image: '*\Google\Chrome\application\\*'
    selection_devemu:
      Image: '*\dvcemumanager.exe'
    filter_devemu:
      Image: '*\Microsoft Device Emulator\\*'
    selection_gadget:
      Image: '*\Gadget.exe'
    filter_gadget:
      Image: '*\Windows Media Player\\*'
    selection_hcc:
      Image: '*\hcc.exe'
    filter_hcc:
      Image: '*\HTML Help Workshop\\*'
    selection_hkcmd:
      Image: '*\hkcmd.exe'
    filter_hkcmd:
      Image:
      - '*\System32\\*'
      - '*\SysNative\\*'
      - '*\SysWowo64\\*'
    selection_mc:
      Image: '*\Mc.exe'
    filter_mc:
      Image:
      - '*\Microsoft Visual Studio*'
      - '*\Microsoft SDK*'
      - '*\Windows Kit*'
    selection_msmpeng:
      Image: '*\MsMpEng.exe'
    filter_msmpeng:
      Image:
      - '*\Microsoft Security Client\\*'
      - '*\Windows Defender\\*'
      - '*\AntiMalware\\*'
    selection_msseces:
      Image: '*\msseces.exe'
    filter_msseces:
      Image:
      - '*\Microsoft Security Center\\*'
      - '*\Microsoft Security Client\\*'
      - '*\Microsoft Security Essentials\\*'
    selection_oinfo:
      Image: '*\OInfoP11.exe'
    filter_oinfo:
      Image: '*\Common Files\Microsoft Shared\\*'
    selection_oleview:
      Image: '*\OleView.exe'
    filter_oleview:
      Image:
      - '*\Microsoft Visual Studio*'
      - '*\Microsoft SDK*'
      - '*\Windows Kit*'
      - '*\Windows Resource Kit\\*'
    selection_rc:
      Image: '*\rc.exe'
    filter_rc:
      Image:
      - '*\Microsoft Visual Studio*'
      - '*\Microsoft SDK*'
      - '*\Windows Kit*'
      - '*\Windows Resource Kit\\*'
      - '*\Microsoft.NET\\*'
    condition: ( selection_cammute and not filter_cammute ) or ( selection_chrome_frame
      and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or
      ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc
      ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc
      ) or ( selection_msmpeng and not filter_msmpeng ) or ( selection_msseces and not
      filter_msseces ) or ( selection_oinfo and not filter_oinfo ) or ( selection_oleview
      and not filter_oleview ) or ( selection_rc and not filter_rc )
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\Hwp.exe AND image_path:*\\gbb.exe)
  index: logstash-beats-*
  name: Suspicious HWP Sub Processes
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
  https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1
  https://twitter.com/cyberwar_15/status/1187287262054076416
  https://blog.alyac.co.kr/1901
  https://en.wikipedia.org/wiki/Hangul_(word_processor)


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious HWP Sub Processes
  id: 023394c4-29d5-46ab-92b8-6a534c6f447b
  description: Detects suspicious Hangul Word Processor (Hanword) sub processes that
    could indicate an exploitation
  status: experimental
  references:
  - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
  - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1
  - https://twitter.com/cyberwar_15/status/1187287262054076416
  - https://blog.alyac.co.kr/1901
  - https://en.wikipedia.org/wiki/Hangul_(word_processor)
  tags:
  - attack.execution
  - attack.defense_evasion
  - attack.initial_access
  - attack.t1059
  - attack.t1202
  - attack.t1193
  - attack.g0032
  author: Florian Roth
  date: 2019/10/24
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\Hwp.exe'
      Image: '*\gbb.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.


customized_type: Issue
value:
  _False Positives_
   Unknown

  _Interesting Log Fields_
  Image
  CommandLine
  User
  LogonGuid
  Hashes
  ParentProcessGuid
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Query Registry
  id: 970007b7-ce32-49d0-a4a4-fbef016950bd
  status: experimental
  description: Adversaries may interact with the Windows Registry to gather information
    about the system, configuration, and installed software.
  author: Timur Zinniatullin, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1012/T1012.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \reg.exe
      CommandLine|contains:
      - currentVersion\windows
      - currentVersion\runServicesOnce
      - currentVersion\runServices
      - winlogon\
      - currentVersion\shellServiceObjectDelayLoad
      - currentVersion\runOnce
      - currentVersion\runOnceEx
      - currentVersion\run
      - currentVersion\policies\explorer\run
      - currentcontrolset\services
    condition: selection
  fields:
  - Image
  - CommandLine
  - User
  - LogonGuid
  - Hashes
  - ParentProcessGuid
  - ParentCommandLine
  level: low
  tags:
  - attack.discovery
  - attack.t1012
  - attack.t1007

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\ \/dest\:rdp\-tcp\:*)
  index: logstash-beats-*
  name: Suspicious RDP Redirect Using TSCON
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious RDP Redirect Using TSCON
  id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb
  status: experimental
  description: Detects a suspicious RDP session redirect using tscon.exe
  references:
  - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
  tags:
  - attack.lateral_movement
  - attack.privilege_escalation
  - attack.t1076
  - car.2013-07-002
  author: Florian Roth
  date: 2018/03/17
  modified: 2018/12/11
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '* /dest:rdp-tcp:*'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\powershell.exe AND event_data.CommandLine:(*new\-object\ system.net.webclient\).downloadstring\(*
          OR *new\-object\ system.net.webclient\).downloadfile\(* OR *new\-object\ net.webclient\).downloadstring\(*
          OR *new\-object\ net.webclient\).downloadfile\(*))
  index: logstash-beats-*
  name: PowerShell Download from URL
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: PowerShell Download from URL
  id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7
  status: experimental
  description: Detects a Powershell process that contains download commands in its command
    line string
  author: Florian Roth
  date: 2019/01/16
  tags:
  - attack.t1086
  - attack.execution
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\powershell.exe'
      CommandLine:
      - '*new-object system.net.webclient).downloadstring(*'
      - '*new-object system.net.webclient).downloadfile(*'
      - '*new-object net.webclient).downloadstring(*'
      - '*new-object net.webclient).downloadfile(*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Will need to be tuned. I recommend adding the user profile path in CommandLine if it is getting too noisy.

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\wscript.exe OR *\\cscript.exe) AND event_data.CommandLine:(*.jse
          OR *.vbe OR *.js OR *.vba))
  index: logstash-beats-*
  name: WSF/JSE/JS/VBA/VBE File Execution
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WSF/JSE/JS/VBA/VBE File Execution
  id: 1e33157c-53b1-41ad-bbcc-780b80b58288
  status: experimental
  description: Detects suspicious file execution by wscript and cscript
  author: Michael Haag
  date: 2019/01/16
  tags:
  - attack.execution
  - attack.t1064
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\wscript.exe'
      - '*\cscript.exe'
      CommandLine:
      - '*.jse'
      - '*.vbe'
      - '*.js'
      - '*.vba'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Will need to be tuned. I recommend adding the user profile path in CommandLine if
    it is getting too noisy.
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\rundll32.exe*\ url.dll,*OpenURL\ * OR *\\rundll32.exe*\
          url.dll,*OpenURLA\ * OR *\\rundll32.exe*\ url.dll,*FileProtocolHandler\ *
          OR *\\rundll32.exe*\ zipfldr.dll,*RouteTheCall\ * OR *\\rundll32.exe*\ Shell32.dll,*Control_RunDLL\
          * OR *\\rundll32.exe\ javascript\:* OR *\ url.dll,*OpenURL\ * OR *\ url.dll,*OpenURLA\
          * OR *\ url.dll,*FileProtocolHandler\ * OR *\ zipfldr.dll,*RouteTheCall\ *
          OR *\ Shell32.dll,*Control_RunDLL\ * OR *\ javascript\:* OR *.RegisterXLL*))
  index: logstash-beats-*
  name: Suspicious Rundll32 Activity
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
  https://twitter.com/Hexacorn/status/885258886428725250
  https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Rundll32 Activity
  id: e593cf51-88db-4ee1-b920-37e89012a3c9
  description: Detects suspicious process related to rundll32 based on arguments
  status: experimental
  references:
  - http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
  - https://twitter.com/Hexacorn/status/885258886428725250
  - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1085
  author: juju4
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*\rundll32.exe* url.dll,*OpenURL *'
      - '*\rundll32.exe* url.dll,*OpenURLA *'
      - '*\rundll32.exe* url.dll,*FileProtocolHandler *'
      - '*\rundll32.exe* zipfldr.dll,*RouteTheCall *'
      - '*\rundll32.exe* Shell32.dll,*Control_RunDLL *'
      - '*\rundll32.exe javascript:*'
      - '* url.dll,*OpenURL *'
      - '* url.dll,*OpenURLA *'
      - '* url.dll,*FileProtocolHandler *'
      - '* zipfldr.dll,*RouteTheCall *'
      - '* Shell32.dll,*Control_RunDLL *'
      - '* javascript:*'
      - '*.RegisterXLL*'
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Unlikely, because no sane admin pings IP addresses in a hexadecimal form

  _Interesting Log Fields_
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\ping.exe\ 0x* OR *\\ping\ 0x*))
  index: logstash-beats-*
  name: Ping Hex IP
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna
  https://twitter.com/vysecurity/status/977198418354491392


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Ping Hex IP
  id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd
  description: Detects a ping command that uses a hex encoded IP address
  references:
  - https://github.com/vysec/Aggressor-VYSEC/blob/master/ping.cna
  - https://twitter.com/vysecurity/status/977198418354491392
  author: Florian Roth
  date: 2018/03/23
  tags:
  - attack.defense_evasion
  - attack.t1140
  - attack.t1027
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*\ping.exe 0x*'
      - '*\ping 0x*'
    condition: selection
  fields:
  - ParentCommandLine
  falsepositives:
  - Unlikely, because no sane admin pings IP addresses in a hexadecimal form
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          Command:(rundll32.exe\ *,zxFunction* OR rundll32.exe\ *,RemoteDiskXXXXX))
  index: logstash-beats-*
  name: ZxShell Malware
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: ZxShell Malware
  id: f0b70adb-0075-43b0-9745-e82a1c608fcc
  description: Detects a ZxShell start by the called and well-known function name
  author: Florian Roth
  date: 2017/07/20
  references:
  - https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
  tags:
  - attack.g0001
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1085
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Command:
      - rundll32.exe *,zxFunction*
      - rundll32.exe *,RemoteDiskXXXXX
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\ \/INJECTRUNNING\ *)
  index: logstash-beats-*
  name: MavInject Process Injection
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/gN3mes1s/status/941315826107510784
  https://reaqta.com/2017/12/mavinject-microsoft-injector/
  https://twitter.com/Hexacorn/status/776122138063409152


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MavInject Process Injection
  id: 17eb8e57-9983-420d-ad8a-2c4976c22eb8
  status: experimental
  description: Detects process injection using the signed Windows tool Mavinject32.exe
  references:
  - https://twitter.com/gN3mes1s/status/941315826107510784
  - https://reaqta.com/2017/12/mavinject-microsoft-injector/
  - https://twitter.com/Hexacorn/status/776122138063409152
  author: Florian Roth
  date: 2018/12/12
  tags:
  - attack.t1055
  - attack.t1218
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '* /INJECTRUNNING *'
    condition: selection
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Legitimate administrator or user uses netsh.exe trace functionality for legitimate reason


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*netsh* AND event_data.CommandLine:*trace* AND event_data.CommandLine:*start*)
  index: logstash-beats-*
  name: Capture a Network Trace with netsh.exe
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Capture a Network Trace with netsh.exe
  id: d3c3861d-c504-4c77-ba55-224ba82d0118
  status: experimental
  description: Detects capture a network trace via netsh.exe trace functionality
  references:
  - https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/
  author: Kutepov Anton, oscd.community
  date: 2019/10/24
  tags:
  - attack.discovery
  - attack.t1040
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains|all:
      - netsh
      - trace
      - start
    condition: selection
  falsepositives:
  - Legitimate administrator or user uses netsh.exe trace functionality for legitimate
    reason
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Legitimate administrator or user enumerates local users for legitimate reason

  _Interesting Log Fields_
  Image
  CommandLine
  User
  LogonGuid
  Hashes
  ParentProcessGuid
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Local Accounts Discovery
  id: 502b42de-4306-40b4-9596-6f590c81f073
  status: experimental
  description: Local accounts, System Owner/User discovery using operating systems utilities
  author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1033/T1033.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_1:
    - Image|endswith: \whoami.exe
    - Image|endswith: \wmic.exe
      CommandLine|contains|all:
      - useraccount
      - get
    - Image|endswith:
      - \quser.exe
      - \qwinsta.exe
    - Image|endswith: \cmdkey.exe
      CommandLine|contains: /list
    - Image|endswith: \cmd.exe
      CommandLine|contains|all:
      - /c
      - dir
      - \Users\
    selection_2:
      Image|endswith:
      - \net.exe
      - \net1.exe
      CommandLine|contains: user
    filter:
      CommandLine|contains:
      - /domain
      - /add
      - /delete
      - /active
      - /expires
      - /passwordreq
      - /scriptpath
      - /times
      - /workstations
    condition: selection_1 or ( selection_2 and not filter )
  fields:
  - Image
  - CommandLine
  - User
  - LogonGuid
  - Hashes
  - ParentProcessGuid
  - ParentCommandLine
  falsepositives:
  - Legitimate administrator or user enumerates local users for legitimate reason
  level: low
  tags:
  - attack.discovery
  - attack.t1033
  - attack.t1087

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*.cpl AND (NOT (event_data.CommandLine:(*\\System32\\\\*
          OR *%System%*))))
  index: logstash-beats-*
  name: Control Panel Items
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Control Panel Items
  id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
  status: experimental
  description: Detects the use of a control panel item (.cpl) outside of the System32
    folder
  reference:
  - https://attack.mitre.org/techniques/T1196/
  tags:
  - attack.execution
  - attack.t1196
  - attack.defense_evasion
  author: Kyaw Min Thein
  date: 2019/08/27
  level: critical
  logsource:
    product: windows
    category: process_creation
  detection:
    selection:
      CommandLine: '*.cpl'
    filter:
      CommandLine:
      - '*\System32\\*'
      - '*%System%*'
    condition: selection and not filter
  falsepositives:
  - Unknown

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\EdgeTransport.exe)
  index: logstash-beats-*
  name: WMI Backdoor Exchange Transport Agent
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/cglyer/status/1182389676876980224
  https://twitter.com/cglyer/status/1182391019633029120


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Backdoor Exchange Transport Agent
  id: 797011dc-44f4-4e6f-9f10-a8ceefbe566b
  status: experimental
  description: Detects a WMi backdoor in Exchange Transport Agents via WMi event filters
  author: Florian Roth
  date: 2019/10/11
  references:
  - https://twitter.com/cglyer/status/1182389676876980224
  - https://twitter.com/cglyer/status/1182391019633029120
  logsource:
    category: process_creation
    product: windows
  tags:
  - attack.persistence
  - attack.t1084
  detection:
    selection:
      ParentImage: '*\EdgeTransport.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(rasdial))
  index: logstash-beats-*
  name: Suspicious RASdial Activity
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious RASdial Activity
  id: 6bba49bf-7f8c-47d6-a1bb-6b4dece4640e
  description: Detects suspicious process related to rasdial.exe
  status: experimental
  references:
  - https://twitter.com/subTee/status/891298217907830785
  author: juju4
  date: 2019/01/16
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1064
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - rasdial
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ localgroup\ administrators\ admin\ \/add OR *\\Win64.exe*))
  index: logstash-beats-*
  name: Hurricane Panda Activity
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Hurricane Panda Activity
  id: 0eb2107b-a596-422e-b123-b389d5594ed7
  author: Florian Roth
  date: 2019/03/04
  status: experimental
  description: Detects Hurricane Panda Activity
  references:
  - https://www.crowdstrike.com/blog/crowdstrike-discovers-use-64-bit-zero-day-privilege-escalation-exploit-cve-2014-4113-hurricane-panda/
  tags:
  - attack.privilege_escalation
  - attack.g0009
  - attack.t1068
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* localgroup administrators admin /add'
      - '*\Win64.exe*'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*OjpGcm9tQmFzZTY0U3RyaW5n* OR *o6RnJvbUJhc2U2NFN0cmluZ*
          OR *6OkZyb21CYXNlNjRTdHJpbm*))
  index: logstash-beats-*
  name: Encoded FromBase64String
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Encoded FromBase64String
  id: fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
  status: experimental
  description: Detects a base64 encoded FromBase64String keyword in a process command
    line
  author: Florian Roth
  date: 2019/08/24
  tags:
  - attack.t1086
  - attack.t1140
  - attack.execution
  - attack.defense_evasion
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|base64offset|contains: ::FromBase64String
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (image_path:(*\\rundll32.exe)
          OR event_data.Description:(*Windows\-Hostprozess\ \(Rundll32\)*)) AND event_data.CommandLine:(*Default.GetString*
          OR *FromBase64String*))
  index: logstash-beats-*
  name: Detection of PowerShell Execution via DLL
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Detection of PowerShell Execution via DLL
  id: 6812a10b-60ea-420c-832f-dfcc33b646ba
  status: experimental
  description: Detects PowerShell Strings applied to rundllas seen in PowerShdll.dll
  references:
  - https://github.com/p3nt4/PowerShdll/blob/master/README.md
  tags:
  - attack.execution
  - attack.t1086
  - car.2014-04-003
  author: Markus Neis
  date: 2018/08/25
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image:
      - '*\rundll32.exe'
    selection2:
      Description:
      - '*Windows-Hostprozess (Rundll32)*'
    selection3:
      CommandLine:
      - '*Default.GetString*'
      - '*FromBase64String*'
    condition: (selection1 or selection2) and selection3
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects installation of a new shim using sdbinst.exe. A shim can be used to load malicious DLLs into applications.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\sdbinst.exe) AND event_data.CommandLine:(*.sdb*))
  index: logstash-beats-*
  name: Possible Shim Database Persistence via sdbinst.exe
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible Shim Database Persistence via sdbinst.exe
  id: 517490a7-115a-48c6-8862-1a481504d5a8
  status: experimental
  description: Detects installation of a new shim using sdbinst.exe. A shim can be used
    to load malicious DLLs into applications.
  references:
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  tags:
  - attack.persistence
  - attack.t1138
  author: Markus Neis
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\sdbinst.exe'
      CommandLine:
      - '*.sdb*'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Winzip
  Other self-extractors

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (image_path:(*\\wscript.exe OR *\\cscript.exe) AND event_data.CommandLine:(*\
          C\:\\Users\\\\*.jse\ * OR *\ C\:\\Users\\\\*.vbe\ * OR *\ C\:\\Users\\\\*.js\
          * OR *\ C\:\\Users\\\\*.vba\ * OR *\ C\:\\Users\\\\*.vbs\ * OR *\ C\:\\ProgramData\\\\*.jse\
          * OR *\ C\:\\ProgramData\\\\*.vbe\ * OR *\ C\:\\ProgramData\\\\*.js\ * OR
          *\ C\:\\ProgramData\\\\*.vba\ * OR *\ C\:\\ProgramData\\\\*.vbs\ *)) AND (NOT
          (event_data.ParentImage:*\\winzip*)))
  index: logstash-beats-*
  name: WScript or CScript Dropper
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WScript or CScript Dropper
  id: cea72823-df4d-4567-950c-0b579eaf0846
  status: experimental
  description: Detects wscript/cscript executions of scripts located in user directories
  author: Margaritis Dimitrios (idea), Florian Roth (rule)
  date: 2019/01/16
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1064
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\wscript.exe'
      - '*\cscript.exe'
      CommandLine:
      - '* C:\Users\\*.jse *'
      - '* C:\Users\\*.vbe *'
      - '* C:\Users\\*.js *'
      - '* C:\Users\\*.vba *'
      - '* C:\Users\\*.vbs *'
      - '* C:\ProgramData\\*.jse *'
      - '* C:\ProgramData\\*.vbe *'
      - '* C:\ProgramData\\*.js *'
      - '* C:\ProgramData\\*.vba *'
      - '* C:\ProgramData\\*.vbs *'
    falsepositive:
      ParentImage: '*\winzip*'
    condition: selection and not falsepositive
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Winzip
  - Other self-extractors
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Cdb.yml
  http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible App Whitelisting Bypass via WinDbg/CDB as a Shellcode Runner
  id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2
  status: experimental
  description: Launch 64-bit shellcode from the x64_calc.wds file using cdb.exe.
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Cdb.yml
  - http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
  author: Beyu Denis, oscd.community
  date: 2019/10/26
  modified: 2019/11/04
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \cdb.exe
      CommandLine|contains: -cf
    condition: selection
  falsepositives:
  - Legitimate use of debugging tools

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((image_path:*\\regsvr32.exe AND event_data.CommandLine:*\\Temp\\\\*) OR (image_path:*\\regsvr32.exe
          AND event_data.ParentImage:*\\powershell.exe) OR (image_path:*\\regsvr32.exe
          AND event_data.ParentImage:*\\cmd.exe) OR (image_path:*\\regsvr32.exe AND
          event_data.CommandLine:(*\/i\:http*\ scrobj.dll OR *\/i\:ftp*\ scrobj.dll))
          OR (image_path:*\\wscript.exe AND event_data.ParentImage:*\\regsvr32.exe)
          OR (image_path:*\\EXCEL.EXE AND event_data.CommandLine:*..\\..\\..\\Windows\\System32\\regsvr32.exe\
          *)))
  index: logstash-beats-*
  name: Regsvr32 Anomaly
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Regsvr32 Anomaly
  id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
  status: experimental
  description: Detects various anomalies in relation to regsvr32.exe
  author: Florian Roth
  date: 2019/01/16
  references:
  - https://subt0x10.blogspot.de/2017/04/bypass-application-whitelisting-script.html
  tags:
  - attack.t1117
  - attack.defense_evasion
  - attack.execution
  - car.2019-04-002
  - car.2019-04-003
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image: '*\regsvr32.exe'
      CommandLine: '*\Temp\\*'
    selection2:
      Image: '*\regsvr32.exe'
      ParentImage: '*\powershell.exe'
    selection3:
      Image: '*\regsvr32.exe'
      ParentImage: '*\cmd.exe'
    selection4:
      Image: '*\regsvr32.exe'
      CommandLine:
      - '*/i:http* scrobj.dll'
      - '*/i:ftp* scrobj.dll'
    selection5:
      Image: '*\wscript.exe'
      ParentImage: '*\regsvr32.exe'
    selection6:
      Image: '*\EXCEL.EXE'
      CommandLine: '*..\..\..\Windows\System32\regsvr32.exe *'
    condition: 1 of them
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://securityxploded.com/
  https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: SecurityXploded Tool
  id: 7679d464-4f74-45e2-9e01-ac66c5eb041a
  description: Detects the execution of SecurityXploded Tools
  author: Florian Roth
  references:
  - https://securityxploded.com/
  - https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
  date: 2018/12/19
  tags:
  - attack.credential_access
  - attack.t1003
  - attack.s0005
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Company: SecurityXploded
    selection2:
      Image|endswith: PasswordDump.exe
    selection3:
      OriginalFilename|endswith: PasswordDump.exe
    condition: 1 of them
  falsepositives:
  - unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects the execution of whoami as LOCAL_SYSTEM, often used after privilege escalation by attackers who want to evaluate the new user context


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Whoami as LOCAL_SYSTEM
  id: 1453b1a4-261b-4daf-afe1-2a400a838b5c
  status: experimental
  description: Detects the execution of whoami as LOCAL_SYSTEM, often used after privilege
    escalation by attackers who want to evaluate the new user context
  author: Florian Roth
  date: 2019/12/22
  tags:
  - attack.discovery
  - attack.t1033
  - car.2016-03-001
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|contains: \whoami.exe
      User: NT AUTHORITY\SYSTEM
    filter1:
      ParentImage|endswith: \monitoringhost.exe
    condition: selection and not filter1
  falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Dxcap.yml
  https://twitter.com/harr0ey/status/992008180904419328


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Application Whitelisting Bypass via Dxcap.exe
  id: 60f16a96-db70-42eb-8f76-16763e333590
  status: experimental
  description: Detects execution of of Dxcap.exe
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Dxcap.yml
  - https://twitter.com/harr0ey/status/992008180904419328
  author: Beyu Denis, oscd.community
  date: 2019/10/26
  modified: 2019/11/04
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \dxcap.exe
      CommandLine|contains|all:
      - -c
      - .exe
    condition: selection
  falsepositives:
  - Legitimate execution of dxcap.exe by legitimate user

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Administrative activity
  Software installation

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (image_path:*\\schtasks.exe AND event_data.CommandLine:*\ \/create\ *) AND
          (NOT (event_data.User:NT\ AUTHORITY\\SYSTEM)))
  index: logstash-beats-*
  name: Scheduled Task Creation
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Scheduled Task Creation
  id: 92626ddd-662c-49e3-ac59-f6535f12d189
  status: experimental
  description: Detects the creation of scheduled tasks in user session
  author: Florian Roth
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\schtasks.exe'
      CommandLine: '* /create *'
    filter:
      User: NT AUTHORITY\SYSTEM
    condition: selection and not filter
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.execution
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1053
  - attack.s0111
  - car.2013-08-001
  falsepositives:
  - Administrative activity
  - Software installation
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  Detects an explotation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\consent.exe AND image_path:*\\iexplore.exe AND event_data.CommandLine:*\
          http* AND (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational)
          AND (IntegrityLevel:System OR event_data.User:NT\ AUTHORITY\\SYSTEM))
  index: logstash-beats-*
  name: Exploiting CVE-2019-1388
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388
  https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Exploiting CVE-2019-1388
  id: 02e0b2ea-a597-428e-b04a-af6a1a403e5c
  status: experimental
  description: Detects an explotation attempt in which the UAC consent dialogue is used
    to invoke an Internet Explorer process running as LOCAL_SYSTEM
  references:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388
  - https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege
  author: Florian Roth
  date: 2019/11/20
  tags:
  - attack.privilege_escalation
  - attack.t1068
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\consent.exe'
      Image: '*\iexplore.exe'
      CommandLine: '* http*'
    rights1:
      IntegrityLevel: System
    rights2:
      User: NT AUTHORITY\SYSTEM
    condition: selection and ( rights1 or rights2 )
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*netsh\ firewall\ add*))
  index: logstash-beats-*
  name: Netsh
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://attack.mitre.org/software/S0246/ (Lazarus HARDRAIN)
  https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Netsh
  id: cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c
  description: Allow Incoming Connections by Port or Application on Windows Firewall
  references:
  - https://attack.mitre.org/software/S0246/ (Lazarus HARDRAIN)
  - https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
  date: 2019/01/29
  tags:
  - attack.lateral_movement
  - attack.command_and_control
  - attack.t1090
  status: experimental
  author: Markus Neis
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*netsh firewall add*'
    condition: selection
  falsepositives:
  - Legitimate administration
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  igfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe)
  msiexec.exe hiding desktop.ini

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine
  User


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (image_path:*\\attrib.exe AND event_data.CommandLine:*\ \+h\ *) AND (NOT (((event_id:1
          AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (event_data.CommandLine:*\\desktop.ini\
          * OR (event_data.ParentImage:*\\cmd.exe AND event_data.CommandLine:\+R\ \+H\
          \+S\ \+A\ \\\\*.cui AND event_data.ParentCommandLine:C\:\\WINDOWS\\system32\\\\*.bat))))))
  index: logstash-beats-*
  name: Hiding Files with Attrib.exe
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Hiding Files with Attrib.exe
  id: 4281cb20-2994-4580-aa63-c8b86d019934
  status: experimental
  description: Detects usage of attrib.exe to hide files from users.
  author: Sami Ruohonen
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\attrib.exe'
      CommandLine: '* +h *'
    ini:
      CommandLine: '*\desktop.ini *'
    intel:
      ParentImage: '*\cmd.exe'
      CommandLine: +R +H +S +A \\*.cui
      ParentCommandLine: C:\WINDOWS\system32\\*.bat
    condition: selection and not (ini or intel)
  fields:
  - CommandLine
  - ParentCommandLine
  - User
  tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1158
  falsepositives:
  - igfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe
    and igfxCUIService.exe is the parent of the cmd.exe)
  - msiexec.exe hiding desktop.ini
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  Web servers that spawn shell processes could be the result of a successfully placed web shell or an other attack


customized_type: Issue
value:
  _False Positives_
  Particular web applications may spawn a shell process legitimately

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:(*\\w3wp.exe OR *\\httpd.exe OR *\\nginx.exe OR *\\php\-cgi.exe)
          AND image_path:(*\\cmd.exe OR *\\sh.exe OR *\\bash.exe OR *\\powershell.exe))
  index: logstash-beats-*
  name: Shells Spawned by Web Servers
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Shells Spawned by Web Servers
  id: 8202070f-edeb-4d31-a010-a26c72ac5600
  status: experimental
  description: Web servers that spawn shell processes could be the result of a successfully
    placed web shell or an other attack
  author: Thomas Patzke
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\w3wp.exe'
      - '*\httpd.exe'
      - '*\nginx.exe'
      - '*\php-cgi.exe'
      Image:
      - '*\cmd.exe'
      - '*\sh.exe'
      - '*\bash.exe'
      - '*\powershell.exe'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.privilege_escalation
  - attack.persistence
  - attack.t1100
  falsepositives:
  - Particular web applications may spawn a shell process legitimately
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/gN3mes1s/status/1222088214581825540
  https://twitter.com/gN3mes1s/status/1222095963789111296
  https://twitter.com/gN3mes1s/status/1222095371175911424


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: ZOHO Dctask64 Process Injection
  id: 6345b048-8441-43a7-9bed-541133633d7a
  status: experimental
  description: Detects suspicious process injection using ZOHO's dctask64.exe
  references:
  - https://twitter.com/gN3mes1s/status/1222088214581825540
  - https://twitter.com/gN3mes1s/status/1222095963789111296
  - https://twitter.com/gN3mes1s/status/1222095371175911424
  author: Florian Roth
  date: 2020/01/28
  tags:
  - attack.defense_evasion
  - attack.t1055
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith:
      - \dctask64.exe
    filter:
      CommandLine|contains:
      - DesktopCentral_Agent\agent
    condition: selection and not filter
  fields:
  - CommandLine
  - ParentCommandLine
  - ParentImage
  falsepositives:
  - Unknown yet
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\sysprep.exe\ *\\AppData\\\\* OR sysprep.exe\ *\\AppData\\\\*))
  index: logstash-beats-*
  name: Sysprep on AppData Folder
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
  https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Sysprep on AppData Folder
  id: d5b9ae7a-e6fc-405e-80ff-2ff9dcc64e7e
  status: experimental
  description: Detects suspicious sysprep process start with AppData folder as target
    (as used by Trojan Syndicasec in Thrip report by Symantec)
  references:
  - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
  - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
  tags:
  - attack.execution
  author: Florian Roth
  date: 2018/06/22
  modified: 2018/12/11
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*\sysprep.exe *\AppData\\*'
      - sysprep.exe *\AppData\\*
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects


customized_type: Issue
value:
  _False Positives_
  Legitimate CMSTP use (unlikely in modern enterprise environments)

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine
  Hashes


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentCommandLine:*\\DllHost.exe AND event_data.ParentCommandLine:(*\{3E5FC7F9\-9A51\-4367\-9063\-A120244FBEC7\}
          OR *\{3E000D72\-A845\-4CD9\-BD83\-80C07C3B881F\}))
  index: logstash-beats-*
  name: CMSTP UAC Bypass via COM Object Access
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  https://twitter.com/hFireF0X/status/897640081053364225


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: CMSTP UAC Bypass via COM Object Access
  id: 4b60e6f2-bf39-47b4-b4ea-398e33cfe253
  status: stable
  description: Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile
    Installer Autoelevate-capable COM Objects
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.execution
  - attack.t1088
  - attack.t1191
  - attack.g0069
  - car.2019-04-001
  author: Nik Seetharaman
  modified: 2019/07/31
  date: 2019/01/16
  references:
  - http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://twitter.com/hFireF0X/status/897640081053364225
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      ParentCommandLine: '*\DllHost.exe'
    selection2:
      ParentCommandLine:
      - '*{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'
      - '*{3E000D72-A845-4CD9-BD83-80C07C3B881F}'
    condition: selection1 and selection2
  fields:
  - CommandLine
  - ParentCommandLine
  - Hashes
  falsepositives:
  - Legitimate CMSTP use (unlikely in modern enterprise environments)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Will need to be tuned. If using Splunk, I recommend | stats count by Computer,CommandLine following the search for easy hunting by computer/CommandLine.

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\net.exe OR *\\net1.exe) AND event_data.CommandLine:(*\ group*
          OR *\ localgroup* OR *\ user* OR *\ view* OR *\ share OR *\ accounts* OR *\
          use* OR *\ stop\ *))
  index: logstash-beats-*
  name: Net.exe Execution
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Net.exe Execution
  id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
  status: experimental
  description: Detects execution of Net.exe, whether suspicious or benign.
  references:
  - https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
  author: Michael Haag, Mark Woan (improvements)
  date: 2019/01/16
  tags:
  - attack.s0039
  - attack.lateral_movement
  - attack.discovery
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\net.exe'
      - '*\net1.exe'
      CommandLine:
      - '* group*'
      - '* localgroup*'
      - '* user*'
      - '* view*'
      - '* share'
      - '* accounts*'
      - '* use*'
      - '* stop *'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Will need to be tuned. If using Splunk, I recommend | stats count by Computer,CommandLine
    following the search for easy hunting by computer/CommandLine.
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \-NoP\ \-NonI\ \-w\ Hidden\ \-c\ $x\=$\(\(gp\ HKCU\:Software\\\\Microsoft\\\\Windows\
          Update\).Update\)* OR *\ \-NoP\ \-NonI\ \-c\ $x\=$\(\(gp\ HKCU\:Software\\\\Microsoft\\\\Windows\
          Update\).Update\);*))
  index: logstash-beats-*
  name: Empire PowerShell UAC Bypass
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64
  https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Empire PowerShell UAC Bypass
  id: 3268b746-88d8-4cd3-bffc-30077d02c787
  status: experimental
  description: Detects some Empire PowerShell UAC bypass methods
  references:
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64
  author: Ecco
  date: 2019/08/30
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update)*'
      - '* -NoP -NonI -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update);*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1088
  - car.2019-04-001
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.NewProcessName:*\\bcdedit.exe AND ProcessCommandLine:(*delete*
          OR *deletevalue* OR *import*))
  index: logstash-beats-*
  name: Possible Ransomware or Unauthorized MBR Modifications
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible Ransomware or Unauthorized MBR Modifications
  id: c9fbe8e9-119d-40a6-9b59-dd58a5d84429
  status: experimental
  description: Detects, possibly, malicious unauthorized usage of bcdedit.exe
  references:
  - https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
  author: '@neu5ron'
  date: 2019/02/07
  tags:
  - attack.defense_evasion
  - attack.t1070
  - attack.persistence
  - attack.t1067
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      NewProcessName: '*\bcdedit.exe'
      ProcessCommandLine:
      - '*delete*'
      - '*deletevalue*'
      - '*import*'
    condition: selection
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  False positives depend on scripts and administrative tools used in the monitored environment
  Using installutil to add features for .NET applications (primarly would occur in developer environments)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\msdt.exe* OR *\\installutil.exe* OR *\\regsvcs.exe*
          OR *\\regasm.exe* OR *\\msbuild.exe* OR *\\ieexec.exe*))
  index: logstash-beats-*
  name: Possible Applocker Bypass
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/subTee/ApplicationWhitelistBypassTechniques/blob/master/TheList.txt
  https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible Applocker Bypass
  id: 82a19e3a-2bfe-4a91-8c0d-5d4c98fbb719
  description: Detects execution of executables that can be used to bypass Applocker
    whitelisting
  status: experimental
  references:
  - https://github.com/subTee/ApplicationWhitelistBypassTechniques/blob/master/TheList.txt
  - https://room362.com/post/2014/2014-01-16-application-whitelist-bypass-using-ieexec-dot-exe/
  author: juju4
  date: 2019/01/16
  tags:
  - attack.defense_evasion
  - attack.t1118
  - attack.t1121
  - attack.t1127
  - attack.t1170
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains:
      - \msdt.exe
      - \installutil.exe
      - \regsvcs.exe
      - \regasm.exe
      - \msbuild.exe
      - \ieexec.exe
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  - Using installutil to add features for .NET applications (primarly would occur in
    developer environments)
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files, rule detects when adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses


customized_type: Issue
value:
  _False Positives_
  WMIC.exe FP depend on scripts and administrative methods used in the monitored environment
  msxsl.exe is not installed by default so unlikely.


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: XSL Script Processing
  id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d
  status: experimental
  description: Extensible Stylesheet Language (XSL) files are commonly used to describe
    the processing and rendering of data within XML files, rule detects when adversaries
    abuse this functionality to execute arbitrary files while potentially bypassing
    application whitelisting defenses
  author: Timur Zinniatullin, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
    - Image|endswith: \wmic.exe
      CommandLine|contains: /format
    - Image|endswith: \msxsl.exe
    condition: selection
  falsepositives:
  - WMIC.exe FP depend on scripts and administrative methods used in the monitored environment
  - msxsl.exe is not installed by default so unlikely.
  level: medium
  tags:
  - attack.execution
  - attack.t1220

  </code></pre>
  }}


customized_type: Issue
value:
  Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks


customized_type: Issue
value:
  _False Positives_
  Execution of tools named GUP.exe and located in folders different than Notepad++\updater


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\GUP.exe AND (NOT (image_path:(C\:\\Users\\\\*\\AppData\\Local\\Notepad\+\+\\\updater\\gup.exe
          OR C\:\\Users\\\\*\\AppData\\Roaming\\Notepad\+\+\\\updater\\gup.exe OR C\:\\Program\
          Files\\Notepad\+\+\\\updater\\gup.exe OR C\:\\Program\ Files\ \(x86\)\\Notepad\+\+\\\updater\\gup.exe))))
  index: logstash-beats-*
  name: Suspicious GUP Usage
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious GUP Usage
  id: 0a4f6091-223b-41f6-8743-f322ec84930b
  description: Detects execution of the Notepad++ updater in a suspicious directory,
    which is often used in DLL side-loading attacks
  status: experimental
  references:
  - https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
  tags:
  - attack.defense_evasion
  - attack.t1073
  author: Florian Roth
  date: 2019/02/06
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\GUP.exe'
    filter:
      Image:
      - C:\Users\\*\AppData\Local\Notepad++\updater\gup.exe
      - C:\Users\\*\AppData\Roaming\Notepad++\updater\gup.exe
      - C:\Program Files\Notepad++\updater\gup.exe
      - C:\Program Files (x86)\Notepad++\updater\gup.exe
    condition: selection and not filter
  falsepositives:
  - Execution of tools named GUP.exe and located in folders different than Notepad++\updater
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:(*\\powershell.exe) AND event_data.CommandLine:(*schtasks*\/Create*\/SC\
          *ONLOGON*\/TN\ *Updater*\/TR\ *powershell* OR *schtasks*\/Create*\/SC\ *DAILY*\/TN\
          *Updater*\/TR\ *powershell* OR *schtasks*\/Create*\/SC\ *ONIDLE*\/TN\ *Updater*\/TR\
          *powershell* OR *schtasks*\/Create*\/SC\ *Updater*\/TN\ *Updater*\/TR\ *powershell*))
  index: logstash-beats-*
  name: Default PowerSploit and Empire Schtasks Persistence
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
  https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/persistence/userland/schtasks.py
  https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/persistence/elevated/schtasks.py


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Default PowerSploit and Empire Schtasks Persistence
  id: 56c217c3-2de2-479b-990f-5c109ba8458f
  status: experimental
  description: Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
  references:
  - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
  - https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/persistence/userland/schtasks.py
  - https://github.com/EmpireProject/Empire/blob/master/lib/modules/powershell/persistence/elevated/schtasks.py
  author: Markus Neis, @Karneades
  date: 2018/03/06
  logsource:
    product: windows
    category: process_creation
  detection:
    selection:
      ParentImage:
      - '*\powershell.exe'
      CommandLine:
      - '*schtasks*/Create*/SC *ONLOGON*/TN *Updater*/TR *powershell*'
      - '*schtasks*/Create*/SC *DAILY*/TN *Updater*/TR *powershell*'
      - '*schtasks*/Create*/SC *ONIDLE*/TN *Updater*/TR *powershell*'
      - '*schtasks*/Create*/SC *Updater*/TN *Updater*/TR *powershell*'
    condition: selection
  tags:
  - attack.execution
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1053
  - attack.t1086
  - attack.s0111
  - attack.g0022
  - attack.g0060
  - car.2013-08-001
  falsepositives:
  - False positives are possible, depends on organisation and processes
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*copy\ *\\c$* OR *copy\ *\\ADMIN$*))
  index: logstash-beats-*
  name: Copy from Admin Share
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Copy from Admin Share
  id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900
  status: experimental
  description: Detects a suspicious copy command from a remote C$ or ADMIN$ share
  references:
  - https://twitter.com/SBousseaden/status/1211636381086339073
  author: Florian Roth
  date: 2019/12/30
  tags:
  - attack.lateral_movement
  - attack.t1077
  - attack.t1105
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains:
      - copy *\c$
      - copy *\ADMIN$
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Administrative scripts
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Diskpart.exe usage to manage partitions on the local hard drive

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (image_path:(*\\tasksche.exe OR *\\mssecsvc.exe OR *\\taskdl.exe OR *\\@WanaDecryptor@*
          OR *\\WanaDecryptor* OR *\\taskhsvc.exe OR *\\taskse.exe OR *\\111.exe OR
          *\\lhdfrgui.exe OR *\\diskpart.exe OR *\\linuxnew.exe OR *\\wannacry.exe)
          OR event_data.CommandLine:(*icacls\ *\ \/grant\ Everyone\:F\ \/T\ \/C\ \/Q*
          OR *bcdedit\ \/set\ \{default\}\ recoveryenabled\ no* OR *wbadmin\ delete\
          catalog\ \-quiet* OR *@Please_Read_Me@.txt*)))
  index: logstash-beats-*
  name: WannaCry Ransomware
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WannaCry Ransomware
  id: 41d40bff-377a-43e2-8e1b-2e543069e079
  status: experimental
  description: Detects WannaCry ransomware activity
  references:
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
  author: Florian Roth (rule), Tom U. @c_APT_ure (collection)
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image:
      - '*\tasksche.exe'
      - '*\mssecsvc.exe'
      - '*\taskdl.exe'
      - '*\@WanaDecryptor@*'
      - '*\WanaDecryptor*'
      - '*\taskhsvc.exe'
      - '*\taskse.exe'
      - '*\111.exe'
      - '*\lhdfrgui.exe'
      - '*\diskpart.exe'
      - '*\linuxnew.exe'
      - '*\wannacry.exe'
    selection2:
      CommandLine:
      - '*icacls * /grant Everyone:F /T /C /Q*'
      - '*bcdedit /set {default} recoveryenabled no*'
      - '*wbadmin delete catalog -quiet*'
      - '*@Please_Read_Me@.txt*'
    condition: 1 of them
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Diskpart.exe usage to manage partitions on the local hard drive
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  This method detects a suspicious powershell command line combination as used by APT29 in a campaign against US think tanks


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\-noni\ \-ep\ bypass\ $*)
  index: logstash-beats-*
  name: APT29
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: APT29
  id: 033fe7d6-66d1-4240-ac6b-28908009c71f
  description: This method detects a suspicious powershell command line combination
    as used by APT29 in a campaign against US think tanks
  references:
  - https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
  tags:
  - attack.execution
  - attack.g0016
  - attack.t1086
  author: Florian Roth
  date: 2018/12/04
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*-noni -ep bypass $*'
    condition: selection
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\regsvr32*\\AppData\\Local\\\\* OR *\\AppData\\Local\\\\*,DllEntry*))
  index: logstash-beats-*
  name: BlueMashroom DLL Load
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.virusbulletin.com/conference/vb2019/abstracts/apt-cases-exploiting-vulnerabilities-region-specific-software


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: BlueMashroom DLL Load
  id: bd70d3f8-e60e-4d25-89f0-0b5a9cff20e0
  status: experimental
  description: Detects a suspicious DLL loading from AppData Local path as described
    in BlueMashroom report
  references:
  - https://www.virusbulletin.com/conference/vb2019/abstracts/apt-cases-exploiting-vulnerabilities-region-specific-software
  tags:
  - attack.defense_evasion
  - attack.t1117
  author: Florian Roth
  date: 2019/10/02
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*\regsvr32*\AppData\Local\\*'
      - '*\AppData\Local\\*,DllEntry*'
    condition: selection
  falsepositives:
  - Unlikely
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Network Sniffing
  id: ba1f7802-adc7-48b4-9ecb-81e227fddfd5
  status: experimental
  description: Network sniffing refers to using the network interface on a system to
    monitor or capture information sent over a wired or wireless connection. An adversary
    may place a network interface into promiscuous mode to passively access data in
    transit over the network, or use span ports to capture a larger amount of data.
  author: Timur Zinniatullin, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1040/T1040.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
    - Image|endswith: \tshark.exe
      CommandLine|contains: -i
    - Image|endswith: \windump.exe
    condition: selection
  falsepositives:
  - Admin activity
  fields:
  - Image
  - CommandLine
  - User
  - LogonGuid
  - Hashes
  - ParentProcessGuid
  - ParentCommandLine
  level: low
  tags:
  - attack.credential_access
  - attack.discovery
  - attack.t1040

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:(*Temp\\wtask.exe\ \/create* OR *%windir\:\~\-3,1%%PUBLIC\:\~\-9,1%*
          OR *\/E\:vbscript\ *\ C\:\\Users\\*.txt\"\ \/F OR *\/tn\ \"Security\ Script\
          * OR *%windir\:\~\-1,1%*) OR image_path:(*Temp\\winwsh.exe)))
  index: logstash-beats-*
  name: Mustang Panda Dropper
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://app.any.run/tasks/7ca5661d-a67b-43ec-98c1-dd7a8103c256/
  https://app.any.run/tasks/b12cccf3-1c22-4e28-9d3e-c7a6062f3914/
  https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Mustang Panda Dropper
  id: 2d87d610-d760-45ee-a7e6-7a6f2a65de00
  status: experimental
  description: Detects specific process parameters as used by Mustang Panda droppers
  author: Florian Roth
  date: 2019/10/30
  references:
  - https://app.any.run/tasks/7ca5661d-a67b-43ec-98c1-dd7a8103c256/
  - https://app.any.run/tasks/b12cccf3-1c22-4e28-9d3e-c7a6062f3914/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine:
      - '*Temp\wtask.exe /create*'
      - '*%windir:~-3,1%%PUBLIC:~-9,1%*'
      - '*/E:vbscript * C:\Users\*.txt" /F'
      - '*/tn "Security Script *'
      - '*%windir:~-1,1%*'
    selection2:
      Image:
      - '*Temp\winwsh.exe'
    condition: 1 of them
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unlikely
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*noconsentprompt* AND event_data.CommandLine:*shadow\:*)
  index: logstash-beats-*
  name: MSTSC Shadowing
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/kmkz_security/status/1220694202301976576
  https://github.com/kmkz/Pentesting/blob/master/Post-Exploitation-Cheat-Sheet


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MSTSC Shadowing
  id: 6ba5a05f-b095-4f0a-8654-b825f4f16334
  status: Detects RDP session hijacking by using MSTSC shadowing
  description:
  author: Florian Roth
  date: 2020/01/24
  references:
  - https://twitter.com/kmkz_security/status/1220694202301976576
  - https://github.com/kmkz/Pentesting/blob/master/Post-Exploitation-Cheat-Sheet
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains|all:
      - noconsentprompt
      - 'shadow:'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\\SYSVOL\\\\*\\policies\\\\*)
  index: logstash-beats-*
  name: Suspicious SYSVOL Domain Group Policy Access
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://adsecurity.org/?p=2288
  https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious SYSVOL Domain Group Policy Access
  id: 05f3c945-dcc8-4393-9f3d-af65077a8f86
  status: experimental
  description: Detects Access to Domain Group Policies stored in SYSVOL
  references:
  - https://adsecurity.org/?p=2288
  - https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100
  author: Markus Neis
  date: 2018/04/09
  modified: 2018/12/11
  tags:
  - attack.credential_access
  - attack.t1003
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine: '*\SYSVOL\\*\policies\\*'
    condition: selection
  falsepositives:
  - administrative activity
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Unknown as it may vary from organisation to arganisation how admins use to install IIS modules


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\\APPCMD.EXE\ install\ module\ \/name\:*))
  index: logstash-beats-*
  name: IIS Native-Code Module Command Line Installation
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: IIS Native-Code Module Command Line Installation
  id: 9465ddf4-f9e4-4ebd-8d98-702df3a93239
  description: Detects suspicious IIS native-code module installations via command line
  status: experimental
  references:
  - https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
  author: Florian Roth
  date: 2012/12/11
  tags:
  - attack.persistence
  - attack.t1100
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*\APPCMD.EXE install module /name:*'
    condition: selection
  falsepositives:
  - Unknown as it may vary from organisation to arganisation how admins use to install
    IIS modules
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((image_path:*\\rundll32.exe AND event_data.CommandLine:*,dll_u) OR event_data.CommandLine:*\
          \-export\ dll_u\ *))
  index: logstash-beats-*
  name: Equation Group DLL_U Load
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/adamcaudill/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
  https://securelist.com/apt-slingshot/84312/
  https://twitter.com/cyb3rops/status/972186477512839170


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Equation Group DLL_U Load
  id: d465d1d8-27a2-4cca-9621-a800f37cf72e
  author: Florian Roth
  date: 2019/03/04
  description: Detects a specific tool and export used by EquationGroup
  references:
  - https://github.com/adamcaudill/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
  - https://securelist.com/apt-slingshot/84312/
  - https://twitter.com/cyb3rops/status/972186477512839170
  tags:
  - attack.execution
  - attack.g0020
  - attack.t1059
  - attack.defense_evasion
  - attack.t1085
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image: '*\rundll32.exe'
      CommandLine: '*,dll_u'
    selection2:
      CommandLine: '* -export dll_u *'
    condition: 1 of them
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (image_path:*\\svchost.exe AND (NOT (event_data.ParentImage:(*\\services.exe
          OR *\\MsMpEng.exe OR *\\Mrt.exe OR *\\rpcnet.exe OR *\\svchost.exe)))) AND
          (NOT (event_data.ParentImage:None)))
  index: logstash-beats-*
  name: Suspicious Svchost Process
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Svchost Process
  id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d
  status: experimental
  description: Detects a suspicious svchost process start
  tags:
  - attack.defense_evasion
  - attack.t1036
  author: Florian Roth
  date: 2017/08/15
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\svchost.exe'
    filter:
      ParentImage:
      - '*\services.exe'
      - '*\MsMpEng.exe'
      - '*\Mrt.exe'
      - '*\rpcnet.exe'
      - '*\svchost.exe'
    filter_null:
      ParentImage:
    condition: selection and not filter and not filter_null
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.User:NT\ AUTHORITY\\SYSTEM AND image_path:*\\tscon.exe)
  index: logstash-beats-*
  name: Suspicious TSCON Start
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious TSCON Start
  id: 9847f263-4a81-424f-970c-875dab15b79b
  status: experimental
  description: Detects a tscon.exe start as LOCAL SYSTEM
  references:
  - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
  author: Florian Roth
  date: 2018/03/17
  tags:
  - attack.command_and_control
  - attack.t1219
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      User: NT AUTHORITY\SYSTEM
      Image: '*\tscon.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ msiexec*\:\/\/*))
  index: logstash-beats-*
  name: MsiExec Web Install
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MsiExec Web Install
  id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f
  status: experimental
  description: Detects suspicious msiexec process starts with web addreses as parameter
  references:
  - https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/
  tags:
  - attack.defense_evasion
  author: Florian Roth
  date: 2018/02/09
  modified: 2012/12/11
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* msiexec*://*'
    condition: selection
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((image_path:(*\\wmic.exe) AND event_data.CommandLine:(wmic\ *\ *format\:\\\"http*
          OR wmic\ *\ \/format\:'http OR wmic\ *\ \/format\:http*)) OR (event_data.Imphash:(1B1A3F43BF37B5BFE60751F2EE2F326E
          OR 37777A96245A3C74EB217308F3546F4C OR 9D87C9D67CE724033C0B40CC4CA1B206) AND
          event_data.CommandLine:(*\ *format\:\\\"http* OR *\ \/format\:'http OR *\
          \/format\:http*))))
  index: logstash-beats-*
  name: SquiblyTwo
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
  https://twitter.com/mattifestation/status/986280382042595328


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: SquiblyTwo
  id: 8d63dadf-b91b-4187-87b6-34a1114577ea
  status: experimental
  description: Detects WMI SquiblyTwo Attack with possible renamed WMI by looking for
    imphash
  references:
  - https://subt0x11.blogspot.ch/2018/04/wmicexe-whitelisting-bypass-hacking.html
  - https://twitter.com/mattifestation/status/986280382042595328
  tags:
  - attack.defense_evasion
  - attack.t1047
  author: Markus Neis / Florian Roth
  date: 2019/01/16
  falsepositives:
  - Unknown
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image:
      - '*\wmic.exe'
      CommandLine:
      - wmic * *format:\"http*
      - wmic * /format:'http
      - wmic * /format:http*
    selection2:
      Imphash:
      - 1B1A3F43BF37B5BFE60751F2EE2F326E
      - 37777A96245A3C74EB217308F3546F4C
      - 9D87C9D67CE724033C0B40CC4CA1B206
      CommandLine:
      - '* *format:\"http*'
      - "* /format:'http"
      - '* /format:http*'
    condition: 1 of them

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.User:NT\ AUTHORITY\\SYSTEM AND image_path:*\\taskmgr.exe)
  index: logstash-beats-*
  name: Taskmgr as LOCAL_SYSTEM
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Taskmgr as LOCAL_SYSTEM
  id: 9fff585c-c33e-4a86-b3cd-39312079a65f
  status: experimental
  description: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
  tags:
  - attack.defense_evasion
  - attack.t1036
  author: Florian Roth
  date: 2018/03/18
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      User: NT AUTHORITY\SYSTEM
      Image: '*\taskmgr.exe'
    condition: selection
  falsepositives:
  - Unkown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Administrative activity

  _Interesting Log Fields_
  Image
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\taskmgr.exe AND (NOT (image_path:(*\\resmon.exe
          OR *\\mmc.exe OR *\\taskmgr.exe))))
  index: logstash-beats-*
  name: Taskmgr as Parent
  priority: 4
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Taskmgr as Parent
  id: 3d7679bd-0c00-440c-97b0-3f204273e6c7
  status: experimental
  description: Detects the creation of a process from Windows task manager
  tags:
  - attack.defense_evasion
  - attack.t1036
  author: Florian Roth
  date: 2018/03/13
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\taskmgr.exe'
    filter:
      Image:
      - '*\resmon.exe'
      - '*\mmc.exe'
      - '*\taskmgr.exe'
    condition: selection and not filter
  fields:
  - Image
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Administrative activity
  level: low

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Administrative scripts
  Microsoft SCCM

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_data.ParentImage:(*\\mshta.exe OR *\\powershell.exe OR *\\rundll32.exe
          OR *\\cscript.exe OR *\\wscript.exe OR *\\wmiprvse.exe) AND image_path:(*\\schtasks.exe
          OR *\\nslookup.exe OR *\\certutil.exe OR *\\bitsadmin.exe OR *\\mshta.exe))
          AND (NOT (event_data.CurrentDirectory:*\\ccmcache\\\\*)))
  index: logstash-beats-*
  name: Windows Shell Spawning Suspicious Program
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows Shell Spawning Suspicious Program
  id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde
  status: experimental
  description: Detects a suspicious child process of a Windows shell
  references:
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
  author: Florian Roth
  date: 2018/04/06
  modified: 2019/02/05
  tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1064
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\mshta.exe'
      - '*\powershell.exe'
      - '*\rundll32.exe'
      - '*\cscript.exe'
      - '*\wscript.exe'
      - '*\wmiprvse.exe'
      Image:
      - '*\schtasks.exe'
      - '*\nslookup.exe'
      - '*\certutil.exe'
      - '*\bitsadmin.exe'
      - '*\mshta.exe'
    falsepositives:
      CurrentDirectory: '*\ccmcache\\*'
    condition: selection and not falsepositives
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Administrative scripts
  - Microsoft SCCM
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Devtoolslauncher.yml
  https://twitter.com/_felamos/status/1179811992841797632


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Devtoolslauncher.exe Executes Specified Binary
  id: cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6
  status: experimental
  description: The Devtoolslauncher.exe executes other binary
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Devtoolslauncher.yml
  - https://twitter.com/_felamos/status/1179811992841797632
  author: Beyu Denis, oscd.community (rule), @_felamos (idea)
  date: 2019/10/12
  modified: 2019/11/04
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  level: critical
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \devtoolslauncher.exe
      CommandLine|contains: LaunchForDeploy
    condition: selection
  falsepositives:
  - Legitimate use of devtoolslauncher.exe by legitimate user

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:(*\\wmiprvse.exe) AND image_path:(*\\powershell.exe))
  index: logstash-beats-*
  name: WMI Spawning Windows PowerShell
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_shell_spawn_susp_program.yml
  https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Spawning Windows PowerShell
  id: 692f0bec-83ba-4d04-af7e-e884a96059b6
  status: experimental
  description: Detects WMI spawning PowerShell
  references:
  - https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_shell_spawn_susp_program.yml
  - https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e
  author: Markus Neis / @Karneades
  date: 2019/04/03
  tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1064
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\wmiprvse.exe'
      Image:
      - '*\powershell.exe'
    condition: selection
  falsepositives:
  - AppvClient
  - CCM
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(netsh\ interface\ portproxy\ add\ v4tov4\ *))
  index: logstash-beats-*
  name: Netsh Port Forwarding
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Netsh Port Forwarding
  id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614
  description: Detects netsh commands that configure a port forwarding
  references:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  date: 2019/01/29
  tags:
  - attack.lateral_movement
  - attack.command_and_control
  - attack.t1090
  status: experimental
  author: Florian Roth
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - netsh interface portproxy add v4tov4 *
    condition: selection
  falsepositives:
  - Legitimate administration
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\msiexec.exe AND (NOT (image_path:(C\:\\Windows\\System32\\\\*
          OR C\:\\Windows\\SysWOW64\\\\* OR C\:\\Windows\\WinSxS\\\\*))))
  index: logstash-beats-*
  name: Suspicious MsiExec Directory
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious MsiExec Directory
  id: e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
  status: experimental
  description: Detects suspicious msiexec process starts in an uncommon directory
  references:
  - https://twitter.com/200_okay_/status/1194765831911215104
  tags:
  - attack.defense_evasion
  - attack.t1036
  author: Florian Roth
  date: 2019/11/14
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\msiexec.exe'
    filter:
      Image:
      - C:\Windows\System32\\*
      - C:\Windows\SysWOW64\\*
      - C:\Windows\WinSxS\\*
    condition: selection and not filter
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\powershell.exe AND event_data.CommandLine:*\ hidden\ * AND event_data.CommandLine:(*AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA*
          OR *aXRzYWRtaW4gL3RyYW5zZmVy* OR *IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA*
          OR *JpdHNhZG1pbiAvdHJhbnNmZX* OR *YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg*
          OR *Yml0c2FkbWluIC90cmFuc2Zlc* OR *AGMAaAB1AG4AawBfAHMAaQB6AGUA* OR *JABjAGgAdQBuAGsAXwBzAGkAegBlA*
          OR *JGNodW5rX3Npem* OR *QAYwBoAHUAbgBrAF8AcwBpAHoAZQ* OR *RjaHVua19zaXpl*
          OR *Y2h1bmtfc2l6Z* OR *AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A* OR *kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg*
          OR *lPLkNvbXByZXNzaW9u* OR *SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA* OR *SU8uQ29tcHJlc3Npb2*
          OR *Ty5Db21wcmVzc2lvb* OR *AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ* OR *kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA*
          OR *lPLk1lbW9yeVN0cmVhb* OR *SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A* OR
          *SU8uTWVtb3J5U3RyZWFt* OR *Ty5NZW1vcnlTdHJlYW* OR *4ARwBlAHQAQwBoAHUAbgBrA*
          OR *5HZXRDaHVua* OR *AEcAZQB0AEMAaAB1AG4Aaw* OR *LgBHAGUAdABDAGgAdQBuAGsA*
          OR *LkdldENodW5r* OR *R2V0Q2h1bm* OR *AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A* OR
          *QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA* OR *RIUkVBRF9JTkZPNj* OR *SFJFQURfSU5GTzY0*
          OR *VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA* OR *VEhSRUFEX0lORk82N* OR *AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA*
          OR *cmVhdGVSZW1vdGVUaHJlYW* OR *MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA*
          OR *NyZWF0ZVJlbW90ZVRocmVhZ* OR *Q3JlYXRlUmVtb3RlVGhyZWFk* OR *QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA*
          OR *0AZQBtAG0AbwB2AGUA* OR *1lbW1vdm* OR *AGUAbQBtAG8AdgBlA* OR *bQBlAG0AbQBvAHYAZQ*
          OR *bWVtbW92Z* OR *ZW1tb3Zl*))
  index: logstash-beats-*
  name: Malicious Base64 Encoded PowerShell Keywords in Command Lines
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malicious Base64 Encoded PowerShell Keywords in Command Lines
  id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0
  status: experimental
  description: Detects base64 encoded strings used in hidden malicious PowerShell command
    lines
  references:
  - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/
  tags:
  - attack.execution
  - attack.t1086
  author: John Lambert (rule)
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    encoded:
      Image: '*\powershell.exe'
      CommandLine: '* hidden *'
    selection:
      CommandLine:
      - '*AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA*'
      - '*aXRzYWRtaW4gL3RyYW5zZmVy*'
      - '*IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA*'
      - '*JpdHNhZG1pbiAvdHJhbnNmZX*'
      - '*YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg*'
      - '*Yml0c2FkbWluIC90cmFuc2Zlc*'
      - '*AGMAaAB1AG4AawBfAHMAaQB6AGUA*'
      - '*JABjAGgAdQBuAGsAXwBzAGkAegBlA*'
      - '*JGNodW5rX3Npem*'
      - '*QAYwBoAHUAbgBrAF8AcwBpAHoAZQ*'
      - '*RjaHVua19zaXpl*'
      - '*Y2h1bmtfc2l6Z*'
      - '*AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A*'
      - '*kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg*'
      - '*lPLkNvbXByZXNzaW9u*'
      - '*SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA*'
      - '*SU8uQ29tcHJlc3Npb2*'
      - '*Ty5Db21wcmVzc2lvb*'
      - '*AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ*'
      - '*kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA*'
      - '*lPLk1lbW9yeVN0cmVhb*'
      - '*SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A*'
      - '*SU8uTWVtb3J5U3RyZWFt*'
      - '*Ty5NZW1vcnlTdHJlYW*'
      - '*4ARwBlAHQAQwBoAHUAbgBrA*'
      - '*5HZXRDaHVua*'
      - '*AEcAZQB0AEMAaAB1AG4Aaw*'
      - '*LgBHAGUAdABDAGgAdQBuAGsA*'
      - '*LkdldENodW5r*'
      - '*R2V0Q2h1bm*'
      - '*AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A*'
      - '*QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA*'
      - '*RIUkVBRF9JTkZPNj*'
      - '*SFJFQURfSU5GTzY0*'
      - '*VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA*'
      - '*VEhSRUFEX0lORk82N*'
      - '*AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA*'
      - '*cmVhdGVSZW1vdGVUaHJlYW*'
      - '*MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA*'
      - '*NyZWF0ZVJlbW90ZVRocmVhZ*'
      - '*Q3JlYXRlUmVtb3RlVGhyZWFk*'
      - '*QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA*'
      - '*0AZQBtAG0AbwB2AGUA*'
      - '*1lbW1vdm*'
      - '*AGUAbQBtAG8AdgBlA*'
      - '*bQBlAG0AbQBvAHYAZQ*'
      - '*bWVtbW92Z*'
      - '*ZW1tb3Zl*'
    condition: encoded and selection
  falsepositives:
  - Penetration tests
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Printer software / driver installations
  HP software

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\mshta.exe AND image_path:(*\\cmd.exe OR *\\powershell.exe
          OR *\\wscript.exe OR *\\cscript.exe OR *\\sh.exe OR *\\bash.exe OR *\\reg.exe
          OR *\\regsvr32.exe OR *\\BITSADMIN*))
  index: logstash-beats-*
  name: MSHTA Spawning Windows Shell
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MSHTA Spawning Windows Shell
  id: 03cc0c25-389f-4bf8-b48d-11878079f1ca
  status: experimental
  description: Detects a Windows command line executable started from MSHTA.
  references:
  - https://www.trustedsec.com/july-2015/malicious-htas/
  author: Michael Haag
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\mshta.exe'
      Image:
      - '*\cmd.exe'
      - '*\powershell.exe'
      - '*\wscript.exe'
      - '*\cscript.exe'
      - '*\sh.exe'
      - '*\bash.exe'
      - '*\reg.exe'
      - '*\regsvr32.exe'
      - '*\BITSADMIN*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1170
  - car.2013-02-003
  - car.2013-03-001
  - car.2014-04-003
  falsepositives:
  - Printer software / driver installations
  - HP software
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*\:\:FromBase64String\(*)
  index: logstash-beats-*
  name: FromBase64String Command Line
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: FromBase64String Command Line
  id: e32d4572-9826-4738-b651-95fa63747e8a
  status: experimental
  description: Detects suspicious FromBase64String expressions in command line arguments
  references:
  - https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
  author: Florian Roth
  date: 2020/01/29
  tags:
  - attack.t1027
  - attack.defense_evasion
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|contains: ::FromBase64String(
    condition: selection
  falsepositives:
  - Administrative script libraries
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\WINWORD.EXE AND image_path:*\\MicroScMgmt.exe\ )
  index: logstash-beats-*
  name: Exploit for CVE-2015-1641
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.virustotal.com/en/file/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8/analysis/
  https://www.hybrid-analysis.com/sample/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Exploit for CVE-2015-1641
  id: 7993792c-5ce2-4475-a3db-a3a5539827ef
  status: experimental
  description: Detects Winword starting uncommon sub process MicroScMgmt.exe as used
    in exploits for CVE-2015-1641
  references:
  - https://www.virustotal.com/en/file/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8/analysis/
  - https://www.hybrid-analysis.com/sample/5567408950b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8?environmentId=100
  author: Florian Roth
  date: 2018/02/22
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\WINWORD.EXE'
      Image: '*\MicroScMgmt.exe '
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd decribed in CVE-2019-1378


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentCommandLine:(*\\cmd.exe\ \/c\ C\:\\Windows\\Setup\\Scripts\\SetupComplete.cmd
          OR *\\cmd.exe\ \/c\ C\:\\Windows\\Setup\\Scripts\\PartnerSetupComplete.cmd)
          AND (NOT (image_path:(C\:\\Windows\\System32\\\\* OR C\:\\Windows\\SysWOW64\\\\*
          OR C\:\\Windows\\WinSxS\\\\* OR C\:\\Windows\\Setup\\\\*))))
  index: logstash-beats-*
  name: Exploiting SetupComplete.cmd CVE-2019-1378
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Exploiting SetupComplete.cmd CVE-2019-1378
  id: 1c373b6d-76ce-4553-997d-8c1da9a6b5f5
  status: experimental
  description: Detects exploitation attempt of privilege escalation vulnerability via
    SetupComplete.cmd and PartnerSetupComplete.cmd decribed in CVE-2019-1378
  references:
  - https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
  author: Florian Roth
  date: 2019/11/15
  tags:
  - attack.defense_evasion
  - attack.privilege_escalation
  - attack.t1055
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentCommandLine:
      - '*\cmd.exe /c C:\Windows\Setup\Scripts\SetupComplete.cmd'
      - '*\cmd.exe /c C:\Windows\Setup\Scripts\PartnerSetupComplete.cmd'
    filter:
      Image:
      - C:\Windows\System32\\*
      - C:\Windows\SysWOW64\\*
      - C:\Windows\WinSxS\\*
      - C:\Windows\Setup\\*
    condition: selection and not filter
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:C\:\\WINDOWS\\system32\\wbem\\scrcons.exe AND event_data.ParentImage:C\:\\Windows\\System32\\svchost.exe)
  index: logstash-beats-*
  name: WMI Persistence - Script Event Consumer
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: WMI Persistence - Script Event Consumer
  id: ec1d5e28-8f3b-4188-a6f8-6e8df81dc28e
  status: experimental
  description: Detects WMI script event consumers
  references:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
  author: Thomas Patzke
  date: 2018/03/07
  tags:
  - attack.execution
  - attack.persistence
  - attack.t1047
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: C:\WINDOWS\system32\wbem\scrcons.exe
      ParentImage: C:\Windows\System32\svchost.exe
    condition: selection
  falsepositives:
  - Legitimate event consumers
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          ((image_path:C\:\\Windows\\SysWOW64\\cmd.exe AND event_data.CommandLine:*\\Windows\\Caches\\NavShExt.dll\
          *) OR event_data.CommandLine:*\\AppData\\Roaming\\MICROS\~1\\Windows\\Caches\\NavShExt.dll,Setting))
  index: logstash-beats-*
  name: Elise Backdoor
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Elise Backdoor
  id: e507feb7-5f73-4ef6-a970-91bb6f6d744f
  status: experimental
  description: Detects Elise backdoor acitivty as used by APT32
  references:
  - https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
  tags:
  - attack.g0030
  - attack.g0050
  - attack.s0081
  author: Florian Roth
  date: 2018/01/31
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Image: C:\Windows\SysWOW64\cmd.exe
      CommandLine: '*\Windows\Caches\NavShExt.dll *'
    selection2:
      CommandLine: '*\AppData\Roaming\MICROS~1\Windows\Caches\NavShExt.dll,Setting'
    condition: 1 of them
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code with the built-in certutil utility


customized_type: Issue
value:
  _False Positives_
  False positives depend on scripts and administrative tools used in the monitored environment

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \-decode\ * OR *\ \/decode\ * OR *\ \-decodehex\
          * OR *\ \/decodehex\ * OR *\ \-urlcache\ * OR *\ \/urlcache\ * OR *\ \-verifyctl\
          * OR *\ \/verifyctl\ * OR *\ \-encode\ * OR *\ \/encode\ * OR *certutil*\
          \-URL* OR *certutil*\ \/URL* OR *certutil*\ \-ping* OR *certutil*\ \/ping*))
  index: logstash-beats-*
  name: Suspicious Certutil Command
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/JohnLaTwC/status/835149808817991680
  https://twitter.com/subTee/status/888102593838362624
  https://twitter.com/subTee/status/888071631528235010
  https://blogs.technet.microsoft.com/pki/2006/11/30/basic-crl-checking-with-certutil/
  https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/
  https://twitter.com/egre55/status/1087685529016193025
  https://lolbas-project.github.io/lolbas/Binaries/Certutil/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Certutil Command
  id: e011a729-98a6-4139-b5c4-bf6f6dd8239a
  status: experimental
  description: Detects a suspicious Microsoft certutil execution with sub commands like
    'decode' sub command, which is sometimes used to decode malicious code with the
    built-in certutil utility
  author: Florian Roth, juju4, keepwatch
  modified: 2019/01/22
  date: 2019/01/16
  references:
  - https://twitter.com/JohnLaTwC/status/835149808817991680
  - https://twitter.com/subTee/status/888102593838362624
  - https://twitter.com/subTee/status/888071631528235010
  - https://blogs.technet.microsoft.com/pki/2006/11/30/basic-crl-checking-with-certutil/
  - https://www.trustedsec.com/2017/07/new-tool-release-nps_payload/
  - https://twitter.com/egre55/status/1087685529016193025
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '* -decode *'
      - '* /decode *'
      - '* -decodehex *'
      - '* /decodehex *'
      - '* -urlcache *'
      - '* /urlcache *'
      - '* -verifyctl *'
      - '* /verifyctl *'
      - '* -encode *'
      - '* /encode *'
      - '*certutil* -URL*'
      - '*certutil* /URL*'
      - '*certutil* -ping*'
      - '*certutil* /ping*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.defense_evasion
  - attack.t1140
  - attack.t1105
  - attack.s0189
  - attack.g0007
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Will need to be tuned
  If using Splunk, I recommend | stats count by Computer,CommandLine following for easy hunting by Computer/CommandLine.

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\wmic.exe) AND event_data.CommandLine:(*\/NODE\:*process\ call\
          create\ * OR *\ path\ AntiVirusProduct\ get\ * OR *\ path\ FirewallProduct\
          get\ * OR *\ shadowcopy\ delete\ *))
  index: logstash-beats-*
  name: Suspicious WMI Execution
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://digital-forensics.sans.org/blog/2010/06/04/wmic-draft/
  https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1
  https://blog.malwarebytes.com/threat-analysis/2016/04/rokku-ransomware/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious WMI Execution
  id: 526be59f-a573-4eea-b5f7-f0973207634d
  status: experimental
  description: Detects WMI executing suspicious commands
  references:
  - https://digital-forensics.sans.org/blog/2010/06/04/wmic-draft/
  - https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1
  - https://blog.malwarebytes.com/threat-analysis/2016/04/rokku-ransomware/
  author: Michael Haag, Florian Roth, juju4
  date: 2019/01/16
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\wmic.exe'
      CommandLine:
      - '*/NODE:*process call create *'
      - '* path AntiVirusProduct get *'
      - '* path FirewallProduct get *'
      - '* shadowcopy delete *'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.execution
  - attack.t1047
  - car.2016-03-002
  falsepositives:
  - Will need to be tuned
  - If using Splunk, I recommend | stats count by Computer,CommandLine following for
    easy hunting by Computer/CommandLine.
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\svchost.exe AND image_path:*\\mshta.exe)
  index: logstash-beats-*
  name: MSHTA Spwaned by SVCHOST
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MSHTA Spwaned by SVCHOST
  id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471
  status: experimental
  description: Detects MSHTA.EXE spwaned by SVCHOST as seen in LethalHTA and described
    in report
  references:
  - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1170
  author: Markus Neis
  date: 2018/06/07
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\svchost.exe'
      Image: '*\mshta.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Powerpnt.yml
  https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
  Reegun J (OCBC Bank)


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Malicious Payload Download via Office Binaries
  id: 0c79148b-118e-472b-bdb7-9b57b444cc19
  status: experimental
  description: Downloads payload from remote server
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Powerpnt.yml
  - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
  - Reegun J (OCBC Bank)
  author: Beyu Denis, oscd.community
  date: 2019/10/26
  modified: 2019/11/04
  tags:
  - attack.command_and_control
  - attack.t1105
  level: high
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith:
      - \powerpnt.exe
      - \winword.exe
      - \excel.exe
      CommandLine|contains: http
    condition: selection
  falsepositives:
  - Unknown

  </code></pre>
  }}


customized_type: Issue
value:
  Detects commands that delete all local volume shadow copies as used by different Ransomware families


customized_type: Issue
value:
  _False Positives_
  Adminsitrative scripts - e.g. to prepare image for golden image creation

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*vssadmin\ delete\ shadows* OR *wmic\ SHADOWCOPY\
          DELETE*))
  index: logstash-beats-*
  name: Ransomware Deletes Volume Shadow Copies
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
  https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Ransomware Deletes Volume Shadow Copies
  id: 4eebe114-4b24-4a9d-9a6c-c7bd7c8eaa61
  status: experimental
  description: Detects commands that delete all local volume shadow copies as used by
    different Ransomware families
  references:
  - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
  author: Florian Roth
  date: 2019/06/01
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - '*vssadmin delete shadows*'
      - '*wmic SHADOWCOPY DELETE*'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Adminsitrative scripts - e.g. to prepare image for golden image creation
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          OriginalFileName:(cmd.exe OR 7z.exe OR winrar.exe) AND (NOT (image_path:(*\\cmd.exe
          OR *\\7z.exe OR *\\winrar.exe))))
  index: logstash-beats-*
  name: Renamed Binary
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed Binary
  id: 36480ae1-a1cb-4eaa-a0d6-29801d7e9142
  status: experimental
  description: Detects the execution of a renamed binary often used by attackers or
    malware leveraging new Sysmon OriginalFileName datapoint.
  author: Matthew Green - @mgreen27
  date: 2019/06/15
  references:
  - https://attack.mitre.org/techniques/T1036/
  - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
  - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
  tags:
  - attack.t1036
  - attack.defense_evasion
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      OriginalFileName:
      - cmd.exe
      - 7z.exe
      - winrar.exe
    filter:
      Image:
      - '*\cmd.exe'
      - '*\7z.exe'
      - '*\winrar.exe'
    condition: selection and not filter
  falsepositives:
  - Custom applications use renamed binaries adding slight change to binary name. Typically
    this is easy to spot and add to whitelist
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects suspicious powershell process which includes bxor command, alternatvide obfuscation method to b64 encoded commands.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*\ \-bxor*))
  index: logstash-beats-*
  name: Suspicious XOR Encoded PowerShell Command Line
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious XOR Encoded PowerShell Command Line
  id: bb780e0c-16cf-4383-8383-1e5471db6cf9
  description: Detects suspicious powershell process which includes bxor command, alternatvide
    obfuscation method to b64 encoded commands.
  status: experimental
  author: Sami Ruohonen
  date: 2018/09/05
  tags:
  - attack.execution
  - attack.t1086
  detection:
    selection:
      CommandLine:
      - '* -bxor*'
    condition: selection
  falsepositives:
  - unknown
  level: medium
  logsource:
    category: process_creation
    product: windows

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Microsoft Operations Manager (MOM)
  Other scripts

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_data.ParentImage:(*\\wscript.exe OR *\\cscript.exe) AND image_path:(*\\powershell.exe))
          AND (NOT (event_data.CurrentDirectory:*\\Health\ Service\ State\\\\*)))
  index: logstash-beats-*
  name: Suspicious PowerShell Invocation Based on Parent Process
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.carbonblack.com/2017/03/15/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious PowerShell Invocation Based on Parent Process
  id: 95eadcb2-92e4-4ed1-9031-92547773a6db
  status: experimental
  description: Detects suspicious powershell invocations from interpreters or unusual
    programs
  author: Florian Roth
  date: 2019/01/16
  references:
  - https://www.carbonblack.com/2017/03/15/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/
  tags:
  - attack.execution
  - attack.t1086
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\wscript.exe'
      - '*\cscript.exe'
      Image:
      - '*\powershell.exe'
    falsepositive:
      CurrentDirectory: '*\Health Service State\\*'
    condition: selection and not falsepositive
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Microsoft Operations Manager (MOM)
  - Other scripts
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*SUVYIChb* OR *lFWCAoW* OR *JRVggKF* OR *aWV4IChb*
          OR *lleCAoW* OR *pZXggKF* OR *aWV4IChOZX* OR *lleCAoTmV3* OR *pZXggKE5ld*
          OR *SUVYIChOZX* OR *lFWCAoTmV3* OR *JRVggKE5ld*))
  index: logstash-beats-*
  name: Encoded IEX
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Encoded IEX
  id: 88f680b8-070e-402c-ae11-d2914f2257f1
  status: experimental
  description: Detects a base64 encoded IEX command string in a process command line
  author: Florian Roth
  date: 2019/08/23
  tags:
  - attack.t1086
  - attack.t1140
  - attack.execution
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine|base64offset|contains:
      - IEX ([
      - iex ([
      - iex (New
      - IEX (New
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND event_data.Product:(*PAExec*)
          AND event_data.Imphash:(11D40A7B7876288F919AB819CC2D9802 OR 6444f8a34e99b8f7d9647de66aabe516
          OR dfd6aa3f7b2b1035b76b718f1ddc689f OR 1a6cca4d5460b1710a12dea39e4a592c))
          AND (NOT (image_path:*paexec*)))
  index: logstash-beats-*
  name: Execution of Renamed PaExec
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  sha256=01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc
  https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Execution of Renamed PaExec
  id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b
  status: experimental
  description: Detects execution of renamed paexec via imphash and executable product
    string
  references:
  - sha256=01a461ad68d11b5b5096f45eb54df9ba62c5af413fa9eb544eacb598373a26bc
  - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf
  tags:
  - attack.defense_evasion
  - attack.t1036
  - FIN7
  - car.2013-05-009
  date: 2019/04/17
  author: Jason Lynch
  falsepositives:
  - Unknown imphashes
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      Product:
      - '*PAExec*'
    selection2:
      Imphash:
      - 11D40A7B7876288F919AB819CC2D9802
      - 6444f8a34e99b8f7d9647de66aabe516
      - dfd6aa3f7b2b1035b76b718f1ddc689f
      - 1a6cca4d5460b1710a12dea39e4a592c
    filter1:
      Image: '*paexec*'
    condition: (selection1 and selection2) and not filter1

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:schtasks.exe AND event_data.CommandLine:*\/change*\/TN*\/RU*\/RP*)
  index: logstash-beats-*
  name: Windows 10 Scheduled Task SandboxEscaper 0-day
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Windows 10 Scheduled Task SandboxEscaper 0-day
  id: 931b6802-d6a6-4267-9ffa-526f57f22aaf
  status: experimental
  description: Detects Task Scheduler .job import arbitrary DACL write\par
  references:
  - https://github.com/SandboxEscaper/polarbearrepo/tree/master/bearlpe
  author: Olaf Hartong
  date: 2019/05/22
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: schtasks.exe
      CommandLine: '*/change*/TN*/RU*/RP*'
    condition: selection
  falsepositives:
  - Unknown
  tags:
  - attack.privilege_escalation
  - attack.execution
  - attack.t1053
  - car.2013-08-001
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/LOLUtilz/OSBinaries/Openwith.yml
  https://twitter.com/harr0ey/status/991670870384021504


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: OpenWith.exe Executes Specified Binary
  id: cec8e918-30f7-4e2d-9bfa-a59cc97ae60f
  status: experimental
  description: The OpenWith.exe executes other binary
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/LOLUtilz/OSBinaries/Openwith.yml
  - https://twitter.com/harr0ey/status/991670870384021504
  author: Beyu Denis, oscd.community (rule), @harr0ey (idea)
  date: 2019/10/12
  modified: 2019/11/04
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  level: high
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \OpenWith.exe
      CommandLine|contains: /c
    condition: selection
  falsepositives:
  - Legitimate use of OpenWith.exe by legitimate user

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\mmc.exe AND image_path:(*\\cmd.exe OR *\\powershell.exe
          OR *\\wscript.exe OR *\\cscript.exe OR *\\sh.exe OR *\\bash.exe OR *\\reg.exe
          OR *\\regsvr32.exe OR *\\BITSADMIN*))
  index: logstash-beats-*
  name: MMC Spawning Windows Shell
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: MMC Spawning Windows Shell
  id: 05a2ab7e-ce11-4b63-86db-ab32e763e11d
  status: experimental
  description: Detects a Windows command line executable started from MMC.
  author: Karneades, Swisscom CSIRT
  date: 2019/08/05
  tags:
  - attack.lateral_movement
  - attack.t1175
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\mmc.exe'
      Image:
      - '*\cmd.exe'
      - '*\powershell.exe'
      - '*\wscript.exe'
      - '*\cscript.exe'
      - '*\sh.exe'
      - '*\bash.exe'
      - '*\reg.exe'
      - '*\regsvr32.exe'
      - '*\BITSADMIN*'
    condition: selection
  fields:
  - CommandLine
  - Image
  - ParentCommandLine
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\svchost.exe OR *\\rundll32.exe OR *\\services.exe OR *\\powershell.exe
          OR *\\regsvr32.exe OR *\\spoolsv.exe OR *\\lsass.exe OR *\\smss.exe OR *\\csrss.exe
          OR *\\conhost.exe OR *\\wininit.exe OR *\\lsm.exe OR *\\winlogon.exe OR *\\explorer.exe
          OR *\\taskhost.exe) AND (NOT (image_path:(C\:\\Windows\\System32\\\\* OR C\:\\Windows\\SysWow64\\\\*
          OR C\:\\Windows\\explorer.exe OR C\:\\Windows\\winsxs\\\\* OR \\SystemRoot\\System32\\\\*))))
  index: logstash-beats-*
  name: System File Execution Location Anomaly
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: System File Execution Location Anomaly
  id: e4a6b256-3e47-40fc-89d2-7a477edd6915
  status: experimental
  description: Detects a Windows program executable started in a suspicious folder
  references:
  - https://twitter.com/GelosSnake/status/934900723426439170
  author: Florian Roth, Patrick Bareiss
  date: 2017/11/27
  tags:
  - attack.defense_evasion
  - attack.t1036
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\svchost.exe'
      - '*\rundll32.exe'
      - '*\services.exe'
      - '*\powershell.exe'
      - '*\regsvr32.exe'
      - '*\spoolsv.exe'
      - '*\lsass.exe'
      - '*\smss.exe'
      - '*\csrss.exe'
      - '*\conhost.exe'
      - '*\wininit.exe'
      - '*\lsm.exe'
      - '*\winlogon.exe'
      - '*\explorer.exe'
      - '*\taskhost.exe'
    filter:
      Image:
      - C:\Windows\System32\\*
      - C:\Windows\SysWow64\\*
      - C:\Windows\explorer.exe
      - C:\Windows\winsxs\\*
      - \SystemRoot\System32\\*
    condition: selection and not filter
  falsepositives:
  - Exotic software
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.


customized_type: Issue
value:
  _False Positives_
  Administrative scripts (installers)

  _Interesting Log Fields_
  ParentImage
  CommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:*curl*\ start\ *)
  index: logstash-beats-*
  name: Curl Start Combination
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Curl Start Combination
  id: 21dd6d38-2b18-4453-9404-a0fe4a0cc288
  status: experimental
  description: Adversaries can use curl to download payloads remotely and execute them.
    Curl is included by default in Windows 10 build 17063 and later.
  references:
  - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983
  author: Sreeman
  date: 2020/01/13
  tags:
  - attack.execution
  - attack.t1218
  logsource:
    category: process_creation
    product: windows
  detection:
    condition: selection
    selection:
      CommandLine|contains: 'curl* start '
  falsepositives:
  - Administrative scripts (installers)
  fields:
  - ParentImage
  - CommandLine
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects invocation of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.


customized_type: Issue
value:
  _False Positives_
  Legitimate MWC use (unlikely in modern enterprise environments)

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:*\\Microsoft.Workflow.Compiler.exe)
  index: logstash-beats-*
  name: Microsoft Workflow Compiler
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Microsoft Workflow Compiler
  id: 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
  status: experimental
  description: Detects invocation of Microsoft Workflow Compiler, which may permit the
    execution of arbitrary unsigned code.
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1127
  author: Nik Seetharaman
  date: 2019/01/16
  references:
  - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image: '*\Microsoft.Workflow.Compiler.exe'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Legitimate MWC use (unlikely in modern enterprise environments)
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a Windows command line executable started from Microsoft Word, Excel, Powerpoint, Publisher and Visio.


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:(*\\WINWORD.EXE OR *\\EXCEL.EXE OR *\\POWERPNT.exe
          OR *\\MSPUB.exe OR *\\VISIO.exe OR *\\OUTLOOK.EXE) AND image_path:(*\\cmd.exe
          OR *\\powershell.exe OR *\\wscript.exe OR *\\cscript.exe OR *\\sh.exe OR *\\bash.exe
          OR *\\scrcons.exe OR *\\schtasks.exe OR *\\regsvr32.exe OR *\\hh.exe OR *\\wmic.exe
          OR *\\mshta.exe OR *\\rundll32.exe OR *\\msiexec.exe OR *\\forfiles.exe OR
          *\\scriptrunner.exe OR *\\mftrace.exe OR *\\AppVLP.exe OR *\\svchost.exe))
  index: logstash-beats-*
  name: Microsoft Office Product Spawning Windows Shell
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
  https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Microsoft Office Product Spawning Windows Shell
  id: 438025f9-5856-4663-83f7-52f878a70a50
  status: experimental
  description: Detects a Windows command line executable started from Microsoft Word,
    Excel, Powerpoint, Publisher and Visio.
  references:
  - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
  tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1059
  - attack.t1202
  - car.2013-02-003
  - car.2014-04-003
  author: Michael Haag, Florian Roth, Markus Neis
  date: 2018/04/06
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage:
      - '*\WINWORD.EXE'
      - '*\EXCEL.EXE'
      - '*\POWERPNT.exe'
      - '*\MSPUB.exe'
      - '*\VISIO.exe'
      - '*\OUTLOOK.EXE'
      Image:
      - '*\cmd.exe'
      - '*\powershell.exe'
      - '*\wscript.exe'
      - '*\cscript.exe'
      - '*\sh.exe'
      - '*\bash.exe'
      - '*\scrcons.exe'
      - '*\schtasks.exe'
      - '*\regsvr32.exe'
      - '*\hh.exe'
      - '*\wmic.exe'
      - '*\mshta.exe'
      - '*\rundll32.exe'
      - '*\msiexec.exe'
      - '*\forfiles.exe'
      - '*\scriptrunner.exe'
      - '*\mftrace.exe'
      - '*\AppVLP.exe'
      - '*\svchost.exe'
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Inventory tool runs
  Penetration tests
  Administrative activity

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(net\ group\ \"domain\ admins\"\ \/domain OR net\ localgroup\
          administrators))
  index: logstash-beats-*
  name: Suspicious Reconnaissance Activity
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Reconnaissance Activity
  id: d95de845-b83c-4a9a-8a6a-4fc802ebf6c0
  status: experimental
  description: Detects suspicious command line activity on Windows systems
  author: Florian Roth
  date: 2019/01/16
  tags:
  - attack.discovery
  - attack.t1087
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - net group "domain admins" /domain
      - net localgroup administrators
    condition: selection
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Inventory tool runs
  - Penetration tests
  - Administrative activity
  analysis:
    recommendation: Check if the user that executed the commands is suspicious (e.g.
      service accounts, LOCAL_SYSTEM)
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(netsh\ i*\ p*\=3389\ c*))
  index: logstash-beats-*
  name: Netsh RDP Port Forwarding
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Netsh RDP Port Forwarding
  id: 782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
  description: Detects netsh commands that configure a port forwarding of port 3389
    used for RDP
  references:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  date: 2019/01/29
  tags:
  - attack.lateral_movement
  - attack.t1021
  - car.2013-07-002
  status: experimental
  author: Florian Roth
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - netsh i* p*=3389 c*
    condition: selection
  falsepositives:
  - Legitimate administration
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Service Execution
  id: 2a072a96-a086-49fa-bcb5-15cc5a619093
  status: experimental
  description: Detects manual service execution (start) via system utilities
  author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
  date: 2019/10/21
  modified: 2019/11/04
  references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1035/T1035.yaml
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith:
      - \net.exe
      - \net1.exe
      CommandLine|contains: ' start '
    condition: selection
  falsepositives:
  - Legitimate administrator or user executes a service for legitimate reason
  level: low
  tags:
  - attack.execution
  - attack.t1035

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (image_path:*\\rundll32.exe
          OR OriginalFileName:RUNDLL32.EXE) AND event_data.CommandLine:(*comsvcs*MiniDump*full*
          OR *comsvcs*MiniDumpW*full*))
  index: logstash-beats-*
  name: Process Dump via Comsvcs DLL
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
  https://twitter.com/SBousseaden/status/1167417096374050817


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Process Dump via Comsvcs DLL
  id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c
  status: experimental
  description: Detects process memory dump via comsvcs.dll and rundll32
  references:
  - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
  - https://twitter.com/SBousseaden/status/1167417096374050817
  author: Modexp (idea)
  date: 2019/09/02
  logsource:
    category: process_creation
    product: windows
  detection:
    rundll_image:
      Image: '*\rundll32.exe'
    rundll_ofn:
      OriginalFileName: RUNDLL32.EXE
    selection:
      CommandLine:
      - '*comsvcs*MiniDump*full*'
      - '*comsvcs*MiniDumpW*full*'
    condition: (rundll_image or rundll_ofn) and selection
  fields:
  - CommandLine
  - ParentCommandLine
  tags:
  - attack.credential_access
  - attack.t1003
  falsepositives:
  - unknown
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(rundll32.exe\ %APPDATA%\\\\*.dat\",* OR rundll32.exe\
          %APPDATA%\\\\*.dll\",#1))
  index: logstash-beats-*
  name: Sofacy Trojan Loader Activity
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
  https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100
  https://twitter.com/ClearskySec/status/960924755355369472


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Sofacy Trojan Loader Activity
  id: ba778144-5e3d-40cf-8af9-e28fb1df1e20
  author: Florian Roth
  status: experimental
  date: 2018/03/01
  description: Detects Trojan loader acitivty as used by APT28
  references:
  - https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
  - https://www.reverse.it/sample/e3399d4802f9e6d6d539e3ae57e7ea9a54610a7c4155a6541df8e94d67af086e?environmentId=100
  - https://twitter.com/ClearskySec/status/960924755355369472
  tags:
  - attack.g0007
  - attack.execution
  - attack.t1059
  - attack.defense_evasion
  - attack.t1085
  - car.2013-10-002
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - rundll32.exe %APPDATA%\\*.dat",*
      - rundll32.exe %APPDATA%\\*.dll",#1
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a method that uses Wsreset.exe tool that can be used to reset the Windows Store to bypass UAC


customized_type: Issue
value:
  https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  https://www.activecyber.us/activelabs/windows-uac-bypass
  https://twitter.com/ReaQta/status/1222548288731217921


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Wsreset UAC Bypass
  id: bdc8918e-a1d5-49d1-9db7-ea0fd91aa2ae
  status: experimental
  description: Detects a method that uses Wsreset.exe tool that can be used to reset
    the Windows Store to bypass UAC
  references:
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  - https://www.activecyber.us/activelabs/windows-uac-bypass
  - https://twitter.com/ReaQta/status/1222548288731217921
  author: Florian Roth
  date: 2020/01/30
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1088
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage|endswith:
      - \WSreset.exe
    condition: selection
  fields:
  - CommandLine
  falsepositives:
  - Unknown sub processes of Wsreset.exe
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.ParentImage:*\\WINWORD.EXE AND image_path:*\\csc.exe)
  index: logstash-beats-*
  name: Exploit for CVE-2017-8759
  priority: 1
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.hybrid-analysis.com/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Exploit for CVE-2017-8759
  id: fdd84c68-a1f6-47c9-9477-920584f94905
  description: Detects Winword starting uncommon sub process csc.exe as used in exploits
    for CVE-2017-8759
  references:
  - https://www.hybrid-analysis.com/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  - https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  tags:
  - attack.execution
  - attack.t1203
  author: Florian Roth
  date: 2017/09/15
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      ParentImage: '*\WINWORD.EXE'
      Image: '*\csc.exe'
    condition: selection
  falsepositives:
  - Unknown
  level: critical

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (image_path:*\\setspn.exe
          OR event_data.Description:*Query\ or\ reset\ the\ computer*\ SPN\ attribute*)
          AND event_data.CommandLine:*\-q*)
  index: logstash-beats-*
  name: Possible SPN Enumeration
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Possible SPN Enumeration
  id: 1eeed653-dbc8-4187-ad0c-eeebb20e6599
  description: Detects Service Principal Name Enumeration used for Kerberoasting
  status: experimental
  references:
  - https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation
  author: Markus Neis, keepwatch
  date: 2018/11/14
  tags:
  - attack.credential_access
  - attack.t1208
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_image:
      Image: '*\setspn.exe'
    selection_desc:
      Description: '*Query or reset the computer* SPN attribute*'
    cmd:
      CommandLine: '*-q*'
    condition: (selection_image or selection_desc) and cmd
  falsepositives:
  - Administrator Activity
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(*System.Management.Automation.AmsiUtils*) AND event_data.CommandLine:(*amsiInitFailed*))
  index: logstash-beats-*
  name: Powershell AMSI Bypass via .NET Reflection
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/mattifestation/status/735261176745988096
  https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Powershell AMSI Bypass via .NET Reflection
  id: 30edb182-aa75-42c0-b0a9-e998bb29067c
  status: experimental
  description: Detects Request to amsiInitFailed that can be used to disable AMSI Scanning
  references:
  - https://twitter.com/mattifestation/status/735261176745988096
  - https://www.hybrid-analysis.com/sample/0ced17419e01663a0cd836c9c2eb925e3031ffb5b18ccf35f4dea5d586d0203e?environmentId=120
  tags:
  - attack.execution
  - attack.defense_evasion
  - attack.t1086
  author: Markus Neis
  date: 2018/08/17
  logsource:
    category: process_creation
    product: windows
  detection:
    selection1:
      CommandLine:
      - '*System.Management.Automation.AmsiUtils*'
    selection2:
      CommandLine:
      - '*amsiInitFailed*'
    condition: selection1 and selection2
    falsepositives:
    - Potential Admin Activity
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:*EnableUnsafeClientMailRules* OR (event_data.ParentImage:*\\outlook.exe
          AND event_data.CommandLine:\\\\\\\\*\\\\*.exe)))
  index: logstash-beats-*
  name: Suspicious Execution from Outlook
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/sensepost/ruler
  https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Execution from Outlook
  id: e212d415-0e93-435f-9e1a-f29005bb4723
  status: experimental
  description: Detects EnableUnsafeClientMailRules used for Script Execution from Outlook
  references:
  - https://github.com/sensepost/ruler
  - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
  tags:
  - attack.execution
  - attack.t1059
  - attack.t1202
  author: Markus Neis
  date: 2018/12/27
  logsource:
    category: process_creation
    product: windows
  detection:
    clientMailRules:
      CommandLine: '*EnableUnsafeClientMailRules*'
    outlookExec:
      ParentImage: '*\outlook.exe'
      CommandLine: \\\\*\\*.exe
    condition: clientMailRules or outlookExec
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Csi.yml
  https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Application Whitelisting Bypass via Dnx.exe
  id: 81ebd28b-9607-4478-bf06-974ed9d53ed7
  status: experimental
  description: Execute C# code located in the consoleapp folder
  references:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OtherMSBinaries/Csi.yml
  - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
  author: Beyu Denis, oscd.community
  date: 2019/10/26
  modified: 2019/11/04
  tags:
  - attack.defense_evasion
  - attack.execution
  - attack.t1218
  level: medium
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image|endswith: \dnx.exe
    condition: selection
  falsepositives:
  - Legitimate use of dnx.exe by legitimate user

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(reg\ query\ \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal\
          Server\ Client\\Default\" OR powershell.exe\ mshta.exe\ http* OR cmd.exe\
          \/c\ taskkill\ \/im\ cmd.exe))
  index: logstash-beats-*
  name: Baby Shark Activity
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Baby Shark Activity
  id: 2b30fa36-3a18-402f-a22d-bf4ce2189f35
  status: experimental
  description: Detects activity that could be related to Baby Shark malware
  references:
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  tags:
  - attack.execution
  - attack.t1059
  - attack.t1086
  - attack.discovery
  - attack.t1012
  - attack.defense_evasion
  - attack.t1170
  logsource:
    category: process_creation
    product: windows
  author: Florian Roth
  date: 2019/02/24
  detection:
    selection:
      CommandLine:
      - reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"
      - powershell.exe mshta.exe http*
      - cmd.exe /c taskkill /im cmd.exe
    condition: selection
  falsepositives:
  - unknown
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  Detects a renamed dctask64.exe used for process injection, command execution, process creation with a signed binary by ZOHO Corporation


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Renamed ZOHO Dctask64
  id: 340a090b-c4e9-412e-bb36-b4b16fe96f9b
  status: experimental
  description: Detects a renamed dctask64.exe used for process injection, command execution,
    process creation with a signed binary by ZOHO Corporation
  references:
  - https://twitter.com/gN3mes1s/status/1222088214581825540
  - https://twitter.com/gN3mes1s/status/1222095963789111296
  - https://twitter.com/gN3mes1s/status/1222095371175911424
  author: Florian Roth
  date: 2020/01/28
  tags:
  - attack.defense_evasion
  - attack.t1055
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Imphash: 6834B1B94E49701D77CCB3C0895E1AFD
    filter:
      Image|endswith: \dctask64.exe
    condition: selection and not filter
  fields:
  - CommandLine
  - ParentCommandLine
  - ParentImage
  falsepositives:
  - Unknown yet
  level: high

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(tasklist OR net\ time OR systeminfo OR whoami OR nbtstat
          OR net\ start OR *\\net1\ start OR qprocess OR nslookup OR hostname.exe OR
          *\\net1\ user\ \/domain OR *\\net1\ group\ \/domain OR *\\net1\ group\ \"domain\
          admins\"\ \/domain OR *\\net1\ group\ \"Exchange\ Trusted\ Subsystem\"\ \/domain
          OR *\\net1\ accounts\ \/domain OR *\\net1\ user\ net\ localgroup\ administrators
          OR netstat\ \-an))
  index: logstash-beats-*
  max_threshold: 4
  metric_agg_key: _id
  metric_agg_type: cardinality
  name: Reconnaissance Activity with Net Command
  priority: 3
  query_key: event_data.CommandLine
  realert:
    minutes: 0
  type: metric_aggregation
  </code></pre>
  }}


customized_type: Issue
value:
  https://twitter.com/haroonmeer/status/939099379834658817
  https://twitter.com/c_APT_ure/status/939475433711722497
  https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Reconnaissance Activity with Net Command
  id: 2887e914-ce96-435f-8105-593937e90757
  status: experimental
  description: Detects a set of commands often used in recon stages by different attack
    groups
  references:
  - https://twitter.com/haroonmeer/status/939099379834658817
  - https://twitter.com/c_APT_ure/status/939475433711722497
  - https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html
  author: Florian Roth, Markus Neis
  date: 2018/08/22
  modified: 2018/12/11
  tags:
  - attack.discovery
  - attack.t1087
  - attack.t1082
  - car.2016-03-001
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - tasklist
      - net time
      - systeminfo
      - whoami
      - nbtstat
      - net start
      - '*\net1 start'
      - qprocess
      - nslookup
      - hostname.exe
      - '*\net1 user /domain'
      - '*\net1 group /domain'
      - '*\net1 group "domain admins" /domain'
      - '*\net1 group "Exchange Trusted Subsystem" /domain'
      - '*\net1 accounts /domain'
      - '*\net1 user net localgroup administrators'
      - netstat -an
    timeframe: 15s
    condition: selection | count() by CommandLine > 4
  falsepositives:
  - False positives depend on scripts and administrative tools used in the monitored
    environment
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  Detects clearing or configuration of eventlogs uwing wevtutil. Might be used by ransomwares during the attack (seen by NotPetya and others)


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND (image_path:*\\wevtutil.exe
          OR OriginalFileName:wevtutil.exe) AND (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational)
          AND (event_data.CommandLine:*\ cl\ * OR event_data.CommandLine:*\ clear\-log\
          * OR event_data.CommandLine:*\ sl\ * OR event_data.CommandLine:*\ set\-log\
          *))
  index: logstash-beats-*
  name: Suspicious Eventlog Clear or Configuration Using Wevtutil
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Suspicious Eventlog Clear or Configuration Using Wevtutil
  id: cc36992a-4671-4f21-a91d-6c2b72a2edf5
  description: Detects clearing or configuration of eventlogs uwing wevtutil. Might
    be used by ransomwares during the attack (seen by NotPetya and others)
  author: Ecco
  date: 2019/09/26
  tags:
  - attack.execution
  - attack.t1070
  - car.2016-04-002
  level: high
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_binary_1:
      Image: '*\wevtutil.exe'
    selection_binary_2:
      OriginalFileName: wevtutil.exe
    selection_clear_1:
      CommandLine: '* cl *'
    selection_clear_2:
      CommandLine: '* clear-log *'
    selection_disable_1:
      CommandLine: '* sl *'
    selection_disable_2:
      CommandLine: '* set-log *'
    condition: (1 of selection_binary_*) and (1 of selection_clear_* or 1 of selection_disable_*)
  falsepositives:
  - Admin activity
  - Scripts and administrative tools used in the monitored environment

  </code></pre>
  }}


customized_type: Issue
value:
  Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:ps.exe\ \-accepteula)
  index: logstash-beats-*
  name: Ps.exe Renamed SysInternals Tool
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Ps.exe Renamed SysInternals Tool
  id: 18da1007-3f26-470f-875d-f77faf1cab31
  description: Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report
  references:
      - https://www.us-cert.gov/ncas/alerts/TA17-293A
  tags:
      - attack.defense_evasion
      - attack.g0035
      - attack.t1036
      - car.2013-05-009
  author: Florian Roth
  date: 2017/10/22
  logsource:
      category: process_creation
      product: windows
  detection:
      selection:
          CommandLine: 'ps.exe -accepteula'
      condition: selection
  falsepositives:
      - Renamed SysInternals tool
  level: high
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: ((event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational) AND
          (event_data.CommandLine:*\ cl\ *\/Trace* OR event_data.CommandLine:*\ clear\-log\
          *\/Trace* OR event_data.CommandLine:*\ sl*\ \/e\:false* OR event_data.CommandLine:*\
          set\-log*\ \/e\:false*))
  index: logstash-beats-*
  name: Disable of ETW Trace
  priority: 2
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_mal_lockergoga.yml
  https://abuse.io/lockergoga.txt


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Disable of ETW Trace
  id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
  description: Detects a command that clears or disables any ETW trace log which could
    indicate a logging evasion.
  references:
  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_mal_lockergoga.yml
  - https://abuse.io/lockergoga.txt
  author: '@neu5ron, Florian Roth'
  date: 2019/03/22
  tags:
  - attack.execution
  - attack.t1070
  - car.2016-04-002
  level: high
  logsource:
    category: process_creation
    product: windows
  detection:
    selection_clear_1:
      CommandLine: '* cl */Trace*'
    selection_clear_2:
      CommandLine: '* clear-log */Trace*'
    selection_disable_1:
      CommandLine: '* sl* /e:false*'
    selection_disable_2:
      CommandLine: '* set-log* /e:false*'
    condition: selection_clear_1 or selection_clear_2 or selection_disable_1 or selection_disable_2

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Sysmon Driver Unload
  id: 4d7cda18-1b12-4e52-b45c-d28653210df8
  status: experimental
  author: Kirill Kiryanov, oscd.community
  description: Detect possible Sysmon driver unload
  date: 2019/10/23
  modified: 2019/11/07
  references:
  - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
  logsource:
    product: windows
    category: process_creation
  detection:
    selection:
      Image|endswith: \fltmc.exe
      CommandLine|contains|all:
      - unload
      - sys
    condition: selection
  falsepositives: Unknown
  level: high
  fields:
  - CommandLine
  - Details

  </code></pre>
  }}


customized_type: Issue
value:
  _False Positives_
  Various applications
  Tools that include ping or nslookup command invocations

  _Interesting Log Fields_
  CommandLine
  ParentCommandLine


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          image_path:(*\\wwwroot\\\\* OR *\\wmpub\\\\* OR *\\htdocs\\\\*) AND (NOT (image_path:(*bin\\\\*
          OR *\\Tools\\\\* OR *\\SMSComponent\\\\*) AND event_data.ParentImage:(*\\services.exe))))
  index: logstash-beats-*
  name: Execution in Webserver Root Folder
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Execution in Webserver Root Folder
  id: 35efb964-e6a5-47ad-bbcd-19661854018d
  status: experimental
  description: Detects a suspicious program execution in a web service root folder (filter
    out false positives)
  author: Florian Roth
  date: 2019/01/16
  tags:
  - attack.persistence
  - attack.t1100
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      Image:
      - '*\wwwroot\\*'
      - '*\wmpub\\*'
      - '*\htdocs\\*'
    filter:
      Image:
      - '*bin\\*'
      - '*\Tools\\*'
      - '*\SMSComponent\\*'
      ParentImage:
      - '*\services.exe'
    condition: selection and not filter
  fields:
  - CommandLine
  - ParentCommandLine
  falsepositives:
  - Various applications
  - Tools that include ping or nslookup command invocations
  level: medium

  </code></pre>
  }}


customized_type: Issue
value:
  {{collapse(View ElastAlert Config)
  <pre><code class="yaml">

  filter:
  - query:
      query_string:
        query: (event_id:1 AND log_name:Microsoft\-Windows\-Sysmon\/Operational AND
          event_data.CommandLine:(netsh\ firewall\ set\ opmode\ mode\=disable OR netsh\
          advfirewall\ set\ *\ state\ off))
  index: logstash-beats-*
  name: Firewall Disabled via Netsh
  priority: 3
  realert:
    minutes: 0
  type: any
  </code></pre>
  }}


customized_type: Issue
value:
  https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
  https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/


customized_type: Issue
value:
  {{collapse(View Sigma)
  <pre><code class="yaml">

  title: Firewall Disabled via Netsh
  id: 57c4bf16-227f-4394-8ec7-1b745ee061c3
  description: Detects netsh commands that turns off the Windows firewall
  references:
  - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
  - https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
  date: 2019/11/01
  status: experimental
  author: Fatih Sirin
  tags:
  - attack.defense_evasion
  logsource:
    category: process_creation
    product: windows
  detection:
    selection:
      CommandLine:
      - netsh firewall set opmode mode=disable
      - netsh advfirewall set * state off
    condition: selection
  falsepositives:
  - Legitimate administration
  level: medium

  </code></pre>
  }}


