{ "meta": { "version": "r2026-04-01", "source": "SigmaHQ/sigma (github.com/SigmaHQ/sigma)", "description": "Complete curated Sysmon Sigma rule database for DFIR reference. Covers all Sysmon event types with behavioral detection patterns. Not a mirror of the full SigmaHQ repo \u2014 rules are hand-curated for clarity and investigative value.", "total_rules": 380, "curated_count": 380, "license": "Detection Rule License 1.1 (DRL 1.1)", "convert_at": "https://sigconverter.io" }, "rules": [ { "id": "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "title": "Audit Policy Tampering Via NT Resource Kit Auditpol", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability.\nThis can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2021-12-18", "modified": "2023-02-21", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains:\n - /logon:none\n - /system:none\n - /sam:none\n - /privilege:none\n - /object:none\n - /process:none\n - /policy:none", "false_positives": [ "The old auditpol utility isn't available by default on recent versions of Windows as it was replaced by a newer version. The FP rate should be very low except for tools that use a similar flag structure" ], "references": [ "https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_auditpol_nt_resource_kit_usage.yml", "filename": "proc_creation_win_auditpol_nt_resource_kit_usage.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "0a13e132-651d-11eb-ae93-0242ac130002", "title": "Audit Policy Tampering Via Auditpol", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Threat actors can use auditpol binary to change audit policy configuration to impair detection capability.\nThis can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.", "author": "Janantha Marasinghe (https://github.com/blueteam0ps)", "date": "2021-02-02", "modified": "2023-02-22", "detection_yaml": "condition: all of selection_*\nselection_cli:\n CommandLine|contains:\n - disable\n - clear\n - remove\n - restore\nselection_img:\n- Image|endswith: \\auditpol.exe\n- OriginalFileName: AUDITPOL.EXE", "false_positives": [ "Administrator or administrator scripts might leverage the flags mentioned in the detection section. Either way, it should always be monitored" ], "references": [ "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_auditpol_susp_execution.yml", "filename": "proc_creation_win_auditpol_susp_execution.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "1444443e-6757-43e4-9ea4-c8fc705f79a2", "title": "Boot Configuration Tampering Via Bcdedit.EXE", "sysmon_eids": [ 1 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1490", "technique": "", "level": "high", "description": "Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.", "author": "E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community", "date": "2019-10-24", "modified": "2023-02-15", "detection_yaml": "condition: all of selection_*\nselection_cli:\n- CommandLine|contains|all:\n - bootstatuspolicy\n - ignoreallfailures\n- CommandLine|contains|all:\n - recoveryenabled\n - 'no'\nselection_img:\n- Image|endswith: \\bcdedit.exe\n- OriginalFileName: bcdedit.exe\nselection_set:\n CommandLine|contains: set", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md", "https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_bcdedit_boot_conf_tamper.yml", "filename": "proc_creation_win_bcdedit_boot_conf_tamper.yml", "curated": true, "technique_ids": [ "T1490" ], "tactic_tags": [ "impact" ] }, { "id": "2fdefcb3-dbda-401e-ae23-f0db027628bc", "title": "Sticky Key Like Backdoor Execution", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.008", "technique": "", "level": "critical", "description": "Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen", "author": "Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community", "date": "2018-03-15", "modified": "2023-03-07", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains:\n - sethc.exe\n - utilman.exe\n - osk.exe\n - Magnify.exe\n - Narrator.exe\n - DisplaySwitch.exe\n Image|endswith:\n - \\cmd.exe\n - \\cscript.exe\n - \\mshta.exe\n - \\powershell.exe\n - \\pwsh.exe\n - \\regsvr32.exe\n - \\rundll32.exe\n - \\wscript.exe\n - \\wt.exe\n ParentImage|endswith: \\winlogon.exe", "false_positives": [ "Unlikely" ], "references": [ "https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml", "filename": "proc_creation_win_cmd_sticky_key_like_backdoor_execution.yml", "curated": true, "technique_ids": [ "T1546.008" ], "tactic_tags": [ "persistence" ] }, { "id": "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "title": "Persistence Via Sticky Key Backdoor", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.008", "technique": "", "level": "critical", "description": "By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system.\nWhen the sticky keys are \"activated\" the privilleged shell is launched.", "author": "Sreeman", "date": "2020-02-18", "modified": "2023-03-07", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains|all:\n - 'copy '\n - '/y '\n - C:\\windows\\system32\\cmd.exe C:\\windows\\system32\\sethc.exe", "false_positives": [ "Unlikely" ], "references": [ "https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html", "https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf", "https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml", "filename": "proc_creation_win_cmd_sticky_keys_replace.yml", "curated": true, "technique_ids": [ "T1546.008" ], "tactic_tags": [ "persistence" ] }, { "id": "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "title": "HackTool - F-Secure C3 Load by Rundll32", "sysmon_eids": [ 1 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.011", "technique": "", "level": "critical", "description": "F-Secure C3 produces DLLs with a default exported StartNodeRelay function.", "author": "Alfie Champion (ajpc500)", "date": "2021-06-02", "modified": "2023-03-05", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains|all:\n - rundll32.exe\n - .dll\n - StartNodeRelay", "false_positives": [ "Unknown" ], "references": [ "https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_c3_rundll32_pattern.yml", "filename": "proc_creation_win_hktl_c3_rundll32_pattern.yml", "curated": true, "technique_ids": [ "T1218.011" ], "tactic_tags": [ "stealth" ] }, { "id": "d78b5d61-187d-44b6-bf02-93486a80de5a", "title": "HackTool - DInjector PowerShell Cradle Execution", "sysmon_eids": [ 1 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "critical", "description": "Detects the use of the Dinject PowerShell cradle based on the specific flags", "author": "Florian Roth (Nextron Systems)", "date": "2021-12-07", "modified": "2023-02-04", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains|all:\n - ' /am51'\n - ' /password'", "false_positives": [ "Unlikely" ], "references": [ "https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_dinjector.yml", "filename": "proc_creation_win_hktl_dinjector.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "2704ab9e-afe2-4854-a3b1-0c0706d03578", "title": "HackTool - Dumpert Process Dumper Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory", "author": "Florian Roth (Nextron Systems)", "date": "2020-02-04", "modified": "2025-01-22", "detection_yaml": "condition: selection\nselection:\n- Hashes|contains: MD5=09D278F9DE118EF09163C6140255C690\n- CommandLine|contains: Dumpert.dll", "false_positives": [ "Very unlikely" ], "references": [ "https://github.com/outflanknl/Dumpert", "https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml", "filename": "proc_creation_win_hktl_dumpert.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "3268b746-88d8-4cd3-bffc-30077d02c787", "title": "HackTool - Empire PowerShell UAC Bypass", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "critical", "description": "Detects some Empire PowerShell UAC bypass methods", "author": "Ecco", "date": "2019-08-30", "modified": "2023-02-21", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains:\n - ' -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update)'\n - ' -NoP -NonI -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update);'", "false_positives": [ "Unknown" ], "references": [ "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64", "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_uac_bypass.yml", "filename": "proc_creation_win_hktl_empire_powershell_uac_bypass.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "24e3e58a-646b-4b50-adef-02ef935b9fc8", "title": "Hacktool Execution - Imphash", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1588.002", "technique": "", "level": "critical", "description": "Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed", "author": "Florian Roth (Nextron Systems)", "date": "2022-03-04", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n Hashes|contains:\n - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932\n - IMPHASH=3A19059BD7688CB88E70005F18EFC439\n - IMPHASH=bf6223a49e45d99094406777eb6004ba\n - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1\n - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC\n - IMPHASH=F9A28C458284584A93B14216308D31BD\n - IMPHASH=6118619783FC175BC7EBECFF0769B46E\n - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA\n - IMPHASH=563233BFA169ACC7892451F71AD5850A\n - IMPHASH=87575CB7A0E0700EB37F2E3668671A08\n - IMPHASH=13F08707F759AF6003837A150A371BA1\n - IMPHASH=1781F06048A7E58B323F0B9259BE798B\n - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5\n - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D\n - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2\n - IMPHASH=713C29B396B907ED71A72482759ED757\n - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F\n - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E\n - IMPHASH=8B114550386E31895DFAB371E741123D\n - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793\n - IMPHASH=9D68781980370E00E0BD939EE5E6C141\n ...", "false_positives": [ "Legitimate use of one of these tools" ], "references": [ "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_execution_via_imphashes.yml", "filename": "proc_creation_win_hktl_execution_via_imphashes.yml", "curated": true, "technique_ids": [ "T1588.002", "T1003" ], "tactic_tags": [] }, { "id": "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "title": "HackTool - Inveigh Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-24", "modified": "2023-02-04", "detection_yaml": "condition: selection\nselection:\n- Image|endswith: \\Inveigh.exe\n- OriginalFileName:\n - \\Inveigh.exe\n - \\Inveigh.dll\n- Description: Inveigh\n- CommandLine|contains:\n - ' -SpooferIP'\n - ' -ReplyToIPs '\n - ' -ReplyToDomains '\n - ' -ReplyToMACs '\n - ' -SnifferIP'", "false_positives": [ "Very unlikely" ], "references": [ "https://github.com/Kevin-Robertson/Inveigh", "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_inveigh.yml", "filename": "proc_creation_win_hktl_inveigh.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "ff23ffbc-3378-435e-992f-0624dcf93ab4", "title": "HackTool - PurpleSharp Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1587", "technique": "", "level": "critical", "description": "Detects the execution of the PurpleSharp adversary simulation tool", "author": "Florian Roth (Nextron Systems)", "date": "2021-06-18", "modified": "2023-02-05", "detection_yaml": "condition: 1 of selection_*\nselection_cli:\n CommandLine|contains:\n - xyz123456.exe\n - PurpleSharp\nselection_img:\n- Image|contains: \\purplesharp\n- OriginalFileName: PurpleSharp.exe", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/mvelazc0/PurpleSharp" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_purplesharp_indicators.yml", "filename": "proc_creation_win_hktl_purplesharp_indicators.yml", "curated": true, "technique_ids": [ "T1587" ], "tactic_tags": [] }, { "id": "5589ab4f-a767-433c-961d-c91f3f704db1", "title": "Potential SMB Relay Attack Tool Execution", "sysmon_eids": [ 1 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1557.001", "technique": "", "level": "critical", "description": "Detects different hacktools used for relay attacks on Windows for privilege escalation", "author": "Florian Roth (Nextron Systems)", "date": "2021-07-24", "modified": "2023-02-14", "detection_yaml": "condition: 1 of selection_* and not 1 of filter_*\nfilter_hotpotatoes:\n Image|contains:\n - HotPotatoes6\n - HotPotatoes7\n - 'HotPotatoes '\nselection_juicypotato_enum:\n CommandLine|contains: .exe -c \"{\n CommandLine|endswith: '}\" -z'\nselection_pe:\n Image|contains:\n - PetitPotam\n - RottenPotato\n - HotPotato\n - JuicyPotato\n - \\just_dce_\n - Juicy Potato\n - \\temp\\rot.exe\n - \\Potato.exe\n - \\SpoolSample.exe\n - \\Responder.exe\n - \\smbrelayx\n - \\ntlmrelayx\n - \\LocalPotato\nselection_script:\n CommandLine|contains:\n - Invoke-Tater\n - ' smbrelay'\n - ' ntlmrelay'\n - 'cme smb '\n - ' /ntlm:NTLMhash '\n - Invoke-PetitPotam\n - '.exe -t * -p '", "false_positives": [ "Legitimate files with these rare hacktool names" ], "references": [ "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/", "https://pentestlab.blog/2017/04/13/hot-potato/", "https://github.com/ohpe/juicy-potato", "https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes", "https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml", "filename": "proc_creation_win_hktl_relay_attacks_tools.yml", "curated": true, "technique_ids": [ "T1557.001" ], "tactic_tags": [ "collection", "execution" ] }, { "id": "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "title": "HackTool - Rubeus Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1003", "technique": "", "level": "critical", "description": "Detects the execution of the hacktool Rubeus via PE information of command line parameters", "author": "Florian Roth (Nextron Systems)", "date": "2018-12-19", "modified": "2023-04-20", "detection_yaml": "condition: selection\nselection:\n- Image|endswith: \\Rubeus.exe\n- OriginalFileName: Rubeus.exe\n- Description: Rubeus\n- CommandLine|contains:\n - 'asreproast '\n - 'dump /service:krbtgt '\n - dump /luid:0x\n - 'kerberoast '\n - 'createnetonly /program:'\n - 'ptt /ticket:'\n - '/impersonateuser:'\n - 'renew /ticket:'\n - 'asktgt /user:'\n - 'harvest /interval:'\n - 's4u /user:'\n - 's4u /ticket:'\n - 'hash /password:'\n - 'golden /aes256:'\n - 'silver /user:'", "false_positives": [ "Unlikely" ], "references": [ "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus", "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://github.com/GhostPack/Rubeus" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml", "filename": "proc_creation_win_hktl_rubeus.yml", "curated": true, "technique_ids": [ "T1003", "T1558.003", "T1550.003" ], "tactic_tags": [] }, { "id": "b1876533-4ed5-4a83-90f3-b8645840a413", "title": "HackTool - SafetyKatz Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects the execution of the hacktool SafetyKatz via PE information and default Image name", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-20", "modified": "2023-02-04", "detection_yaml": "condition: selection\nselection:\n- Image|endswith: \\SafetyKatz.exe\n- OriginalFileName: SafetyKatz.exe\n- Description: SafetyKatz", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/GhostPack/SafetyKatz" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_safetykatz.yml", "filename": "proc_creation_win_hktl_safetykatz.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "7679d464-4f74-45e2-9e01-ac66c5eb041a", "title": "HackTool - SecurityXploded Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1555", "technique": "", "level": "critical", "description": "Detects the execution of SecurityXploded Tools", "author": "Florian Roth (Nextron Systems)", "date": "2018-12-19", "modified": "2023-02-04", "detection_yaml": "condition: selection\nselection:\n- Company: SecurityXploded\n- Image|endswith: PasswordDump.exe\n- OriginalFileName|endswith: PasswordDump.exe", "false_positives": [ "Unlikely" ], "references": [ "https://securityxploded.com/", "https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_secutyxploded.yml", "filename": "proc_creation_win_hktl_secutyxploded.yml", "curated": true, "technique_ids": [ "T1555" ], "tactic_tags": [] }, { "id": "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "title": "HackTool - SharpUp PrivEsc Tool Execution", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1615", "technique": "", "level": "critical", "description": "Detects the use of SharpUp, a tool for local privilege escalation", "author": "Florian Roth (Nextron Systems)", "date": "2022-08-20", "modified": "2023-02-13", "detection_yaml": "condition: selection\nselection:\n- Image|endswith: \\SharpUp.exe\n- Description: SharpUp\n- CommandLine|contains:\n - HijackablePaths\n - UnquotedServicePath\n - ProcessDLLHijack\n - ModifiableServiceBinaries\n - ModifiableScheduledTask\n - DomainGPPPassword\n - CachedGPPPassword", "false_positives": [ "Unknown" ], "references": [ "https://github.com/GhostPack/SharpUp" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpup.yml", "filename": "proc_creation_win_hktl_sharpup.yml", "curated": true, "technique_ids": [ "T1615", "T1569.002", "T1574.005" ], "tactic_tags": [ "persistence", "discovery", "execution", "stealth" ] }, { "id": "42333b2c-b425-441c-b70e-99404a17170f", "title": "HackTool - Sliver C2 Implant Activity Pattern", "sysmon_eids": [ 1 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059", "technique": "", "level": "critical", "description": "Detects process activity patterns as seen being used by Sliver C2 framework implants", "author": "Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)", "date": "2022-08-25", "modified": "2023-03-05", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains: -NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36", "https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sliver_c2_execution_pattern.yml", "filename": "proc_creation_win_hktl_sliver_c2_execution_pattern.yml", "curated": true, "technique_ids": [ "T1059" ], "tactic_tags": [ "execution" ] }, { "id": "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "title": "HackTool - SysmonEOP Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1068", "technique": "", "level": "critical", "description": "Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120", "author": "Florian Roth (Nextron Systems)", "date": "2022-12-04", "modified": "2024-11-23", "detection_yaml": "condition: 1 of selection_*\nselection_hash:\n Hashes|contains:\n - IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5\n - IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC\nselection_img:\n Image|endswith: \\SysmonEOP.exe", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/Wh04m1001/SysmonEoP" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sysmoneop.yml", "filename": "proc_creation_win_hktl_sysmoneop.yml", "curated": true, "technique_ids": [ "T1068" ], "tactic_tags": [] }, { "id": "7aa7009a-28b9-4344-8c1f-159489a390df", "title": "HackTool - Windows Credential Editor (WCE) Execution", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.\nIt is often used by threat actors for credential dumping and lateral movement within compromised networks.", "author": "Florian Roth (Nextron Systems)", "date": "2019-12-31", "modified": "2025-10-21", "detection_yaml": "condition: 1 of selection_*\nselection_hash:\n Hashes|contains:\n - IMPHASH=136F0A8572C058A96436C82E541E4C41\n - IMPHASH=589657C64DDE88533186C39F82FA1F50\n - IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF\n - IMPHASH=7D490037BF450877E6D0287BDCFF8D2E\n - IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED\n - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F\n - IMPHASH=BA434A7A729EEC20E136CA4C32D6C740\n - IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8\n - IMPHASH=E96A73C7BF33A464C510EDE582318BF2\nselection_img:\n Image|endswith:\n - \\WCE.exe\n - \\WCE64.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.ampliasecurity.com/research/windows-credentials-editor/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_wce.yml", "filename": "proc_creation_win_hktl_wce.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "863218bd-c7d0-4c52-80cd-0a96c09f54af", "title": "Arbitrary File Download Via IMEWDBLD.EXE", "sysmon_eids": [ 1 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1218", "technique": "", "level": "high", "description": "Detects usage of \"IMEWDBLD.exe\" to download arbitrary files", "author": "Swachchhanda Shrawan Poudel", "date": "2023-11-09", "modified": "", "detection_yaml": "condition: all of selection_*\nselection_cli:\n CommandLine|contains:\n - http://\n - https://\nselection_img:\n- Image|endswith: \\IMEWDBLD.exe\n- OriginalFileName: imewdbld.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download", "https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_imewbdld_download.yml", "filename": "proc_creation_win_imewbdld_download.yml", "curated": true, "technique_ids": [ "T1218" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "0ed99dda-6a35-11ef-8c99-0242ac120002", "title": "Attempts of Kerberos Coercion Via DNS SPN Spoofing", "sysmon_eids": [ 1 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1557.001", "technique": "", "level": "high", "description": "Detects the presence of \"UWhRC....AAYBAAAA\" pattern in command line.\nThe pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\nAttackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\nIt is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\nto spoof Service Principal Names (SPNs) and redirect authentication requests ...", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-06-20", "modified": "", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains|all:\n - UWhRCA\n - BAAAA", "false_positives": [ "Unknown" ], "references": [ "https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025", "https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml", "filename": "proc_creation_win_kerberos_coercion_via_dns_spn_spoofing.yml", "curated": true, "technique_ids": [ "T1557.001", "T1187" ], "tactic_tags": [ "collection", "persistence" ] }, { "id": "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "title": "Potential Credential Dumping Via LSASS Process Clone", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1003", "technique": "", "level": "critical", "description": "Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity", "author": "Florian Roth (Nextron Systems), Samir Bousseaden", "date": "2021-11-27", "modified": "2023-03-02", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\Windows\\System32\\lsass.exe\n ParentImage|endswith: \\Windows\\System32\\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", "https://twitter.com/Hexacorn/status/1420053502554951689", "https://twitter.com/SBousseaden/status/1464566846594691073?s=20" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml", "filename": "proc_creation_win_lsass_process_clone.yml", "curated": true, "technique_ids": [ "T1003", "T1003.001" ], "tactic_tags": [] }, { "id": "d55b793d-f847-4eea-b59a-5ab09908ac90", "title": "Suspicious Child Process Of Veeam Dabatase", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "", "technique": "", "level": "critical", "description": "Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-05-04", "modified": "", "detection_yaml": "condition: selection_parent and 1 of selection_child_*\nselection_child_1:\n CommandLine|contains:\n - '-ex '\n - bypass\n - cscript\n - DownloadString\n - http://\n - https://\n - mshta\n - regsvr32\n - rundll32\n - wscript\n - 'copy '\n Image|endswith:\n - \\cmd.exe\n - \\powershell.exe\n - \\pwsh.exe\n - \\wsl.exe\n - \\wt.exe\nselection_child_2:\n Image|endswith:\n - \\net.exe\n - \\net1.exe\n - \\netstat.exe\n - \\nltest.exe\n - \\ping.exe\n - \\tasklist.exe\n - \\whoami.exe\nselection_parent:\n ParentCommandLine|contains: VEEAMSQL\n ParentImage|endswith: \\sqlservr.exe", "false_positives": [], "references": [ "https://labs.withsecure.com/publications/fin7-target-veeam-servers" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_mssql_veaam_susp_child_processes.yml", "filename": "proc_creation_win_mssql_veaam_susp_child_processes.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "persistence" ] }, { "id": "c86500e9-a645-4680-98d7-f882c70c1ea3", "title": "AADInternals PowerShell Cmdlets Execution - ProccessCreation", "sysmon_eids": [ 1 ], "tactic": "Execution", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.", "author": "Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2022-12-23", "modified": "2025-02-06", "detection_yaml": "condition: all of selection_*\nselection_cli:\n CommandLine|contains:\n - Add-AADInt\n - ConvertTo-AADInt\n - Disable-AADInt\n - Enable-AADInt\n - Export-AADInt\n - Find-AADInt\n - Get-AADInt\n - Grant-AADInt\n - Initialize-AADInt\n - Install-AADInt\n - Invoke-AADInt\n - Join-AADInt\n - New-AADInt\n - Open-AADInt\n - Read-AADInt\n - Register-AADInt\n - Remove-AADInt\n - Reset-AADInt\n - Resolve-AADInt\n - Restore-AADInt\n - Save-AADInt\n - Search-AADInt\n - Send-AADInt\n - Set-AADInt\n - Start-AADInt\n - Unprotect-AADInt\n - Update-AADInt\nselection_img:\n- Image|endswith:\n - \\powershell.exe\n - \\powershell_ise.exe\n - \\pwsh.exe\n- OriginalFileName:\n - PowerShell.Exe\n - pwsh.dll", "false_positives": [ "Legitimate use of the library for administrative activity" ], "references": [ "https://o365blog.com/aadinternals/", "https://github.com/Gerenios/AADInternals" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml", "filename": "proc_creation_win_powershell_aadinternals_cmdlets_execution.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "execution", "reconnaissance", "discovery", "impact" ] }, { "id": "e32d4572-9826-4738-b651-95fa63747e8a", "title": "Base64 Encoded PowerShell Command Detected", "sysmon_eids": [ 1 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027", "technique": "", "level": "high", "description": "Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string", "author": "Florian Roth (Nextron Systems)", "date": "2020-01-29", "modified": "2023-01-26", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains: ::FromBase64String(", "false_positives": [ "Administrative script libraries" ], "references": [ "https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml", "filename": "proc_creation_win_powershell_frombase64string.yml", "curated": true, "technique_ids": [ "T1027", "T1140", "T1059.001" ], "tactic_tags": [ "stealth", "execution" ] }, { "id": "514e4c3a-c77d-4cde-a00f-046425e2301e", "title": "Abuse of Service Permissions to Hide Services Via Set-Service", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.011", "technique": "", "level": "high", "description": "Detects usage of the \"Set-Service\" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as \"sc.exe\", \"Get-Service\"...etc. (Works only in powershell 7)", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-17", "modified": "", "detection_yaml": "condition: all of selection_*\nselection_cmdlet:\n CommandLine|contains:\n - '-SecurityDescriptorSddl '\n - '-sd '\nselection_img:\n- Image|endswith: \\pwsh.exe\n- OriginalFileName: pwsh.dll\nselection_sddl:\n CommandLine|contains|all:\n - 'Set-Service '\n - DCLCWPDTSD", "false_positives": [ "Rare intended use of hidden services" ], "references": [ "https://twitter.com/Alh4zr3d/status/1580925761996828672", "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_hide_services_via_set_service.yml", "filename": "proc_creation_win_powershell_hide_services_via_set_service.yml", "curated": true, "technique_ids": [ "T1574.011" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "889719ef-dd62-43df-86c3-768fb08dc7c0", "title": "Suspicious PowerShell Mailbox Export to Share", "sysmon_eids": [ 1 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "", "technique": "", "level": "critical", "description": "Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations", "author": "Florian Roth (Nextron Systems)", "date": "2021-08-07", "modified": "2022-10-26", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains|all:\n - New-MailboxExportRequest\n - ' -Mailbox '\n - ' -FilePath \\\\\\\\'", "false_positives": [ "Unknown" ], "references": [ "https://youtu.be/5mqid-7zp8k?t=2481", "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html", "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1", "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml", "filename": "proc_creation_win_powershell_mailboxexport_share.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "exfiltration" ] }, { "id": "d7662ff6-9e97-4596-a61d-9839e32dee8d", "title": "Add SafeBoot Keys Via Reg Utility", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects execution of \"reg.exe\" commands with the \"add\" or \"copy\" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-09-02", "modified": "2024-03-19", "detection_yaml": "condition: all of selection*\nselection_flag:\n CommandLine|contains:\n - ' copy '\n - ' add '\nselection_img:\n- Image|endswith: \\reg.exe\n- OriginalFileName: reg.exe\nselection_safeboot:\n CommandLine|contains: \\SYSTEM\\CurrentControlSet\\Control\\SafeBoot", "false_positives": [ "Unlikely" ], "references": [ "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_reg_add_safeboot.yml", "filename": "proc_creation_win_reg_add_safeboot.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "title": "Renamed Whoami Execution", "sysmon_eids": [ 1 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1033", "technique": "", "level": "critical", "description": "Detects the execution of whoami that has been renamed to a different name to avoid detection", "author": "Florian Roth (Nextron Systems)", "date": "2021-08-12", "modified": "2022-10-09", "detection_yaml": "condition: selection and not filter\nfilter:\n Image|endswith: \\whoami.exe\nselection:\n OriginalFileName: whoami.exe", "false_positives": [ "Unknown" ], "references": [ "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml", "filename": "proc_creation_win_renamed_whoami.yml", "curated": true, "technique_ids": [ "T1033" ], "tactic_tags": [ "discovery" ] }, { "id": "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "title": "Allow Service Access Using Security Descriptor Tampering Via Sc.EXE", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "high", "description": "Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-02-28", "modified": "2025-10-22", "detection_yaml": "condition: all of selection_* and not 1 of filter_optional_*\nfilter_optional_hexnode:\n ParentImage: C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe\nselection_sc:\n- Image|endswith: \\sc.exe\n- OriginalFileName: sc.exe\nselection_sdset:\n CommandLine|contains|all:\n - sdset\n - A;\nselection_trustee:\n CommandLine|contains:\n - ;IU\n - ;SU\n - ;BA\n - ;SY\n - ;WD", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/0gtweet/status/1628720819537936386", "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/", "https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml", "filename": "proc_creation_win_sc_sdset_allow_service_changes.yml", "curated": true, "technique_ids": [ "T1543.003" ], "tactic_tags": [ "persistence" ] }, { "id": "d522eca2-2973-4391-a3e0-ef0374321dae", "title": "Abused Debug Privilege by Arbitrary Parent Processes", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1548", "technique": "", "level": "high", "description": "Detection of unusual child processes by different system processes", "author": "Semanur Guneysu @semanurtg, oscd.community", "date": "2020-10-28", "modified": "2022-11-11", "detection_yaml": "condition: all of selection_* and not filter\nfilter:\n CommandLine|contains|all:\n - ' route '\n - ' ADD '\nselection_img:\n- Image|endswith:\n - \\powershell.exe\n - \\pwsh.exe\n - \\cmd.exe\n- OriginalFileName:\n - PowerShell.EXE\n - pwsh.dll\n - Cmd.Exe\nselection_parent:\n ParentImage|endswith:\n - \\winlogon.exe\n - \\services.exe\n - \\lsass.exe\n - \\csrss.exe\n - \\smss.exe\n - \\wininit.exe\n - \\spoolsv.exe\n - \\searchindexer.exe\n User|contains:\n - AUTHORI\n - AUTORI", "false_positives": [ "Unknown" ], "references": [ "https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_abusing_debug_privilege.yml", "filename": "proc_creation_win_susp_abusing_debug_privilege.yml", "curated": true, "technique_ids": [ "T1548" ], "tactic_tags": [] }, { "id": "a7c3d773-caef-227e-a7e7-c2f13c622329", "title": "Bad Opsec Defaults Sacrificial Processes With Improper Arguments", "sysmon_eids": [ 1 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.011", "technique": "", "level": "high", "description": "Detects attackers using tooling with bad opsec defaults.\nE.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run.\nOne trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.", "author": "Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)", "date": "2020-10-23", "modified": "2024-08-15", "detection_yaml": "condition: 1 of selection_* and not 1 of filter_optional_*\nfilter_optional_chromium_installer:\n CommandLine|endswith: rundll32.exe\n Image|endswith: \\rundll32.exe\n ParentCommandLine|contains: '--uninstall '\n ParentImage|contains:\n - \\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\\n - \\AppData\\Local\\Google\\Chrome\\Application\\\n ParentImage|endswith: \\Installer\\setup.exe\nfilter_optional_edge_update:\n CommandLine|endswith: rundll32.exe\n Image|endswith: \\rundll32.exe\n ParentImage|contains: \\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{\nselection_regasm:\n CommandLine|endswith: regasm.exe\n Image|endswith: \\regasm.exe\nselection_regsvcs:\n CommandLine|endswith: regsvcs.exe\n Image|endswith: \\regsvcs.exe\nselection_regsvr32:\n CommandLine|endswith: regsvr32.exe\n Image|endswith: \\regsvr32.exe\nselection_rundll32:\n CommandLine|endswith: rundll32.exe\n Image|endswith: \\rundll32.exe\nselection_werfault:\n CommandLine|endswith: WerFault.exe\n Image|endswith: \\WerFault.exe", "false_positives": [ "Unlikely" ], "references": [ "https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/", "https://www.cobaltstrike.com/help-opsec", "https://twitter.com/CyberRaiju/status/1251492025678983169", "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32", "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml", "filename": "proc_creation_win_susp_bad_opsec_sacrificial_processes.yml", "curated": true, "technique_ids": [ "T1218.011" ], "tactic_tags": [ "stealth" ] }, { "id": "4f647cfa-b598-4e12-ad69-c68dd16caef8", "title": "DumpStack.log Defender Evasion", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "critical", "description": "Detects the use of the filename DumpStack.log to evade Microsoft Defender", "author": "Florian Roth (Nextron Systems)", "date": "2022-01-06", "modified": "2022-06-17", "detection_yaml": "condition: 1 of selection*\nselection:\n Image|endswith: \\DumpStack.log\nselection_download:\n CommandLine|contains: ' -o DumpStack.log'", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/mrd0x/status/1479094189048713219" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_dumpstack_log_evasion.yml", "filename": "proc_creation_win_susp_dumpstack_log_evasion.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "title": "Base64 MZ Header In CommandLine", "sysmon_eids": [ 1 ], "tactic": "Execution", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects encoded base64 MZ header in the commandline", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-07-12", "modified": "", "detection_yaml": "condition: selection\nselection:\n CommandLine|contains:\n - TVqQAAMAAAAEAAAA\n - TVpQAAIAAAAEAA8A\n - TVqAAAEAAAAEABAA\n - TVoAAAAAAAAAAAAA\n - TVpTAQEAAAAEAAAA", "false_positives": [ "Unlikely" ], "references": [ "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_inline_base64_mz_header.yml", "filename": "proc_creation_win_susp_inline_base64_mz_header.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "execution" ] }, { "id": "e66779cc-383e-4224-a3a4-267eeb585c40", "title": "Bypass UAC via CMSTP", "sysmon_eids": [ 1 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "high", "description": "Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files", "author": "E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community", "date": "2019-10-24", "modified": "2022-08-30", "detection_yaml": "condition: all of selection*\nselection_cli:\n CommandLine|contains:\n - /s\n - -s\n - /au\n - -au\n - /ni\n - -ni\nselection_img:\n- Image|endswith: \\cmstp.exe\n- OriginalFileName: CMSTP.EXE", "false_positives": [ "Legitimate use of cmstp.exe utility by legitimate user" ], "references": [ "https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md", "https://lolbas-project.github.io/lolbas/Binaries/Cmstp/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp.yml", "filename": "proc_creation_win_uac_bypass_cmstp.yml", "curated": true, "technique_ids": [ "T1548.002", "T1218.003" ], "tactic_tags": [ "stealth" ] }, { "id": "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "title": "TrustedPath UAC Bypass Pattern", "sysmon_eids": [ 1 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "critical", "description": "Detects indicators of a UAC bypass method by mocking directories", "author": "Florian Roth (Nextron Systems)", "date": "2021-08-27", "modified": "2025-06-17", "detection_yaml": "condition: selection\nselection:\n Image|contains:\n - C:\\Windows \\System32\\\n - C:\\Windows \\SysWOW64\\", "false_positives": [ "Unknown" ], "references": [ "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e", "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows", "https://github.com/netero1010/TrustedPath-UACBypass-BOF", "https://x.com/Wietze/status/1933495426952421843" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml", "filename": "proc_creation_win_uac_bypass_trustedpath.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "title": "All Backups Deleted Via Wbadmin.EXE", "sysmon_eids": [ 1 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1490", "technique": "", "level": "high", "description": "Detects the deletion of all backups or system state backups via \"wbadmin.exe\".\nThis technique is used by numerous ransomware families and actors.\nThis may only be successful on server platforms that have Windows Backup enabled.", "author": "frack113, Nasreddine Bencherchali (Nextron Systems)", "date": "2021-12-13", "modified": "2024-05-10", "detection_yaml": "condition: all of selection_*\nselection_cli:\n CommandLine|contains: keepVersions:0\n CommandLine|contains|all:\n - delete\n - backup\nselection_img:\n- Image|endswith: \\wbadmin.exe\n- OriginalFileName: WBADMIN.EXE", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell", "https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md", "https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wbadmin_delete_all_backups.yml", "filename": "proc_creation_win_wbadmin_delete_all_backups.yml", "curated": true, "technique_ids": [ "T1490" ], "tactic_tags": [ "impact" ] }, { "id": "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "title": "Add Insecure Download Source To Winget", "sysmon_eids": [ 1 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059", "technique": "", "level": "high", "description": "Detects usage of winget to add a new insecure (http) download source.\nWinget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-04-17", "modified": "", "detection_yaml": "condition: all of selection_*\nselection_cli:\n CommandLine|contains|all:\n - 'source '\n - 'add '\n - http://\nselection_img:\n- Image|endswith: \\winget.exe\n- OriginalFileName: winget.exe", "false_positives": [ "False positives might occur if the users are unaware of such control checks" ], "references": [ "https://learn.microsoft.com/en-us/windows/package-manager/winget/source", "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml", "filename": "proc_creation_win_winget_add_insecure_custom_source.yml", "curated": true, "technique_ids": [ "T1059" ], "tactic_tags": [ "execution" ] }, { "id": "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "title": "WMI Backdoor Exchange Transport Agent", "sysmon_eids": [ 1 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.003", "technique": "", "level": "critical", "description": "Detects a WMI backdoor in Exchange Transport Agents via WMI event filters", "author": "Florian Roth (Nextron Systems)", "date": "2019-10-11", "modified": "2023-02-08", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_conhost:\n Image: C:\\Windows\\System32\\conhost.exe\nfilter_oleconverter:\n Image|endswith: \\Bin\\OleConverter.exe\n Image|startswith: C:\\Program Files\\Microsoft\\Exchange Server\\\nselection:\n ParentImage|endswith: \\EdgeTransport.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/cglyer/status/1182389676876980224", "https://twitter.com/cglyer/status/1182391019633029120" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml", "filename": "proc_creation_win_wmi_backdoor_exchange_transport_agent.yml", "curated": true, "technique_ids": [ "T1546.003" ], "tactic_tags": [ "persistence" ] }, { "id": "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "title": "Folder Removed From Exploit Guard ProtectedFolders List - Registry", "sysmon_eids": [ 12 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects the removal of folders from the \"ProtectedFolders\" list of of exploit guard. This could indicate an attacker trying to launch an encryption process or trying to manipulate data inside of the protected folder", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-05", "modified": "2023-02-08", "detection_yaml": "condition: selection\nselection:\n EventType: DeleteValue\n TargetObject|contains: SOFTWARE\\Microsoft\\Windows Defender\\Windows Defender Exploit\n Guard\\Controlled Folder Access\\ProtectedFolders", "false_positives": [ "Legitimate administrators removing applications (should always be investigated)" ], "references": [ "https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_exploit_guard_protected_folders.yml", "filename": "registry_delete_exploit_guard_protected_folders.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "460479f3-80b7-42da-9c43-2cc1d54dbccd", "title": "Creation of a Local Hidden User Account by Registry", "sysmon_eids": [ 12, 13, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1136.001", "technique": "", "level": "high", "description": "Sysmon registry detection of a local hidden user account.", "author": "Christian Burkard (Nextron Systems)", "date": "2021-05-03", "modified": "2025-10-31", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\lsass.exe\n TargetObject|contains: \\SAM\\SAM\\Domains\\Account\\Users\\Names\\\n TargetObject|endswith: $\\(Default)", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SBousseaden/status/1387530414185664538" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml", "filename": "registry_event_add_local_hidden_user.yml", "curated": true, "technique_ids": [ "T1136.001" ], "tactic_tags": [ "persistence" ] }, { "id": "6ea3bf32-9680-422d-9f50-e90716b12a66", "title": "UAC Bypass Via Wsreset", "sysmon_eids": [ 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "high", "description": "Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.", "author": "oscd.community, Dmitry Uchakin", "date": "2020-10-07", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n TargetObject|endswith: \\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command", "false_positives": [ "Unknown" ], "references": [ "https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly", "https://lolbas-project.github.io/lolbas/Binaries/Wsreset" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_bypass_via_wsreset.yml", "filename": "registry_event_bypass_via_wsreset.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "b6d235fc-1d38-4b12-adbe-325f06728f37", "title": "CMSTP Execution Registry Event", "sysmon_eids": [ 12, 13, 14 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1218.003", "technique": "", "level": "high", "description": "Detects various indicators of Microsoft Connection Manager Profile Installer execution", "author": "Nik Seetharaman", "date": "2018-07-16", "modified": "2020-12-23", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: \\cmmgr32.exe", "false_positives": [ "Legitimate CMSTP use (unlikely in modern enterprise environments)" ], "references": [ "https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_cmstp_execution_by_registry.yml", "filename": "registry_event_cmstp_execution_by_registry.yml", "curated": true, "technique_ids": [ "T1218.003" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f", "title": "Windows Defender Threat Severity Default Action Modified", "sysmon_eids": [ 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects modifications or creations of Windows Defender's default threat action settings based on severity to 'allow' or take 'no action'.\nThis is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level,\nallowing malicious software to run unimpeded. An attacker might use this technique to bypass defenses before executing payloads.", "author": "Matt Anderson (Huntress)", "date": "2025-07-11", "modified": "", "detection_yaml": "condition: selection\nselection:\n Details:\n - DWORD (0x00000006)\n - DWORD (0x00000009)\n TargetObject|contains: \\Microsoft\\Windows Defender\\Threats\\ThreatSeverityDefaultAction\\\n TargetObject|endswith:\n - \\1\n - \\2\n - \\4\n - \\5", "false_positives": [ "Legitimate administration via scripts or tools (e.g., SCCM, Intune, GPO enforcement). Correlate with administrative activity.", "Software installations that legitimately modify Defender settings (less common for these specific keys)." ], "references": [ "https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference", "https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction", "https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952", "https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2", "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_defender_threat_action_modified.yml", "filename": "registry_event_defender_threat_action_modified.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "title": "Disable Security Events Logging Adding Reg Key MiniNt", "sysmon_eids": [ 12, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Detects the addition of a key 'MiniNt' to the registry. Upon a reboot, Windows Event Log service will stop writing events.", "author": "Ilyas Ochkov, oscd.community", "date": "2019-10-25", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n- EventType: CreateKey\n TargetObject: HKLM\\SYSTEM\\CurrentControlSet\\Control\\MiniNt\n- NewName: HKLM\\SYSTEM\\CurrentControlSet\\Control\\MiniNt", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/0gtweet/status/1182516740955226112", "https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_disable_security_events_logging_adding_reg_key_minint.yml", "filename": "registry_event_disable_security_events_logging_adding_reg_key_minint.yml", "curated": true, "technique_ids": [ "T1685.001", "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "title": "Wdigest CredGuard Registry Modification", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Detects potential malicious modification of the property value of IsCredGuardEnabled from\nHKLM:\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest to disable Cred Guard on a system.\nThis is usually used with UseLogonCredential to manipulate the caching credentials.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2019-08-25", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n TargetObject|endswith: \\IsCredGuardEnabled", "false_positives": [ "Unknown" ], "references": [ "https://teamhydra.blog/2020/08/25/bypassing-credential-guard/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_disable_wdigest_credential_guard.yml", "filename": "registry_event_disable_wdigest_credential_guard.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "5aad0995-46ab-41bd-a9ff-724f41114971", "title": "Esentutl Volume Shadow Copy Service Keys", "sysmon_eids": [ 12, 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.002", "technique": "", "level": "high", "description": "Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\VSS\\\\Diag\\\\VolSnap\\\\Volume are captured.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-10-20", "modified": "2022-12-25", "detection_yaml": "condition: selection and not filter\nfilter:\n TargetObject|contains: System\\CurrentControlSet\\Services\\VSS\\Start\nselection:\n Image|endswith: esentutl.exe\n TargetObject|contains: System\\CurrentControlSet\\Services\\VSS", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_esentutl_volume_shadow_copy_service_keys.yml", "filename": "registry_event_esentutl_volume_shadow_copy_service_keys.yml", "curated": true, "technique_ids": [ "T1003.002" ], "tactic_tags": [] }, { "id": "a6b33c02-8305-488f-8585-03cb2a7763f2", "title": "Windows Credential Editor Registry", "sysmon_eids": [ 12, 13, 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects the use of Windows Credential Editor (WCE)", "author": "Florian Roth (Nextron Systems)", "date": "2019-12-31", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: Services\\WCESERVICE\\Start", "false_positives": [ "Unknown" ], "references": [ "https://www.ampliasecurity.com/research/windows-credentials-editor/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_hack_wce_reg.yml", "filename": "registry_event_hack_wce_reg.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "title": "HybridConnectionManager Service Installation - Registry", "sysmon_eids": [ 12, 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1608", "technique": "", "level": "high", "description": "Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2021-04-12", "modified": "2022-11-27", "detection_yaml": "condition: selection1 or selection2\nselection1:\n TargetObject|contains: \\Services\\HybridConnectionManager\nselection2:\n Details|contains: Microsoft.HybridConnectionManager.Listener.exe\n EventType: SetValue", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/Cyb3rWard0g/status/1381642789369286662" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_hybridconnectionmgr_svc_installation.yml", "filename": "registry_event_hybridconnectionmgr_svc_installation.yml", "curated": true, "technique_ids": [ "T1608" ], "tactic_tags": [] }, { "id": "f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7", "title": "Registry Entries For Azorult Malware", "sysmon_eids": [ 12, 13, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "critical", "description": "Detects the presence of a registry key created during Azorult execution", "author": "Trent Liffick", "date": "2020-05-08", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 12\n - 13\n TargetObject|contains: SYSTEM\\\n TargetObject|endswith: \\services\\localNETService", "false_positives": [ "Unknown" ], "references": [ "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_mal_azorult.yml", "filename": "registry_event_mal_azorult.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence", "execution" ] }, { "id": "1c8e96cd-2bed-487d-9de0-b46c90cade56", "title": "Potential Qakbot Registry Activity", "sysmon_eids": [ 12, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Detects a registry key used by IceID in a campaign that distributes malicious OneNote files", "author": "Hieu Tran", "date": "2023-03-13", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetObject|endswith: \\Software\\firm\\soft\\Name", "false_positives": [ "Unknown" ], "references": [ "https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml", "filename": "registry_event_malware_qakbot_registry.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "title": "Path To Screensaver Binary Modified", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.002", "technique": "", "level": "medium", "description": "Detects value modification of registry key containing path to binary used as screensaver.", "author": "Bartlomiej Czyz @bczyz1, oscd.community", "date": "2020-10-11", "modified": "2021-11-27", "detection_yaml": "condition: selection and not filter\nfilter:\n Image|endswith:\n - \\rundll32.exe\n - \\explorer.exe\nselection:\n TargetObject|endswith: \\Control Panel\\Desktop\\SCRNSAVE.EXE", "false_positives": [ "Legitimate modification of screensaver" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md", "https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_modify_screensaver_binary_path.yml", "filename": "registry_event_modify_screensaver_binary_path.yml", "curated": true, "technique_ids": [ "T1546.002" ], "tactic_tags": [ "persistence" ] }, { "id": "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "title": "Narrator's Feedback-Hub Persistence", "sysmon_eids": [ 12, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547.001", "technique": "", "level": "high", "description": "Detects abusing Windows 10 Narrator's Feedback-Hub", "author": "Dmitriy Lifanov, oscd.community", "date": "2019-10-25", "modified": "2022-03-26", "detection_yaml": "condition: 1 of selection*\nselection1:\n EventType: DeleteValue\n TargetObject|endswith: \\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\Shell\\open\\command\\DelegateExecute\nselection2:\n TargetObject|endswith: \\AppXypsaf9f1qserqevf0sws76dx4k9a5206\\Shell\\open\\command\\(Default)", "false_positives": [ "Unknown" ], "references": [ "https://giuliocomi.blogspot.com/2019/10/abusing-windows-10-narrators-feedback.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_narrator_feedback_persistance.yml", "filename": "registry_event_narrator_feedback_persistance.yml", "curated": true, "technique_ids": [ "T1547.001" ], "tactic_tags": [ "persistence" ] }, { "id": "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "title": "NetNTLM Downgrade Attack - Registry", "sysmon_eids": [ 12, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects NetNTLM downgrade attack", "author": "Florian Roth (Nextron Systems), wagga, Nasreddine Bencherchali (Splunk STRT)", "date": "2018-03-20", "modified": "2024-12-03", "detection_yaml": "condition: selection_regkey and 1 of selection_value_*\nselection_regkey:\n TargetObject|contains|all:\n - SYSTEM\\\n - ControlSet\n - \\Control\\Lsa\nselection_value_lmcompatibilitylevel:\n Details:\n - DWORD (0x00000000)\n - DWORD (0x00000001)\n - DWORD (0x00000002)\n TargetObject|endswith: \\lmcompatibilitylevel\nselection_value_ntlmminclientsec:\n Details:\n - DWORD (0x00000000)\n - DWORD (0x00000010)\n - DWORD (0x00000020)\n - DWORD (0x00000030)\n TargetObject|endswith: \\NtlmMinClientSec\nselection_value_restrictsendingntlmtraffic:\n TargetObject|endswith: \\RestrictSendingNTLMTraffic", "false_positives": [ "Services or tools that set the values to more restrictive values" ], "references": [ "https://web.archive.org/web/20171113231705/https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks", "https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_net_ntlm_downgrade.yml", "filename": "registry_event_net_ntlm_downgrade.yml", "curated": true, "technique_ids": [ "T1685", "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "6aa1d992-5925-4e9f-a49b-845e51d1de01", "title": "New DLL Added to AppCertDlls Registry Key", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.009", "technique": "", "level": "medium", "description": "Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs value in the Registry key can be abused to obtain persistence and privilege escalation\nby causing a malicious DLL to be loaded and run in the context of separate processes on the computer.", "author": "Ilyas Ochkov, oscd.community", "date": "2019-10-25", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n- TargetObject: HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\AppCertDlls\n- NewName: HKLM\\SYSTEM\\CurentControlSet\\Control\\Session Manager\\AppCertDlls", "false_positives": [ "Unknown" ], "references": [ "http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/", "https://eqllib.readthedocs.io/en/latest/analytics/14f90406-10a0-4d36-a672-31cabe149f2f.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appcertdlls_registry_key.yml", "filename": "registry_event_new_dll_added_to_appcertdlls_registry_key.yml", "curated": true, "technique_ids": [ "T1546.009" ], "tactic_tags": [ "persistence" ] }, { "id": "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "title": "New DLL Added to AppInit_DLLs Registry Key", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.010", "technique": "", "level": "medium", "description": "DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows are loaded by user32.dll into every process that loads user32.dll", "author": "Ilyas Ochkov, oscd.community, Tim Shelton", "date": "2019-10-25", "modified": "2022-12-25", "detection_yaml": "condition: selection and not filter\nfilter:\n Details: (Empty)\nselection:\n- TargetObject|endswith:\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls\n - \\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls\n- NewName|endswith:\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls\n - \\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls", "false_positives": [ "Unknown" ], "references": [ "https://eqllib.readthedocs.io/en/latest/analytics/822dc4c5-b355-4df8-bd37-29c458997b8f.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_new_dll_added_to_appinit_dlls_registry_key.yml", "filename": "registry_event_new_dll_added_to_appinit_dlls_registry_key.yml", "curated": true, "technique_ids": [ "T1546.010" ], "tactic_tags": [ "persistence" ] }, { "id": "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "title": "Office Application Startup - Office Test", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1137.002", "technique": "", "level": "medium", "description": "Detects the addition of office test registry that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started", "author": "omkar72", "date": "2020-10-25", "modified": "2023-11-08", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: \\Software\\Microsoft\\Office test\\Special\\Perf", "false_positives": [ "Unlikely" ], "references": [ "https://unit42.paloaltonetworks.com/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_office_test_regadd.yml", "filename": "registry_event_office_test_regadd.yml", "curated": true, "technique_ids": [ "T1137.002" ], "tactic_tags": [ "persistence" ] }, { "id": "295a59c1-7b79-4b47-a930-df12c15fc9c2", "title": "Windows Registry Trust Record Modification", "sysmon_eids": [ 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1566.001", "technique": "", "level": "medium", "description": "Alerts on trust record modification within the registry, indicating usage of macros", "author": "Antonlovesdnb, Trent Liffick (@tliffick)", "date": "2020-02-19", "modified": "2023-06-21", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: \\Security\\Trusted Documents\\TrustRecords", "false_positives": [ "This will alert on legitimate macro usage as well, additional tuning is required" ], "references": [ "https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/", "http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html", "https://twitter.com/inversecos/status/1494174785621819397" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml", "filename": "registry_event_office_trust_record_modification.yml", "curated": true, "technique_ids": [ "T1566.001" ], "tactic_tags": [] }, { "id": "277efb8f-60be-4f10-b4d3-037802f37167", "title": "Registry Persistence Mechanisms in Recycle Bin", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547", "technique": "", "level": "high", "description": "Detects persistence registry keys for Recycle Bin", "author": "frack113", "date": "2021-11-18", "modified": "2022-12-06", "detection_yaml": "condition: 1 of selection_*\nselection_create:\n EventType: RenameKey\n NewName|contains: \\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\shell\\open\nselection_set:\n EventType: SetValue\n TargetObject|contains: \\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\shell\\open\\command\\(Default)", "false_positives": [ "Unknown" ], "references": [ "https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf", "https://persistence-info.github.io/Data/recyclebin.html", "https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml", "filename": "registry_event_persistence_recycle_bin.yml", "curated": true, "technique_ids": [ "T1547" ], "tactic_tags": [ "persistence" ] }, { "id": "a54f842a-3713-4b45-8c84-5f136fdebd3c", "title": "New PortProxy Registry Entry Added", "sysmon_eids": [ 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1090", "technique": "", "level": "medium", "description": "Detects the modification of the PortProxy registry key which is used for port forwarding.", "author": "Andreas Hunkeler (@Karneades)", "date": "2021-06-22", "modified": "2024-03-25", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: \\Services\\PortProxy\\v4tov4\\tcp\\", "false_positives": [ "WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)", "Synergy Software KVM (https://symless.com/synergy)" ], "references": [ "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", "https://adepts.of0x.cc/netsh-portproxy-code/", "https://www.dfirnotes.net/portproxy_detection/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml", "filename": "registry_event_portproxy_registry_key.yml", "curated": true, "technique_ids": [ "T1090" ], "tactic_tags": [] }, { "id": "5b175490-b652-4b02-b1de-5b5b4083c5f8", "title": "RedMimicry Winnti Playbook Registry Manipulation", "sysmon_eids": [ 12, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Detects actions caused by the RedMimicry Winnti playbook", "author": "Alexander Rausch", "date": "2020-06-24", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: HKLM\\SOFTWARE\\Microsoft\\HTMLHelp\\data", "false_positives": [ "Unknown" ], "references": [ "https://redmimicry.com" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml", "filename": "registry_event_redmimicry_winnti_reg.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "title": "WINEKEY Registry Modification", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547", "technique": "", "level": "high", "description": "Detects potential malicious modification of run keys by winekey or team9 backdoor", "author": "omkar72", "date": "2020-10-30", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n TargetObject|endswith: Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Backup Mgr", "false_positives": [ "Unknown" ], "references": [ "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_runkey_winekey.yml", "filename": "registry_event_runkey_winekey.yml", "curated": true, "technique_ids": [ "T1547" ], "tactic_tags": [ "persistence" ] }, { "id": "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "title": "Run Once Task Configuration in Registry", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "medium", "description": "Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup", "author": "Avneet Singh @v3t0_, oscd.community", "date": "2020-11-15", "modified": "2024-03-25", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_chrome:\n Details|contains|all:\n - C:\\Program Files\\Google\\Chrome\\Application\\\n - \\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level\nfilter_optional_edge:\n Details|contains:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\\n - C:\\Program Files\\Microsoft\\Edge\\Application\\\n Details|endswith: \\Installer\\setup.exe\" --configure-user-settings --verbose-logging\n --system-level --msedge --channel=stable\nselection:\n TargetObject|contains: \\Microsoft\\Active Setup\\Installed Components\n TargetObject|endswith: \\StubPath", "false_positives": [ "Legitimate modification of the registry key by legitimate program" ], "references": [ "https://twitter.com/pabraeken/status/990717080805789697", "https://lolbas-project.github.io/lolbas/Binaries/Runonce/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml", "filename": "registry_event_runonce_persistence.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "title": "Shell Open Registry Keys Manipulation", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "high", "description": "Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62)", "author": "Christian Burkard (Nextron Systems)", "date": "2021-08-30", "modified": "2022-01-13", "detection_yaml": "condition: selection1 or selection2 or (selection3 and not filter_sel3)\nfilter_sel3:\n Details: (Empty)\nselection1:\n Details|contains: \\Software\\Classes\\{\n EventType: SetValue\n TargetObject|endswith: Classes\\ms-settings\\shell\\open\\command\\SymbolicLinkValue\nselection2:\n TargetObject|endswith: Classes\\ms-settings\\shell\\open\\command\\DelegateExecute\nselection3:\n EventType: SetValue\n TargetObject|endswith:\n - Classes\\ms-settings\\shell\\open\\command\\(Default)\n - Classes\\exefile\\shell\\open\\command\\(Default)", "false_positives": [ "Unknown" ], "references": [ "https://github.com/hfiref0x/UACME", "https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/", "https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass", "https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml", "filename": "registry_event_shell_open_keys_manipulation.yml", "curated": true, "technique_ids": [ "T1548.002", "T1546.001" ], "tactic_tags": [ "persistence" ] }, { "id": "55e29995-75e7-451a-bef0-6225e2f13597", "title": "Potential Credential Dumping Via LSASS SilentProcessExit Technique", "sysmon_eids": [ 12, 13, 14 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects changes to the Registry in which a monitor program gets registered to dump the memory of the lsass.exe process", "author": "Florian Roth (Nextron Systems)", "date": "2021-02-26", "modified": "2022-12-19", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: Microsoft\\Windows NT\\CurrentVersion\\SilentProcessExit\\lsass.exe", "false_positives": [ "Unlikely" ], "references": [ "https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/", "https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_silentprocessexit_lsass.yml", "filename": "registry_event_silentprocessexit_lsass.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "title": "Security Support Provider (SSP) Added to LSA Configuration", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547.005", "technique": "", "level": "high", "description": "Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.", "author": "iwillkeepwatch", "date": "2019-01-18", "modified": "2026-03-30", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_image_null:\n Image: null\nfilter_main_msiexec:\n Image:\n - C:\\Windows\\system32\\msiexec.exe\n - C:\\Windows\\syswow64\\MsiExec.exe\nselection:\n TargetObject|endswith:\n - \\Control\\Lsa\\Security Packages\n - \\Control\\Lsa\\OSConfig\\Security Packages", "false_positives": [ "Unknown" ], "references": [ "https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/", "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_ssp_added_lsa_config.yml", "filename": "registry_event_ssp_added_lsa_config.yml", "curated": true, "technique_ids": [ "T1547.005" ], "tactic_tags": [ "persistence" ] }, { "id": "baca5663-583c-45f9-b5dc-ea96a22ce542", "title": "Sticky Key Like Backdoor Usage - Registry", "sysmon_eids": [ 12, 13, 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.008", "technique": "", "level": "critical", "description": "Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen", "author": "Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community", "date": "2018-03-15", "modified": "2022-11-26", "detection_yaml": "condition: selection_registry\nselection_registry:\n TargetObject|endswith:\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\sethc.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\osk.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Magnify.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\Narrator.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\DisplaySwitch.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\atbroker.exe\\Debugger\n - \\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\HelpPane.exe\\Debugger", "false_positives": [ "Unlikely" ], "references": [ "https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/", "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_stickykey_like_backdoor.yml", "filename": "registry_event_stickykey_like_backdoor.yml", "curated": true, "technique_ids": [ "T1546.008" ], "tactic_tags": [ "persistence" ] }, { "id": "9577edbb-851f-4243-8c91-1d5b50c1a39b", "title": "Atbroker Registry Change", "sysmon_eids": [ 14 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218", "technique": "", "level": "medium", "description": "Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'", "author": "Mateusz Wydra, oscd.community", "date": "2020-10-13", "modified": "2023-01-19", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_atbroker:\n Details: (Empty)\n Image: C:\\Windows\\system32\\atbroker.exe\n TargetObject|contains: \\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\Configuration\nfilter_uninstallers:\n Image|startswith: C:\\Windows\\Installer\\MSI\n TargetObject|contains: Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\nselection:\n TargetObject|contains:\n - Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs\n - Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\Configuration", "false_positives": [ "Creation of non-default, legitimate at usage" ], "references": [ "http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/", "https://lolbas-project.github.io/lolbas/Binaries/Atbroker/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml", "filename": "registry_event_susp_atbroker_change.yml", "curated": true, "technique_ids": [ "T1218", "T1547" ], "tactic_tags": [ "stealth", "persistence" ] }, { "id": "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "title": "Suspicious Run Key from Download", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547.001", "technique": "", "level": "high", "description": "Detects the suspicious RUN keys created by software located in Download or temporary Outlook/Internet Explorer directories", "author": "Florian Roth (Nextron Systems), Swachchhanda Shrawan Poude (Nextron Systems)", "date": "2019-10-01", "modified": "2025-02-17", "detection_yaml": "condition: selection\nselection:\n Image|contains:\n - \\AppData\\Local\\Packages\\Microsoft.Outlook_\n - \\AppData\\Local\\Microsoft\\Olk\\Attachments\\\n - \\Downloads\\\n - \\Temporary Internet Files\\Content.Outlook\\\n - \\Local Settings\\Temporary Internet Files\\\n TargetObject|contains:\n - \\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n - \\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\n - \\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run", "false_positives": [ "Software installers downloaded and used by users" ], "references": [ "https://app.any.run/tasks/c5bef5b7-f484-4c43-9cf3-d5c5c7839def/", "https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_download_run_key.yml", "filename": "registry_event_susp_download_run_key.yml", "curated": true, "technique_ids": [ "T1547.001" ], "tactic_tags": [ "persistence" ] }, { "id": "b3503044-60ce-4bf4-bbcb-e3db98788823", "title": "DLL Load via LSASS", "sysmon_eids": [ 12, 13, 14 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1547.008", "technique": "", "level": "high", "description": "Detects a method to load DLL via LSASS process using an undocumented Registry key", "author": "Florian Roth (Nextron Systems)", "date": "2019-10-16", "modified": "2022-04-21", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_domain_controller:\n Details:\n - '%%systemroot%%\\system32\\ntdsa.dll'\n - '%%systemroot%%\\system32\\lsadb.dll'\n Image: C:\\Windows\\system32\\lsass.exe\nselection:\n TargetObject|contains:\n - \\CurrentControlSet\\Services\\NTDS\\DirectoryServiceExtPt\n - \\CurrentControlSet\\Services\\NTDS\\LsaDbExtPt", "false_positives": [ "Unknown" ], "references": [ "https://blog.xpnsec.com/exploring-mimikatz-part-1/", "https://twitter.com/SBousseaden/status/1183745981189427200" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml", "filename": "registry_event_susp_lsass_dll_load.yml", "curated": true, "technique_ids": [ "T1547.008" ], "tactic_tags": [ "execution", "persistence" ] }, { "id": "62120148-6b7a-42be-8b91-271c04e281a3", "title": "Suspicious Camera and Microphone Access", "sysmon_eids": [ 14 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1125", "technique": "", "level": "high", "description": "Detects Processes accessing the camera and microphone from suspicious folder", "author": "Den Iuzvyk", "date": "2020-06-07", "modified": "2022-10-09", "detection_yaml": "condition: all of selection_*\nselection_1:\n TargetObject|contains|all:\n - \\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\\n - \\NonPackaged\nselection_2:\n TargetObject|contains:\n - microphone\n - webcam\nselection_3:\n TargetObject|contains:\n - :#Windows#Temp#\n - :#$Recycle.bin#\n - :#Temp#\n - :#Users#Public#\n - :#Users#Default#\n - :#Users#Desktop#", "false_positives": [ "Unlikely, there could be conferencing software running from a Temp folder accessing the devices" ], "references": [ "https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_mic_cam_access.yml", "filename": "registry_event_susp_mic_cam_access.yml", "curated": true, "technique_ids": [ "T1125", "T1123" ], "tactic_tags": [ "collection" ] }, { "id": "7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2", "title": "Registry Tampering by Potentially Suspicious Processes", "sysmon_eids": [ 14 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "medium", "description": "Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc.\nThese processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry\nwithout using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-08-13", "modified": "2026-04-14", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_binary_data:\n Details: Binary Data\nfilter_main_null:\n Details: null\nfilter_main_wscript_legit_1:\n Image|endswith: \\wscript.exe\n TargetObject|contains:\n - SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Notifications\\Data\\\n - \\Services\\bam\\State\\UserSettings\\S-1-\n - Software\\Microsoft\\Windows Script\\Settings\\Telemetry\\wscript.exe\\\n - Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\\nfilter_main_wscript_legit_2:\n Image|endswith: \\wscript.exe\n TargetObject|contains: \\wscript.exe\nselection:\n Image|endswith:\n - \\mshta.exe\n - \\wscript.exe\n - \\cscript.exe", "false_positives": [ "Some legitimate admin or install scripts may use these processes for registry modifications." ], "references": [ "https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/", "https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_susp_process_registry_modification.yml", "filename": "registry_event_susp_process_registry_modification.yml", "curated": true, "technique_ids": [ "T1112", "T1059.005" ], "tactic_tags": [ "persistence", "execution" ] }, { "id": "aa37cbb0-da36-42cb-a90f-fdf216fc7467", "title": "AMSI Disabled via Registry Modification", "sysmon_eids": [ 13 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value.\nAnti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content.\nAdversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned.", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-12-25", "modified": "", "detection_yaml": "condition: selection\nselection:\n Details: DWORD (0x00000000)\n TargetObject|endswith: \\Software\\Microsoft\\Windows Script\\Settings\\AmsiEnable", "false_positives": [ "Unlikely" ], "references": [ "https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d", "https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal", "https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_amsi_disable.yml", "filename": "registry_set_amsi_disable.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "46dd5308-4572-4d12-aa43-8938f0184d4f", "title": "Bypass UAC Using DelegateExecute", "sysmon_eids": [ 13 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "high", "description": "Bypasses User Account Control using a fileless method", "author": "frack113", "date": "2022-01-05", "modified": "2023-08-17", "detection_yaml": "condition: selection\nselection:\n Details: (Empty)\n TargetObject|endswith: \\open\\command\\DelegateExecute", "false_positives": [ "Unknown" ], "references": [ "https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand", "https://devblogs.microsoft.com/oldnewthing/20100312-01/?p=14623", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-7---bypass-uac-using-sdclt-delegateexecute" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_delegateexecute.yml", "filename": "registry_set_bypass_uac_using_delegateexecute.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "title": "Bypass UAC Using Event Viewer", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547.010", "technique": "", "level": "high", "description": "Bypasses User Account Control using Event Viewer and a relevant Windows Registry modification", "author": "frack113", "date": "2022-01-05", "modified": "2023-08-17", "detection_yaml": "condition: selection and not filter\nfilter:\n Details|startswith: '%SystemRoot%\\system32\\mmc.exe \"%1\" %'\nselection:\n TargetObject|endswith: _Classes\\mscfile\\shell\\open\\command\\(Default)", "false_positives": [ "Unknown" ], "references": [ "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml", "filename": "registry_set_bypass_uac_using_eventviewer.yml", "curated": true, "technique_ids": [ "T1547.010" ], "tactic_tags": [ "persistence" ] }, { "id": "724ea201-6514-4f38-9739-e5973c34f49a", "title": "Bypass UAC Using SilentCleanup Task", "sysmon_eids": [ 13 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "high", "description": "Detects the setting of the environement variable \"windir\" to a non default value.\nAttackers often abuse this variable in order to trigger a UAC bypass via the \"SilentCleanup\" task.\nThe SilentCleanup task located in %windir%\\system32\\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC.", "author": "frack113, Nextron Systems", "date": "2022-01-06", "modified": "2024-01-30", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_default:\n Details: '%SystemRoot%'\nselection:\n TargetObject|endswith: \\Environment\\windir", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task", "https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/", "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task.yml", "filename": "registry_set_bypass_uac_using_silentcleanup_task.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "7d9263bd-dc47-4a58-bc92-5474abab390c", "title": "Change Winevt Channel Access Permission Via Registry", "sysmon_eids": [ 13 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Detects tampering with the \"ChannelAccess\" registry key in order to change access to Windows event channel.", "author": "frack113", "date": "2022-09-17", "modified": "2024-03-25", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_tiworker:\n Image|endswith: \\TiWorker.exe\n Image|startswith: C:\\Windows\\WinSxS\\\nfilter_main_trustedinstaller:\n Image: C:\\Windows\\servicing\\TrustedInstaller.exe\nselection:\n Details|contains:\n - (A;;0x1;;;LA)\n - (A;;0x1;;;SY)\n - (A;;0x5;;;BA)\n TargetObject|contains: \\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\\n TargetObject|endswith: \\ChannelAccess", "false_positives": [ "Unknown" ], "references": [ "https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/", "https://learn.microsoft.com/en-us/windows/win32/api/winevt/", "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml", "filename": "registry_set_change_winevt_channelaccess.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "07743f65-7ec9-404a-a519-913db7118a8d", "title": "COM Hijack via Sdclt", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546", "technique": "", "level": "high", "description": "Detects changes to 'HKCU\\Software\\Classes\\Folder\\shell\\open\\command\\DelegateExecute'", "author": "Omkar Gudhate", "date": "2020-09-27", "modified": "2023-09-28", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: \\Software\\Classes\\Folder\\shell\\open\\command\\DelegateExecute", "false_positives": [ "Unknown" ], "references": [ "http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass", "https://www.exploit-db.com/exploits/47696" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml", "filename": "registry_set_comhijack_sdclt.yml", "curated": true, "technique_ids": [ "T1546", "T1548" ], "tactic_tags": [ "persistence" ] }, { "id": "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "title": "Custom File Open Handler Executes PowerShell", "sysmon_eids": [ 13 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1202", "technique": "", "level": "high", "description": "Detects the abuse of custom file open handler, executing powershell", "author": "CD_R0M_", "date": "2022-06-11", "modified": "2023-08-17", "detection_yaml": "condition: selection\nselection:\n Details|contains|all:\n - powershell\n - -command\n TargetObject|contains: shell\\open\\command\\", "false_positives": [ "Unknown" ], "references": [ "https://news.sophos.com/en-us/2022/02/01/solarmarker-campaign-used-novel-registry-changes-to-establish-persistence/?cmp=30728" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_custom_file_open_handler_powershell_execution.yml", "filename": "registry_set_custom_file_open_handler_powershell_execution.yml", "curated": true, "technique_ids": [ "T1202" ], "tactic_tags": [ "stealth" ] }, { "id": "31e124fb-5dc4-42a0-83b3-44a69c77b271", "title": "Antivirus Filter Driver Disallowed On Dev Drive - Registry", "sysmon_eids": [ 13 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects activity that indicates a user disabling the ability for Antivirus mini filter to inspect a \"Dev Drive\".", "author": "@kostastsale, Nasreddine Bencherchali (Nextron Systems)", "date": "2023-11-05", "modified": "2024-08-16", "detection_yaml": "condition: selection\nselection:\n Details: DWORD (0x00000000)\n TargetObject|endswith: \\FilterManager\\FltmgrDevDriveAllowAntivirusFilter", "false_positives": [ "Unlikely" ], "references": [ "https://twitter.com/0gtweet/status/1720419490519752955" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_devdrv_disallow_antivirus_filter.yml", "filename": "registry_set_devdrv_disallow_antivirus_filter.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "9d3436ef-9476-4c43-acca-90ce06bdf33a", "title": "DHCP Callout DLL Installation", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)", "author": "Dimitrios Slamaris", "date": "2017-05-15", "modified": "2023-08-17", "detection_yaml": "condition: selection\nselection:\n TargetObject|endswith:\n - \\Services\\DHCPServer\\Parameters\\CalloutDlls\n - \\Services\\DHCPServer\\Parameters\\CalloutEnabled", "false_positives": [ "Unknown" ], "references": [ "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html", "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml", "filename": "registry_set_dhcp_calloutdll.yml", "curated": true, "technique_ids": [ "T1574.001", "T1112" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "e3fdf743-f05b-4051-990a-b66919be1743", "title": "Change User Account Associated with the FAX Service", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Detect change of the user account associated with the FAX service to avoid the escalation problem.", "author": "frack113", "date": "2022-07-17", "modified": "2022-12-30", "detection_yaml": "condition: selection and not filter\nfilter:\n Details|contains: NetworkService\nselection:\n TargetObject: HKLM\\System\\CurrentControlSet\\Services\\Fax\\ObjectName", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/dottor_morte/status/1544652325570191361", "https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_fax_change_service_user.yml", "filename": "registry_set_fax_change_service_user.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "title": "Change the Fax Dll", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Detect possible persistence using Fax DLL load when service restart", "author": "frack113", "date": "2022-07-17", "modified": "2022-12-30", "detection_yaml": "condition: selection and not filter\nfilter:\n Details: '%systemroot%\\system32\\fxst30.dll'\nselection:\n TargetObject|contains|all:\n - \\Software\\Microsoft\\Fax\\Device Providers\\\n - \\ImageName", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/dottor_morte/status/1544652325570191361", "https://raw.githubusercontent.com/RiccardoAncarani/talks/master/F-Secure/unorthodox-lateral-movement.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_fax_dll_persistance.yml", "filename": "registry_set_fax_dll_persistance.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "833ef470-fa01-4631-a79b-6f291c9ac498", "title": "Add Debugger Entry To Hangs Key For Persistence", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects when an attacker adds a new \"Debugger\" value to the \"Hangs\" key in order to achieve persistence which will get invoked when an application crashes", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-07-21", "modified": "2023-08-17", "detection_yaml": "condition: selection\nselection:\n TargetObject|contains: \\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Hangs\\Debugger", "false_positives": [ "This value is not set by default but could be rarly used by administrators" ], "references": [ "https://persistence-info.github.io/Data/wer_debugger.html", "https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_hangs_debugger_persistence.yml", "filename": "registry_set_hangs_debugger_persistence.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "persistence" ] }, { "id": "790317c0-0a36-4a6a-a105-6e576bf99a14", "title": "COM Object Hijacking Via Modification Of Default System CLSID Default Value", "sysmon_eids": [ 13 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.015", "technique": "", "level": "high", "description": "Detects potential COM object hijacking via modification of default system CLSID.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2024-07-16", "modified": "2025-11-10", "detection_yaml": "condition: all of selection_target_* and 1 of selection_susp_location_*\nselection_susp_location_1:\n Details|contains:\n - :\\Perflogs\\\n - \\AppData\\Local\\\n - \\Desktop\\\n - \\Downloads\\\n - \\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\\n - \\System32\\spool\\drivers\\color\\\n - \\Temporary Internet\n - \\Users\\Public\\\n - \\Windows\\Temp\\\n - '%appdata%'\n - '%temp%'\n - '%tmp%'\nselection_susp_location_2:\n- Details|contains|all:\n - :\\Users\\\n - \\Favorites\\\n- Details|contains|all:\n - :\\Users\\\n - \\Favourites\\\n- Details|contains|all:\n - :\\Users\\\n - \\Contacts\\\n- Details|contains|all:\n - :\\Users\\\n - \\Pictures\\\nselection_target_builtin_clsid:\n TargetObject|contains:\n - \\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\\\n - \\{2155fee3-2419-4373-b102-6843707eb41f}\\\n - \\{4590f811-1d3a-11d0-891f-00aa004b2e24}\\\n - \\{4de225bf-cf59-4cfc-85f7-68b90f185355}\\\n - \\{ddc05a5a-351a-4e06-8eaf-54ec1bc2dcea}\\\n - \\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}\\\n - \\{F82B4EF1-93A9-4DDE-8015-F7950A1A6E31}\\\n - \\{784959...", "false_positives": [ "Unlikely" ], "references": [ "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/ (idea)", "https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/", "https://blog.talosintelligence.com/uat-5647-romcom/", "https://global.ptsecurity.com/analytics/pt-esc-threat-intelligence/darkhotel-a-cluster-of-groups-united-by-common-techniques", "https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_persistence_com_hijacking_builtin.yml", "filename": "registry_set_persistence_com_hijacking_builtin.yml", "curated": true, "technique_ids": [ "T1546.015" ], "tactic_tags": [ "persistence" ] }, { "id": "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3", "title": "Unusual File Modification by dns.exe", "sysmon_eids": [ 2 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1133", "technique": "", "level": "high", "description": "Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)", "author": "Tim Rauch (Nextron Systems), Elastic (idea)", "date": "2022-09-27", "modified": "", "detection_yaml": "condition: selection and not filter\nfilter:\n TargetFilename|endswith: \\dns.log\nselection:\n Image|endswith: \\dns.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_change/file_change_win_unusual_modification_by_dns_exe.yml", "filename": "file_change_win_unusual_modification_by_dns_exe.yml", "curated": true, "technique_ids": [ "T1133" ], "tactic_tags": [ "persistence" ] }, { "id": "06125661-3814-4e03-bfa2-1e4411c60ac3", "title": "Backup Files Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1490", "technique": "", "level": "medium", "description": "Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.", "author": "frack113", "date": "2022-01-02", "modified": "2023-02-15", "detection_yaml": "condition: selection\nselection:\n Image|endswith:\n - \\cmd.exe\n - \\powershell.exe\n - \\pwsh.exe\n - \\wt.exe\n - \\rundll32.exe\n - \\regsvr32.exe\n TargetFilename|endswith:\n - .VHD\n - .bac\n - .bak\n - .wbcat\n - .bkf\n - .set\n - .win\n - .dsk", "false_positives": [ "Legitimate usage" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_backup_file.yml", "filename": "file_delete_win_delete_backup_file.yml", "curated": true, "technique_ids": [ "T1490" ], "tactic_tags": [ "impact" ] }, { "id": "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "title": "EventLog EVTX File Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070", "technique": "", "level": "medium", "description": "Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-02-15", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith: .evtx\n TargetFilename|startswith: C:\\Windows\\System32\\winevt\\Logs\\", "false_positives": [ "Unknown" ], "references": [ "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_event_log_files.yml", "filename": "file_delete_win_delete_event_log_files.yml", "curated": true, "technique_ids": [ "T1070" ], "tactic_tags": [ "stealth" ] }, { "id": "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "title": "Exchange PowerShell Cmdlet History Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070", "technique": "", "level": "high", "description": "Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-26", "modified": "2022-12-30", "detection_yaml": "condition: selection\nselection:\n TargetFilename|contains: _Cmdlet_\n TargetFilename|startswith: \\Logging\\CmdletInfra\\LocalPowerShell\\Cmdlet\\", "false_positives": [ "Possible FP during log rotation" ], "references": [ "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml", "filename": "file_delete_win_delete_exchange_powershell_logs.yml", "curated": true, "technique_ids": [ "T1070" ], "tactic_tags": [ "stealth" ] }, { "id": "3eb8c339-a765-48cc-a150-4364c04652bf", "title": "IIS WebServer Access Logs Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070", "technique": "", "level": "medium", "description": "Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence", "author": "Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)", "date": "2022-09-16", "modified": "2023-02-15", "detection_yaml": "condition: selection\nselection:\n TargetFilename|contains: \\inetpub\\logs\\LogFiles\\\n TargetFilename|endswith: .log", "false_positives": [ "During uninstallation of the IIS service", "During log rotation" ], "references": [ "https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml", "filename": "file_delete_win_delete_iis_access_logs.yml", "curated": true, "technique_ids": [ "T1070" ], "tactic_tags": [ "stealth" ] }, { "id": "f01d1f70-cd41-42ec-9c0b-26dd9c22bf29", "title": "Process Deletion of Its Own Executable", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "medium", "description": "Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.", "author": "Max Altgelt (Nextron Systems)", "date": "2024-09-03", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename|fieldref: Image", "false_positives": [ "Some false positives are to be expected from uninstallers." ], "references": [ "https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_own_image.yml", "filename": "file_delete_win_delete_own_image.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "ff301988-c231-4bd0-834c-ac9d73b86586", "title": "PowerShell Console History Logs Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070", "technique": "", "level": "medium", "description": "Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-02-15", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith: \\PSReadLine\\ConsoleHost_history.txt", "false_positives": [ "Unknown" ], "references": [ "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml", "filename": "file_delete_win_delete_powershell_command_history.yml", "curated": true, "technique_ids": [ "T1070" ], "tactic_tags": [ "stealth" ] }, { "id": "0a1f9d29-6465-4776-b091-7f43b26e4c89", "title": "Prefetch File Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070.004", "technique": "", "level": "high", "description": "Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence", "author": "Cedric MAURUGEON", "date": "2021-09-29", "modified": "2024-01-25", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_svchost:\n Image|endswith: :\\windows\\system32\\svchost.exe\n User|contains:\n - AUTHORI\n - AUTORI\nselection:\n TargetFilename|contains: :\\Windows\\Prefetch\\\n TargetFilename|endswith: .pf", "false_positives": [ "Unknown" ], "references": [ "Internal Research", "https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_prefetch.yml", "filename": "file_delete_win_delete_prefetch.yml", "curated": true, "technique_ids": [ "T1070.004" ], "tactic_tags": [ "stealth" ] }, { "id": "b1decb61-ed83-4339-8e95-53ea51901720", "title": "TeamViewer Log File Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070.004", "technique": "", "level": "low", "description": "Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence", "author": "frack113", "date": "2022-01-16", "modified": "2023-02-15", "detection_yaml": "condition: selection and not filter\nfilter:\n Image: C:\\Windows\\system32\\svchost.exe\nselection:\n TargetFilename|contains: \\TeamViewer_\n TargetFilename|endswith: .log", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_teamviewer_logs.yml", "filename": "file_delete_win_delete_teamviewer_logs.yml", "curated": true, "technique_ids": [ "T1070.004" ], "tactic_tags": [ "stealth" ] }, { "id": "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "title": "Tomcat WebServer Logs Deleted", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070", "technique": "", "level": "medium", "description": "Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-02-16", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename|contains:\n - catalina.\n - _access_log.\n - localhost.\n TargetFilename|contains|all:\n - \\Tomcat\n - \\logs\\", "false_positives": [ "During uninstallation of the tomcat server", "During log rotation" ], "references": [ "Internal Research", "https://linuxhint.com/view-tomcat-logs-windows/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml", "filename": "file_delete_win_delete_tomcat_logs.yml", "curated": true, "technique_ids": [ "T1070" ], "tactic_tags": [ "stealth" ] }, { "id": "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "title": "File Deleted Via Sysinternals SDelete", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070.004", "technique": "", "level": "medium", "description": "Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-05-02", "modified": "2023-02-15", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_wireshark:\n TargetFilename|endswith: \\Wireshark\\radius\\dictionary.alcatel-lucent.aaa\nselection:\n TargetFilename|endswith:\n - .AAA\n - .ZZZ", "false_positives": [ "Legitimate usage" ], "references": [ "https://github.com/OTRF/detection-hackathon-apt29/issues/9", "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_sysinternals_sdelete_file_deletion.yml", "filename": "file_delete_win_sysinternals_sdelete_file_deletion.yml", "curated": true, "technique_ids": [ "T1070.004" ], "tactic_tags": [ "stealth" ] }, { "id": "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "title": "Unusual File Deletion by Dns.exe", "sysmon_eids": [ 23, 26 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1133", "technique": "", "level": "high", "description": "Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)", "author": "Tim Rauch (Nextron Systems), Elastic (idea)", "date": "2022-09-27", "modified": "2023-02-15", "detection_yaml": "condition: selection and not filter\nfilter:\n TargetFilename|endswith: \\dns.log\nselection:\n Image|endswith: \\dns.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_unusual_deletion_by_dns_exe.yml", "filename": "file_delete_win_unusual_deletion_by_dns_exe.yml", "curated": true, "technique_ids": [ "T1133" ], "tactic_tags": [ "persistence" ] }, { "id": "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "title": "ADS Zone.Identifier Deleted By Uncommon Application", "sysmon_eids": [ 23, 26 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070.004", "technique": "", "level": "medium", "description": "Detects the deletion of the \"Zone.Identifier\" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-09-04", "modified": "2025-07-04", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_generic:\n Image:\n - C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe\n - C:\\Program Files\\PowerShell\\7\\pwsh.exe\n - C:\\Windows\\explorer.exe\n - C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\n - C:\\Windows\\SysWOW64\\explorer.exe\n - C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\nfilter_optional_browsers_chrome:\n Image:\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_browsers_firefox:\n Image:\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\nfilter_optional_browsers_msedge:\n Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nselection:\n TargetFilename|endswith: :Zone.Identifier", "false_positives": [ "Other third party applications not listed." ], "references": [ "https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/", "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml", "filename": "file_delete_win_zone_identifier_ads_uncommon.yml", "curated": true, "technique_ids": [ "T1070.004" ], "tactic_tags": [ "stealth" ] }, { "id": "02773bed-83bf-469f-b7ff-e676e7d78bab", "title": "BloodHound Collection Files", "sysmon_eids": [ 11 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1087.001", "technique": "", "level": "high", "description": "Detects default file names outputted by the BloodHound collection tool SharpHound", "author": "C.J. May", "date": "2022-08-09", "modified": "2026-02-19", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_ms_winapps:\n Image|endswith: \\svchost.exe\n TargetFilename|endswith: \\pocket_containers.json\n TargetFilename|startswith: C:\\Program Files\\WindowsApps\\Microsoft.\nselection:\n TargetFilename|endswith:\n - BloodHound.zip\n - _computers.json\n - _containers.json\n - _gpos.json\n - _groups.json\n - _ous.json\n - _users.json", "false_positives": [ "Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise" ], "references": [ "https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_bloodhound_collection.yml", "filename": "file_event_win_bloodhound_collection.yml", "curated": true, "technique_ids": [ "T1087.001", "T1087.002", "T1482", "T1069.001", "T1069.002", "T1059.001" ], "tactic_tags": [ "discovery", "execution" ] }, { "id": "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "title": "Creation Exe for Service with Unquoted Path", "sysmon_eids": [ 11 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547.009", "technique": "", "level": "high", "description": "Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.\nAdversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.", "author": "frack113", "date": "2021-12-30", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename: C:\\program.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.009/T1574.009.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_creation_unquoted_service_path.yml", "filename": "file_event_win_creation_unquoted_service_path.yml", "curated": true, "technique_ids": [ "T1547.009" ], "tactic_tags": [ "persistence" ] }, { "id": "8fbf3271-1ef6-4e94-8210-03c2317947f6", "title": "Cred Dump Tools Dropped Files", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Files with well-known filenames (parts of credential dump software or files produced by them) creation", "author": "Teymur Kheirkhabarov, oscd.community", "date": "2019-11-01", "modified": "2025-10-25", "detection_yaml": "condition: selection\nselection:\n- TargetFilename|contains:\n - \\fgdump-log\n - \\kirbi\n - \\pwdump\n - \\pwhashes\n - \\wce_ccache\n - \\wce_krbtkts\n- TargetFilename|endswith:\n - \\cachedump.exe\n - \\cachedump64.exe\n - \\DumpExt.dll\n - \\DumpSvc.exe\n - \\Dumpy.exe\n - \\fgexec.exe\n - \\lsremora.dll\n - \\lsremora64.dll\n - \\NTDS.out\n - \\procdump.exe\n - \\procdump64.exe\n - \\procdump64a.exe\n - \\pstgdump.exe\n - \\pwdump.exe\n - \\SAM.out\n - \\SECURITY.out\n - \\servpw.exe\n - \\servpw64.exe\n - \\SYSTEM.out\n - \\test.pwd\n - \\wceaux.dll", "false_positives": [ "Legitimate Administrator using tool for password recovery" ], "references": [ "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_cred_dump_tools_dropped_files.yml", "filename": "file_event_win_cred_dump_tools_dropped_files.yml", "curated": true, "technique_ids": [ "T1003.001", "T1003.002", "T1003.003", "T1003.004", "T1003.005" ], "tactic_tags": [] }, { "id": "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "title": "Potential DCOM InternetExplorer.Application DLL Hijack", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "critical", "description": "Detects potential DLL hijack of \"iertutil.dll\" found in the DCOM InternetExplorer.Application Class over the network", "author": "Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga", "date": "2020-10-12", "modified": "2022-12-18", "detection_yaml": "condition: selection\nselection:\n Image: System\n TargetFilename|endswith: \\Internet Explorer\\iertutil.dll", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dcom_iertutil_dll_hijack.yml", "filename": "file_event_win_dcom_iertutil_dll_hijack.yml", "curated": true, "technique_ids": [ "T1021.002", "T1021.003" ], "tactic_tags": [] }, { "id": "b6f91281-20aa-446a-b986-38a92813a18f", "title": "DLL Search Order Hijackig Via Additional Space in Path", "sysmon_eids": [ 11 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...)\nbut with a space in order to trick DLL load search order and perform a \"DLL Search Order Hijacking\" attack", "author": "frack113, Nasreddine Bencherchali (Nextron Systems)", "date": "2022-07-30", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith: .dll\n TargetFilename|startswith:\n - C:\\Windows \\\n - C:\\Program Files \\\n - C:\\Program Files (x86) \\", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/cyb3rops/status/1552932770464292864", "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_dll_sideloading_space_path.yml", "filename": "file_event_win_dll_sideloading_space_path.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "title": "HackTool - CrackMapExec File Indicators", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects file creation events with filename patterns used by CrackMapExec.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2024-03-11", "modified": "2024-06-27", "detection_yaml": "condition: selection_path and 1 of selection_names_*\nselection_names_re:\n- TargetFilename|re: \\\\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.txt$\n- TargetFilename|re: \\\\[a-zA-Z]{8}\\.tmp$\nselection_names_str:\n TargetFilename|endswith:\n - \\temp.ps1\n - \\msol.ps1\nselection_path:\n TargetFilename|startswith: C:\\Windows\\Temp\\", "false_positives": [ "Unknown" ], "references": [ "https://github.com/byt3bl33d3r/CrackMapExec/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_crackmapexec_indicators.yml", "filename": "file_event_win_hktl_crackmapexec_indicators.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "title": "HackTool - Dumpert Process Dumper Default File", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory", "author": "Florian Roth (Nextron Systems)", "date": "2020-02-04", "modified": "2023-05-09", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith: dumpert.dmp", "false_positives": [ "Very unlikely" ], "references": [ "https://github.com/outflanknl/Dumpert", "https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_dumpert.yml", "filename": "file_event_win_hktl_dumpert.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "title": "HackTool - Inveigh Execution Artefacts", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1219.002", "technique": "", "level": "critical", "description": "Detects the presence and execution of Inveigh via dropped artefacts", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-24", "modified": "2024-06-27", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith:\n - \\Inveigh-Log.txt\n - \\Inveigh-Cleartext.txt\n - \\Inveigh-NTLMv1Users.txt\n - \\Inveigh-NTLMv2Users.txt\n - \\Inveigh-NTLMv1.txt\n - \\Inveigh-NTLMv2.txt\n - \\Inveigh-FormInput.txt\n - \\Inveigh.dll\n - \\Inveigh.exe\n - \\Inveigh.ps1\n - \\Inveigh-Relay.ps1", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs", "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs", "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml", "filename": "file_event_win_hktl_inveigh_artefacts.yml", "curated": true, "technique_ids": [ "T1219.002" ], "tactic_tags": [] }, { "id": "9e099d99-44c2-42b6-a6d8-54c3545cab29", "title": "HackTool - Mimikatz Kirbi File Creation", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1558", "technique": "", "level": "critical", "description": "Detects the creation of files created by mimikatz such as \".kirbi\", \"mimilsa.log\", etc.", "author": "Florian Roth (Nextron Systems), David ANDRE", "date": "2021-11-08", "modified": "2024-06-27", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith:\n - .kirbi\n - mimilsa.log", "false_positives": [ "Unlikely" ], "references": [ "https://cobalt.io/blog/kerberoast-attack-techniques", "https://pentestlab.blog/2019/10/21/persistence-security-support-provider/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_mimikatz_files.yml", "filename": "file_event_win_hktl_mimikatz_files.yml", "curated": true, "technique_ids": [ "T1558" ], "tactic_tags": [] }, { "id": "efc21479-9e83-41da-8cf1-122e06ba8db3", "title": "HackTool - NetExec File Indicators", "sysmon_eids": [ 11 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "high", "description": "Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.\nNetExec is a PyInstaller-bundled binary that extracts its embedded data files to a \"_MEI\" directory\nunder the Temp folder upon execution. Files dropped under the \"\\nxc\\\" sub-directory of that\nextraction path are unique to NetExec and serve as reliable on-disk indicators of execution.\nNetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for\nActive Direc...", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2026-04-08", "modified": "", "detection_yaml": "condition: selection\nselection:\n- Image|contains: \\nxc-windows-latest\\\n- TargetFilename|contains|all:\n - \\Temp\\_MEI\n - \\nxc\\data\\", "false_positives": [ "Unknown" ], "references": [ "https://github.com/Pennyw0rth/NetExec", "https://www.netexec.wiki/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml", "filename": "file_event_win_hktl_netexec_file_indicators.yml", "curated": true, "technique_ids": [ "T1021.002", "T1059.005" ], "tactic_tags": [ "execution", "discovery" ] }, { "id": "cad1fe90-2406-44dc-bd03-59d0b58fe722", "title": "HackTool - NPPSpy Hacktool Usage", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file", "author": "Florian Roth (Nextron Systems)", "date": "2021-11-29", "modified": "2024-06-27", "detection_yaml": "condition: selection\nselection:\n TargetFilename|endswith:\n - \\NPPSpy.txt\n - \\NPPSpy.dll", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy", "https://twitter.com/0gtweet/status/1465282548494487554" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_nppspy.yml", "filename": "file_event_win_hktl_nppspy.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "847def9e-924d-4e90-b7c4-5f581395a2b4", "title": "HackTool - QuarksPwDump Dump File", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.002", "technique": "", "level": "critical", "description": "Detects a dump file written by QuarksPwDump password dumper", "author": "Florian Roth (Nextron Systems)", "date": "2018-02-10", "modified": "2024-06-27", "detection_yaml": "condition: selection\nselection:\n TargetFilename|contains|all:\n - \\AppData\\Local\\Temp\\SAM-\n - .dmp", "false_positives": [ "Unknown" ], "references": [ "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_quarkspw_filedump.yml", "filename": "file_event_win_hktl_quarkspw_filedump.yml", "curated": true, "technique_ids": [ "T1003.002" ], "tactic_tags": [] }, { "id": "03f4ca17-de95-428d-a75a-4ee78b047256", "title": "HackTool - Impacket File Indicators", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects file creation events with filename patterns used by Impacket.", "author": "The DFIR Report, IrishDeath", "date": "2025-05-19", "modified": "", "detection_yaml": "condition: selection_names_re\nselection_names_re:\n TargetFilename|re: \\\\sessionresume_[a-zA-Z]{8}$", "false_positives": [ "Unknown" ], "references": [ "https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/", "https://github.com/fortra/impacket" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_impacket_file_indicators.yml", "filename": "file_event_win_impacket_file_indicators.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "title": "Adwind RAT / JRAT File Artifact", "sysmon_eids": [ 11 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059.005", "technique": "", "level": "high", "description": "Detects javaw.exe in AppData folder as used by Adwind / JRAT", "author": "Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community", "date": "2017-11-10", "modified": "2022-12-02", "detection_yaml": "condition: selection\nselection:\n- TargetFilename|contains|all:\n - \\AppData\\Roaming\\Oracle\\bin\\java\n - .exe\n- TargetFilename|contains|all:\n - \\Retrive\n - .vbs", "false_positives": [], "references": [ "https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_mal_adwind.yml", "filename": "file_event_win_mal_adwind.yml", "curated": true, "technique_ids": [ "T1059.005", "T1059.007" ], "tactic_tags": [ "execution" ] }, { "id": "318557a5-150c-4c8d-b70e-a9910e199857", "title": "File Creation In Suspicious Directory By Msdt.EXE", "sysmon_eids": [ 11 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1547.001", "technique": "", "level": "high", "description": "Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities", "author": "Vadim Varganov, Florian Roth (Nextron Systems)", "date": "2022-08-24", "modified": "2023-02-23", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\msdt.exe\n TargetFilename|contains:\n - \\Desktop\\\n - \\Start Menu\\Programs\\Startup\\\n - C:\\PerfLogs\\\n - C:\\ProgramData\\\n - C:\\Users\\Public\\", "false_positives": [ "Unknown" ], "references": [ "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd", "https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml", "filename": "file_event_win_msdt_susp_directories.yml", "curated": true, "technique_ids": [ "T1547.001" ], "tactic_tags": [ "persistence" ] }, { "id": "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "title": "File With Uncommon Extension Created By An Office Application", "sysmon_eids": [ 11 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1204.002", "technique": "", "level": "high", "description": "Detects the creation of files with an executable or script extension by an Office application.", "author": "Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems)", "date": "2021-08-23", "modified": "2025-10-17", "detection_yaml": "condition: all of selection* and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_localassembly:\n TargetFilename|contains: \\AppData\\Local\\assembly\\tmp\\\n TargetFilename|endswith: .dll\nfilter_optional_backstageinappnavcache:\n TargetFilename|contains|all:\n - C:\\Users\\\n - \\AppData\\Local\\Microsoft\\Office\\\n - \\BackstageInAppNavCache\\\n TargetFilename|endswith: .com\nfilter_optional_webex:\n Image|endswith: \\winword.exe\n TargetFilename|contains: \\AppData\\Local\\Temp\\webexdelta\\\n TargetFilename|endswith:\n - .dll\n - .exe\nfilter_optional_webservicecache:\n TargetFilename|contains|all:\n - C:\\Users\\\n - \\AppData\\Local\\Microsoft\\Office\\\n - \\WebServiceCache\\AllUsers\n TargetFilename|endswith: .com\nselection1:\n Image|endswith:\n - \\excel.exe\n - \\msaccess.exe\n - \\mspub.exe\n - \\powerpnt.exe\n - \\visio.exe\n - \\winword.exe\nselection2:\n TargetFilename|endswith:\n - .bat\n - .cmd\n - .com\n - .dll\n - .exe\n - .hta\n - .ocx\n - .proj\n - .ps1\n - .scf\n - .scr\n - .sys\n ...", "false_positives": [ "Unknown" ], "references": [ "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_office_susp_file_extension.yml", "filename": "file_event_win_office_susp_file_extension.yml", "curated": true, "technique_ids": [ "T1204.002" ], "tactic_tags": [ "execution" ] }, { "id": "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "title": ".RDP File Created By Uncommon Application", "sysmon_eids": [ 11 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects creation of a file with an \".rdp\" extension by an application that doesn't commonly create such files.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-04-18", "modified": "2024-11-01", "detection_yaml": "condition: selection\nselection:\n Image|endswith:\n - \\brave.exe\n - \\CCleaner Browser\\Application\\CCleanerBrowser.exe\n - \\chromium.exe\n - \\firefox.exe\n - \\Google\\Chrome\\Application\\chrome.exe\n - \\iexplore.exe\n - \\microsoftedge.exe\n - \\msedge.exe\n - \\Opera.exe\n - \\Vivaldi.exe\n - \\Whale.exe\n - \\olk.exe\n - \\Outlook.exe\n - \\RuntimeBroker.exe\n - \\Thunderbird.exe\n - \\Discord.exe\n - \\Keybase.exe\n - \\msteams.exe\n - \\Slack.exe\n - \\teams.exe\n TargetFilename|endswith: .rdp", "false_positives": [ "Unknown" ], "references": [ "https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/", "https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml", "filename": "file_event_win_rdp_file_susp_creation.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "title": "DPAPI Backup Keys And Certificate Export Activity IOC", "sysmon_eids": [ 11 ], "tactic": "", "tactic_id": "", "technique_id": "T1555", "technique": "", "level": "high", "description": "Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.", "author": "Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)", "date": "2024-06-26", "modified": "", "detection_yaml": "condition: selection\nselection:\n TargetFilename|contains:\n - ntds_capi_\n - ntds_legacy_\n - ntds_unknown_\n TargetFilename|endswith:\n - .cer\n - .key\n - .pfx\n - .pvk", "false_positives": [ "Unlikely" ], "references": [ "https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/", "https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml", "filename": "file_event_win_susp_dpapi_backup_and_cert_export_ioc.yml", "curated": true, "technique_ids": [ "T1555", "T1552.004" ], "tactic_tags": [] }, { "id": "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "title": "Wmiexec Default Output File", "sysmon_eids": [ 11 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1047", "technique": "", "level": "critical", "description": "Detects the creation of the default output filename used by the wmiexec tool", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-06-02", "modified": "2023-03-08", "detection_yaml": "condition: selection\nselection:\n- TargetFilename|re: \\\\Windows\\\\__1\\d{9}\\.\\d{1,7}$\n- TargetFilename|re: C:\\\\__1\\d{9}\\.\\d{1,7}$\n- TargetFilename|re: D:\\\\__1\\d{9}\\.\\d{1,7}$", "false_positives": [ "Unlikely" ], "references": [ "https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/", "https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmiexec_default_filename.yml", "filename": "file_event_win_wmiexec_default_filename.yml", "curated": true, "technique_ids": [ "T1047" ], "tactic_tags": [ "execution" ] }, { "id": "614a7e17-5643-4d89-b6fe-f9df1a79641c", "title": "Wmiprvse Wbemcomn DLL Hijack - File", "sysmon_eids": [ 11 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1047", "technique": "", "level": "critical", "description": "Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\\Windows\\System32\\wbem\\` directory over the network and loading it for a WMI DLL Hijack scenario.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-10-12", "modified": "2022-12-02", "detection_yaml": "condition: selection\nselection:\n Image: System\n TargetFilename|endswith: \\wbem\\wbemcomn.dll", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_wmiprvse_wbemcomn_dll_hijack.yml", "filename": "file_event_win_wmiprvse_wbemcomn_dll_hijack.yml", "curated": true, "technique_ids": [ "T1047", "T1021.002" ], "tactic_tags": [ "execution" ] }, { "id": "5205613d-2a63-4412-a895-3a2458b587b3", "title": "Network Connection Initiated By AddinUtil.EXE", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218", "technique": "", "level": "high", "description": "Detects a network connection initiated by the Add-In deployment cache updating utility \"AddInutil.exe\".\nThis could indicate a potential command and control communication as this tool doesn't usually initiate network activity.", "author": "Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)", "date": "2023-09-18", "modified": "2024-07-16", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\addinutil.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_addinutil_initiated.yml", "filename": "net_connection_win_addinutil_initiated.yml", "curated": true, "technique_ids": [ "T1218" ], "tactic_tags": [ "stealth" ] }, { "id": "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "title": "Uncommon Connection to Active Directory Web Services", "sysmon_eids": [ 3 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1087", "technique": "", "level": "medium", "description": "Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.", "author": "@kostastsale", "date": "2024-01-26", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_dsac:\n Image: C:\\Windows\\system32\\dsac.exe\nfilter_main_ms_monitoring_agent:\n Image: C:\\Program Files\\Microsoft Monitoring Agent\\\nfilter_main_powershell:\n Image|startswith:\n - C:\\Program Files\\PowerShell\\7\\pwsh.exe\n - C:\\Program Files\\PowerShell\\7-preview\\pwsh.ex\n - C:\\Windows\\System32\\WindowsPowerShell\\\n - C:\\Windows\\SysWOW64\\WindowsPowerShell\\\nselection:\n DestinationPort: 9389\n Initiated: true", "false_positives": [ "ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives." ], "references": [ "https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c", "https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_adws_unusual_connection.yml", "filename": "net_connection_win_adws_unusual_connection.yml", "curated": true, "technique_ids": [ "T1087" ], "tactic_tags": [ "discovery" ] }, { "id": "0dba975d-a193-4ed1-a067-424df57570d1", "title": "Uncommon Network Connection Initiated By Certutil.EXE", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "high", "description": "Detects a network connection initiated by the certutil.exe utility.\nAttackers can abuse the utility in order to download malware or additional payloads.", "author": "frack113, Florian Roth (Nextron Systems)", "date": "2022-09-02", "modified": "2024-05-31", "detection_yaml": "condition: selection\nselection:\n DestinationPort:\n - 80\n - 135\n - 443\n - 445\n Image|endswith: \\certutil.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_certutil_initiated_connection.yml", "filename": "net_connection_win_certutil_initiated_connection.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "efafe0bf-4238-479e-af8f-797bd3490d2d", "title": "Outbound Network Connection Initiated By Cmstp.EXE", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.003", "technique": "", "level": "high", "description": "Detects a network connection initiated by Cmstp.EXE\nIts uncommon for \"cmstp.exe\" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-30", "modified": "2024-05-31", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nselection:\n Image|endswith: \\cmstp.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_cmstp_initiated_connection.yml", "filename": "net_connection_win_cmstp_initiated_connection.yml", "curated": true, "technique_ids": [ "T1218.003" ], "tactic_tags": [ "stealth" ] }, { "id": "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "title": "Outbound Network Connection Initiated By Microsoft Dialer", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1071.001", "technique": "", "level": "high", "description": "Detects outbound network connection initiated by Microsoft Dialer.\nThe Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.\nThis is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection...", "author": "CertainlyP", "date": "2024-04-26", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nselection:\n Image|endswith: :\\Windows\\System32\\dialer.exe\n Initiated: 'true'", "false_positives": [ "In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives." ], "references": [ "https://tria.ge/240301-rk34sagf5x/behavioral2", "https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d", "https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/", "https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_dialer_initiated_connection.yml", "filename": "net_connection_win_dialer_initiated_connection.yml", "curated": true, "technique_ids": [ "T1071.001" ], "tactic_tags": [ "execution" ] }, { "id": "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "title": "Network Connection Initiated To AzureWebsites.NET By Non-Browser Process", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1102", "technique": "", "level": "medium", "description": "Detects an initiated network connection by a non browser process on the system to \"azurewebsites.net\". The latter was often used by threat actors as a malware hosting and exfiltration site.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2024-06-24", "modified": "2024-07-16", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_avant:\n Image|endswith: \\avant.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Avant Browser\\\n - C:\\Program Files\\Avant Browser\\\nfilter_main_brave:\n Image|endswith: \\brave.exe\n Image|startswith: C:\\Program Files\\BraveSoftware\\\nfilter_main_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_main_chrome_appdata:\n Image|endswith: \\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\n Image|startswith: C:\\Users\\\nfilter_main_defender:\n Image|contains:\n - C:\\Program Files\\Windows Defender Advanced Threat Protection\\\n - C:\\Program Files\\Windows Defender\\\n - C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\n Image|endswith:\n - \\MsMpEng.exe\n - \\MsSense.exe\nfilter_main_discord:\n Image|contains: \\AppData\\Local\\Discord\\\n Image|endswith: \\Discord.exe\nfilter_main_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\Edge...", "false_positives": [ "Unknown" ], "references": [ "https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/", "https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_azurewebsites.yml", "filename": "net_connection_win_domain_azurewebsites.yml", "curated": true, "technique_ids": [ "T1102", "T1102.001" ], "tactic_tags": [] }, { "id": "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "title": "Network Connection Initiated To BTunnels Domains", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567", "technique": "", "level": "medium", "description": "Detects network connections to BTunnels domains initiated by a process on the system.\nAttackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "Kamran Saifullah", "date": "2024-09-13", "modified": "", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith: .btunnel.co.in\n Initiated: 'true'", "false_positives": [ "Legitimate use of BTunnels will also trigger this." ], "references": [ "https://defr0ggy.github.io/research/Utilizing-BTunnel-For-Data-Exfiltration/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_btunnels.yml", "filename": "net_connection_win_domain_btunnels.yml", "curated": true, "technique_ids": [ "T1567", "T1572" ], "tactic_tags": [ "exfiltration" ] }, { "id": "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "title": "Network Connection Initiated To Cloudflared Tunnels Domains", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567", "technique": "", "level": "medium", "description": "Detects network connections to Cloudflared tunnels domains initiated by a process on the system.\nAttackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)", "date": "2024-05-27", "modified": "", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith:\n - .v2.argotunnel.com\n - protocol-v2.argotunnel.com\n - trycloudflare.com\n - update.argotunnel.com\n Initiated: 'true'", "false_positives": [ "Legitimate use of cloudflare tunnels will also trigger this." ], "references": [ "https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/", "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/", "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_cloudflared_communication.yml", "filename": "net_connection_win_domain_cloudflared_communication.yml", "curated": true, "technique_ids": [ "T1567", "T1572" ], "tactic_tags": [ "exfiltration" ] }, { "id": "fa5b1358-b040-4403-9868-15f7d9ab6329", "title": "Network Communication With Crypto Mining Pool", "sysmon_eids": [ 3 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1496", "technique": "", "level": "high", "description": "Detects initiated network connections to crypto mining pools", "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)", "date": "2021-10-26", "modified": "2024-01-19", "detection_yaml": "condition: selection\nselection:\n DestinationHostname:\n - alimabi.cn\n - ap.luckpool.net\n - bcn.pool.minergate.com\n - bcn.vip.pool.minergate.com\n - bohemianpool.com\n - ca-aipg.miningocean.org\n - ca-dynex.miningocean.org\n - ca-neurai.miningocean.org\n - ca-qrl.miningocean.org\n - ca-upx.miningocean.org\n - ca-zephyr.miningocean.org\n - ca.minexmr.com\n - ca.monero.herominers.com\n - cbd.monerpool.org\n - cbdv2.monerpool.org\n - cryptmonero.com\n - crypto-pool.fr\n - crypto-pool.info\n - cryptonight-hub.miningpoolhub.com\n - d1pool.ddns.net\n - d5pool.us\n - daili01.monerpool.org\n - de-aipg.miningocean.org\n - de-dynex.miningocean.org\n - de-zephyr.miningocean.org\n - de.minexmr.com\n - dl.nbminer.com\n - donate.graef.in\n - donate.ssl.xmrig.com\n - donate.v2.xmrig.com\n - donate.xmrig.com\n - donate2.graef.in\n - drill.moneroworld.com\n - dwarfpool.com\n - emercoin.com\n - emercoin.net\n - emergate.net\n - ethereumpool.co\n - eu.luckpool.net\n - eu.minerpool.pw\n - fcn-xmr.po...", "false_positives": [ "Unlikely" ], "references": [ "https://www.poolwatch.io/coin/monero", "https://github.com/stamparm/maltrail/blob/3ea70459b9559134449423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt", "https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_crypto_mining_pools.yml", "filename": "net_connection_win_domain_crypto_mining_pools.yml", "curated": true, "technique_ids": [ "T1496" ], "tactic_tags": [ "impact" ] }, { "id": "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "title": "New Connection Initiated To Potential Dead Drop Resolver Domain", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1102", "technique": "", "level": "high", "description": "Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.\nIn this context attackers leverage known websites such as \"facebook\", \"youtube\", etc. In order to pass through undetected.", "author": "Sorina Ionescu, X__Junior (Nextron Systems)", "date": "2022-08-17", "modified": "2026-03-29", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_avant:\n Image|endswith: \\avant.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Avant Browser\\\n - C:\\Program Files\\Avant Browser\\\nfilter_main_brave:\n Image|endswith: \\brave.exe\n Image|startswith: C:\\Program Files\\BraveSoftware\\\nfilter_main_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_main_chrome_appdata:\n Image|endswith: \\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe\n Image|startswith: C:\\Users\\\nfilter_main_defender:\n Image|contains:\n - C:\\Program Files\\Windows Defender Advanced Threat Protection\\\n - C:\\Program Files\\Windows Defender\\\n - C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\n Image|endswith:\n - \\MsMpEng.exe\n - \\MsSense.exe\nfilter_main_discord:\n DestinationHostname|endswith:\n - discord.com\n - cdn.discordapp.com\n Image|contains: \\AppData\\Local\\Discord\\\n Image|endswith: \\Discord.exe\nfilter...", "false_positives": [ "One might need to exclude other internet browsers found in it's network or other applications like ones mentioned above from Microsoft Defender.", "Ninite contacting githubusercontent.com" ], "references": [ "https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/", "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/", "https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html", "https://github.com/kleiton0x00/RedditC2", "https://twitter.com/kleiton0x7e/status/1600567316810551296" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_dead_drop_resolvers.yml", "filename": "net_connection_win_domain_dead_drop_resolvers.yml", "curated": true, "technique_ids": [ "T1102", "T1102.001" ], "tactic_tags": [] }, { "id": "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "title": "Network Connection Initiated To DevTunnels Domain", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567.001", "technique": "", "level": "medium", "description": "Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "Kamran Saifullah", "date": "2023-11-20", "modified": "", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith: .devtunnels.ms\n Initiated: 'true'", "false_positives": [ "Legitimate use of Devtunnels will also trigger this." ], "references": [ "https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2", "https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security", "https://cydefops.com/devtunnels-unleashed" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_devtunnels.yml", "filename": "net_connection_win_domain_devtunnels.yml", "curated": true, "technique_ids": [ "T1567.001", "T1572" ], "tactic_tags": [ "exfiltration" ] }, { "id": "25eabf56-22f0-4915-a1ed-056b8dae0a68", "title": "Suspicious Dropbox API Usage", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "high", "description": "Detects an executable that isn't dropbox but communicates with the Dropbox API", "author": "Florian Roth (Nextron Systems)", "date": "2022-04-20", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_legit_dropbox:\n Image|contains: \\Dropbox\nselection:\n DestinationHostname|endswith:\n - api.dropboxapi.com\n - content.dropboxapi.com\n Initiated: 'true'", "false_positives": [ "Legitimate use of the API with a tool that the author wasn't aware of" ], "references": [ "https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb", "https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_dropbox_api.yml", "filename": "net_connection_win_domain_dropbox_api.yml", "curated": true, "technique_ids": [ "T1105", "T1567.002" ], "tactic_tags": [ "exfiltration" ] }, { "id": "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "title": "Suspicious Network Connection to IP Lookup Service APIs", "sysmon_eids": [ 3 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1016", "technique": "", "level": "medium", "description": "Detects external IP address lookups by non-browser processes via services such as \"api.ipify.org\". This could be indicative of potential post compromise internet test activity.", "author": "Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)", "date": "2023-04-24", "modified": "2024-03-22", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_brave:\n Image|endswith: \\brave.exe\nfilter_optional_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_optional_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Files\\Microsoft\\EdgeCore\\\nfilter_optional_firefox:\n Image:\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\nfilter_optional_ie:\n Image:\n - C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\n - C:\\Program Files\\Internet Explorer\\...", "false_positives": [ "Legitimate use of the external websites for troubleshooting or network monitoring" ], "references": [ "https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/", "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_external_ip_lookup.yml", "filename": "net_connection_win_domain_external_ip_lookup.yml", "curated": true, "technique_ids": [ "T1016" ], "tactic_tags": [ "discovery" ] }, { "id": "7e9cf7b6-e827-11ed-a05b-0242ac120003", "title": "Suspicious Non-Browser Network Communication With Google API", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1102", "technique": "", "level": "medium", "description": "Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)", "author": "Gavin Knapp", "date": "2023-05-01", "modified": "2025-02-22", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_empty:\n Image: ''\nfilter_main_null:\n Image: null\nfilter_optional_brave:\n Image|endswith: \\brave.exe\nfilter_optional_chrome:\n Image|endswith:\n - :\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - :\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_edge_1:\n- Image|contains: :\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith:\n - :\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - :\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\n - \\WindowsApps\\MicrosoftEdge.exe\nfilter_optional_edge_2:\n Image|contains:\n - :\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - :\\Program Files\\Microsoft\\EdgeCore\\\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\nfilter_optional_firefox:\n Image|endswith:\n - :\\Program Files\\Mozilla Firefox\\firefox.exe\n - :\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\nfilter_optional_google_drive:\n Imag...", "false_positives": [ "Legitimate applications communicating with the \"googleapis.com\" endpoints that are not already in the exclusion list. This is environmental dependent and requires further testing and tuning." ], "references": [ "https://github.com/looCiprian/GC2-sheet", "https://youtu.be/n2dFlSaBBKo", "https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf", "https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/", "https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_google_api_non_browser_access.yml", "filename": "net_connection_win_domain_google_api_non_browser_access.yml", "curated": true, "technique_ids": [ "T1102" ], "tactic_tags": [] }, { "id": "3ab65069-d82a-4d44-a759-466661a082d1", "title": "Communication To LocaltoNet Tunneling Service Initiated", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1572", "technique": "", "level": "high", "description": "Detects an executable initiating a network connection to \"LocaltoNet\" tunneling sub-domains.\nLocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.\nAttackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.", "author": "Andreas Braathen (mnemonic.io)", "date": "2024-06-17", "modified": "", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith:\n - .localto.net\n - .localtonet.com\n Initiated: 'true'", "false_positives": [ "Legitimate use of the LocaltoNet service." ], "references": [ "https://localtonet.com/documents/supported-tunnels", "https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_localtonet_tunnel.yml", "filename": "net_connection_win_domain_localtonet_tunnel.yml", "curated": true, "technique_ids": [ "T1572", "T1090", "T1102" ], "tactic_tags": [] }, { "id": "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4", "title": "Network Connection Initiated To Mega.nz", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567.002", "technique": "", "level": "low", "description": "Detects a network connection initiated by a binary to \"api.mega.co.nz\".\nAttackers were seen abusing file sharing websites similar to \"mega.nz\" in order to upload/download additional payloads.", "author": "Florian Roth (Nextron Systems)", "date": "2021-12-06", "modified": "2024-05-31", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith:\n - mega.co.nz\n - mega.nz\n Initiated: 'true'", "false_positives": [ "Legitimate MEGA installers and utilities are expected to communicate with this domain. Exclude hosts that are known to be allowed to use this tool." ], "references": [ "https://megatools.megous.com/", "https://www.mandiant.com/resources/russian-targeting-gov-business" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_mega_nz.yml", "filename": "net_connection_win_domain_mega_nz.yml", "curated": true, "technique_ids": [ "T1567.002" ], "tactic_tags": [ "exfiltration" ] }, { "id": "18249279-932f-45e2-b37a-8925f2597670", "title": "Process Initiated Network Connection To Ngrok Domain", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567", "technique": "", "level": "high", "description": "Detects an executable initiating a network connection to \"ngrok\" domains.\nAttackers were seen using this \"ngrok\" in order to store their second stage payloads and malware.\nWhile communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.", "author": "Florian Roth (Nextron Systems)", "date": "2022-07-16", "modified": "2025-07-30", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith:\n - .ngrok-free.app\n - .ngrok-free.dev\n - .ngrok.app\n - .ngrok.dev\n - .ngrok.io\n Initiated: 'true'", "false_positives": [ "Legitimate use of the ngrok service." ], "references": [ "https://ngrok.com/", "https://ngrok.com/blog-post/new-ngrok-domains", "https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/", "https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_ngrok.yml", "filename": "net_connection_win_domain_ngrok.yml", "curated": true, "technique_ids": [ "T1567", "T1572", "T1102" ], "tactic_tags": [ "exfiltration" ] }, { "id": "1d08ac94-400d-4469-a82f-daee9a908849", "title": "Communication To Ngrok Tunneling Service Initiated", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567", "technique": "", "level": "high", "description": "Detects an executable initiating a network connection to \"ngrok\" tunneling domains.\nAttackers were seen using this \"ngrok\" in order to store their second stage payloads and malware.\nWhile communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.", "author": "Florian Roth (Nextron Systems)", "date": "2022-11-03", "modified": "2024-02-02", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|contains:\n - tunnel.us.ngrok.com\n - tunnel.eu.ngrok.com\n - tunnel.ap.ngrok.com\n - tunnel.au.ngrok.com\n - tunnel.sa.ngrok.com\n - tunnel.jp.ngrok.com\n - tunnel.in.ngrok.com", "false_positives": [ "Legitimate use of the ngrok service." ], "references": [ "https://twitter.com/hakluke/status/1587733971814977537/photo/1", "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_ngrok_tunnel.yml", "filename": "net_connection_win_domain_ngrok_tunnel.yml", "curated": true, "technique_ids": [ "T1567", "T1568.002", "T1572", "T1090", "T1102" ], "tactic_tags": [ "exfiltration" ] }, { "id": "7e9cf7b6-e827-11ed-a05b-15959c120003", "title": "Potentially Suspicious Network Connection To Notion API", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1102", "technique": "", "level": "low", "description": "Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as \"OffensiveNotion C2\"", "author": "Gavin Knapp", "date": "2023-05-03", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_brave:\n Image|endswith: \\brave.exe\nfilter_main_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_main_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_main_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Files\\Microsoft\\EdgeCore\\\nfilter_main_firefox:\n Image:\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\nfilter_main_ie:\n Image:\n - C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\n - C:\\Program Files\\Internet Explorer\\iexplore.exe\nfilter_main_max...", "false_positives": [ "Legitimate applications communicating with the \"api.notion.com\" endpoint that are not already in the exclusion list. The desktop and browser applications do not appear to be using the API by default unless integrations are configured." ], "references": [ "https://github.com/mttaggart/OffensiveNotion", "https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_notion_api_susp_communication.yml", "filename": "net_connection_win_domain_notion_api_susp_communication.yml", "curated": true, "technique_ids": [ "T1102" ], "tactic_tags": [] }, { "id": "07837ab9-60e1-481f-a74d-c31fb496a94c", "title": "Network Communication Initiated To Portmap.IO Domain", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1041", "technique": "", "level": "medium", "description": "Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors", "author": "Florian Roth (Nextron Systems)", "date": "2024-05-31", "modified": "", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith: .portmap.io\n Initiated: 'true'", "false_positives": [ "Legitimate use of portmap.io domains" ], "references": [ "https://portmap.io/", "https://github.com/rapid7/metasploit-framework/issues/11337", "https://pro.twitter.com/JaromirHorejsi/status/1795001037746761892/photo/2" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_portmap.yml", "filename": "net_connection_win_domain_portmap.yml", "curated": true, "technique_ids": [ "T1041", "T1090.002" ], "tactic_tags": [ "exfiltration" ] }, { "id": "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "title": "Suspicious Non-Browser Network Communication With Telegram API", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1102", "technique": "", "level": "medium", "description": "Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-05-19", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_brave:\n Image|endswith: \\brave.exe\nfilter_main_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_main_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_main_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Files\\Microsoft\\EdgeCore\\\nfilter_main_firefox:\n Image:\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\nfilter_main_ie:\n Image:\n - C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\n - C:\\Program Files\\Internet Explorer\\iexplore.exe\nfilter_main_max...", "false_positives": [ "Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS etc." ], "references": [ "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_telegram_api_non_browser_access.yml", "filename": "net_connection_win_domain_telegram_api_non_browser_access.yml", "curated": true, "technique_ids": [ "T1102", "T1567", "T1105" ], "tactic_tags": [ "exfiltration" ] }, { "id": "4b657234-038e-4ad5-997c-4be42340bce4", "title": "Network Connection Initiated To Visual Studio Code Tunnels Domain", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567", "technique": "", "level": "medium", "description": "Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "Kamran Saifullah", "date": "2023-11-20", "modified": "", "detection_yaml": "condition: selection\nselection:\n DestinationHostname|endswith: .tunnels.api.visualstudio.com\n Initiated: 'true'", "false_positives": [ "Legitimate use of Visual Studio Code tunnel will also trigger this." ], "references": [ "https://ipfyx.fr/post/visual-studio-code-tunnel/", "https://badoption.eu/blog/2023/01/31/code_c2.html", "https://cydefops.com/vscode-data-exfiltration" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_domain_vscode_tunnel_connection.yml", "filename": "net_connection_win_domain_vscode_tunnel_connection.yml", "curated": true, "technique_ids": [ "T1567", "T1572" ], "tactic_tags": [ "exfiltration" ] }, { "id": "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "title": "Network Connection Initiated By Eqnedt32.EXE", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1203", "technique": "", "level": "high", "description": "Detects network connections from the Equation Editor process \"eqnedt32.exe\".", "author": "Max Altgelt (Nextron Systems)", "date": "2022-04-14", "modified": "2024-05-31", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\eqnedt32.exe", "false_positives": [ "Unlikely" ], "references": [ "https://twitter.com/forensicitguy/status/1513538712986079238", "https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/", "https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_eqnedt.yml", "filename": "net_connection_win_eqnedt.yml", "curated": true, "technique_ids": [ "T1203" ], "tactic_tags": [ "execution" ] }, { "id": "2fdaf50b-9fd5-449f-ba69-f17248119af6", "title": "Network Connection Initiated via Finger.EXE", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1071.004", "technique": "", "level": "high", "description": "Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.\nIn one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.\nSince the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.\nInvestigating such network connections can also help identify potential malicious infrastructure used by threat actors", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-11-19", "modified": "", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\finger.exe\n Initiated: 'true'", "false_positives": [ "Unlikely" ], "references": [ "https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_finger.yml", "filename": "net_connection_win_finger.yml", "curated": true, "technique_ids": [ "T1071.004", "T1059.003" ], "tactic_tags": [ "execution" ] }, { "id": "8d7e392e-9b28-49e1-831d-5949c6281228", "title": "Network Connection Initiated By IMEWDBLD.EXE", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "high", "description": "Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.", "author": "frack113", "date": "2022-01-22", "modified": "2023-11-09", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\IMEWDBLD.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download", "https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_imewdbld.yml", "filename": "net_connection_win_imewdbld.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "e81528db-fc02-45e8-8e98-4e84aba1f10b", "title": "Network Connection Initiated Via Notepad.EXE", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "high", "description": "Detects a network connection that is initiated by the \"notepad.exe\" process.\nThis might be a sign of process injection from a beacon process or something similar.\nNotepad rarely initiates a network communication except when printing documents for example.", "author": "EagleEye Team", "date": "2020-05-14", "modified": "2024-02-02", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_printing:\n DestinationPort: 9100\nselection:\n Image|endswith: \\notepad.exe", "false_positives": [ "Printing documents via notepad might cause communication with the printer via port 9100 or similar." ], "references": [ "https://web.archive.org/web/20200219102749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf", "https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_notepad.yml", "filename": "net_connection_win_notepad.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "title": "Office Application Initiated Network Connection To Non-Local IP", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1203", "technique": "", "level": "medium", "description": "Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.\nThis rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.\nThis rule will require an initial baseline and tuning that is specific to your organization.", "author": "Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)", "date": "2021-11-10", "modified": "2025-10-17", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_destination_host:\n DestinationHostname|endswith: .deploy.static.akamaitechnologies.com\n DestinationPort: 443\n Protocol: tcp\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nfilter_main_msrange_exchange_1:\n DestinationIp|cidr:\n - 13.107.4.0/22\n - 13.107.6.152/31\n - 13.107.18.10/31\n - 13.107.42.0/23\n - 13.107.128.0/22\n - 23.35.224.0/20\n - 23.53.40.0/22\n - 23.103.160.0/20\n - 23.216.76.0/22\n - 40.96.0.0/13\n - 40.104.0.0/15\n - 52.96.0.0/14\n - 131.253.33.215/32\n - 132.245.0.0/16\n - 150.171.32.0/22\n - 204.79.197.215/32\n - 2603:1006::/40\n - 2603:1016::/36\n - 2603:1026::/36\n - 2603:1036::/36\n - 2603:1046::/36\n - 2603:1056::/36\n - 2620:1ec:4::152/128\n - 2620:1ec:4::153/128\n - 2620:1ec:c::10/128\n - 2620:1ec:c::11/128\n - 2620:1ec:d::10/128\n - 2620:1ec:d::11/128\n - 2620:1ec:8f0::/4...", "false_positives": [ "You may have to tune certain domains out that Excel may call out to, such as microsoft or other business use case domains.", "Office documents commonly have templates that refer to external addresses, like \"sharepoint.ourcompany.com\" may have to be tuned.", "It is highly recommended to baseline your activity and tune out common business use cases." ], "references": [ "https://corelight.com/blog/detecting-cve-2021-42292", "https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_office_outbound_non_local_ip.yml", "filename": "net_connection_win_office_outbound_non_local_ip.yml", "curated": true, "technique_ids": [ "T1203" ], "tactic_tags": [ "execution" ] }, { "id": "3b5ba899-9842-4bc2-acc2-12308498bf42", "title": "Office Application Initiated Network Connection Over Uncommon Ports", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "medium", "description": "Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.", "author": "X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)", "date": "2023-07-12", "modified": "2025-10-17", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_common_ports:\n DestinationPort:\n - 53\n - 80\n - 139\n - 389\n - 443\n - 445\n - 3268\nfilter_main_outlook_ports:\n DestinationPort:\n - 143\n - 465\n - 587\n - 993\n - 995\n Image|contains: :\\Program Files\\Microsoft Office\\\n Image|endswith: \\OUTLOOK.EXE\nselection:\n Image|endswith:\n - \\excel.exe\n - \\outlook.exe\n - \\powerpnt.exe\n - \\winword.exe\n - \\wordview.exe\n Initiated: 'true'", "false_positives": [ "Other ports can be used, apply additional filters accordingly" ], "references": [ "https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_office_uncommon_ports.yml", "filename": "net_connection_win_office_uncommon_ports.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "title": "Python Initiated Connection", "sysmon_eids": [ 3 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1046", "technique": "", "level": "medium", "description": "Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.", "author": "frack113", "date": "2021-12-10", "modified": "2025-03-05", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_local_communication:\n DestinationIp: 127.0.0.1\n SourceIp: 127.0.0.1\nfilter_main_pip:\n CommandLine|contains|all:\n - pip.exe\n - install\nfilter_optional_conda:\n CommandLine|contains|all:\n - :\\ProgramData\\Anaconda3\\Scripts\\conda-script.py\n - update\n ParentImage: C:\\ProgramData\\Anaconda3\\Scripts\\conda.exe\nfilter_optional_conda_jupyter_notebook:\n CommandLine|contains: C:\\ProgramData\\Anaconda3\\Scripts\\jupyter-notebook-script.py\n ParentImage: C:\\ProgramData\\Anaconda3\\python.exe\nselection:\n Image|contains|all:\n - \\python\n - .exe\n Initiated: 'true'", "false_positives": [ "Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying." ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python", "https://pypi.org/project/scapy/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_python.yml", "filename": "net_connection_win_python.yml", "curated": true, "technique_ids": [ "T1046" ], "tactic_tags": [ "discovery" ] }, { "id": "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "title": "Outbound RDP Connections Over Non-Standard Tools", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.001", "technique": "", "level": "high", "description": "Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.\nAn initial baseline is required before using this utility to exclude third party RDP tooling that you might use.", "author": "Markus Neis", "date": "2019-05-15", "modified": "2024-02-09", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_mstsc:\n Image:\n - C:\\Windows\\System32\\mstsc.exe\n - C:\\Windows\\SysWOW64\\mstsc.exe\nfilter_optional_avast:\n Image|endswith:\n - \\Avast Software\\Avast\\AvastSvc.exe\n - \\Avast\\AvastSvc.exe\nfilter_optional_chrome:\n Image: C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_dns:\n Image: C:\\Windows\\System32\\dns.exe\n Protocol: udp\n SourcePort: 53\nfilter_optional_empty:\n Image: ''\nfilter_optional_firefox:\n Image: C:\\Program Files\\Mozilla Firefox\\firefox.exe\nfilter_optional_null:\n Image: null\nfilter_optional_sentinel_one:\n Image|endswith: \\Ranger\\SentinelRanger.exe\nfilter_optional_splunk:\n Image|startswith: C:\\Program Files\\SplunkUniversalForwarder\\bin\\\nfilter_optional_sysinternals_rdcman:\n Image|endswith: \\RDCMan.exe\nfilter_optional_third_party:\n Image|endswith:\n - \\FSAssessment.exe\n - \\FSDiscovery.exe\n - \\MobaRTE.exe\n - \\mRemote.exe\n - \\mRemoteNG.exe\n - \\Passwords...", "false_positives": [ "Third party RDP tools" ], "references": [ "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_outbound_over_non_standard_tools.yml", "filename": "net_connection_win_rdp_outbound_over_non_standard_tools.yml", "curated": true, "technique_ids": [ "T1021.001" ], "tactic_tags": [] }, { "id": "5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "title": "RDP Over Reverse SSH Tunnel", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1572", "technique": "", "level": "high", "description": "Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389", "author": "Samir Bousseaden", "date": "2019-02-16", "modified": "2024-03-12", "detection_yaml": "condition: all of selection_*\nselection_destination:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - ::1/128\nselection_img:\n Image|endswith: \\svchost.exe\n Initiated: 'true'\n SourcePort: 3389", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/cyb3rops/status/1096842275437625346" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_reverse_tunnel.yml", "filename": "net_connection_win_rdp_reverse_tunnel.yml", "curated": true, "technique_ids": [ "T1572", "T1021.001" ], "tactic_tags": [] }, { "id": "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "title": "RDP to HTTP or HTTPS Target Ports", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1572", "technique": "", "level": "high", "description": "Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443", "author": "Florian Roth (Nextron Systems)", "date": "2022-04-29", "modified": "2022-07-14", "detection_yaml": "condition: selection\nselection:\n DestinationPort:\n - 80\n - 443\n Image|endswith: \\svchost.exe\n Initiated: 'true'\n SourcePort: 3389", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/tekdefense/status/1519711183162556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg", "https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rdp_to_http.yml", "filename": "net_connection_win_rdp_to_http.yml", "curated": true, "technique_ids": [ "T1572", "T1021.001" ], "tactic_tags": [] }, { "id": "0531e43a-d77d-47c2-b89f-5fe50321c805", "title": "RegAsm.EXE Initiating Network Connection To Public IP", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.009", "technique": "", "level": "medium", "description": "Detects \"RegAsm.exe\" initiating a network connection to public IP adresses", "author": "frack113", "date": "2024-04-25", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nselection:\n Image|endswith: \\regasm.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/", "https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/", "https://lolbas-project.github.io/lolbas/Binaries/Regasm/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_regasm_network_activity.yml", "filename": "net_connection_win_regasm_network_activity.yml", "curated": true, "technique_ids": [ "T1218.009" ], "tactic_tags": [ "stealth" ] }, { "id": "c7e91a02-d771-4a6d-a700-42587e0b1095", "title": "Network Connection Initiated By Regsvr32.EXE", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1559.001", "technique": "", "level": "medium", "description": "Detects a network connection initiated by \"Regsvr32.exe\"", "author": "Dmitriy Lifanov, oscd.community", "date": "2019-10-25", "modified": "2023-09-18", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\regsvr32.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_regsvr32_network_activity.yml", "filename": "net_connection_win_regsvr32_network_activity.yml", "curated": true, "technique_ids": [ "T1559.001", "T1218.010" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "title": "Remote Access Tool - AnyDesk Incoming Connection", "sysmon_eids": [ 3 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1219.002", "technique": "", "level": "medium", "description": "Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.", "author": "@d4ns4n_ (Wuerth-Phoenix)", "date": "2024-09-02", "modified": "2025-02-24", "detection_yaml": "condition: selection\nselection:\n Image|endswith:\n - \\AnyDesk.exe\n - \\AnyDeskMSI.exe\n Initiated: 'false'", "false_positives": [ "Legitimate incoming connections (e.g. sysadmin activity). Most of the time I would expect outgoing connections (initiated locally)." ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows", "https://asec.ahnlab.com/en/40263/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_remote_access_tools_anydesk_incoming_connection.yml", "filename": "net_connection_win_remote_access_tools_anydesk_incoming_connection.yml", "curated": true, "technique_ids": [ "T1219.002" ], "tactic_tags": [ "persistence" ] }, { "id": "cdc8da7d-c303-42f8-b08c-b4ab47230263", "title": "Rundll32 Internet Connection", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.011", "technique": "", "level": "medium", "description": "Detects a rundll32 that communicates with public IP addresses", "author": "Florian Roth (Nextron Systems)", "date": "2017-11-04", "modified": "2024-03-13", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_app_sdb:\n CommandLine|endswith: \\system32\\PcaSvc.dll,PcaPatchSdbTask\nfilter_main_azure_managed:\n SourceHostname|endswith: .internal.cloudapp.net\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nfilter_main_ms_ranges:\n DestinationIp|cidr:\n - 20.0.0.0/8\n - 51.103.0.0/16\n - 51.104.0.0/16\n - 51.105.0.0/16\nfilter_main_svchost_update_processes:\n DestinationPort: 443\n ParentImage: C:\\Windows\\System32\\svchost.exe\nselection:\n Image|endswith: \\rundll32.exe\n Initiated: 'true'", "false_positives": [ "Communication to other corporate systems that use IP addresses from public address spaces" ], "references": [ "https://www.hybrid-analysis.com/sample/759fb4c0091a78c5ee035715afe3084686a8493f39014aea72dae36869de9ff6?environmentId=100" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_rundll32_net_connections.yml", "filename": "net_connection_win_rundll32_net_connections.yml", "curated": true, "technique_ids": [ "T1218.011" ], "tactic_tags": [ "stealth", "execution" ] }, { "id": "50e54b8d-ad73-43f8-96a1-5191685b17a4", "title": "Silenttrinity Stager Msbuild Activity", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1127.001", "technique": "", "level": "high", "description": "Detects a possible remote connections to Silenttrinity c2", "author": "Kiran kumar s, oscd.community", "date": "2020-10-11", "modified": "2022-10-05", "detection_yaml": "condition: selection and filter\nfilter:\n DestinationPort:\n - 80\n - 443\n Initiated: 'true'\nselection:\n Image|endswith: \\msbuild.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_silenttrinity_stager_msbuild_activity.yml", "filename": "net_connection_win_silenttrinity_stager_msbuild_activity.yml", "curated": true, "technique_ids": [ "T1127.001" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "20384606-a124-4fec-acbb-8bd373728613", "title": "Suspicious Network Connection Binary No CommandLine", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects suspicious network connections made by a well-known Windows binary run with no command line parameters", "author": "Florian Roth (Nextron Systems)", "date": "2022-07-03", "modified": "", "detection_yaml": "condition: selection and not 1 of filter*\nfilter_no_cmdline:\n CommandLine: ''\nfilter_null:\n CommandLine: null\nselection:\n CommandLine|endswith:\n - \\regsvr32.exe\n - \\rundll32.exe\n - \\dllhost.exe\n Image|endswith:\n - \\regsvr32.exe\n - \\rundll32.exe\n - \\dllhost.exe\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://redcanary.com/blog/raspberry-robin/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_binary_no_cmdline.yml", "filename": "net_connection_win_susp_binary_no_cmdline.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "title": "Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "high", "description": "Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.", "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)", "date": "2018-08-30", "modified": "2026-03-29", "detection_yaml": "condition: all of selection_*\nselection_domains:\n DestinationHostname|endswith:\n - .githubusercontent.com\n - 0x0.st\n - anonfiles.com\n - bashupload.com\n - cdn.discordapp.com\n - chunk.io\n - ddns.net\n - dl.dropboxusercontent.com\n - ghostbin.co\n - github.com\n - glitch.me\n - gofile.io\n - hastebin.com\n - mediafire.com\n - mega.co.nz\n - mega.nz\n - onrender.com\n - pages.dev\n - paste.ee\n - pastebin.com\n - pastebin.pl\n - pastetext.net\n - pixeldrain.com\n - privatlab.com\n - privatlab.net\n - send.exploit.in\n - sendspace.com\n - storage.googleapis.com\n - storjshare.io\n - supabase.co\n - temp.sh\n - transfer.sh\n - trycloudflare.com\n - ufile.io\n - w3spaces.com\n - workers.dev\n - x0.at\n Initiated: 'true'\nselection_paths:\n Image|contains:\n - :\\$Recycle.bin\n - :\\Perflogs\\\n - :\\Temp\\\n - :\\Users\\Default\\\n - :\\Users\\Public\\\n - :\\Windows\\Fonts\\\n - :\\Windows\\IME\\\n - :\\Windows\\System32\\Tasks\\\n - :\\Windows\\Tasks\\\n - :\\Windows\\Temp\\\n - \\AppData\\Temp\\\n - \\config\\s...", "false_positives": [ "Some installers located in the temp directory might communicate with the Github domains in order to download additional software. Baseline these cases or move the github domain to a lower level hunting rule." ], "references": [ "https://twitter.com/M_haggis/status/900741347035889665", "https://twitter.com/M_haggis/status/1032799638213066752", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a", "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_file_sharing_domains_susp_folders.yml", "filename": "net_connection_win_susp_file_sharing_domains_susp_folders.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "7b434893-c57d-4f41-908d-6a17bf1ae98f", "title": "Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "high", "description": "Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.", "author": "Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)", "date": "2017-03-19", "modified": "2026-03-29", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_domains:\n DestinationHostname|endswith:\n - .githubusercontent.com\n - 0x0.st\n - anonfiles.com\n - bashupload.com\n - cdn.discordapp.com\n - chunk.io\n - ddns.net\n - dl.dropboxusercontent.com\n - ghostbin.co\n - github.com\n - glitch.me\n - gofile.io\n - hastebin.com\n - mediafire.com\n - mega.co.nz\n - mega.nz\n - onrender.com\n - pages.dev\n - paste.ee\n - pastebin.com\n - pastebin.pl\n - pastetext.net\n - portmap.io\n - privatlab.com\n - privatlab.net\n - send.exploit.in\n - sendspace.com\n - storage.googleapis.com\n - storjshare.io\n - supabase.co\n - temp.sh\n - transfer.sh\n - trycloudflare.com\n - ufile.io\n - w3spaces.com\n - workers.dev\n - x0.at\nselection:\n Image|contains:\n - :\\$Recycle.bin\n - :\\Perflogs\\\n - :\\Temp\\\n - :\\Users\\Default\\\n - :\\Users\\Public\\\n - :\\Windows\\Fonts\\\n - :\\Windows\\IME\\\n - :\\Windows\\System32\\Tasks\\\n - :\\Windows\\Tasks\\\n - \\config\\systemprofile\\\n - \\Contacts\\\n - \\Favorites\\\n - ...", "false_positives": [ "Unknown" ], "references": [ "https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml", "filename": "net_connection_win_susp_initiated_uncommon_or_suspicious_locations.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "title": "Potentially Suspicious Malware Callback Communication", "sysmon_eids": [ 3 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1571", "technique": "", "level": "high", "description": "Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases", "author": "Florian Roth (Nextron Systems)", "date": "2017-03-19", "modified": "2024-03-12", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nfilter_optional_sys_directories:\n Image|startswith:\n - C:\\Program Files\\\n - C:\\Program Files (x86)\\\nselection:\n DestinationPort:\n - 100\n - 198\n - 200\n - 243\n - 473\n - 666\n - 700\n - 743\n - 777\n - 1443\n - 1515\n - 1777\n - 1817\n - 1904\n - 1960\n - 2443\n - 2448\n - 3360\n - 3675\n - 3939\n - 4040\n - 4433\n - 4438\n - 4443\n - 4444\n - 4455\n - 5445\n - 5552\n - 5649\n - 6625\n - 7210\n - 7777\n - 8143\n - 8843\n - 9631\n - 9943\n - 10101\n - 12102\n - 12103\n - 12322\n - 13145\n - 13394\n - 13504\n - 13505\n - 13506\n - 13507\n - 14102\n - 14103\n - 14154\n - 49180\n - 65520\n - 65535\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_malware_callback_port.yml", "filename": "net_connection_win_susp_malware_callback_port.yml", "curated": true, "technique_ids": [ "T1571" ], "tactic_tags": [ "persistence" ] }, { "id": "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "title": "Communication To Uncommon Destination Ports", "sysmon_eids": [ 3 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1571", "technique": "", "level": "medium", "description": "Detects programs that connect to uncommon destination ports", "author": "Florian Roth (Nextron Systems)", "date": "2017-03-19", "modified": "2024-03-12", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nfilter_optional_sys_directories:\n Image|startswith:\n - C:\\Program Files\\\n - C:\\Program Files (x86)\\\nselection:\n DestinationPort:\n - 8080\n - 8888\n Initiated: 'true'", "false_positives": [ "Unknown" ], "references": [ "https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_malware_callback_ports_uncommon.yml", "filename": "net_connection_win_susp_malware_callback_ports_uncommon.yml", "curated": true, "technique_ids": [ "T1571" ], "tactic_tags": [ "persistence" ] }, { "id": "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "title": "Uncommon Outbound Kerberos Connection", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1558", "technique": "", "level": "medium", "description": "Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.", "author": "Ilyas Ochkov, oscd.community", "date": "2019-10-24", "modified": "2024-03-15", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_lsass:\n Image: C:\\Windows\\System32\\lsass.exe\nfilter_optional_chrome:\n Image:\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_firefox:\n Image:\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\nfilter_optional_tomcat:\n Image|endswith: \\tomcat\\bin\\tomcat8.exe\nselection:\n DestinationPort: 88\n Initiated: 'true'", "false_positives": [ "Web Browsers and third party application might generate similar activity. An initial baseline is required." ], "references": [ "https://github.com/GhostPack/Rubeus" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_kerberos_connection.yml", "filename": "net_connection_win_susp_outbound_kerberos_connection.yml", "curated": true, "technique_ids": [ "T1558", "T1550.003" ], "tactic_tags": [] }, { "id": "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "title": "Microsoft Sync Center Suspicious Network Connections", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "medium", "description": "Detects suspicious connections from Microsoft Sync Center to non-private IPs.", "author": "elhoim", "date": "2022-04-28", "modified": "2024-03-12", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nselection:\n Image|endswith: \\mobsync.exe", "false_positives": [ "Unknown" ], "references": [ "https://redcanary.com/blog/intelligence-insights-november-2021/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml", "filename": "net_connection_win_susp_outbound_mobsync_connection.yml", "curated": true, "technique_ids": [ "T1055", "T1218" ], "tactic_tags": [ "stealth", "execution" ] }, { "id": "9976fa64-2804-423c-8a5b-646ade840773", "title": "Suspicious Outbound SMTP Connections", "sysmon_eids": [ 3 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1048.003", "technique": "", "level": "medium", "description": "Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.\nThe data may also be sent to an alternate network location from the main command and control server.", "author": "frack113", "date": "2022-01-07", "modified": "2022-09-21", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_clients:\n Image|endswith:\n - \\thunderbird.exe\n - \\outlook.exe\nfilter_mailserver:\n Image|startswith: C:\\Program Files\\Microsoft\\Exchange Server\\\nfilter_outlook:\n Image|endswith: \\HxTsr.exe\n Image|startswith: C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_\nselection:\n DestinationPort:\n - 25\n - 587\n - 465\n - 2525\n Initiated: 'true'", "false_positives": [ "Other SMTP tools" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp", "https://www.ietf.org/rfc/rfc2821.txt" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_outbound_smtp_connections.yml", "filename": "net_connection_win_susp_outbound_smtp_connections.yml", "curated": true, "technique_ids": [ "T1048.003" ], "tactic_tags": [ "exfiltration" ] }, { "id": "c539afac-c12a-46ed-b1bd-5a5567c9f045", "title": "Potential Remote PowerShell Session Initiated", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059.001", "technique": "", "level": "high", "description": "Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.\nThis could potentially indicates a remote PowerShell connection.", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-09-12", "modified": "2024-02-02", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_localhost:\n DestinationIp:\n - ::1\n - 127.0.0.1\n SourceIp:\n - ::1\n - 127.0.0.1\nfilter_main_service_users:\n- User|contains:\n - NETWORK SERVICE\n - NETZWERKDIENST\n - SERVICIO DE RED\n - SERVIZIO DI RETE\n- User|contains|all:\n - SERVICE R\n - SEAU\nfilter_optional_avast:\n Image:\n - C:\\Program Files\\Avast Software\\Avast\\AvastSvc.exe\n - C:\\Program Files (x86)\\Avast Software\\Avast\\AvastSvc.exe\nselection:\n DestinationPort:\n - 5985\n - 5986\n Initiated: 'true'\n SourceIsIpv6: 'false'", "false_positives": [ "Legitimate usage of remote PowerShell, e.g. remote administration and monitoring.", "Network Service user name of a not-covered localization" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml", "filename": "net_connection_win_susp_remote_powershell_session.yml", "curated": true, "technique_ids": [ "T1059.001", "T1021.006" ], "tactic_tags": [ "execution" ] }, { "id": "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "title": "Outbound Network Connection To Public IP Via Winlogon", "sysmon_eids": [ 3 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1218.011", "technique": "", "level": "medium", "description": "Detects a \"winlogon.exe\" process that initiate network communications with public IP addresses", "author": "Christopher Peacock @securepeacock, SCYTHE @scythe_io", "date": "2023-04-28", "modified": "2024-03-12", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nselection:\n Image|endswith: \\winlogon.exe\n Initiated: 'true'", "false_positives": [ "Communication to other corporate systems that use IP addresses from public address spaces" ], "references": [ "https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_winlogon_net_connections.yml", "filename": "net_connection_win_winlogon_net_connections.yml", "curated": true, "technique_ids": [ "T1218.011" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "786cdae8-fefb-4eb2-9227-04e34060db01", "title": "Suspicious Wordpad Outbound Connections", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "medium", "description": "Detects a network connection initiated by \"wordpad.exe\" over uncommon destination ports.\nThis might indicate potential process injection activity from a beacon or similar mechanisms.", "author": "X__Junior (Nextron Systems)", "date": "2023-07-12", "modified": "2023-12-15", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_ports:\n DestinationPort:\n - 80\n - 139\n - 443\n - 445\n - 465\n - 587\n - 993\n - 995\nselection:\n Image|endswith: \\wordpad.exe\n Initiated: 'true'", "false_positives": [ "Other ports can be used, apply additional filters accordingly" ], "references": [ "https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wordpad_uncommon_ports.yml", "filename": "net_connection_win_wordpad_uncommon_ports.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "08249dc0-a28d-4555-8ba5-9255a198e08c", "title": "Local Network Connection Initiated By Script Interpreter", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "medium", "description": "Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.", "author": "frack113", "date": "2022-08-28", "modified": "2024-05-31", "detection_yaml": "condition: selection\nselection:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\n Image|endswith:\n - \\wscript.exe\n - \\cscript.exe\n Initiated: 'true'", "false_positives": [ "Legitimate scripts" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wscript_cscript_local_connection.yml", "filename": "net_connection_win_wscript_cscript_local_connection.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "992a6cae-db6a-43c8-9cec-76d7195c96fc", "title": "Outbound Network Connection Initiated By Script Interpreter", "sysmon_eids": [ 3 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "high", "description": "Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.", "author": "frack113, Florian Roth (Nextron Systems)", "date": "2022-08-28", "modified": "2024-03-13", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_local_ranges:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nfilter_main_ms_ranges:\n DestinationIp|cidr: 20.0.0.0/11\nselection:\n Image|endswith:\n - \\wscript.exe\n - \\cscript.exe\n Initiated: 'true'", "false_positives": [ "Legitimate scripts" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wscript_cscript_outbound_connection.yml", "filename": "net_connection_win_wscript_cscript_outbound_connection.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "c649a6c7-cd8c-4a78-9c04-000fc76df954", "title": "Potentially Suspicious Wuauclt Network Connection", "sysmon_eids": [ 3 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218", "technique": "", "level": "medium", "description": "Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.\nOne could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-10-12", "modified": "2024-03-12", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_cli_empty:\n CommandLine: ''\nfilter_main_cli_null:\n CommandLine: null\nfilter_main_ip:\n DestinationIp|cidr:\n - 127.0.0.0/8\n - 10.0.0.0/8\n - 169.254.0.0/16\n - 172.16.0.0/12\n - 192.168.0.0/16\n - ::1/128\n - fe80::/10\n - fc00::/7\nfilter_main_msrange:\n DestinationIp|cidr:\n - 20.184.0.0/13\n - 20.192.0.0/10\n - 23.79.0.0/16\n - 51.10.0.0/15\n - 51.103.0.0/16\n - 51.104.0.0/15\n - 52.224.0.0/11\nfilter_main_uus:\n CommandLine|contains:\n - :\\Windows\\UUS\\Packages\\Preview\\amd64\\updatedeploy.dll /ClassId\n - :\\Windows\\UUS\\amd64\\UpdateDeploy.dll /ClassId\nfilter_main_winsxs:\n CommandLine|contains|all:\n - :\\Windows\\WinSxS\\\n - '\\UpdateDeploy.dll /ClassId '\nselection:\n CommandLine|contains: ' /RunHandlerComServer'\n Image|contains: wuauclt", "false_positives": [ "Unknown" ], "references": [ "https://dtm.uk/wuauclt/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml", "filename": "net_connection_win_wuauclt_network_connection.yml", "curated": true, "technique_ids": [ "T1218" ], "tactic_tags": [ "stealth" ] }, { "id": "75e508f7-932d-4ebc-af77-269237a84ce1", "title": "DLL Loaded From Suspicious Location Via Cmspt.EXE", "sysmon_eids": [ 7 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.003", "technique": "", "level": "high", "description": "Detects cmstp loading \"dll\" or \"ocx\" files from suspicious locations", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-30", "modified": "2023-02-17", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|contains:\n - \\PerfLogs\\\n - \\ProgramData\\\n - \\Users\\\n - \\Windows\\Temp\\\n - C:\\Temp\\\n ImageLoaded|endswith:\n - .dll\n - .ocx\n Image|endswith: \\cmstp.exe", "false_positives": [ "Unikely" ], "references": [ "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/TTPs/Defense%20Evasion/T1218%20-%20Signed%20Binary%20Proxy%20Execution/T1218.003%20-%20CMSTP/Procedures.yaml" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_cmstp_load_dll_from_susp_location.yml", "filename": "image_load_cmstp_load_dll_from_susp_location.yml", "curated": true, "technique_ids": [ "T1218.003" ], "tactic_tags": [ "stealth" ] }, { "id": "84b0a8f3-680b-4096-a45b-e9a89221727c", "title": "PCRE.NET Package Image Load", "sysmon_eids": [ 7 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059", "technique": "", "level": "high", "description": "Detects processes loading modules related to PCRE.NET package", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-10-29", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|contains: \\AppData\\Local\\Temp\\ba9ea7344a4a5f591d6e5dc32a13494b\\", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/rbmaslen/status/1321859647091970051", "https://twitter.com/tifkin_/status/1321916444557365248" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_pcre_dotnet_dll_load.yml", "filename": "image_load_dll_pcre_dotnet_dll_load.yml", "curated": true, "technique_ids": [ "T1059" ], "tactic_tags": [ "execution" ] }, { "id": "b48492dc-c5ef-4572-8dff-32bc241c15c8", "title": "Load Of RstrtMgr.DLL By A Suspicious Process", "sysmon_eids": [ 7 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1486", "technique": "", "level": "high", "description": "Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.\nThis library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.\nIt could also be used for anti-analysis purposes by shut downing specific processes.", "author": "Luc G\u00e9naux", "date": "2023-11-28", "modified": "", "detection_yaml": "condition: selection_img and 1 of selection_folders_*\nselection_folders_1:\n Image|contains:\n - :\\Perflogs\\\n - :\\Users\\Public\\\n - \\Temporary Internet\nselection_folders_2:\n- Image|contains|all:\n - :\\Users\\\n - \\Favorites\\\n- Image|contains|all:\n - :\\Users\\\n - \\Favourites\\\n- Image|contains|all:\n - :\\Users\\\n - \\Contacts\\\nselection_img:\n- ImageLoaded|endswith: \\RstrtMgr.dll\n- OriginalFileName: RstrtMgr.dll", "false_positives": [ "Processes related to software installation" ], "references": [ "https://www.crowdstrike.com/blog/windows-restart-manager-part-1/", "https://www.crowdstrike.com/blog/windows-restart-manager-part-2/", "https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/", "https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_rstrtmgr_suspicious_load.yml", "filename": "image_load_dll_rstrtmgr_suspicious_load.yml", "curated": true, "technique_ids": [ "T1486", "T1685" ], "tactic_tags": [ "impact" ] }, { "id": "ec8c4047-fad9-416a-8c81-0f479353d7f6", "title": "Diagnostic Library Sdiageng.DLL Loaded By Msdt.EXE", "sysmon_eids": [ 7 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1202", "technique": "", "level": "high", "description": "Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the \"sdiageng.dll\" library", "author": "Greg (rule)", "date": "2022-06-17", "modified": "2023-02-17", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith: \\sdiageng.dll\n Image|endswith: \\msdt.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.securonix.com/blog/detecting-microsoft-msdt-dogwalk/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_sdiageng_load_by_msdt.yml", "filename": "image_load_dll_sdiageng_load_by_msdt.yml", "curated": true, "technique_ids": [ "T1202" ], "tactic_tags": [ "stealth" ] }, { "id": "49329257-089d-46e6-af37-4afce4290685", "title": "HackTool - SharpEvtMute DLL Load", "sysmon_eids": [ 7 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs", "author": "Florian Roth (Nextron Systems)", "date": "2022-09-07", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n Hashes|contains: IMPHASH=330768A4F172E10ACB6287B87289D83B", "false_positives": [ "Other DLLs with the same Imphash" ], "references": [ "https://github.com/bats3c/EvtMute" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_hktl_sharpevtmute.yml", "filename": "image_load_hktl_sharpevtmute.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "title": "HackTool - SILENTTRINITY Stager DLL Load", "sysmon_eids": [ 7 ], "tactic": "", "tactic_id": "", "technique_id": "T1071", "technique": "", "level": "high", "description": "Detects SILENTTRINITY stager dll loading activity", "author": "Aleksey Potapov, oscd.community", "date": "2019-10-22", "modified": "2023-02-17", "detection_yaml": "condition: selection\nselection:\n Description|contains: st2stager", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/byt3bl33d3r/SILENTTRINITY" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_hktl_silenttrinity_stager.yml", "filename": "image_load_hktl_silenttrinity_stager.yml", "curated": true, "technique_ids": [ "T1071" ], "tactic_tags": [] }, { "id": "f354eba5-623b-450f-b073-0b5b2773b6aa", "title": "Potential DCOM InternetExplorer.Application DLL Hijack - Image Load", "sysmon_eids": [ 7 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "critical", "description": "Detects potential DLL hijack of \"iertutil.dll\" found in the DCOM InternetExplorer.Application Class", "author": "Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga", "date": "2020-10-12", "modified": "2022-12-18", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith: \\Internet Explorer\\iertutil.dll\n Image|endswith: \\Internet Explorer\\iexplore.exe", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_iexplore_dcom_iertutil_dll_hijack.yml", "filename": "image_load_iexplore_dcom_iertutil_dll_hijack.yml", "curated": true, "technique_ids": [ "T1021.002", "T1021.003" ], "tactic_tags": [] }, { "id": "90217a70-13fc-48e4-b3db-0d836c5824ac", "title": "GAC DLL Loaded Via Office Applications", "sysmon_eids": [ 7 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1204.002", "technique": "", "level": "high", "description": "Detects any GAC DLL being loaded by an Office Product", "author": "Antonlovesdnb", "date": "2020-02-19", "modified": "2023-02-10", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|startswith: C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\n Image|endswith:\n - \\excel.exe\n - \\mspub.exe\n - \\onenote.exe\n - \\onenoteim.exe\n - \\outlook.exe\n - \\powerpnt.exe\n - \\winword.exe", "false_positives": [ "Legitimate macro usage. Add the appropriate filter according to your environment" ], "references": [ "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_office_dotnet_gac_dll_load.yml", "filename": "image_load_office_dotnet_gac_dll_load.yml", "curated": true, "technique_ids": [ "T1204.002" ], "tactic_tags": [ "execution" ] }, { "id": "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "title": "Abusable DLL Potential Sideloading From Suspicious Location", "sysmon_eids": [ 7 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059", "technique": "", "level": "high", "description": "Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations", "author": "X__Junior (Nextron Systems)", "date": "2023-07-11", "modified": "", "detection_yaml": "condition: selection_dll and 1 of selection_folders_*\nselection_dll:\n ImageLoaded|endswith:\n - \\coreclr.dll\n - \\facesdk.dll\n - \\HPCustPartUI.dll\n - \\libcef.dll\n - \\ZIPDLL.dll\nselection_folders_1:\n ImageLoaded|contains:\n - :\\Perflogs\\\n - :\\Users\\Public\\\n - \\Temporary Internet\n - \\Windows\\Temp\\\nselection_folders_2:\n- ImageLoaded|contains|all:\n - :\\Users\\\n - \\Favorites\\\n- ImageLoaded|contains|all:\n - :\\Users\\\n - \\Favourites\\\n- ImageLoaded|contains|all:\n - :\\Users\\\n - \\Contacts\\\n- ImageLoaded|contains|all:\n - :\\Users\\\n - \\Pictures\\", "false_positives": [ "Unknown" ], "references": [ "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html", "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml", "filename": "image_load_side_load_abused_dlls_susp_paths.yml", "curated": true, "technique_ids": [ "T1059" ], "tactic_tags": [ "execution" ] }, { "id": "90ae0469-0cee-4509-b67f-e5efcef040f7", "title": "Aruba Network Service Potential DLL Sideloading", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access \"arubanetsvc.exe\" process using DLL Search Order Hijacking", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-01-22", "modified": "2023-03-15", "detection_yaml": "condition: selection and not filter\nfilter:\n ImageLoaded|startswith:\n - C:\\Windows\\System32\\\n - C:\\Windows\\SysWOW64\\\n - C:\\Windows\\WinSxS\\\nselection:\n ImageLoaded|endswith:\n - \\wtsapi32.dll\n - \\msvcr100.dll\n - \\msvcp100.dll\n - \\dbghelp.dll\n - \\dbgcore.dll\n - \\wininet.dll\n - \\iphlpapi.dll\n - \\version.dll\n - \\cryptsp.dll\n - \\cryptbase.dll\n - \\wldp.dll\n - \\profapi.dll\n - \\sspicli.dll\n - \\winsta.dll\n - \\dpapi.dll\n Image|endswith: \\arubanetsvc.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/wdormann/status/1616581559892545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_aruba_networks_virtual_intranet_access.yml", "filename": "image_load_side_load_aruba_networks_virtual_intranet_access.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "6360757a-d460-456c-8b13-74cf0e60cceb", "title": "Potential DLL Sideloading Via comctl32.dll", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects potential DLL sideloading using comctl32.dll to obtain system privileges", "author": "Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash)", "date": "2022-12-16", "modified": "2022-12-19", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith: \\comctl32.dll\n ImageLoaded|startswith:\n - C:\\Windows\\System32\\logonUI.exe.local\\\n - C:\\Windows\\System32\\werFault.exe.local\\\n - C:\\Windows\\System32\\consent.exe.local\\\n - C:\\Windows\\System32\\narrator.exe.local\\\n - C:\\windows\\system32\\wermgr.exe.local\\", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/binderlabs/DirCreate2System", "https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_comctl32.yml", "filename": "image_load_side_load_comctl32.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5", "title": "Potential EACore.DLL Sideloading", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects potential DLL sideloading of \"EACore.dll\"", "author": "X__Junior (Nextron Systems)", "date": "2023-08-03", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_legit_path:\n ImageLoaded|startswith: C:\\Program Files\\Electronic Arts\\EA Desktop\\\n Image|contains|all:\n - C:\\Program Files\\Electronic Arts\\EA Desktop\\\n - \\EACoreServer.exe\nselection:\n ImageLoaded|endswith: \\EACore.dll", "false_positives": [ "Unlikely" ], "references": [ "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_eacore.yml", "filename": "image_load_side_load_eacore.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "d2451be2-b582-4e15-8701-4196ac180260", "title": "Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects potential DLL side loading of \"KeyScramblerIE.dll\" by \"KeyScrambler.exe\".\nVarious threat actors and malware have been found side loading a masqueraded \"KeyScramblerIE.dll\" through \"KeyScrambler.exe\".", "author": "Swachchhanda Shrawan Poudel", "date": "2024-04-15", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_legitimate_path:\n ImageLoaded|contains:\n - C:\\Program Files (x86)\\KeyScrambler\\\n - C:\\Program Files\\KeyScrambler\\\n Image|contains:\n - C:\\Program Files (x86)\\KeyScrambler\\\n - C:\\Program Files\\KeyScrambler\\\nfilter_main_signature:\n Signature: QFX Software Corporation\n SignatureStatus: Valid\nselection:\n ImageLoaded|endswith: \\KeyScramblerIE.dll\n Image|endswith:\n - \\KeyScrambler.exe\n - \\KeyScramblerLogon.exe", "false_positives": [ "Unknown" ], "references": [ "https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html", "https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/", "https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/", "https://twitter.com/Max_Mal_/status/1775222576639291859", "https://twitter.com/DTCERT/status/1712785426895839339" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_keyscrambler.yml", "filename": "image_load_side_load_keyscrambler.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "6b98b92b-4f00-4f62-b4fe-4d1920215771", "title": "Potential DLL Sideloading Of Non-Existent DLLs From System Folders", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts.\nPhantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.", "author": "Nasreddine Bencherchali (Nextron Systems), SBousseaden", "date": "2022-12-09", "modified": "2026-01-24", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_ms_signed:\n Signature: Microsoft Windows\n SignatureStatus: Valid\n Signed: 'true'\nselection:\n ImageLoaded|endswith:\n - :\\Windows\\System32\\axeonoffhelper.dll\n - :\\Windows\\System32\\cdpsgshims.dll\n - :\\Windows\\System32\\oci.dll\n - :\\Windows\\System32\\offdmpsvc.dll\n - :\\Windows\\System32\\shellchromeapi.dll\n - :\\Windows\\System32\\TSMSISrv.dll\n - :\\Windows\\System32\\TSVIPSrv.dll\n - :\\Windows\\System32\\wbem\\wbemcomn.dll\n - :\\Windows\\System32\\WLBSCTRL.dll\n - :\\Windows\\System32\\wow64log.dll\n - :\\Windows\\System32\\WptsExtensions.dll", "false_positives": [ "Unknown" ], "references": [ "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html", "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/", "https://decoded.avast.io/martinchlumecky/png-steganography/", "https://github.com/Wh04m1001/SysmonEoP", "https://itm4n.github.io/cdpsvc-dll-hijacking/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml", "filename": "image_load_side_load_non_existent_dlls.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "title": "Microsoft Office DLL Sideload", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location", "author": "Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)", "date": "2022-08-17", "modified": "2023-03-15", "detection_yaml": "condition: selection and not filter\nfilter:\n ImageLoaded|startswith:\n - C:\\Program Files\\Microsoft Office\\OFFICE\n - C:\\Program Files (x86)\\Microsoft Office\\OFFICE\n - C:\\Program Files\\Microsoft Office\\Root\\OFFICE\n - C:\\Program Files (x86)\\Microsoft Office\\Root\\OFFICE\nselection:\n ImageLoaded|endswith: \\outllib.dll", "false_positives": [ "Unlikely" ], "references": [ "https://hijacklibs.net/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_office_dlls.yml", "filename": "image_load_side_load_office_dlls.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "title": "DLL Sideloading Of ShellChromeAPI.DLL", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects processes loading the non-existent DLL \"ShellChromeAPI\". One known example is the \"DeviceEnroller\" binary in combination with the \"PhoneDeepLink\" flag tries to load this DLL.\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-12-01", "modified": "", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith: \\ShellChromeAPI.dll", "false_positives": [ "Unknown" ], "references": [ "https://mobile.twitter.com/0gtweet/status/1564131230941122561", "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml", "filename": "image_load_side_load_shell_chrome_api.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "828af599-4c53-4ed2-ba4a-a9f835c434ea", "title": "Fax Service DLL Search Order Hijack", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.", "author": "NVISO", "date": "2020-05-04", "modified": "2022-06-02", "detection_yaml": "condition: selection and not filter\nfilter:\n ImageLoaded|startswith: C:\\Windows\\WinSxS\\\nselection:\n ImageLoaded|endswith: ualapi.dll\n Image|endswith: \\fxssvc.exe", "false_positives": [ "Unlikely" ], "references": [ "https://windows-internals.com/faxing-your-way-to-system/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_ualapi.yml", "filename": "image_load_side_load_ualapi.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "9313dc13-d04c-46d8-af4a-a930cc55d93b", "title": "Potential DLL Sideloading Via VMware Xfer", "sysmon_eids": [ 7 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1574.001", "technique": "", "level": "high", "description": "Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-02", "modified": "2023-02-17", "detection_yaml": "condition: selection and not filter\nfilter:\n ImageLoaded|startswith: C:\\Program Files\\VMware\\\nselection:\n ImageLoaded|endswith: \\glib-2.0.dll\n Image|endswith: \\VMwareXferlogs.exe", "false_positives": [ "Unlikely" ], "references": [ "https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_vmware_xfer.yml", "filename": "image_load_side_load_vmware_xfer.yml", "curated": true, "technique_ids": [ "T1574.001" ], "tactic_tags": [ "persistence", "execution", "stealth" ] }, { "id": "6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984", "title": "BaaUpdate.exe Suspicious DLL Load", "sysmon_eids": [ 7 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218", "technique": "", "level": "high", "description": "Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.\nThis technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)\nwhich can launch BaaUpdate.exe, which is vulnerable to ...", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-10-18", "modified": "", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|contains:\n - :\\Perflogs\\\n - :\\Users\\Default\\\n - :\\Users\\Public\\\n - :\\Windows\\Temp\\\n - \\AppData\\Local\\Temp\\\n - \\AppData\\Roaming\\\n - \\Contacts\\\n - \\Favorites\\\n - \\Favourites\\\n - \\Links\\\n - \\Music\\\n - \\Pictures\\\n - \\ProgramData\\\n - \\Temporary Internet\n - \\Videos\\\n ImageLoaded|endswith: .dll\n Image|endswith: \\BaaUpdate.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/rtecCyberSec/BitlockMove" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml", "filename": "image_load_susp_baaupdate_dll_load.yml", "curated": true, "technique_ids": [ "T1218", "T1021.003" ], "tactic_tags": [ "stealth" ] }, { "id": "4508a70e-97ef-4300-b62b-ff27992990ea", "title": "DotNet CLR DLL Loaded By Scripting Applications", "sysmon_eids": [ 7 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "high", "description": "Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.", "author": "omkar72, oscd.community", "date": "2020-10-14", "modified": "2023-02-23", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith:\n - \\clr.dll\n - \\mscoree.dll\n - \\mscorlib.dll\n Image|endswith:\n - \\cmstp.exe\n - \\cscript.exe\n - \\mshta.exe\n - \\msxsl.exe\n - \\regsvr32.exe\n - \\wmic.exe\n - \\wscript.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/tyranid/DotNetToJScript", "https://thewover.github.io/Introducing-Donut/", "https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html", "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml", "filename": "image_load_susp_script_dotnet_clr_dll_load.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "2e4e488a-6164-4811-9ea1-f960c7359c40", "title": "HackTool - CACTUSTORCH Remote Thread Creation", "sysmon_eids": [ 8 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1055.012", "technique": "", "level": "high", "description": "Detects remote thread creation from CACTUSTORCH as described in references.", "author": "@SBousseaden (detection), Thomas Patzke (rule)", "date": "2019-02-01", "modified": "2023-05-05", "detection_yaml": "condition: selection\nselection:\n SourceImage|endswith:\n - \\System32\\cscript.exe\n - \\System32\\wscript.exe\n - \\System32\\mshta.exe\n - \\winword.exe\n - \\excel.exe\n StartModule: null\n TargetImage|contains: \\SysWOW64\\", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SBousseaden/status/1090588499517079552", "https://github.com/mdsecactivebreach/CACTUSTORCH" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cactustorch.yml", "filename": "create_remote_thread_win_hktl_cactustorch.yml", "curated": true, "technique_ids": [ "T1055.012", "T1059.005", "T1059.007", "T1218.005" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "6309645e-122d-4c5b-bb2b-22e4f9c2fa42", "title": "HackTool - Potential CobaltStrike Process Injection", "sysmon_eids": [ 8 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055.001", "technique": "", "level": "high", "description": "Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons", "author": "Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community", "date": "2018-11-30", "modified": "2023-05-05", "detection_yaml": "condition: selection\nselection:\n StartAddress|endswith:\n - 0B80\n - 0C7C\n - 0C88", "false_positives": [ "Unknown" ], "references": [ "https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f", "https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_hktl_cobaltstrike.yml", "filename": "create_remote_thread_win_hktl_cobaltstrike.yml", "curated": true, "technique_ids": [ "T1055.001" ], "tactic_tags": [ "stealth" ] }, { "id": "77564cc2-7382-438b-a7f6-395c2ae53b9a", "title": "Remote Thread Created In KeePass.EXE", "sysmon_eids": [ 8 ], "tactic": "", "tactic_id": "", "technique_id": "T1555.005", "technique": "", "level": "high", "description": "Detects remote thread creation in \"KeePass.exe\" which could indicates potential password dumping activity", "author": "Timon Hackenjos", "date": "2022-04-22", "modified": "2023-05-05", "detection_yaml": "condition: selection\nselection:\n TargetImage|endswith: \\KeePass.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.cisa.gov/uscert/ncas/alerts/aa20-259a", "https://github.com/denandz/KeeFarce", "https://github.com/GhostPack/KeeThief" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml", "filename": "create_remote_thread_win_keepass.yml", "curated": true, "technique_ids": [ "T1555.005" ], "tactic_tags": [] }, { "id": "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "title": "Remote Thread Creation In Mstsc.Exe From Suspicious Location", "sysmon_eids": [ 8 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects remote thread creation in the \"mstsc.exe\" process by a process located in a potentially suspicious location.\nThis technique is often used by attackers in order to hook some APIs used by DLLs loaded by \"mstsc.exe\" during RDP authentications in order to steal credentials.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-07-28", "modified": "2024-01-22", "detection_yaml": "condition: selection\nselection:\n SourceImage|contains:\n - :\\Temp\\\n - :\\Users\\Public\\\n - :\\Windows\\PerfLogs\\\n - :\\Windows\\Tasks\\\n - :\\Windows\\Temp\\\n - \\AppData\\Local\\Temp\\\n TargetImage|endswith: \\mstsc.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_mstsc_susp_location.yml", "filename": "create_remote_thread_win_mstsc_susp_location.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "fb656378-f909-47c1-8747-278bf09f4f4f", "title": "Potential Credential Dumping Attempt Via PowerShell Remote Thread", "sysmon_eids": [ 8 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects remote thread creation by PowerShell processes into \"lsass.exe\"", "author": "oscd.community, Natalia Shornikova", "date": "2020-10-06", "modified": "2022-12-18", "detection_yaml": "condition: selection\nselection:\n SourceImage|endswith:\n - \\powershell.exe\n - \\pwsh.exe\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_powershell_lsass.yml", "filename": "create_remote_thread_win_powershell_lsass.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "99b97608-3e21-4bfe-8217-2a127c396a0e", "title": "Remote Thread Creation Via PowerShell In Uncommon Target", "sysmon_eids": [ 8 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1218.011", "technique": "", "level": "medium", "description": "Detects the creation of a remote thread from a Powershell process in an uncommon target process", "author": "Florian Roth (Nextron Systems)", "date": "2018-06-25", "modified": "2023-11-10", "detection_yaml": "condition: selection\nselection:\n SourceImage|endswith:\n - \\powershell.exe\n - \\pwsh.exe\n TargetImage|endswith:\n - \\rundll32.exe\n - \\regsvr32.exe", "false_positives": [ "Unknown" ], "references": [ "https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml", "filename": "create_remote_thread_win_powershell_susp_targets.yml", "curated": true, "technique_ids": [ "T1218.011", "T1059.001" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "f239b326-2f41-4d6b-9dfa-c846a60ef505", "title": "Password Dumper Remote Thread in LSASS", "sysmon_eids": [ 8 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.\nThe process in field Process is the malicious program. A single execution can lead to hundreds of events.", "author": "Thomas Patzke", "date": "2017-02-19", "modified": "2021-06-21", "detection_yaml": "condition: selection\nselection:\n StartModule: ''\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Antivirus products" ], "references": [ "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_password_dumper_lsass.yml", "filename": "create_remote_thread_win_susp_password_dumper_lsass.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "02d1d718-dd13-41af-989d-ea85c7fab93f", "title": "Rare Remote Thread Creation By Uncommon Source Image", "sysmon_eids": [ 8 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "high", "description": "Detects uncommon processes creating remote threads.", "author": "Perez Diego (@darkquassar), oscd.community", "date": "2019-10-27", "modified": "2025-12-08", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_conhost:\n SourceImage:\n - C:\\Windows\\System32\\Defrag.exe\n - C:\\Windows\\System32\\makecab.exe\n TargetImage: C:\\Windows\\System32\\conhost.exe\nfilter_main_ms_office:\n SourceImage|startswith:\n - C:\\Program Files\\Microsoft Office\\\n - C:\\Program Files (x86)\\Microsoft Office\\\n TargetImage: System\nfilter_main_provtol_svchost:\n SourceImage: C:\\Windows\\System32\\provtool.exe\n TargetImage: C:\\Windows\\System32\\svchost.exe\nfilter_main_provtool_system:\n SourceImage: C:\\Windows\\System32\\provtool.exe\n TargetImage: System\nfilter_main_userinit:\n SourceImage: C:\\Windows\\System32\\userinit.exe\n TargetImage: C:\\Windows\\explorer.exe\nfilter_main_winword:\n SourceImage|endswith: \\WINWORD.EXE\n TargetImage|startswith:\n - C:\\Program Files (x86)\\\n - C:\\Program Files\\\nfilter_optional_explorer_vmtools:\n SourceImage|endswith: \\SysWOW64\\explorer.exe\n TargetImage:\n - C:\\Program Files (x86)\\VMware\\VMware Tools\\...", "false_positives": [ "This rule is best put in testing first in order to create a baseline that reflects the data in your environment." ], "references": [ "Personal research, statistical analysis", "https://lolbas-project.github.io" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml", "filename": "create_remote_thread_win_susp_relevant_source_image.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "66d31e5f-52d6-40a4-9615-002d3789a119", "title": "Remote Thread Creation By Uncommon Source Image", "sysmon_eids": [ 8 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "medium", "description": "Detects uncommon processes creating remote threads.", "author": "Perez Diego (@darkquassar), oscd.community", "date": "2019-10-27", "modified": "2025-07-08", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_empty:\n TargetImage: ''\nfilter_main_explorer:\n SourceImage: C:\\Windows\\explorer.exe\n TargetImage|startswith:\n - C:\\Program Files (x86)\\\n - C:\\Program Files\\\n - C:\\Windows\\System32\\\n - C:\\Windows\\SysWOW64\\\nfilter_main_iexplore:\n SourceImage: C:\\Program Files\\Internet Explorer\\iexplore.exe\n TargetImage:\n - C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\n - C:\\Windows\\System32\\rundll32.exe\nfilter_main_msiexec_1:\n SourceImage|endswith: \\msiexec.exe\n TargetImage|contains:\n - \\AppData\\Local\\\n - C:\\Program Files (x86)\\\n - C:\\Program Files\\\n - C:\\Windows\\Microsoft.NET\\Framework64\\\nfilter_main_msiexec_2:\n SourceImage|endswith: \\msiexec.exe\n TargetImage:\n - C:\\Windows\\System32\\msiexec.exe\n - C:\\Windows\\SysWOW64\\msiexec.exe\nfilter_main_null:\n TargetImage: null\nfilter_main_powerpnt:\n SourceImage|endswith: \\POWERPNT.EXE\n TargetImage|contains:\n - C:\\Program Files\\Microsoft Off...", "false_positives": [ "This rule is best put in testing first in order to create a baseline that reflects the data in your environment." ], "references": [ "Personal research, statistical analysis", "https://lolbas-project.github.io" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_source_image.yml", "filename": "create_remote_thread_win_susp_uncommon_source_image.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "a1a144b7-5c9b-4853-a559-2172be8d4a03", "title": "Remote Thread Creation In Uncommon Target Image", "sysmon_eids": [ 8 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055.003", "technique": "", "level": "medium", "description": "Detects uncommon target processes for remote thread creation", "author": "Florian Roth (Nextron Systems)", "date": "2022-03-16", "modified": "2025-07-04", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_csrss:\n SourceImage: C:\\Windows\\System32\\csrss.exe\nfilter_main_notepad:\n SourceImage:\n - C:\\Windows\\System32\\explorer.exe\n - C:\\Windows\\System32\\OpenWith.exe\n TargetImage: C:\\Windows\\System32\\notepad.exe\nfilter_main_sethc:\n SourceImage: C:\\Windows\\System32\\AtBroker.exe\n TargetImage: C:\\Windows\\System32\\Sethc.exe\nfilter_optional_aurora_1:\n StartFunction: EtwpNotificationThread\nfilter_optional_aurora_2:\n SourceImage|contains: unknown process\nfilter_optional_vmtoolsd:\n SourceImage: C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\n StartFunction: GetCommandLineW\n TargetImage:\n - C:\\Windows\\System32\\notepad.exe\n - C:\\Windows\\System32\\spoolsv.exe\nfilter_optional_xerox_pjems:\n SourceImage: C:\\Program Files\\Xerox\\XeroxPrintExperience\\CommonFiles\\XeroxPrintJobEventManagerService.exe\n StartFunction: LoadLibraryW\n TargetImage: C:\\Windows\\System32\\spoolsv.exe\nselection:\n TargetImage|end...", "false_positives": [ "Unknown" ], "references": [ "https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_susp_uncommon_target_image.yml", "filename": "create_remote_thread_win_susp_uncommon_target_image.yml", "curated": true, "technique_ids": [ "T1055.003" ], "tactic_tags": [ "stealth" ] }, { "id": "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "title": "Remote Thread Creation Ttdinject.exe Proxy", "sysmon_eids": [ 8 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1127", "technique": "", "level": "high", "description": "Detects a remote thread creation of Ttdinject.exe used as proxy", "author": "frack113", "date": "2022-05-16", "modified": "2022-06-02", "detection_yaml": "condition: selection\nselection:\n SourceImage|endswith: \\ttdinject.exe", "false_positives": [ "Unknown" ], "references": [ "https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_remote_thread/create_remote_thread_win_ttdinjec.yml", "filename": "create_remote_thread_win_ttdinjec.yml", "curated": true, "technique_ids": [ "T1127" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "b69888d4-380c-45ce-9cf9-d9ce46e67821", "title": "Hidden Executable In NTFS Alternate Data Stream", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564.004", "technique": "", "level": "medium", "description": "Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash", "author": "Florian Roth (Nextron Systems), @0xrawsec", "date": "2018-06-03", "modified": "2023-02-10", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_null:\n Hash|contains: IMPHASH=00000000000000000000000000000000\nselection:\n Hash|contains: IMPHASH=", "false_positives": [ "This rule isn't looking for any particular binary characteristics. As legitimate installers and programs were seen embedding hidden binaries in their ADS. Some false positives are expected from browser processes and similar." ], "references": [ "https://twitter.com/0xrawsec/status/1002478725605273600?s=21" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_ads_executable.yml", "filename": "create_stream_hash_ads_executable.yml", "curated": true, "technique_ids": [ "T1564.004" ], "tactic_tags": [ "stealth" ] }, { "id": "573df571-a223-43bc-846e-3f98da481eca", "title": "Creation Of a Suspicious ADS File Outside a Browser Download", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "medium", "description": "Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers", "author": "frack113", "date": "2022-10-22", "modified": "2023-06-12", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_brave:\n Image|endswith: \\brave.exe\nfilter_optional_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_optional_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Files\\Microsoft\\EdgeCore\\\nfilter_optional_firefox:\n Image:\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\nfilter_optional_ie:\n Image:\n - C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\n - C:\\Program Files\\Internet Explorer\\...", "false_positives": [ "Other legitimate browsers not currently included in the filter (please add them)", "Legitimate downloads via scripting or command-line tools (Investigate to determine if it's legitimate)" ], "references": [ "https://www.bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_creation_internet_file.yml", "filename": "create_stream_hash_creation_internet_file.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "52182dfb-afb7-41db-b4bc-5336cb29b464", "title": "Suspicious File Download From File Sharing Websites - File Stream", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564.004", "technique": "", "level": "high", "description": "Detects the download of suspicious file type from a well-known file and paste sharing domain", "author": "Florian Roth (Nextron Systems)", "date": "2022-08-24", "modified": "2026-03-29", "detection_yaml": "condition: all of selection_*\nselection_domain:\n Contents|contains:\n - .githubusercontent.com\n - 0x0.st\n - anonfiles.com\n - bashupload.com\n - cdn.discordapp.com\n - chunk.io\n - ddns.net\n - dl.dropboxusercontent.com\n - ghostbin.co\n - github.com\n - glitch.me\n - gofile.io\n - hastebin.com\n - mediafire.com\n - mega.nz\n - onrender.com\n - pages.dev\n - paste.ee\n - pastebin.com\n - pastebin.pl\n - pastetext.net\n - pixeldrain.com\n - privatlab.com\n - privatlab.net\n - send.exploit.in\n - sendspace.com\n - storage.googleapis.com\n - storjshare.io\n - supabase.co\n - temp.sh\n - transfer.sh\n - trycloudflare.com\n - ufile.io\n - w3spaces.com\n - workers.dev\n - x0.at\nselection_extension:\n TargetFilename|contains:\n - .cpl:Zone\n - .dll:Zone\n - .exe:Zone\n - .hta:Zone\n - .lnk:Zone\n - .one:Zone\n - .vbe:Zone\n - .vbs:Zone\n - .xll:Zone", "false_positives": [ "Some false positives might occur with binaries download via Github" ], "references": [ "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015", "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a", "https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/", "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_susp_extension.yml", "filename": "create_stream_hash_file_sharing_domains_download_susp_extension.yml", "curated": true, "technique_ids": [ "T1564.004" ], "tactic_tags": [ "stealth" ] }, { "id": "ae02ed70-11aa-4a22-b397-c0d0e8f6ea99", "title": "Unusual File Download From File Sharing Websites - File Stream", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564.004", "technique": "", "level": "medium", "description": "Detects the download of suspicious file type from a well-known file and paste sharing domain", "author": "Florian Roth (Nextron Systems)", "date": "2022-08-24", "modified": "2026-03-29", "detection_yaml": "condition: all of selection_*\nselection_domain:\n Contents|contains:\n - .githubusercontent.com\n - 0x0.st\n - anonfiles.com\n - bashupload.com\n - cdn.discordapp.com\n - chunk.io\n - ddns.net\n - dl.dropboxusercontent.com\n - ghostbin.co\n - github.com\n - glitch.me\n - gofile.io\n - hastebin.com\n - mediafire.com\n - mega.nz\n - onrender.com\n - pages.dev\n - paste.ee\n - pastebin.com\n - pastebin.pl\n - pastetext.net\n - pixeldrain.com\n - privatlab.com\n - privatlab.net\n - send.exploit.in\n - sendspace.com\n - storage.googleapis.com\n - storjshare.io\n - supabase.co\n - temp.sh\n - transfer.sh\n - trycloudflare.com\n - ufile.io\n - w3spaces.com\n - workers.dev\n - x0.at\nselection_extension:\n TargetFilename|contains:\n - .bat:Zone\n - .cmd:Zone\n - .ps1:Zone", "false_positives": [ "Unknown" ], "references": [ "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015", "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a", "https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_file_sharing_domains_download_unusual_extension.yml", "filename": "create_stream_hash_file_sharing_domains_download_unusual_extension.yml", "curated": true, "technique_ids": [ "T1564.004" ], "tactic_tags": [ "stealth" ] }, { "id": "19b041f6-e583-40dc-b842-d6fa8011493f", "title": "HackTool Named File Stream Created", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564.004", "technique": "", "level": "high", "description": "Detects the creation of a named file stream with the imphash of a well-known hack tool", "author": "Florian Roth (Nextron Systems)", "date": "2022-08-24", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n Hash|contains:\n - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932\n - IMPHASH=3A19059BD7688CB88E70005F18EFC439\n - IMPHASH=bf6223a49e45d99094406777eb6004ba\n - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6\n - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3\n - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF\n - IMPHASH=4C1B52A19748428E51B14C278D0F58E3\n - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F\n - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A\n - IMPHASH=672B13F4A0B6F27D29065123FE882DFC\n - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F\n - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D\n - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456\n - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3\n - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88\n - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4\n - IMPHASH=D21BBC50DCC169D7B4D0F01962793154\n - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6\n - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1\n - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC\n - IMPHASH=F9A28C458284584A93B14216308D31BD\n -...", "false_positives": [ "Unknown" ], "references": [ "https://github.com/gentilkiwi/mimikatz", "https://github.com/topotam/PetitPotam", "https://github.com/ohpe/juicy-potato", "https://github.com/antonioCoco/RoguePotato", "https://www.tarasco.org/security/pwdump_7/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_hktl_generic_download.yml", "filename": "create_stream_hash_hktl_generic_download.yml", "curated": true, "technique_ids": [ "T1564.004" ], "tactic_tags": [ "stealth" ] }, { "id": "0d7a9363-af70-4e7b-a3b7-1a176b7fbe84", "title": "Exports Registry Key To an Alternate Data Stream", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564.004", "technique": "", "level": "high", "description": "Exports the target Registry key and hides it in the specified alternate data stream.", "author": "Oddvar Moe, Sander Wiebing, oscd.community", "date": "2020-10-07", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\regedit.exe", "false_positives": [ "Unknown" ], "references": [ "https://lolbas-project.github.io/lolbas/Binaries/Regedit/", "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_regedit_export_to_ads.yml", "filename": "create_stream_hash_regedit_export_to_ads.yml", "curated": true, "technique_ids": [ "T1564.004" ], "tactic_tags": [ "stealth" ] }, { "id": "025bd229-fd1f-4fdb-97ab-20006e1a5368", "title": "Unusual File Download from Direct IP Address", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564.004", "technique": "", "level": "high", "description": "Detects the download of suspicious file type from URLs with IP", "author": "Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)", "date": "2022-09-07", "modified": "2023-02-10", "detection_yaml": "condition: selection\nselection:\n Contents|re: http[s]?://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\n TargetFilename|contains:\n - .ps1:Zone\n - .bat:Zone\n - .exe:Zone\n - .vbe:Zone\n - .vbs:Zone\n - .dll:Zone\n - .one:Zone\n - .cmd:Zone\n - .hta:Zone\n - .xll:Zone\n - .lnk:Zone", "false_positives": [ "Unknown" ], "references": [ "https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md", "https://labs.withsecure.com/publications/detecting-onenote-abuse" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml", "filename": "create_stream_hash_susp_ip_domains.yml", "curated": true, "technique_ids": [ "T1564.004" ], "tactic_tags": [ "stealth" ] }, { "id": "a3f5c081-e75b-43a0-9f5b-51f26fe5dba2", "title": "Potential Suspicious Winget Package Installation", "sysmon_eids": [ 15 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects potential suspicious winget package installation from a suspicious source.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-04-18", "modified": "", "detection_yaml": "condition: selection\nselection:\n Contents|contains:\n - ://1\n - ://2\n - ://3\n - ://4\n - ://5\n - ://6\n - ://7\n - ://8\n - ://9\n Contents|startswith: '[ZoneTransfer] ZoneId=3'\n TargetFilename|contains: \\AppData\\Local\\Temp\\WinGet\\\n TargetFilename|endswith: :Zone.Identifier", "false_positives": [ "Unknown" ], "references": [ "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_winget_susp_package_source.yml", "filename": "create_stream_hash_winget_susp_package_source.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "persistence", "stealth" ] }, { "id": "0bb4bbeb-fe52-4044-b40c-430a04577ebe", "title": "Potentially Suspicious File Download From ZIP TLD", "sysmon_eids": [ 15 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects the download of a file with a potentially suspicious extension from a .zip top level domain.", "author": "Florian Roth (Nextron Systems)", "date": "2023-05-18", "modified": "", "detection_yaml": "condition: selection\nselection:\n Contents|contains: .zip/\n TargetFilename|contains:\n - .bat:Zone\n - .dat:Zone\n - .dll:Zone\n - .doc:Zone\n - .docm:Zone\n - .exe:Zone\n - .hta:Zone\n - .pptm:Zone\n - .ps1:Zone\n - .rar:Zone\n - .rtf:Zone\n - .sct:Zone\n - .vbe:Zone\n - .vbs:Zone\n - .ws:Zone\n - .wsf:Zone\n - .xll:Zone\n - .xls:Zone\n - .xlsm:Zone\n - .zip:Zone", "false_positives": [ "Legitimate file downloads from a websites and web services that uses the \".zip\" top level domain." ], "references": [ "https://twitter.com/cyb3rops/status/1659175181695287297", "https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/create_stream_hash/create_stream_hash_zip_tld_download.yml", "filename": "create_stream_hash_zip_tld_download.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "stealth" ] }, { "id": "3b4b232a-af90-427c-a22f-30b0c0837b95", "title": "CMSTP Execution Process Access", "sysmon_eids": [ 10 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1218.003", "technique": "", "level": "high", "description": "Detects various indicators of Microsoft Connection Manager Profile Installer execution", "author": "Nik Seetharaman", "date": "2018-07-16", "modified": "2021-06-27", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains: cmlua.dll", "false_positives": [ "Legitimate CMSTP use (unlikely in modern enterprise environments)" ], "references": [ "https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_cmstp_execution_by_access.yml", "filename": "proc_access_win_cmstp_execution_by_access.yml", "curated": true, "technique_ids": [ "T1218.003", "T1559.001" ], "tactic_tags": [ "stealth", "execution" ] }, { "id": "09706624-b7f6-455d-9d02-adee024cee1d", "title": "HackTool - CobaltStrike BOF Injection Pattern", "sysmon_eids": [ 10 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1106", "technique": "", "level": "high", "description": "Detects a typical pattern of a CobaltStrike BOF which inject into other processes", "author": "Christian Burkard (Nextron Systems)", "date": "2021-08-04", "modified": "2023-11-28", "detection_yaml": "condition: selection\nselection:\n CallTrace|re: ^C:\\\\Windows\\\\SYSTEM32\\\\ntdll\\.dll\\+[a-z0-9]{4,6}\\|C:\\\\Windows\\\\System32\\\\KERNELBASE\\.dll\\+[a-z0-9]{4,6}\\|UNKNOWN\\([A-Z0-9]{16}\\)$\n GrantedAccess:\n - '0x1028'\n - '0x1fffff'", "false_positives": [ "Unknown" ], "references": [ "https://github.com/boku7/injectAmsiBypass", "https://github.com/boku7/spawn" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml", "filename": "proc_access_win_hktl_cobaltstrike_bof_injection_pattern.yml", "curated": true, "technique_ids": [ "T1106", "T1685" ], "tactic_tags": [ "execution" ] }, { "id": "d0d2f720-d14f-448d-8242-51ff396a334e", "title": "HackTool - Generic Process Access", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects process access requests from hacktool processes based on their default image name", "author": "Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel", "date": "2023-11-27", "modified": "", "detection_yaml": "condition: selection\nselection:\n- SourceImage|endswith:\n - \\Akagi.exe\n - \\Akagi64.exe\n - \\atexec_windows.exe\n - \\Certify.exe\n - \\Certipy.exe\n - \\CoercedPotato.exe\n - \\crackmapexec.exe\n - \\CreateMiniDump.exe\n - \\dcomexec_windows.exe\n - \\dpapi_windows.exe\n - \\findDelegation_windows.exe\n - \\GetADUsers_windows.exe\n - \\GetNPUsers_windows.exe\n - \\getPac_windows.exe\n - \\getST_windows.exe\n - \\getTGT_windows.exe\n - \\GetUserSPNs_windows.exe\n - \\gmer.exe\n - \\hashcat.exe\n - \\htran.exe\n - \\ifmap_windows.exe\n - \\impersonate.exe\n - \\Inveigh.exe\n - \\LocalPotato.exe\n - \\mimikatz_windows.exe\n - \\mimikatz.exe\n - \\netview_windows.exe\n - \\nmapAnswerMachine_windows.exe\n - \\opdump_windows.exe\n - \\PasswordDump.exe\n - \\Potato.exe\n - \\PowerTool.exe\n - \\PowerTool64.exe\n - \\psexec_windows.exe\n - \\PurpleSharp.exe\n - \\pypykatz.exe\n - \\QuarksPwDump.exe\n - \\rdp_check_windows.exe\n - \\Rubeus.exe\n - \\SafetyKatz.exe\n - \\sambaPipe_windows.exe\n - \\SelectMyParent.exe\n - \\SharpCh...", "false_positives": [ "Unlikely" ], "references": [ "https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158", "https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_generic_access.yml", "filename": "proc_access_win_hktl_generic_access.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5", "title": "HackTool - HandleKatz Duplicating LSASS Handle", "sysmon_eids": [ 10 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1106", "technique": "", "level": "high", "description": "Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles", "author": "Bhabesh Raj (rule), @thefLinkk", "date": "2022-06-27", "modified": "2023-11-28", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains: '|UNKNOWN('\n CallTrace|endswith: )\n CallTrace|startswith: C:\\Windows\\System32\\ntdll.dll+\n GrantedAccess: '0x1440'\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/codewhitesec/HandleKatz" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_handlekatz_lsass_access.yml", "filename": "proc_access_win_hktl_handlekatz_lsass_access.yml", "curated": true, "technique_ids": [ "T1106", "T1003.001" ], "tactic_tags": [ "execution" ] }, { "id": "7bdde3bf-2a42-4c39-aa31-a92b3e17afac", "title": "HackTool - LittleCorporal Generated Maldoc Injection", "sysmon_eids": [ 10 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1204.002", "technique": "", "level": "high", "description": "Detects the process injection of a LittleCorporal generated Maldoc.", "author": "Christian Burkard (Nextron Systems)", "date": "2021-08-09", "modified": "2023-11-28", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains|all:\n - :\\Windows\\Microsoft.NET\\Framework64\\v2.\n - UNKNOWN\n SourceImage|endswith: \\winword.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/connormcgarr/LittleCorporal" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_littlecorporal_generated_maldoc.yml", "filename": "proc_access_win_hktl_littlecorporal_generated_maldoc.yml", "curated": true, "technique_ids": [ "T1204.002", "T1055.003" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "d29ada0f-af45-4f27-8f32-f7b77c3dbc4e", "title": "HackTool - SysmonEnte Execution", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon", "author": "Florian Roth (Nextron Systems)", "date": "2022-09-07", "modified": "2026-06-29", "detection_yaml": "condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace\nfilter_main_generic:\n SourceImage|contains:\n - :\\Program Files (x86)\\\n - :\\Program Files\\\n - :\\Windows\\System32\\\n - :\\Windows\\SysWOW64\\\nfilter_main_msdefender:\n SourceImage|contains: :\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\n SourceImage|endswith: \\MsMpEng.exe\nselection_calltrace:\n CallTrace: Ente\nselection_sysmon:\n GrantedAccess: '0x1400'\n TargetImage|contains:\n - :\\Windows\\Sysmon.exe\n - :\\Windows\\Sysmon64.exe\n - :\\Windows\\Sysmon64a.exe", "false_positives": [ "Unknown" ], "references": [ "https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html", "https://github.com/codewhitesec/SysmonEnte/", "https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_hktl_sysmonente.yml", "filename": "proc_access_win_hktl_sysmonente.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "a49fa4d5-11db-418c-8473-1e014a8dd462", "title": "Lsass Memory Dump via Comsvcs DLL", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-10-20", "modified": "2023-11-29", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains: comsvcs.dll\n SourceImage|endswith: \\rundll32.exe\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/shantanukhande/status/1229348874298388484", "https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml", "filename": "proc_access_win_lsass_dump_comsvcs_dll.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "9bd012ee-0dff-44d7-84a0-aa698cfd87a3", "title": "LSASS Memory Access by Tool With Dump Keyword In Name", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects LSASS process access requests from a source process with the \"dump\" keyword in its image name.", "author": "Florian Roth (Nextron Systems)", "date": "2022-02-10", "modified": "2023-11-29", "detection_yaml": "condition: selection\nselection:\n GrantedAccess|endswith:\n - '10'\n - '30'\n - '50'\n - '70'\n - '90'\n - B0\n - D0\n - F0\n - '18'\n - '38'\n - '58'\n - '78'\n - '98'\n - B8\n - D8\n - F8\n - 1A\n - 3A\n - 5A\n - 7A\n - 9A\n - BA\n - DA\n - FA\n - '0x14C2'\n - FF\n SourceImage|contains: dump\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Rare programs that contain the word dump in their name and access lsass" ], "references": [ "https://twitter.com/_xpn_/status/1491557187168178176", "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_dump_keyword_image.yml", "filename": "proc_access_win_lsass_dump_keyword_image.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "5ef9853e-4d0e-4a70-846f-a9ca37d876da", "title": "Potential Credential Dumping Activity Via LSASS", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "medium", "description": "Detects process access requests to the LSASS process with specific call trace calls and access masks.\nThis behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.", "author": "Samir Bousseaden, Michael Haag", "date": "2019-04-03", "modified": "2026-06-29", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_system_user:\n SourceUser|contains:\n - AUTHORI\n - AUTORI\nfilter_optional_sysmon:\n SourceImage|endswith:\n - :\\Windows\\Sysmon64.exe\n - :\\Windows\\Sysmon64a.exe\nfilter_optional_thor:\n CallTrace|contains|all:\n - :\\Windows\\Temp\\asgard2-agent\\\n - \\thor\\thor64.exe+\n - '|UNKNOWN('\n GrantedAccess: '0x103800'\nselection:\n CallTrace|contains:\n - dbgcore.dll\n - dbghelp.dll\n - kernel32.dll\n - kernelbase.dll\n - ntdll.dll\n GrantedAccess|contains:\n - '0x1038'\n - '0x1438'\n - '0x143a'\n - '0x1fffff'\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html", "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md", "https://research.splunk.com/endpoint/windows_possible_credential_dumping/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_memdump.yml", "filename": "proc_access_win_lsass_memdump.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9", "title": "Credential Dumping Activity By Python Based Tool", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.", "author": "Bhabesh Raj, Jonhnathan Ribeiro", "date": "2023-11-27", "modified": "2023-11-29", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains:\n - python27.dll+\n - python3*.dll+\n CallTrace|contains|all:\n - _ctypes.pyd+\n - :\\Windows\\System32\\KERNELBASE.dll+\n - :\\Windows\\SYSTEM32\\ntdll.dll+\n GrantedAccess: '0x1FFFFF'\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/bh4b3sh/status/1303674603819081728", "https://github.com/skelsec/pypykatz" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_python_based_tool.yml", "filename": "proc_access_win_lsass_python_based_tool.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "aa35a627-33fb-4d04-a165-d33b4afca3e8", "title": "Remote LSASS Process Access Through Windows Remote Management", "sysmon_eids": [ 10 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.", "author": "Patryk Prauze - ING Tech", "date": "2019-05-20", "modified": "2023-11-29", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_access:\n GrantedAccess: '0x80000000'\nselection:\n SourceImage|endswith: :\\Windows\\system32\\wsmprovhost.exe\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unlikely" ], "references": [ "https://pentestlab.blog/2018/05/15/lateral-movement-winrm/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml", "filename": "proc_access_win_lsass_remote_access_trough_winrm.yml", "curated": true, "technique_ids": [ "T1003.001", "T1059.001", "T1021.006" ], "tactic_tags": [ "execution" ] }, { "id": "472159c5-31b9-4f56-b794-b766faa8b0a7", "title": "Suspicious LSASS Access Via MalSecLogon", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects suspicious access to LSASS handle via a call trace to \"seclogon.dll\" with a suspicious access right.", "author": "Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems)", "date": "2022-06-29", "modified": "", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains: seclogon.dll\n GrantedAccess: '0x14c0'\n SourceImage|endswith: \\svchost.exe\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SBousseaden/status/1541920424635912196", "https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml", "https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_seclogon_access.yml", "filename": "proc_access_win_lsass_seclogon_access.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "a18dd26b-6450-46de-8c91-9659150cf088", "title": "Potentially Suspicious GrantedAccess Flags On LSASS", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "medium", "description": "Detects process access requests to LSASS process with potentially suspicious access flags", "author": "Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community", "date": "2021-11-22", "modified": "2026-06-29", "detection_yaml": "condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_explorer:\n GrantedAccess: '0x401'\n SourceImage|endswith: \\explorer.exe\nfilter_main_generic:\n SourceImage|contains:\n - :\\Program Files (x86)\\\n - :\\Program Files\\\n - :\\Windows\\System32\\\n - :\\Windows\\SysWOW64\\\nfilter_main_windefend_1:\n SourceImage|contains: :\\ProgramData\\Microsoft\\Windows Defender\\\n SourceImage|endswith: \\MsMpEng.exe\nfilter_main_windefend_2:\n CallTrace|contains|all:\n - '|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{'\n - '}\\mpengine.dll+'\n GrantedAccess: '0x1418'\nfilter_main_windefend_3:\n CallTrace|contains:\n - '|c:\\program files\\windows defender\\mprtp.dll'\n - '|c:\\program files\\windows defender\\MpClient.dll'\nfilter_optional_malwarebytes:\n SourceImage|endswith: :\\ProgramData\\MALWAREBYTES\\MBAMSERVICE\\ctlrupdate\\mbupdatr.exe\nfilter_optional_mbami:\n GrantedAccess: '0x40'\n SourceImage|endswith: \\MBAMInstallerService.exe\nfilter_optional_next...", "false_positives": [ "Legitimate software such as AV and EDR" ], "references": [ "https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights", "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow", "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_susp_access_flag.yml", "filename": "proc_access_win_lsass_susp_access_flag.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "e5b33f7d-eb93-48b6-9851-09e1e610b6d7", "title": "Credential Dumping Attempt Via WerFault", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.", "author": "Florian Roth (Nextron Systems)", "date": "2012-06-27", "modified": "2023-11-29", "detection_yaml": "condition: selection\nselection:\n GrantedAccess: '0x1FFFFF'\n SourceImage|endswith: \\WerFault.exe\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Actual failures in lsass.exe that trigger a crash dump (unlikely)", "Unknown cases in which WerFault accesses lsass.exe" ], "references": [ "https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_werfault.yml", "filename": "proc_access_win_lsass_werfault.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "4be8b654-0c01-4c9d-a10c-6b28467fc651", "title": "LSASS Access From Potentially White-Listed Processes", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference", "author": "Florian Roth (Nextron Systems)", "date": "2022-02-10", "modified": "2023-11-29", "detection_yaml": "condition: selection\nselection:\n GrantedAccess|endswith:\n - '10'\n - '30'\n - '50'\n - '70'\n - '90'\n - B0\n - D0\n - F0\n - '18'\n - '38'\n - '58'\n - '78'\n - '98'\n - B8\n - D8\n - F8\n - 1A\n - 3A\n - 5A\n - 7A\n - 9A\n - BA\n - DA\n - FA\n - '0x14C2'\n - FF\n SourceImage|endswith:\n - \\TrolleyExpress.exe\n - \\ProcessDump.exe\n - \\dump64.exe\n TargetImage|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/_xpn_/status/1491557187168178176", "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz", "https://twitter.com/mrd0x/status/1460597833917251595" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_lsass_whitelisted_process_names.yml", "filename": "proc_access_win_lsass_whitelisted_process_names.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "a24e5861-c6ca-4fde-a93c-ba9256feddf0", "title": "Uncommon Process Access Rights For Target Image", "sysmon_eids": [ 10 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055.011", "technique": "", "level": "low", "description": "Detects process access request to uncommon target images with a \"PROCESS_ALL_ACCESS\" access mask.", "author": "Nasreddine Bencherchali (Nextron Systems), frack113", "date": "2024-05-27", "modified": "", "detection_yaml": "condition: selection\nselection:\n GrantedAccess: '0x1FFFFF'\n TargetImage|endswith:\n - \\calc.exe\n - \\calculator.exe\n - \\mspaint.exe\n - \\notepad.exe\n - \\ping.exe\n - \\wordpad.exe\n - \\write.exe", "false_positives": [ "Unknown" ], "references": [ "https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_susp_all_access_uncommon_target.yml", "filename": "proc_access_win_susp_all_access_uncommon_target.yml", "curated": true, "technique_ids": [ "T1055.011" ], "tactic_tags": [ "stealth" ] }, { "id": "9f5c1d59-33be-4e60-bcab-85d2f566effd", "title": "Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace.\nThese DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,\ndbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-11-27", "modified": "", "detection_yaml": "condition: all of selection_*\nselection_lsass_calltrace:\n CallTrace|contains:\n - dbgcore.dll\n - dbghelp.dll\n TargetImage|endswith: \\lsass.exe\nselection_susp_location:\n SourceImage|contains:\n - :\\Perflogs\\\n - :\\Temp\\\n - :\\Users\\Public\\\n - \\$Recycle.Bin\\\n - \\AppData\\Roaming\\\n - \\Contacts\\\n - \\Desktop\\\n - \\Documents\\\n - \\Downloads\\\n - \\Favorites\\\n - \\Favourites\\\n - \\inetpub\\wwwroot\\\n - \\Music\\\n - \\Pictures\\\n - \\Start Menu\\Programs\\Startup\\\n - \\Users\\Default\\\n - \\Videos\\\n - \\Windows\\Temp\\", "false_positives": [ "Possibly during software installation or update processes" ], "references": [ "https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html", "https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load.yml", "filename": "proc_access_win_susp_dbgcore_dbghelp_load.yml", "curated": true, "technique_ids": [ "T1003.001", "T1685" ], "tactic_tags": [] }, { "id": "3f3f3506-1895-401b-9cc3-e86b16e630d0", "title": "Potential Direct Syscall of NtOpenProcess", "sysmon_eids": [ 10 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1106", "technique": "", "level": "medium", "description": "Detects potential calls to NtOpenProcess directly from NTDLL.", "author": "Christian Burkard (Nextron Systems), Tim Shelton (FP)", "date": "2021-07-28", "modified": "2023-12-13", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_generic:\n SourceImage|contains:\n - :\\Program Files (x86)\\\n - :\\Program Files\\\n - :\\Windows\\System32\\\n - :\\Windows\\SysWOW64\\\n - :\\Windows\\WinSxS\\\n TargetImage|contains:\n - :\\Program Files (x86)\\\n - :\\Program Files\\\n - :\\Windows\\System32\\\n - :\\Windows\\SysWOW64\\\n - :\\Windows\\WinSxS\\\nfilter_main_kerneltrace_edge:\n Provider_Name: Microsoft-Windows-Kernel-Audit-API-Calls\nfilter_main_vcredist:\n SourceImage|endswith: vcredist_x64.exe\n TargetImage|endswith: vcredist_x64.exe\nfilter_optional_adobe_acrobat:\n SourceImage|contains: :\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\\n SourceImage|endswith: \\AcroCEF.exe\n TargetImage|contains: :\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\\n TargetImage|endswith: \\AcroCEF.exe\nfilter_optional_amazon:\n SourceImage|endswith: AmazonSSMAgentSetup.exe\n TargetImage|endswith: AmazonSSMAgentSetup.exe\nfilter_optional_cylance:\n SourceImage|endswith: :\\Windows\\Explo...", "false_positives": [ "Unknown" ], "references": [ "https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_susp_direct_ntopenprocess_call.yml", "filename": "proc_access_win_susp_direct_ntopenprocess_call.yml", "curated": true, "technique_ids": [ "T1106" ], "tactic_tags": [ "execution" ] }, { "id": "174afcfa-6e40-4ae9-af64-496546389294", "title": "Credential Dumping Attempt Via Svchost", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1548", "technique": "", "level": "high", "description": "Detects when a process tries to access the memory of svchost to potentially dump credentials.", "author": "Florent Labouyrie", "date": "2021-04-30", "modified": "2022-10-09", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_known_processes:\n SourceImage|endswith:\n - \\services.exe\n - \\msiexec.exe\nselection:\n GrantedAccess: '0x143a'\n TargetImage|endswith: \\svchost.exe", "false_positives": [ "Unknown" ], "references": [ "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_svchost_credential_dumping.yml", "filename": "proc_access_win_svchost_credential_dumping.yml", "curated": true, "technique_ids": [ "T1548" ], "tactic_tags": [] }, { "id": "166e9c50-8cd9-44af-815d-d1f0c0e90dde", "title": "Suspicious Svchost Process Access", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Detects suspicious access to the \"svchost\" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.", "author": "Tim Burrell", "date": "2020-01-02", "modified": "2023-01-30", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_msbuild:\n CallTrace|contains:\n - Microsoft.Build.ni.dll\n - System.ni.dll\n SourceImage|contains: :\\Program Files\\Microsoft Visual Studio\\\n SourceImage|endswith: \\MSBuild\\Current\\Bin\\MSBuild.exe\nselection:\n CallTrace|contains: UNKNOWN\n GrantedAccess: '0x1F3FFF'\n TargetImage|endswith: :\\Windows\\System32\\svchost.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/hlldz/Invoke-Phant0m", "https://twitter.com/timbmsft/status/900724491076214784" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_svchost_susp_access_request.yml", "filename": "proc_access_win_svchost_susp_access_request.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "fb3722e4-1a06-46b6-b772-253e2e7db933", "title": "Function Call From Undocumented COM Interface EditionUpgradeManager", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "medium", "description": "Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.", "author": "oscd.community, Dmitry Uchakin", "date": "2020-10-07", "modified": "2023-11-30", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains: editionupgrademanagerobj.dll", "false_positives": [ "Unknown" ], "references": [ "https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/", "https://gist.github.com/hfiref0x/de9c83966623236f5ebf8d9ae2407611" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_uac_bypass_editionupgrademanagerobj.yml", "filename": "proc_access_win_uac_bypass_editionupgrademanagerobj.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "4f6c43e2-f989-4ea5-bcd8-843b49a0317c", "title": "UAC Bypass Using WOW64 Logger DLL Hijack", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1548.002", "technique": "", "level": "high", "description": "Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)", "author": "Christian Burkard (Nextron Systems)", "date": "2021-08-23", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n CallTrace|startswith: UNKNOWN(0000000000000000)|UNKNOWN(0000000000000000)|\n GrantedAccess: '0x1fffff'\n SourceImage|contains: :\\Windows\\SysWOW64\\", "false_positives": [ "Unknown" ], "references": [ "https://github.com/hfiref0x/UACME" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_uac_bypass_wow64_logger.yml", "filename": "proc_access_win_uac_bypass_wow64_logger.yml", "curated": true, "technique_ids": [ "T1548.002" ], "tactic_tags": [] }, { "id": "387df17d-3b04-448f-8669-9e7fd5e5fd8c", "title": "Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze", "sysmon_eids": [ 10 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.\nThis technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-11-27", "modified": "", "detection_yaml": "condition: selection\nselection:\n CallTrace|contains:\n - \\dbgcore.dll\n - \\dbghelp.dll\n SourceImage|endswith: \\WerFaultSecure.exe\n TargetImage|endswith: \\MsMpEng.exe", "false_positives": [ "Legitimate Windows Error Reporting operations" ], "references": [ "https://blog.axelarator.net/hunting-for-edr-freeze/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_access/proc_access_win_werfaultsecure_msmpeng_access.yml", "filename": "proc_access_win_werfaultsecure_msmpeng_access.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3", "title": "ADFS Database Named Pipe Connection By Uncommon Tool", "sysmon_eids": [ 17, 18 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1005", "technique": "", "level": "medium", "description": "Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database).\nUsed to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens.", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2021-10-08", "modified": "2023-11-30", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_generic:\n Image|endswith:\n - :\\Windows\\System32\\mmc.exe\n - :\\Windows\\system32\\svchost.exe\n - :\\Windows\\System32\\wsmprovhost.exe\n - :\\Windows\\SysWOW64\\mmc.exe\n - :\\Windows\\SysWOW64\\wsmprovhost.exe\n - :\\Windows\\WID\\Binn\\sqlwriter.exe\n - \\AzureADConnect.exe\n - \\Microsoft.Identity.Health.Adfs.PshSurrogate.exe\n - \\Microsoft.IdentityServer.ServiceHost.exe\n - \\Microsoft.Tri.Sensor.exe\n - \\sqlservr.exe\n - \\tssdis.exe\nselection:\n PipeName: \\MICROSOFT##WID\\tsql\\query", "false_positives": [ "Unknown" ], "references": [ "https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml", "https://o365blog.com/post/adfs/", "https://github.com/Azure/SimuLand" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_adfs_namedpipe_connection_uncommon_tool.yml", "filename": "pipe_created_adfs_namedpipe_connection_uncommon_tool.yml", "curated": true, "technique_ids": [ "T1005" ], "tactic_tags": [ "collection" ] }, { "id": "d5601f8c-b26f-4ab0-9035-69e11a8d4ad2", "title": "CobaltStrike Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "critical", "description": "Detects the creation of a named pipe as used by CobaltStrike", "author": "Florian Roth (Nextron Systems), Wojciech Lesicki", "date": "2021-05-25", "modified": "2022-10-31", "detection_yaml": "condition: 1 of selection*\nselection_MSSE:\n PipeName|contains|all:\n - \\MSSE-\n - -server\nselection_interprocess:\n PipeName|startswith: \\interprocess_\nselection_lsarpc:\n PipeName|startswith: \\lsarpc_\nselection_mojo:\n PipeName|startswith: \\mojo_\nselection_msagent:\n PipeName|startswith: \\msagent_\nselection_netlogon:\n PipeName|startswith: \\netlogon_\nselection_postex:\n PipeName|startswith: \\postex_\nselection_samr:\n PipeName|startswith: \\samr_\nselection_srvsvc:\n PipeName|startswith: \\srvsvc_\nselection_status:\n PipeName|startswith: \\status_\nselection_wkssvc:\n PipeName|startswith: \\wkssvc_", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/d4rksystem/status/1357010969264873472", "https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/", "https://github.com/SigmaHQ/sigma/issues/253", "https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/", "https://redcanary.com/threat-detection-report/threats/cobalt-strike/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml", "filename": "pipe_created_hktl_cobaltstrike.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "0e7163d4-9e19-4fa7-9be6-000c61aad77a", "title": "CobaltStrike Named Pipe Pattern Regex", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "critical", "description": "Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles", "author": "Florian Roth (Nextron Systems)", "date": "2021-07-30", "modified": "2026-06-18", "detection_yaml": "condition: selection\nselection:\n- PipeName|re: \\\\mojo\\.5688\\.8052\\.(?:183894939787088877|35780273329370473)[0-9a-f]{2}\n- PipeName|re: \\\\wkssvc_?[0-9a-f]{2}\n- PipeName|re: \\\\ntsvcs[0-9a-f]{2}\n- PipeName|re: \\\\DserNamePipe[0-9a-f]{2}\n- PipeName|re: \\\\SearchTextHarvester[0-9a-f]{2}\n- PipeName|re: \\\\mypipe-(?:f|h)[0-9a-f]{2}\n- PipeName|re: \\\\windows\\.update\\.manager[0-9a-f]{2,3}\n- PipeName|re: \\\\ntsvcs_[0-9a-f]{2}\n- PipeName|re: \\\\scerpc_?[0-9a-f]{2}\n- PipeName|re: \\\\PGMessagePipe[0-9a-f]{2}\n- PipeName|re: \\\\MsFteWds[0-9a-f]{2}\n- PipeName|re: \\\\f4c3[0-9a-f]{2}\n- PipeName|re: \\\\fullduplex_[0-9a-f]{2}\n- PipeName|re: \\\\msrpc_[0-9a-f]{4}\n- PipeName|re: \\\\win\\\\msrpc_[0-9a-f]{2}\n- PipeName|re: \\\\f53f[0-9a-f]{2}$\n- PipeName|re: \\\\rpc_[0-9a-f]{2}\n- PipeName|re: \\\\spoolss_[0-9a-f]{2}\n- PipeName|re: \\\\Winsock2\\\\CatalogChangeListener-[0-9a-f]{3}-0,", "false_positives": [ "Unknown" ], "references": [ "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575", "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml", "filename": "pipe_created_hktl_cobaltstrike_re.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7", "title": "CobaltStrike Named Pipe Patterns", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "high", "description": "Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles", "author": "Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)", "date": "2021-07-30", "modified": "2024-01-26", "detection_yaml": "condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1\n of filter_optional_*\nfilter_main_generic:\n PipeName:\n - \\wkssvc\n - \\spoolss\n - \\scerpc\n - \\ntsvcs\n - \\SearchTextHarvester\n - \\PGMessagePipe\n - \\MsFteWds\nfilter_optional_websense:\n Image|contains:\n - :\\Program Files\\Websense\\\n - :\\Program Files (x86)\\Websense\\\n PipeName|startswith:\n - \\DserNamePipeR\n - \\DserNamePipeW\nselection_malleable_profile_catalog_change_listener:\n PipeName|endswith: -0,\n PipeName|startswith: \\Winsock2\\CatalogChangeListener-\nselection_malleable_profile_generic:\n- PipeName|startswith:\n - \\DserNamePipe\n - \\f4c3\n - \\f53f\n - \\fullduplex_\n - \\mojo.5688.8052.183894939787088877\n - \\mojo.5688.8052.35780273329370473\n - \\MsFteWds\n - \\msrpc_\n - \\mypipe-f\n - \\mypipe-h\n - \\ntsvcs\n - \\PGMessagePipe\n - \\rpc_\n - \\scerpc\n - \\SearchTextHarvester\n - \\spoolss\n - \\win_svc\n - \\win\\msrpc_\n - \\windows.update.manager\n - \\wkssvc\n- PipeName:\n - \\demoagent_11\n - \\demoa...", "false_positives": [ "Chrome instances using the exact same pipe name \"mojo.xxx\"", "Websense Endpoint using the pipe name \"DserNamePipe(R|W)\\d{1,5}\"", "Some applications may just coincidentally use the pipe names which contain the same prefix as the ones used by CobaltStrike, e.g. \"f4c3\"" ], "references": [ "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575", "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml", "filename": "pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "4d0083b3-580b-40da-9bba-626c19fe4033", "title": "HackTool - CoercedPotato Named Pipe Creation", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "high", "description": "Detects the pattern of a pipe name as used by the hack tool CoercedPotato", "author": "Florian Roth (Nextron Systems)", "date": "2023-10-11", "modified": "", "detection_yaml": "condition: selection\nselection:\n PipeName|contains: \\coerced\\", "false_positives": [ "Unknown" ], "references": [ "https://blog.hackvens.fr/articles/CoercedPotato.html", "https://github.com/hackvens/CoercedPotato" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml", "filename": "pipe_created_hktl_coercedpotato.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "1f7025a6-e747-4130-aac4-961eb47015f1", "title": "HackTool - DiagTrackEoP Default Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "critical", "description": "Detects creation of default named pipe used by the DiagTrackEoP POC, a tool that abuses \"SeImpersonate\" privilege.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-03", "modified": "2023-08-07", "detection_yaml": "condition: selection\nselection:\n PipeName|contains: thisispipe", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L22" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_diagtrack_eop.yml", "filename": "pipe_created_hktl_diagtrack_eop.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "637f689e-b4a5-4a86-be0e-0100a0a33ba2", "title": "HackTool - EfsPotato Named Pipe Creation", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "high", "description": "Detects the pattern of a pipe name as used by the hack tool EfsPotato", "author": "Florian Roth (Nextron Systems)", "date": "2021-08-23", "modified": "2023-12-21", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_ctx:\n PipeName|contains: \\CtxShare\nfilter_optional_default:\n PipeName|startswith: \\pipe\\\nselection:\n PipeName|contains:\n - \\pipe\\\n - \\pipe\\srvsvc", "false_positives": [ "\\pipe\\LOCAL\\Monitorian" ], "references": [ "https://twitter.com/SBousseaden/status/1429530155291193354?s=20", "https://github.com/zcgonvh/EfsPotato" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_efspotato.yml", "filename": "pipe_created_hktl_efspotato.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "961d0ba2-3eea-4303-a930-2cf78bbfcc5e", "title": "HackTool - Credential Dumping Tools Named Pipe Created", "sysmon_eids": [ 17, 18 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "critical", "description": "Detects well-known credential dumping tools execution via specific named pipe creation", "author": "Teymur Kheirkhabarov, oscd.community", "date": "2019-11-01", "modified": "2023-08-07", "detection_yaml": "condition: selection\nselection:\n PipeName|contains:\n - \\cachedump\n - \\lsadump\n - \\wceservicepipe", "false_positives": [ "Legitimate Administrator using tool for password recovery" ], "references": [ "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml", "filename": "pipe_created_hktl_generic_cred_dump_tools_pipes.yml", "curated": true, "technique_ids": [ "T1003.001", "T1003.002", "T1003.004", "T1003.005" ], "tactic_tags": [] }, { "id": "0adc67e0-a68f-4ffd-9c43-28905aad5d6a", "title": "HackTool - Koh Default Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1528", "technique": "", "level": "critical", "description": "Detects creation of default named pipes used by the Koh tool", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-07-08", "modified": "2023-08-07", "detection_yaml": "condition: selection\nselection:\n PipeName|contains:\n - \\imposecost\n - \\imposingcost", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/GhostPack/Koh/blob/0283d9f3f91cf74732ad377821986cfcb088e20a/Clients/BOF/KohClient.c#L12" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_hktl_koh_default_pipe.yml", "filename": "pipe_created_hktl_koh_default_pipe.yml", "curated": true, "technique_ids": [ "T1528", "T1134.001" ], "tactic_tags": [ "stealth" ] }, { "id": "58cb02d5-78ce-4692-b3e1-dce850aae41a", "title": "Alternate PowerShell Hosts Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059.001", "technique": "", "level": "medium", "description": "Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe", "author": "Roberto Rodriguez @Cyb3rWard0g, Tim Shelton", "date": "2019-09-12", "modified": "2025-10-07", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_generic:\n- Image|contains:\n - :\\Program Files\\PowerShell\\7-preview\\pwsh.exe\n - :\\Program Files\\PowerShell\\7\\pwsh.exe\n - :\\Windows\\system32\\dsac.exe\n - :\\Windows\\system32\\inetsrv\\w3wp.exe\n - :\\Windows\\System32\\sdiagnhost.exe\n - :\\Windows\\system32\\ServerManager.exe\n - :\\Windows\\system32\\wbem\\wmiprvse.exe\n - :\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe\n - :\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\n - :\\Windows\\System32\\wsmprovhost.exe\n - :\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe\n - :\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\n- Image|contains|all:\n - C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview\n - \\pwsh.exe\n- Image|contains|all:\n - \\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview\n - \\pwsh.exe\nfilter_main_null:\n Image: null\nfilter_optional_azure_connected_machine_agent:\n Image|endswith: \\GC\\g...", "false_positives": [ "Programs using PowerShell directly without invocation of a dedicated interpreter." ], "references": [ "https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html", "https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml", "filename": "pipe_created_powershell_alternate_host_pipe.yml", "curated": true, "technique_ids": [ "T1059.001" ], "tactic_tags": [ "execution" ] }, { "id": "ac7102b4-9e1e-4802-9b4f-17c5524c015c", "title": "New PowerShell Instance Created", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059.001", "technique": "", "level": "informational", "description": "Detects the execution of PowerShell via the creation of a named pipe starting with PSHost", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2019-09-12", "modified": "2023-11-30", "detection_yaml": "condition: selection\nselection:\n PipeName|startswith: \\PSHost", "false_positives": [ "Likely" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html", "https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_powershell_execution_pipe.yml", "filename": "pipe_created_powershell_execution_pipe.yml", "curated": true, "technique_ids": [ "T1059.001" ], "tactic_tags": [ "execution" ] }, { "id": "f318b911-ea88-43f4-9281-0de23ede628e", "title": "PUA - CSExec Default Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "medium", "description": "Detects default CSExec pipe creation", "author": "Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "date": "2023-08-07", "modified": "2023-11-30", "detection_yaml": "condition: selection\nselection:\n PipeName|contains: \\csexecsvc", "false_positives": [ "Legitimate Administrator activity" ], "references": [ "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view", "https://github.com/malcomvetter/CSExec" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_csexec_default_pipe.yml", "filename": "pipe_created_pua_csexec_default_pipe.yml", "curated": true, "technique_ids": [ "T1021.002", "T1569.002" ], "tactic_tags": [ "execution" ] }, { "id": "f6451de4-df0a-41fa-8d72-b39f54a08db5", "title": "PUA - PAExec Default Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1569.002", "technique": "", "level": "medium", "description": "Detects PAExec default named pipe", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-26", "modified": "", "detection_yaml": "condition: selection\nselection:\n PipeName|startswith: \\PAExec", "false_positives": [ "Unknown" ], "references": [ "https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md", "https://github.com/poweradminllc/PAExec" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_paexec_default_pipe.yml", "filename": "pipe_created_pua_paexec_default_pipe.yml", "curated": true, "technique_ids": [ "T1569.002" ], "tactic_tags": [ "execution" ] }, { "id": "d36f87ea-c403-44d2-aa79-1a0ac7c24456", "title": "PUA - RemCom Default Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "medium", "description": "Detects default RemCom pipe creation", "author": "Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "date": "2023-08-07", "modified": "2023-11-30", "detection_yaml": "condition: selection\nselection:\n PipeName|contains: \\RemCom", "false_positives": [ "Legitimate Administrator activity" ], "references": [ "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view", "https://github.com/kavika13/RemCom" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_pua_remcom_default_pipe.yml", "filename": "pipe_created_pua_remcom_default_pipe.yml", "curated": true, "technique_ids": [ "T1021.002", "T1569.002" ], "tactic_tags": [ "execution" ] }, { "id": "493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb", "title": "WMI Event Consumer Created Named Pipe", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1047", "technique": "", "level": "medium", "description": "Detects the WMI Event Consumer service scrcons.exe creating a named pipe", "author": "Florian Roth (Nextron Systems)", "date": "2021-09-01", "modified": "2023-11-30", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\scrcons.exe", "false_positives": [ "Unknown" ], "references": [ "https://github.com/RiccardoAncarani/LiquidSnake" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_scrcons_wmi_consumer_namedpipe.yml", "filename": "pipe_created_scrcons_wmi_consumer_namedpipe.yml", "curated": true, "technique_ids": [ "T1047" ], "tactic_tags": [ "execution" ] }, { "id": "fe3ac066-98bb-432a-b1e7-a5229cb39d4a", "title": "Malicious Named Pipe Created", "sysmon_eids": [ 17, 18 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055", "technique": "", "level": "critical", "description": "Detects the creation of a named pipe seen used by known APTs or malware.", "author": "Florian Roth (Nextron Systems), blueteam0ps, elhoim", "date": "2017-11-06", "modified": "2023-08-07", "detection_yaml": "condition: selection\nselection:\n PipeName:\n - \\46a676ab7f179e511e30dd2dc41bd388\n - \\583da945-62af-10e8-4902-a8f205c72b2e\n - \\6e7645c4-32c5-4fe3-aabf-e94c2f4370e7\n - \\9f81f59bc58452127884ce513865ed20\n - \\adschemerpc\n - \\ahexec\n - \\AnonymousPipe\n - \\bc31a7\n - \\bc367\n - \\bizkaz\n - \\csexecsvc\n - \\dce_3d\n - \\e710f28d59aa529d6792ca6ff0ca1b34\n - \\gruntsvc\n - \\isapi_dg\n - \\isapi_dg2\n - \\isapi_http\n - \\jaccdpqnvbrrxlaf\n - \\lsassw\n - \\NamePipe_MoreWindows\n - \\pcheap_reuse\n - \\Posh*\n - \\rpchlp_3\n - \\sdlrpc\n - \\svcctl\n - \\testPipe\n - \\winsession", "false_positives": [ "Unknown" ], "references": [ "https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/", "https://securelist.com/faq-the-projectsauron-apt/75533/", "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf", "https://www.us-cert.gov/ncas/alerts/TA17-117A", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_susp_malicious_namedpipes.yml", "filename": "pipe_created_susp_malicious_namedpipes.yml", "curated": true, "technique_ids": [ "T1055" ], "tactic_tags": [ "stealth" ] }, { "id": "41504465-5e3a-4a5b-a5b4-2a0baadd4463", "title": "PsExec Tool Execution From Suspicious Locations - PipeName", "sysmon_eids": [ 17, 18 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1569.002", "technique": "", "level": "medium", "description": "Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-04", "modified": "2023-09-20", "detection_yaml": "condition: selection\nselection:\n Image|contains:\n - :\\Users\\Public\\\n - :\\Windows\\Temp\\\n - \\AppData\\Local\\Temp\\\n - \\Desktop\\\n - \\Downloads\\\n PipeName: \\PSEXESVC", "false_positives": [ "Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment." ], "references": [ "https://www.jpcert.or.jp/english/pub/sr/ir_research.html", "https://jpcertcc.github.io/ToolAnalysisResultSheet" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml", "filename": "pipe_created_sysinternals_psexec_default_pipe_susp_location.yml", "curated": true, "technique_ids": [ "T1569.002" ], "tactic_tags": [ "execution" ] }, { "id": "0f06a3a5-6a09-413f-8743-e6cf35561297", "title": "WMI Event Subscription", "sysmon_eids": [ 19, 20, 21 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1546.003", "technique": "", "level": "medium", "description": "Detects creation of WMI event subscription persistence method", "author": "Tom Ueltschi (@c_APT_ure)", "date": "2019-01-12", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 19\n - 20\n - 21", "false_positives": [ "Exclude legitimate (vetted) use of WMI event subscription in your network" ], "references": [ "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected", "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected", "https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_event_subscription.yml", "filename": "sysmon_wmi_event_subscription.yml", "curated": true, "technique_ids": [ "T1546.003" ], "tactic_tags": [ "persistence" ] }, { "id": "83844185-1c5b-45bc-bcf3-b5bf3084ca5b", "title": "Suspicious Encoded Scripts in a WMI Consumer", "sysmon_eids": [ 19, 20, 21 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1047", "technique": "", "level": "high", "description": "Detects suspicious encoded payloads in WMI Event Consumers", "author": "Florian Roth (Nextron Systems)", "date": "2021-09-01", "modified": "2022-10-09", "detection_yaml": "condition: selection_destination\nselection_destination:\n Destination|base64offset|contains:\n - WriteProcessMemory\n - This program cannot be run in DOS mode\n - This program must be run under Win32", "false_positives": [ "Unknown" ], "references": [ "https://github.com/RiccardoAncarani/LiquidSnake" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_susp_encoded_scripts.yml", "filename": "sysmon_wmi_susp_encoded_scripts.yml", "curated": true, "technique_ids": [ "T1047", "T1546.003" ], "tactic_tags": [ "execution", "persistence" ] }, { "id": "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "title": "Suspicious Scripting in a WMI Consumer", "sysmon_eids": [ 19, 20, 21 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059.005", "technique": "", "level": "high", "description": "Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers", "author": "Florian Roth (Nextron Systems), Jonhnathan Ribeiro", "date": "2019-04-15", "modified": "2023-09-09", "detection_yaml": "condition: selection_destination\nselection_destination:\n- Destination|contains|all:\n - new-object\n - net.webclient\n - .downloadstring\n- Destination|contains|all:\n - new-object\n - net.webclient\n - .downloadfile\n- Destination|contains:\n - ' iex('\n - ' -nop '\n - ' -noprofile '\n - ' -decode '\n - ' -enc '\n - WScript.Shell\n - System.Security.Cryptography.FromBase64Transform", "false_positives": [ "Legitimate administrative scripts" ], "references": [ "https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/", "https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19", "https://github.com/RiccardoAncarani/LiquidSnake" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml", "filename": "sysmon_wmi_susp_scripting.yml", "curated": true, "technique_ids": [ "T1059.005" ], "tactic_tags": [ "execution" ] }, { "id": "065cceea-77ec-4030-9052-fc0affea7110", "title": "DNS Query for Anonfiles.com Domain - Sysmon", "sysmon_eids": [ 22 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567.002", "technique": "", "level": "high", "description": "Detects DNS queries for \"anonfiles.com\", which is an anonymous file upload platform often used for malicious purposes", "author": "pH-T (Nextron Systems)", "date": "2022-07-15", "modified": "2023-01-16", "detection_yaml": "condition: selection\nselection:\n QueryName|contains: .anonfiles.com", "false_positives": [ "Rare legitimate access to anonfiles.com" ], "references": [ "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_anonymfiles_com.yml", "filename": "dns_query_win_anonymfiles_com.yml", "curated": true, "technique_ids": [ "T1567.002" ], "tactic_tags": [ "exfiltration" ] }, { "id": "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "title": "AppX Package Installation Attempts Via AppInstaller.EXE", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1105", "technique": "", "level": "medium", "description": "Detects DNS queries made by \"AppInstaller.EXE\". The AppInstaller is the default handler for the \"ms-appinstaller\" URI. It attempts to load/install a package from the referenced URL", "author": "frack113", "date": "2021-11-24", "modified": "2023-11-09", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\AppInstaller.exe\n Image|startswith: C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/notwhickey/status/1333900137232523264", "https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_appinstaller.yml", "filename": "dns_query_win_appinstaller.yml", "curated": true, "technique_ids": [ "T1105" ], "tactic_tags": [] }, { "id": "a1d9eec5-33b2-4177-8d24-27fe754d0812", "title": "Cloudflared Tunnels Related DNS Requests", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1071.001", "technique": "", "level": "medium", "description": "Detects DNS requests to Cloudflared tunnels domains.\nAttackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-12-20", "modified": "", "detection_yaml": "condition: selection\nselection:\n QueryName|endswith:\n - .v2.argotunnel.com\n - protocol-v2.argotunnel.com\n - trycloudflare.com\n - update.argotunnel.com", "false_positives": [ "Legitimate use of cloudflare tunnels will also trigger this." ], "references": [ "https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/", "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_cloudflared_communication.yml", "filename": "dns_query_win_cloudflared_communication.yml", "curated": true, "technique_ids": [ "T1071.001", "T1572" ], "tactic_tags": [] }, { "id": "f8c1e80b-c73a-476a-ae24-6c72528b1521", "title": "DNS Query To Common Malware Hosting and Shortener Services", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1071.004", "technique": "", "level": "medium", "description": "Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.\nThese include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.\nSuch DNS activity can indicate potential delivery or command-and-control communication attempts.", "author": "Ahmed Nosir (@egycondor)", "date": "2025-06-02", "modified": "", "detection_yaml": "condition: selection\nselection:\n QueryName|contains:\n - msapp.workers.dev\n - trycloudflare.com\n - infinityfreeapp.com\n - my5353.com\n - reurl.cc\n - lihi.cc\n - tinyurl.com", "false_positives": [ "Legitimate use of these services is possible but rare in enterprise environments" ], "references": [ "https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_common_malware_hosting_services.yml", "filename": "dns_query_win_common_malware_hosting_services.yml", "curated": true, "technique_ids": [ "T1071.004" ], "tactic_tags": [] }, { "id": "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "title": "DNS Query To Devtunnels Domain", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1071.001", "technique": "", "level": "medium", "description": "Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "citron_ninja", "date": "2023-10-25", "modified": "2023-11-20", "detection_yaml": "condition: selection\nselection:\n QueryName|endswith: .devtunnels.ms", "false_positives": [ "Legitimate use of Devtunnels will also trigger this." ], "references": [ "https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2", "https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security", "https://cydefops.com/devtunnels-unleashed" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_devtunnels_communication.yml", "filename": "dns_query_win_devtunnels_communication.yml", "curated": true, "technique_ids": [ "T1071.001", "T1572" ], "tactic_tags": [] }, { "id": "a21bcd7e-38ec-49ad-b69a-9ea17e69509e", "title": "DNS Server Discovery Via LDAP Query", "sysmon_eids": [ 22 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1482", "technique": "", "level": "low", "description": "Detects DNS server discovery via LDAP query requests from uncommon applications", "author": "frack113", "date": "2022-08-20", "modified": "2023-09-18", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_defender:\n Image|contains: :\\ProgramData\\Microsoft\\Windows Defender\\Platform\\\n Image|endswith: \\MsMpEng.exe\nfilter_main_generic:\n Image|contains:\n - :\\Program Files\\\n - :\\Program Files (x86)\\\n - :\\Windows\\\nfilter_main_null:\n Image: null\nfilter_main_unknown:\n Image: \nfilter_optional_azure:\n Image|startswith: C:\\WindowsAzure\\GuestAgent\nfilter_optional_browsers:\n Image|endswith:\n - \\chrome.exe\n - \\firefox.exe\n - \\opera.exe\nselection:\n QueryName|startswith: _ldap.", "false_positives": [ "Likely" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup", "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_dns_server_discovery_via_ldap_query.yml", "filename": "dns_query_win_dns_server_discovery_via_ldap_query.yml", "curated": true, "technique_ids": [ "T1482" ], "tactic_tags": [ "discovery" ] }, { "id": "e043f529-8514-4205-8ab0-7f7d2927b400", "title": "DNS Query To AzureWebsites.NET By Non-Browser Process", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1219.002", "technique": "", "level": "medium", "description": "Detects a DNS query by a non browser process on the system to \"azurewebsites.net\". The latter was often used by threat actors as a malware hosting and exfiltration site.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2024-06-24", "modified": "", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_avant:\n Image|endswith: \\avant.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Avant Browser\\\n - C:\\Program Files\\Avant Browser\\\nfilter_optional_brave:\n Image|endswith: \\brave.exe\n Image|startswith: C:\\Program Files\\BraveSoftware\\\nfilter_optional_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_defender:\n Image|endswith:\n - \\MsMpEng.exe\n - \\MsSense.exe\nfilter_optional_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_optional_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Files\\Micr...", "false_positives": [ "Likely with other browser software. Apply additional filters for any other browsers you might use." ], "references": [ "https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/", "https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_domain_azurewebsites.yml", "filename": "dns_query_win_domain_azurewebsites.yml", "curated": true, "technique_ids": [ "T1219.002" ], "tactic_tags": [] }, { "id": "c082c2b0-525b-4dbc-9a26-a57dc4692074", "title": "DNS Query by Finger Utility", "sysmon_eids": [ 22 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1071.004", "technique": "", "level": "high", "description": "Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.\nIn one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.\nSince the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.\nInvestigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for co...", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-11-19", "modified": "", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\finger.exe", "false_positives": [ "Unlikely" ], "references": [ "https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_finger.yml", "filename": "dns_query_win_finger.yml", "curated": true, "technique_ids": [ "T1071.004", "T1059.003" ], "tactic_tags": [ "execution" ] }, { "id": "2074e137-1b73-4e2d-88ba-5a3407dbdce0", "title": "Notepad++ Updater DNS Query to Uncommon Domains", "sysmon_eids": [ 22 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1195.002", "technique": "", "level": "medium", "description": "Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.\nThis could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2026-02-02", "modified": "2026-03-16", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_notepad_legit_domain:\n QueryName: notepad-plus-plus.org\nfilter_optional_github_legit_domain:\n- QueryName|endswith: .githubusercontent.com\n- QueryName: github.com\nfilter_optional_google_storage_legit_domain:\n QueryName|endswith: .googleapis.com\nfilter_optional_sourceforge_legit_domain:\n QueryName|endswith: .sourceforge.net\nfilter_optional_uncommon_domains:\n QueryName|endswith:\n - .azurewebsites.net\n - block.opendns.com\n - gateway.zscalerthree.net\nselection:\n Image|endswith: \\gup.exe", "false_positives": [ "Some legitimate network misconfigurations or proxy issues causing unexpected DNS queries.", "Other legitimate query to official domains not listed in the filter, needing tuning." ], "references": [ "https://notepad-plus-plus.org/news/v889-released/", "https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html", "https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/", "https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/", "https://securelist.com/notepad-supply-chain-attack/118708/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_gup_query_to_uncommon_domains.yml", "filename": "dns_query_win_gup_query_to_uncommon_domains.yml", "curated": true, "technique_ids": [ "T1195.002", "T1557" ], "tactic_tags": [ "collection" ] }, { "id": "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "title": "DNS HybridConnectionManager Service Bus", "sysmon_eids": [ 22 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1554", "technique": "", "level": "high", "description": "Detects Azure Hybrid Connection Manager services querying the Azure service bus service", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2021-04-12", "modified": "2023-01-16", "detection_yaml": "condition: selection\nselection:\n Image|contains: HybridConnectionManager\n QueryName|contains: servicebus.windows.net", "false_positives": [ "Legitimate use of Azure Hybrid Connection Manager and the Azure Service Bus service" ], "references": [ "https://twitter.com/Cyb3rWard0g/status/1381642789369286662" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_hybridconnectionmgr_servicebus.yml", "filename": "dns_query_win_hybridconnectionmgr_servicebus.yml", "curated": true, "technique_ids": [ "T1554" ], "tactic_tags": [ "persistence" ] }, { "id": "e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c", "title": "Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing", "sysmon_eids": [ 22 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1557.001", "technique": "", "level": "high", "description": "Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.\nThe pattern \"1UWhRCAAAAA..BAAAA\" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.\nAttackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.\nIt is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records\nto spoof Service Principal Names (SPNs)...", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-06-20", "modified": "", "detection_yaml": "condition: selection\nselection:\n QueryName|contains|all:\n - UWhRCA\n - BAAAA", "false_positives": [ "Unknown" ], "references": [ "https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025", "https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml", "filename": "dns_query_win_kerberos_coercion_via_dns_object_spoofing.yml", "curated": true, "technique_ids": [ "T1557.001", "T1187" ], "tactic_tags": [ "collection", "persistence" ] }, { "id": "f356a9c4-effd-4608-bbf8-408afd5cd006", "title": "Suspicious Cobalt Strike DNS Beaconing - Sysmon", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1071.004", "technique": "", "level": "critical", "description": "Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons", "author": "Florian Roth (Nextron Systems)", "date": "2021-11-09", "modified": "2023-01-16", "detection_yaml": "condition: 1 of selection*\nselection1:\n QueryName|startswith:\n - aaa.stage.\n - post.1\nselection2:\n QueryName|contains: .stage.123456.", "false_positives": [ "Unknown" ], "references": [ "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml", "filename": "dns_query_win_mal_cobaltstrike.yml", "curated": true, "technique_ids": [ "T1071.004" ], "tactic_tags": [] }, { "id": "613c03ba-0779-4a53-8a1f-47f914a4ded3", "title": "DNS Query To MEGA Hosting Website", "sysmon_eids": [ 22 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567.002", "technique": "", "level": "medium", "description": "Detects DNS queries for subdomains related to MEGA sharing website", "author": "Aaron Greetham (@beardofbinary) - NCC Group", "date": "2021-05-26", "modified": "2023-09-18", "detection_yaml": "condition: selection\nselection:\n QueryName|contains: userstorage.mega.co.nz", "false_positives": [ "Legitimate DNS queries and usage of Mega" ], "references": [ "https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_mega_nz.yml", "filename": "dns_query_win_mega_nz.yml", "curated": true, "technique_ids": [ "T1567.002" ], "tactic_tags": [ "exfiltration" ] }, { "id": "df68f791-ad95-447f-a271-640a0dab9cf8", "title": "DNS Query Request To OneLaunch Update Service", "sysmon_eids": [ 22 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1056", "technique": "", "level": "low", "description": "Detects DNS query requests to \"update.onelaunch.com\". This domain is associated with the OneLaunch adware application.\nWhen the OneLaunch application is installed it will attempt to get updates from this domain.", "author": "Josh Nickels", "date": "2024-02-26", "modified": "", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\OneLaunch.exe\n QueryName: update.onelaunch.com", "false_positives": [ "Unlikely" ], "references": [ "https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf", "https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/", "https://malware.guide/browser-hijacker/remove-onelaunch-virus/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_onelaunch_update_service.yml", "filename": "dns_query_win_onelaunch_update_service.yml", "curated": true, "technique_ids": [ "T1056" ], "tactic_tags": [ "collection" ] }, { "id": "882e858a-3233-4ba8-855e-2f3d3575803d", "title": "DNS Query Request By QuickAssist.EXE", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1071.001", "technique": "", "level": "low", "description": "Detects DNS queries initiated by \"QuickAssist.exe\" to Microsoft Quick Assist primary endpoint that is used to establish a session.", "author": "Muhammad Faisal (@faisalusuf)", "date": "2024-12-19", "modified": "", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\QuickAssist.exe\n QueryName|endswith: remoteassistance.support.services.microsoft.com", "false_positives": [ "Legitimate use of Quick Assist in the environment." ], "references": [ "https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/", "https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/", "https://x.com/cyb3rops/status/1862406110365245506", "https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_quickassist.yml", "filename": "dns_query_win_quickassist.yml", "curated": true, "technique_ids": [ "T1071.001", "T1210" ], "tactic_tags": [] }, { "id": "36e037c4-c228-4866-b6a3-48eb292b9955", "title": "DNS Query Request By Regsvr32.EXE", "sysmon_eids": [ 22 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1559.001", "technique": "", "level": "medium", "description": "Detects DNS queries initiated by \"Regsvr32.exe\"", "author": "Dmitriy Lifanov, oscd.community", "date": "2019-10-25", "modified": "2023-09-18", "detection_yaml": "condition: selection\nselection:\n Image|endswith: \\regsvr32.exe", "false_positives": [ "Unknown" ], "references": [ "https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_regsvr32_dns_query.yml", "filename": "dns_query_win_regsvr32_dns_query.yml", "curated": true, "technique_ids": [ "T1559.001", "T1218.010" ], "tactic_tags": [ "execution", "stealth" ] }, { "id": "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "title": "DNS Query To Remote Access Software Domain From Non-Browser App", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1219.002", "technique": "", "level": "medium", "description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.\nThese services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.\nRemote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly ...", "author": "frack113, Connor Martin", "date": "2022-07-11", "modified": "2024-12-17", "detection_yaml": "condition: 1 of selection_* and not 1 of filter_optional_*\nfilter_optional_avant:\n Image|endswith: \\avant.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Avant Browser\\\n - C:\\Program Files\\Avant Browser\\\nfilter_optional_brave:\n Image|endswith: \\brave.exe\n Image|startswith: C:\\Program Files\\BraveSoftware\\\nfilter_optional_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_defender:\n Image|endswith:\n - \\MsMpEng.exe\n - \\MsSense.exe\nfilter_optional_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_optional_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Fil...", "false_positives": [ "Likely with other browser software. Apply additional filters for any other browsers you might use." ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-6---ammyy-admin-software-execution", "https://redcanary.com/blog/misbehaving-rats/", "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml", "filename": "dns_query_win_remote_access_software_domains_non_browsers.yml", "curated": true, "technique_ids": [ "T1219.002" ], "tactic_tags": [] }, { "id": "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "title": "Suspicious DNS Query for IP Lookup Service APIs", "sysmon_eids": [ 22 ], "tactic": "Reconnaissance", "tactic_id": "", "technique_id": "T1590", "technique": "", "level": "medium", "description": "Detects DNS queries for IP lookup services such as \"api.ipify.org\" originating from a non browser process.", "author": "Brandon George (blog post), Thomas Patzke", "date": "2021-07-08", "modified": "2024-03-22", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_brave:\n Image|endswith: \\brave.exe\nfilter_optional_chrome:\n Image:\n - C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\n - C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\nfilter_optional_edge_1:\n- Image|startswith: C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\\n- Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\n- Image:\n - C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\n - C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe\nfilter_optional_edge_2:\n Image|endswith:\n - \\msedge.exe\n - \\msedgewebview2.exe\n Image|startswith:\n - C:\\Program Files (x86)\\Microsoft\\EdgeCore\\\n - C:\\Program Files\\Microsoft\\EdgeCore\\\nfilter_optional_firefox:\n Image:\n - C:\\Program Files\\Mozilla Firefox\\firefox.exe\n - C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe\nfilter_optional_ie:\n Image:\n - C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\n - C:\\Program Files\\Internet Explorer\\...", "false_positives": [ "Legitimate usage of IP lookup services such as ipify API" ], "references": [ "https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon", "https://twitter.com/neonprimetime/status/1436376497980428318", "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_susp_external_ip_lookup.yml", "filename": "dns_query_win_susp_external_ip_lookup.yml", "curated": true, "technique_ids": [ "T1590" ], "tactic_tags": [ "reconnaissance" ] }, { "id": "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "title": "TeamViewer Domain Query By Non-TeamViewer Application", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1219.002", "technique": "", "level": "medium", "description": "Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)", "author": "Florian Roth (Nextron Systems)", "date": "2022-01-30", "modified": "2023-09-18", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_teamviewer:\n Image|contains: TeamViewer\nselection:\n QueryName:\n - taf.teamviewer.com\n - udp.ping.teamviewer.com", "false_positives": [ "Unknown binary names of TeamViewer", "Depending on the environment the rule might require some initial tuning before usage to avoid FP with third party applications" ], "references": [ "https://www.teamviewer.com/en-us/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_teamviewer_domain_query_by_uncommon_app.yml", "filename": "dns_query_win_teamviewer_domain_query_by_uncommon_app.yml", "curated": true, "technique_ids": [ "T1219.002" ], "tactic_tags": [] }, { "id": "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "title": "DNS Query Tor .Onion Address - Sysmon", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1090.003", "technique": "", "level": "high", "description": "Detects DNS queries to an \".onion\" address related to Tor routing networks", "author": "frack113", "date": "2022-02-20", "modified": "2025-09-12", "detection_yaml": "condition: selection\nselection:\n QueryName|endswith:\n - .hiddenservice.net\n - .onion.ca\n - .onion.cab\n - .onion.casa\n - .onion.city\n - .onion.direct\n - .onion.dog\n - .onion.glass\n - .onion.gq\n - .onion.ink\n - .onion.it\n - .onion.link\n - .onion.lt\n - .onion.lu\n - .onion.nu\n - .onion.pet\n - .onion.plus\n - .onion.rip\n - .onion.sh\n - .onion.to\n - .onion.top\n - .onion\n - .s1.tor-gateways.de\n - .s2.tor-gateways.de\n - .s3.tor-gateways.de\n - .s4.tor-gateways.de\n - .s5.tor-gateways.de\n - .t2w.pw\n - .tor2web.ae.org\n - .tor2web.blutmagie.de\n - .tor2web.com\n - .tor2web.fi\n - .tor2web.io\n - .tor2web.org\n - .tor2web.xyz\n - .torlink.co", "false_positives": [ "Unknown" ], "references": [ "https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/", "https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_tor_onion_domain_query.yml", "filename": "dns_query_win_tor_onion_domain_query.yml", "curated": true, "technique_ids": [ "T1090.003" ], "tactic_tags": [] }, { "id": "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "title": "DNS Query To Ufile.io", "sysmon_eids": [ 22 ], "tactic": "Exfiltration", "tactic_id": "", "technique_id": "T1567.002", "technique": "", "level": "low", "description": "Detects DNS queries to \"ufile.io\", which was seen abused by malware and threat actors as a method for data exfiltration", "author": "yatinwad, TheDFIRReport", "date": "2022-06-23", "modified": "2023-09-18", "detection_yaml": "condition: selection\nselection:\n QueryName|contains: ufile.io", "false_positives": [ "DNS queries for \"ufile\" are not malicious by nature necessarily. Investigate the source to determine the necessary actions to take" ], "references": [ "https://thedfirreport.com/2021/12/13/diavol-ransomware/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_ufile_io_query.yml", "filename": "dns_query_win_ufile_io_query.yml", "curated": true, "technique_ids": [ "T1567.002" ], "tactic_tags": [ "exfiltration" ] }, { "id": "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "title": "DNS Query To Visual Studio Code Tunnels Domain", "sysmon_eids": [ 22 ], "tactic": "", "tactic_id": "", "technique_id": "T1071.001", "technique": "", "level": "medium", "description": "Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.", "author": "citron_ninja", "date": "2023-10-25", "modified": "2023-11-20", "detection_yaml": "condition: selection\nselection:\n QueryName|endswith: .tunnels.api.visualstudio.com", "false_positives": [ "Legitimate use of Visual Studio Code tunnel will also trigger this." ], "references": [ "https://ipfyx.fr/post/visual-studio-code-tunnel/", "https://badoption.eu/blog/2023/01/31/code_c2.html", "https://cydefops.com/vscode-data-exfiltration" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/dns_query/dns_query_win_vscode_tunnel_communication.yml", "filename": "dns_query_win_vscode_tunnel_communication.yml", "curated": true, "technique_ids": [ "T1071.001" ], "tactic_tags": [] }, { "id": "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "title": "Malicious Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "high", "description": "Detects loading of known malicious drivers via their hash.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-18", "modified": "2023-12-02", "detection_yaml": "condition: selection\nselection:\n Hashes|contains:\n - MD5=5be61a24f50eb4c94d98b8a82ef58dcf\n - MD5=d70a80fc73dd43469934a7b1cc623c76\n - MD5=3b71eab204a5f7ed77811e41fed73105\n - MD5=528ce5ce19eb34f401ef024de7ddf222\n - MD5=ae548418b491cd3f31618eb9e5730973\n - MD5=72f53f55898548767e0276c472be41e8\n - MD5=508faa4647f305a97ed7167abc4d1330\n - MD5=ed2b653d55c03f0bffa250372d682b75\n - MD5=0d2ba47286f1c68e87622b3a16bf9d92\n - MD5=3164bd6c12dd0fe1bdf3b833d56323b9\n - MD5=70fd7209ce5c013a1f9e699b5cc86cdc\n - MD5=c71be7b112059d2dc84c0f952e04e6cc\n - MD5=acac842a46f3501fe407b1db1b247a0b\n - MD5=01c2e4d8234258451083d6ce4e8910b7\n - MD5=c8541a9cef64589593e999968a0385b9\n - MD5=e172a38ade3aa0a2bc1bf9604a54a3b5\n - MD5=6fcf56f6ca3210ec397e55f727353c4a\n - MD5=2b80be31fbb11d4c1ef6d6a80b2e0c16\n - MD5=07056573d464b0f5284f7e3acedd4a3f\n - MD5=c7b7f1edb9bbef174e6506885561d85d\n - MD5=d5918d735a23f746f0e83f724c4f26e5\n - MD5=84763d8ca9fe5c3bff9667b2adf667de\n - MD5=fb593b1f1f80d20fc7f4b818065c64b6\n -...", "false_positives": [ "Unknown" ], "references": [ "https://loldrivers.io/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_mal_drivers.yml", "filename": "driver_load_win_mal_drivers.yml", "curated": true, "technique_ids": [ "T1543.003", "T1068" ], "tactic_tags": [ "persistence" ] }, { "id": "39b64854-5497-4b57-a448-40977b8c9679", "title": "Malicious Driver Load By Name", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "medium", "description": "Detects loading of known malicious drivers via the file name of the drivers.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-03", "modified": "2023-12-02", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith:\n - \\wfshbr64.sys\n - \\ktmutil7odm.sys\n - \\ktes.sys\n - \\a26363e7b02b13f2b8d697abb90cd5c3.sys\n - \\kt2.sys\n - \\4748696211bd56c2d93c21cab91e82a5.sys\n - \\malicious.sys\n - \\a236e7d654cd932b7d11cb604629a2d0.sys\n - \\spwizimgvt.sys\n - \\c94f405c5929cfcccc8ad00b42c95083.sys\n - \\fur.sys\n - \\wantd.sys\n - \\windbg.sys\n - \\4118b86e490aed091b1a219dba45f332.sys\n - \\gmer64.sys\n - \\1fc7aeeff3ab19004d2e53eae8160ab1.sys\n - \\poortry2.sys\n - \\wintapix.sys\n - \\daxin_blank6.sys\n - \\6771b13a53b9c7449d4891e427735ea2.sys\n - \\blacklotus_driver.sys\n - \\air_system10.sys\n - \\dkrtk.sys\n - \\7.sys\n - \\sense5ext.sys\n - \\ktgn.sys\n - \\ndislan.sys\n - \\nlslexicons0024uvn.sys\n - \\be6318413160e589080df02bb3ca6e6a.sys\n - \\4.sys\n - \\wantd_2.sys\n - \\e29f6311ae87542b3d693c1f38e4e3ad.sys\n - \\daxin_blank3.sys\n - \\gftkyj64.sys\n - \\daxin_blank2.sys\n - \\wantd_4.sys\n - \\reddriver.sys\n - \\834761775.sys\n - \\mlgbbiicaihflrnh.sys\n - \\mjj0ge.sys\n...", "false_positives": [ "False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.", "If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)" ], "references": [ "https://loldrivers.io/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_mal_drivers_names.yml", "filename": "driver_load_win_mal_drivers_names.yml", "curated": true, "technique_ids": [ "T1543.003", "T1068" ], "tactic_tags": [ "persistence" ] }, { "id": "67add051-9ee7-4ad3-93ba-42935615ae8d", "title": "PUA - Process Hacker Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543", "technique": "", "level": "high", "description": "Detects driver load of the Process Hacker tool", "author": "Florian Roth (Nextron Systems)", "date": "2022-11-16", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n- ImageLoaded|endswith: \\kprocesshacker.sys\n- Hashes|contains:\n - IMPHASH=821D74031D3F625BCBD0DF08B70F1E77\n - IMPHASH=F86759BB4DE4320918615DC06E998A39\n - IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18\n - IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0", "false_positives": [ "Legitimate use of process hacker or system informer by developers or system administrators" ], "references": [ "https://processhacker.sourceforge.io/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_pua_process_hacker.yml", "filename": "driver_load_win_pua_process_hacker.yml", "curated": true, "technique_ids": [ "T1543" ], "tactic_tags": [ "persistence" ] }, { "id": "10cb6535-b31d-4512-9962-513dcbc42cc1", "title": "PUA - System Informer Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543", "technique": "", "level": "medium", "description": "Detects driver load of the System Informer tool", "author": "Florian Roth (Nextron Systems)", "date": "2023-05-08", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n- ImageLoaded|endswith: \\SystemInformer.sys\n- Hashes|contains:\n - SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24\n - SHA256=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454\n - SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D\n - SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B\n - SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D\n - SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34\n - SHA256=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89\n - SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB\n - SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B\n - SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97\n - SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656\n - SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB057...", "false_positives": [ "System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly" ], "references": [ "https://systeminformer.sourceforge.io/", "https://github.com/winsiderss/systeminformer" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_pua_system_informer.yml", "filename": "driver_load_win_pua_system_informer.yml", "curated": true, "technique_ids": [ "T1543" ], "tactic_tags": [ "persistence" ] }, { "id": "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "title": "Driver Load From A Temporary Directory", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "high", "description": "Detects a driver load from a temporary directory", "author": "Florian Roth (Nextron Systems)", "date": "2017-02-12", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|contains: \\Temp\\", "false_positives": [ "There is a relevant set of false positives depending on applications in the environment" ], "references": [ "Internal Research" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_susp_temp_use.yml", "filename": "driver_load_win_susp_temp_use.yml", "curated": true, "technique_ids": [ "T1543.003" ], "tactic_tags": [ "persistence" ] }, { "id": "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "title": "Vulnerable Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "high", "description": "Detects loading of known vulnerable drivers via their hash.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-18", "modified": "2023-12-02", "detection_yaml": "condition: selection\nselection:\n Hashes|contains:\n - MD5=c996d7971c49252c582171d9380360f2\n - MD5=da7e98b23b49b7293ee06713032c74f6\n - MD5=9496585198d726000ea505abc39dbfe9\n - MD5=649ff59b8e571c1fc6535b31662407aa\n - MD5=4429f85e2415742c7cf8c9f54905c4b9\n - MD5=a610cd4c762b5af8575285dafb9baa8f\n - MD5=d5e76d125d624f8025d534f49e3c4162\n - MD5=9c8fffef24fc480917236f9a20b80a47\n - MD5=65b979bcab915c3922578fe77953d789\n - MD5=598f8fb2317350e5f90b7bd16baf5738\n - MD5=6691e873354f1914692df104718eebad\n - MD5=4814205270caa80d35569eee8081838e\n - MD5=7f9128654c3def08c28e0e13efff0fee\n - MD5=ce952204558ea66ec1a9632dcbdde8bd\n - MD5=0c0195c48b6b8582fa6f6373032118da\n - MD5=370a4ca29a7cf1d6bc0744afc12b236c\n - MD5=67e03f83c503c3f11843942df32efe5a\n - MD5=8a70921638ff82bb924456deadcd20e6\n - MD5=8a212a246b3c41f3ddce5888aaaaacd6\n - MD5=a346417e9ae2c17a8fbf73302eeb611d\n - MD5=d4f7c14e92b36c341c41ae93159407dd\n - MD5=748cf64b95ca83abc35762ad2c25458f\n - MD5=79ab228766c76cfdf42a64722821711e\n -...", "false_positives": [ "Unknown" ], "references": [ "https://loldrivers.io/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_drivers.yml", "filename": "driver_load_win_vuln_drivers.yml", "curated": true, "technique_ids": [ "T1543.003", "T1068" ], "tactic_tags": [ "persistence" ] }, { "id": "72cd00d6-490c-4650-86ff-1d11f491daa1", "title": "Vulnerable Driver Load By Name", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "low", "description": "Detects the load of known vulnerable drivers via the file name of the drivers.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-10-03", "modified": "2023-12-02", "detection_yaml": "condition: selection\nselection:\n ImageLoaded|endswith:\n - \\panmonfltx64.sys\n - \\dbutil.sys\n - \\fairplaykd.sys\n - \\nvaudio.sys\n - \\superbmc.sys\n - \\bsmi.sys\n - \\smarteio64.sys\n - \\bwrsh.sys\n - \\agent64.sys\n - \\asmmap64.sys\n - \\dellbios.sys\n - \\chaos-rootkit.sys\n - \\wcpu.sys\n - \\dh_kernel.sys\n - \\sbiosio64.sys\n - \\bw.sys\n - \\asrdrv102.sys\n - \\nt6.sys\n - \\mhyprot3.sys\n - \\winio64c.sys\n - \\asupio64.sys\n - \\blackbonedrv10.sys\n - \\d.sys\n - \\driver7-x86.sys\n - \\sfdrvx32.sys\n - \\enetechio64.sys\n - \\gdrv.sys\n - \\sysinfodetectorx64.sys\n - \\fh-ethercat_dio.sys\n - \\asromgdrv.sys\n - \\my.sys\n - \\dcprotect.sys\n - \\irec.sys\n - \\gedevdrv.sys\n - \\winio32a.sys\n - \\gvcidrv64.sys\n - \\winio32.sys\n - \\bs_hwmio64.sys\n - \\nstr.sys\n - \\inpoutx64.sys\n - \\hw.sys\n - \\winio64.sys\n - \\hpportiox64.sys\n - \\iobitunlocker.sys\n - \\b1.sys\n - \\aoddriver.sys\n - \\elbycdio.sys\n - \\protects.sys\n - \\kprocesshacker.sys\n - \\speedfan.sys\n - \\radhwmgr.sys\n - \\iscflashx64.sys\n ...", "false_positives": [ "False positives may occur if one of the vulnerable driver names mentioned above didn't change its name between versions. So always make sure that the driver being loaded is the legitimate one and the non vulnerable version.", "If you experience a lot of FP you could comment the driver name or its exact known legitimate location (when possible)" ], "references": [ "https://loldrivers.io/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_drivers_names.yml", "filename": "driver_load_win_vuln_drivers_names.yml", "curated": true, "technique_ids": [ "T1543.003", "T1068" ], "tactic_tags": [ "persistence" ] }, { "id": "295c9289-acee-4503-a571-8eacaef36b28", "title": "Vulnerable HackSys Extreme Vulnerable Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "high", "description": "Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-18", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n- ImageLoaded|endswith: \\HEVD.sys\n- Hashes|contains:\n - IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5\n - IMPHASH=c46ea2e651fd5f7f716c8867c6d13594", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/hacksysteam/HackSysExtremeVulnerableDriver" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_hevd_driver.yml", "filename": "driver_load_win_vuln_hevd_driver.yml", "curated": true, "technique_ids": [ "T1543.003" ], "tactic_tags": [ "persistence" ] }, { "id": "1a42dfa6-6cb2-4df9-9b48-295be477e835", "title": "Vulnerable WinRing0 Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1543.003", "technique": "", "level": "high", "description": "Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation", "author": "Florian Roth (Nextron Systems)", "date": "2022-07-26", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n- Hashes|contains: IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7\n- ImageLoaded|endswith:\n - \\WinRing0x64.sys\n - \\WinRing0.sys\n - \\WinRing0.dll\n - \\WinRing0x64.dll\n - \\winring00x64.sys", "false_positives": [ "Unknown" ], "references": [ "https://github.com/xmrig/xmrig/tree/master/bin/WinRing0", "https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_vuln_winring0_driver.yml", "filename": "driver_load_win_vuln_winring0_driver.yml", "curated": true, "technique_ids": [ "T1543.003" ], "tactic_tags": [ "persistence" ] }, { "id": "679085d5-f427-4484-9f58-1dc30a7c426d", "title": "WinDivert Driver Load", "sysmon_eids": [ 6, 29 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1599.001", "technique": "", "level": "high", "description": "Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows", "author": "Florian Roth (Nextron Systems)", "date": "2021-07-30", "modified": "2024-11-23", "detection_yaml": "condition: selection\nselection:\n- ImageLoaded|contains:\n - \\WinDivert.sys\n - \\WinDivert64.sys\n - \\NordDivert.sys\n - \\lingtiwfp.sys\n - \\eswfp.sys\n- Hashes|contains:\n - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087\n - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f\n - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276\n - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76\n - IMPHASH=58623490691babe8330adc81cd04a663\n - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b\n - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96\n - IMPHASH=a1b2e245acd47e4a348e1a552a02859a\n - IMPHASH=2a5f85fe4609461c6339637594fa9b0a\n - IMPHASH=6b2c6f95233c2914d1d488ee27531acc\n - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342\n - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88\n - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38\n - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6\n - IMPHASH=a74929edfc3289895e3f2885278947ae\n - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e\n - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4\n - IMPHASH=c28cd6ccd83179e79dac132a553693d9", "false_positives": [ "Legitimate WinDivert driver usage" ], "references": [ "https://reqrypt.org/windivert-doc.html", "https://rastamouse.me/ntlm-relaying-via-cobalt-strike/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/driver_load/driver_load_win_windivert.yml", "filename": "driver_load_win_windivert.yml", "curated": true, "technique_ids": [ "T1599.001", "T1557.001" ], "tactic_tags": [ "collection" ] }, { "id": "c4b890e5-8d8c-4496-8c66-c805753817cd", "title": "Potential Process Hollowing Activity", "sysmon_eids": [ 25 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1055.012", "technique": "", "level": "medium", "description": "Detects when a memory process image does not match the disk image, indicative of process hollowing.", "author": "Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S", "date": "2022-01-25", "modified": "2023-11-28", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_generic:\n Image|contains:\n - :\\Program Files (x86)\n - :\\Program Files\\\n - :\\Windows\\System32\\wbem\\WMIADAP.exe\n - :\\Windows\\SysWOW64\\wbem\\WMIADAP.exe\nfilter_optional_edge:\n Image|endswith: \\WindowsApps\\MicrosoftEdge.exe\nfilter_optional_opera:\n Image|contains: \\AppData\\Local\\Programs\\Opera\\\n Image|endswith: \\opera.exe\nselection:\n Type: Image is replaced", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SecurePeacock/status/1486054048390332423?s=20", "https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_tampering/proc_tampering_susp_process_hollowing.yml", "filename": "proc_tampering_susp_process_hollowing.yml", "curated": true, "technique_ids": [ "T1055.012" ], "tactic_tags": [ "stealth" ] }, { "id": "db809f10-56ce-4420-8c86-d6a7d793c79c", "title": "Potential Defense Evasion Via Raw Disk Access By Uncommon Tools", "sysmon_eids": [ 9 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1006", "technique": "", "level": "low", "description": "Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts", "author": "Teymur Kheirkhabarov, oscd.community", "date": "2019-10-22", "modified": "2025-12-03", "detection_yaml": "condition: not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_floppy:\n Device|contains: floppy\nfilter_main_generic:\n Image|startswith:\n - C:\\$WINDOWS.~BT\\\n - C:\\Program Files (x86)\\\n - C:\\Program Files\\\n - C:\\Windows\\CCM\\\n - C:\\Windows\\explorer.exe\n - C:\\Windows\\servicing\\\n - C:\\Windows\\SoftwareDistribution\\\n - C:\\Windows\\System32\\\n - C:\\Windows\\SystemApps\\\n - C:\\Windows\\SysWOW64\\\n - C:\\Windows\\uus\\\n - C:\\Windows\\WinSxS\\\nfilter_main_microsoft_appdata:\n Image|contains|all:\n - \\AppData\\\n - \\Microsoft\\\n Image|startswith: C:\\Users\\\nfilter_main_null:\n Image: null\nfilter_main_ssd_nvme:\n Image|endswith:\n - \\Executables\\SSDUpdate.exe\n - \\HostMetadata\\NVMEHostmetadata.exe\n Image|startswith: C:\\Windows\\Temp\\\nfilter_main_system_images:\n Image:\n - Registry\n - System\nfilter_main_systemsettings:\n Image: C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe\nfilter_main_update:\n Image|startswith: C:\\$WinREAgent\\Scratch\\\nfilter_main_windefender:\n Image|endsw...", "false_positives": [ "Likely" ], "references": [ "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/raw_access_thread/raw_access_thread_susp_disk_access_using_uncommon_tools.yml", "filename": "raw_access_thread_susp_disk_access_using_uncommon_tools.yml", "curated": true, "technique_ids": [ "T1006" ], "tactic_tags": [ "stealth" ] }, { "id": "815cd91b-7dbc-4247-841a-d7dd1392b0a8", "title": "Sysmon Configuration Error", "sysmon_eids": [ 16 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564", "technique": "", "level": "high", "description": "Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages", "author": "frack113", "date": "2021-06-04", "modified": "2022-07-07", "detection_yaml": "condition: selection_error and not 1 of filter*\nfilter_by_errorcode:\n Description|contains:\n - Failed to open service configuration with error 19\n - Failed to open service configuration with error 93\nfilter_generic_english:\n Description|contains|all:\n - Failed to open service configuration with error\n - 'Last error: The media is write protected.'\nselection_error:\n Description|contains:\n - Failed to open service configuration with error\n - Failed to connect to the driver to update configuration", "false_positives": [ "Legitimate administrative action" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification_error.yml", "filename": "sysmon_config_modification_error.yml", "curated": true, "technique_ids": [ "T1564" ], "tactic_tags": [ "stealth" ] }, { "id": "1f2b5353-573f-4880-8e33-7d04dcf97744", "title": "Sysmon Configuration Modification", "sysmon_eids": [ 16 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1564", "technique": "", "level": "high", "description": "Detects when an attacker tries to hide from Sysmon by disabling or stopping it", "author": "frack113", "date": "2021-06-04", "modified": "2022-08-02", "detection_yaml": "condition: 1 of selection_* and not filter\nfilter:\n State: Started\nselection_conf:\n- Sysmon config state changed\nselection_stop:\n State: Stopped", "false_positives": [ "Legitimate administrative action" ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/sysmon/sysmon_config_modification_status.yml", "filename": "sysmon_config_modification_status.yml", "curated": true, "technique_ids": [ "T1564" ], "tactic_tags": [ "stealth" ] }, { "id": "2111118f-7e46-4fc8-974a-59fd8ec95196", "title": "DiagTrackEoP Default Login Username", "sysmon_eids": [ 4624 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "critical", "description": "Detects the default \"UserName\" used by the DiagTrackEoP POC", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-08-03", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID: 4624\n LogonType: 9\n TargetOutboundUserName: thisisnotvaliduser", "false_positives": [ "Unlikely" ], "references": [ "https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L46" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_diagtrack_eop_default_login_username.yml", "filename": "win_security_diagtrack_eop_default_login_username.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "c43c26be-2e87-46c7-8661-284588c5a53e", "title": "A Member Was Added to a Security-Enabled Global Group", "sysmon_eids": [ 4728 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "low", "description": "Detects activity when a member is added to a security-enabled global group", "author": "Alexandr Yampolskyi, SOC Prime", "date": "2023-04-26", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4728\n - 632", "false_positives": [ "Unknown" ], "references": [ "https://www.cisecurity.org/controls/cis-controls-list/", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml", "filename": "win_security_member_added_security_enabled_global_group.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "02c39d30-02b5-45d2-b435-8aebfe5a8629", "title": "A Member Was Removed From a Security-Enabled Global Group", "sysmon_eids": [ 4729 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "low", "description": "Detects activity when a member is removed from a security-enabled global group", "author": "Alexandr Yampolskyi, SOC Prime", "date": "2023-04-26", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 633\n - 4729", "false_positives": [ "Unknown" ], "references": [ "https://www.cisecurity.org/controls/cis-controls-list/", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml", "filename": "win_security_member_removed_security_enabled_global_group.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "b237c54b-0f15-4612-a819-44b735e0de27", "title": "A Security-Enabled Global Group Was Deleted", "sysmon_eids": [ 4730 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "low", "description": "Detects activity when a security-enabled global group is deleted", "author": "Alexandr Yampolskyi, SOC Prime", "date": "2023-04-26", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4730\n - 634", "false_positives": [ "Unknown" ], "references": [ "https://www.cisecurity.org/controls/cis-controls-list/", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml", "filename": "win_security_security_enabled_global_group_deleted.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "78d5cab4-557e-454f-9fb9-a222bd0d5edc", "title": "External Remote SMB Logon from Public IP", "sysmon_eids": [ 4624 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1133", "technique": "", "level": "high", "description": "Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.", "author": "Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)", "date": "2023-01-19", "modified": "2024-03-11", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_empty:\n IpAddress: '-'\nfilter_main_local_ranges:\n IpAddress|cidr:\n - ::1/128\n - 10.0.0.0/8\n - 127.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - fc00::/7\n - fe80::/10\nselection:\n EventID: 4624\n LogonType: 3", "false_positives": [ "Legitimate or intentional inbound connections from public IP addresses on the SMB port." ], "references": [ "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html", "https://twitter.com/Purp1eW0lf/status/1616144561965002752" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml", "filename": "win_security_successful_external_remote_smb_login.yml", "curated": true, "technique_ids": [ "T1133", "T1078", "T1110" ], "tactic_tags": [ "persistence", "stealth" ] }, { "id": "f88e112a-21aa-44bd-9b01-6ee2a2bbbed1", "title": "Failed Logon From Public IP", "sysmon_eids": [ 4625 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1078", "technique": "", "level": "medium", "description": "Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.", "author": "NVISO", "date": "2020-05-06", "modified": "2024-03-11", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_ip_unknown:\n IpAddress|contains: '-'\nfilter_main_local_ranges:\n IpAddress|cidr:\n - ::1/128\n - 10.0.0.0/8\n - 127.0.0.0/8\n - 172.16.0.0/12\n - 192.168.0.0/16\n - 169.254.0.0/16\n - fc00::/7\n - fe80::/10\nselection:\n EventID: 4625", "false_positives": [ "Legitimate logon attempts over the internet", "IPv4-to-IPv6 mapped IPs" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_failed_logon_source.yml", "filename": "win_security_susp_failed_logon_source.yml", "curated": true, "technique_ids": [ "T1078", "T1190", "T1133" ], "tactic_tags": [ "persistence", "stealth" ] }, { "id": "749c9f5e-b353-4b90-a9c1-05243357ca4b", "title": "Potential Privilege Escalation via Local Kerberos Relay over LDAP", "sysmon_eids": [ 4624 ], "tactic": "", "tactic_id": "", "technique_id": "T1548", "technique": "", "level": "high", "description": "Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.\nThis may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.", "author": "Elastic, @SBousseaden", "date": "2022-04-27", "modified": "2024-08-13", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_ip_null:\n IpPort: '0'\nselection:\n AuthenticationPackageName: Kerberos\n EventID: 4624\n IpAddress: 127.0.0.1\n LogonType: 3\n TargetUserSid|endswith: '-500'\n TargetUserSid|startswith: S-1-5-21-", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/sbousseaden/status/1518976397364056071?s=12&t=qKO5eKHvWhAP19a50FTZ7g", "https://github.com/elastic/detection-rules/blob/5fe7833312031a4787e07893e27e4ea7a7665745/rules/_deprecated/privilege_escalation_krbrelayup_suspicious_logon.toml#L38" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/account_management/win_security_susp_privesc_kerberos_relay_over_ldap.yml", "filename": "win_security_susp_privesc_kerberos_relay_over_ldap.yml", "curated": true, "technique_ids": [ "T1548" ], "tactic_tags": [] }, { "id": "ff151c33-45fa-475d-af4f-c2f93571f4fe", "title": "Azure AD Health Monitoring Agent Registry Keys Access", "sysmon_eids": [ 4656, 4663 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1012", "technique": "", "level": "medium", "description": "This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.\nThis detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC", "date": "2021-08-26", "modified": "2022-10-09", "detection_yaml": "condition: selection and not filter\nfilter:\n ProcessName|contains:\n - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe\n - Microsoft.Identity.Health.Adfs.InsightsService.exe\n - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe\n - Microsoft.Identity.Health.Adfs.PshSurrogate.exe\n - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe\nselection:\n EventID:\n - 4656\n - 4663\n ObjectName: \\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent\n ObjectType: Key", "false_positives": [ "Unknown" ], "references": [ "https://o365blog.com/post/hybridhealthagent/", "https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_aadhealth_mon_agent_regkey_access.yml", "filename": "win_security_aadhealth_mon_agent_regkey_access.yml", "curated": true, "technique_ids": [ "T1012" ], "tactic_tags": [ "discovery" ] }, { "id": "2c99737c-585d-4431-b61a-c911d86ff32f", "title": "Powerview Add-DomainObjectAcl DCSync AD Extend Right", "sysmon_eids": [ 5136 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "high", "description": "Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer", "author": "Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat", "date": "2019-04-03", "modified": "2022-08-16", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_dns_object_class:\n ObjectClass:\n - dnsNode\n - dnsZoneScope\n - dnsZone\nselection:\n AttributeLDAPDisplayName: ntSecurityDescriptor\n AttributeValue|contains:\n - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2\n - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\n - 89e95b76-444d-4c62-991a-0facbeda640c\n EventID: 5136", "false_positives": [ "New Domain Controller computer account, check user SIDs within the value attribute of event 5136 and verify if it's a regular user or DC computer account." ], "references": [ "https://twitter.com/menasec1/status/1111556090137903104", "https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml", "filename": "win_security_account_backdoor_dcsync_rights.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "35ba1d85-724d-42a3-889f-2e2362bcaf23", "title": "AD Privileged Users or Groups Reconnaissance", "sysmon_eids": [ 4661 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1087.002", "technique": "", "level": "high", "description": "Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs", "author": "Samir Bousseaden", "date": "2019-04-03", "modified": "2022-07-13", "detection_yaml": "condition: selection and selection_object and not filter\nfilter:\n SubjectUserName|endswith: $\nselection:\n EventID: 4661\n ObjectType:\n - SAM_USER\n - SAM_GROUP\nselection_object:\n- ObjectName|endswith:\n - '-512'\n - '-502'\n - '-500'\n - '-505'\n - '-519'\n - '-520'\n - '-544'\n - '-551'\n - '-555'\n- ObjectName|contains: admin", "false_positives": [ "If source account name is not an admin then its super suspicious" ], "references": [ "https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_account_discovery.yml", "filename": "win_security_account_discovery.yml", "curated": true, "technique_ids": [ "T1087.002" ], "tactic_tags": [ "discovery" ] }, { "id": "028c7842-4243-41cd-be6f-12f3cf1a26c7", "title": "AD Object WriteDAC Access", "sysmon_eids": [ 4662 ], "tactic": "", "tactic_id": "", "technique_id": "T1222.001", "technique": "", "level": "critical", "description": "Detects WRITE_DAC access to a domain object", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-09-12", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n AccessMask: '0x40000'\n EventID: 4662\n ObjectServer: DS\n ObjectType:\n - 19195a5b-6da0-11d0-afd3-00c04fd930c9\n - domainDNS", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html", "https://threathunterplaybook.com/library/windows/active_directory_replication.html", "https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_object_writedac_access.yml", "filename": "win_security_ad_object_writedac_access.yml", "curated": true, "technique_ids": [ "T1222.001" ], "tactic_tags": [] }, { "id": "17d619c1-e020-4347-957e-1d1207455c93", "title": "Active Directory Replication from Non Machine Account", "sysmon_eids": [ 4662 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.006", "technique": "", "level": "critical", "description": "Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-07-26", "modified": "2021-11-27", "detection_yaml": "condition: selection and not filter\nfilter:\n- SubjectUserName|endswith: $\n- SubjectUserName|startswith: MSOL_\nselection:\n AccessMask: '0x100'\n EventID: 4662\n Properties|contains:\n - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\n - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2\n - 89e95b76-444d-4c62-991a-0facbeda640c", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html", "https://threathunterplaybook.com/library/windows/active_directory_replication.html", "https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_ad_replication_non_machine_account.yml", "filename": "win_security_ad_replication_non_machine_account.yml", "curated": true, "technique_ids": [ "T1003.006" ], "tactic_tags": [] }, { "id": "5ee3a654-372f-11ec-8d3d-0242ac130003", "title": "ADCS Certificate Template Configuration Vulnerability", "sysmon_eids": [ 4898, 4899 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "low", "description": "Detects certificate creation with template allowing risk permission subject", "author": "Orlinum , BlueDefenZer", "date": "2021-11-17", "modified": "2022-12-25", "detection_yaml": "condition: selection1 or selection2\nselection1:\n EventID: 4898\n TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT\nselection2:\n EventID: 4899\n NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT", "false_positives": [ "Administrator activity", "Proxy SSL certificate with subject modification", "Smart card enrollement" ], "references": [ "https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability.yml", "filename": "win_security_adcs_certificate_template_configuration_vulnerability.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "bfbd3291-de87-4b7c-88a2-d6a5deb28668", "title": "ADCS Certificate Template Configuration Vulnerability with Risky EKU", "sysmon_eids": [ 4898, 4899 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "high", "description": "Detects certificate creation with template allowing risk permission subject and risky EKU", "author": "Orlinum , BlueDefenZer", "date": "2021-11-17", "modified": "2022-12-25", "detection_yaml": "condition: (selection10 and selection11) or (selection20 and selection21)\nselection10:\n EventID: 4898\n TemplateContent|contains:\n - 1.3.6.1.5.5.7.3.2\n - 1.3.6.1.5.2.3.4\n - 1.3.6.1.4.1.311.20.2.2\n - 2.5.29.37.0\nselection11:\n TemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT\nselection20:\n EventID: 4899\n NewTemplateContent|contains:\n - 1.3.6.1.5.5.7.3.2\n - 1.3.6.1.5.2.3.4\n - 1.3.6.1.4.1.311.20.2.2\n - 2.5.29.37.0\nselection21:\n NewTemplateContent|contains: CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT", "false_positives": [ "Administrator activity", "Proxy SSL certificate with subject modification", "Smart card enrollement" ], "references": [ "https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_adcs_certificate_template_configuration_vulnerability_eku.yml", "filename": "win_security_adcs_certificate_template_configuration_vulnerability_eku.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "20d96d95-5a20-4cf1-a483-f3bda8a7c037", "title": "Add or Remove Computer from DC", "sysmon_eids": [ 4741, 4743 ], "tactic": "", "tactic_id": "", "technique_id": "T1207", "technique": "", "level": "low", "description": "Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.", "author": "frack113", "date": "2022-10-14", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4741\n - 4743", "false_positives": [ "Unknown" ], "references": [ "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_add_remove_computer.yml", "filename": "win_security_add_remove_computer.yml", "curated": true, "technique_ids": [ "T1207" ], "tactic_tags": [] }, { "id": "098d7118-55bc-4912-a836-dc6483a8d150", "title": "Access To ADMIN$ Network Share", "sysmon_eids": [ 5140 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "low", "description": "Detects access to ADMIN$ network share", "author": "Florian Roth (Nextron Systems)", "date": "2017-03-04", "modified": "2024-01-16", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_main_computer_account:\n SubjectUserName|endswith: $\nselection:\n EventID: 5140\n ShareName: Admin$", "false_positives": [ "Legitimate administrative activity" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_admin_share_access.yml", "filename": "win_security_admin_share_access.yml", "curated": true, "technique_ids": [ "T1021.002" ], "tactic_tags": [] }, { "id": "311b6ce2-7890-4383-a8c2-663a9f6b43cd", "title": "Enabled User Right in AD to Control User Objects", "sysmon_eids": [ 4704 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "high", "description": "Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.", "author": "@neu5ron", "date": "2017-07-30", "modified": "2021-12-02", "detection_yaml": "condition: all of selection*\nselection_base:\n EventID: 4704\nselection_keywords:\n PrivilegeList|contains: SeEnableDelegationPrivilege", "false_positives": [ "Unknown" ], "references": [ "https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml", "filename": "win_security_alert_active_directory_user_control.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "300bac00-e041-4ee2-9c36-e262656a6ecc", "title": "Active Directory User Backdoors", "sysmon_eids": [ 4738, 5136 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "high", "description": "Detects scenarios where one can control another users or computers account without having to use their credentials.", "author": "@neu5ron", "date": "2017-04-13", "modified": "2024-02-26", "detection_yaml": "condition: (selection1 and not 1 of filter_*) or 1 of selection_5136_*\nfilter_empty:\n AllowedToDelegateTo:\n - ''\n - '-'\nfilter_null:\n AllowedToDelegateTo: null\nselection1:\n EventID: 4738\nselection_5136_1:\n AttributeLDAPDisplayName: msDS-AllowedToDelegateTo\n EventID: 5136\nselection_5136_2:\n AttributeLDAPDisplayName: servicePrincipalName\n EventID: 5136\n ObjectClass: user\nselection_5136_3:\n AttributeLDAPDisplayName: msDS-AllowedToActOnBehalfOfOtherIdentity\n EventID: 5136", "false_positives": [ "Unknown" ], "references": [ "https://msdn.microsoft.com/en-us/library/cc220234.aspx", "https://adsecurity.org/?p=3466", "https://blog.harmj0y.net/redteaming/another-word-on-delegation/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml", "filename": "win_security_alert_ad_user_backdoors.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "f6de9536-0441-4b3f-a646-f4e00f300ffd", "title": "Weak Encryption Enabled and Kerberoast", "sysmon_eids": [ 4738 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.", "author": "@neu5ron", "date": "2017-07-30", "modified": "2021-11-27", "detection_yaml": "condition: selection and ((newuac_des and not olduac_des) or (newuac_preauth and not\n olduac_preauth) or (newuac_encrypted and not olduac_encrypted))\nnewuac_des:\n NewUacValue|endswith:\n - 8???\n - 9???\n - A???\n - B???\n - C???\n - D???\n - E???\n - F???\nnewuac_encrypted:\n NewUacValue|endswith:\n - 8??\n - 9??\n - A??\n - B??\n - C??\n - D??\n - E??\n - F??\nnewuac_preauth:\n NewUacValue|endswith:\n - 1????\n - 3????\n - 5????\n - 7????\n - 9????\n - B????\n - D????\n - F????\nolduac_des:\n OldUacValue|endswith:\n - 8???\n - 9???\n - A???\n - B???\n - C???\n - D???\n - E???\n - F???\nolduac_encrypted:\n OldUacValue|endswith:\n - 8??\n - 9??\n - A??\n - B??\n - C??\n - D??\n - E??\n - F??\nolduac_preauth:\n OldUacValue|endswith:\n - 1????\n - 3????\n - 5????\n - 7????\n - 9????\n - B????\n - D????\n - F????\nselection:\n EventID: 4738", "false_positives": [ "Unknown" ], "references": [ "https://adsecurity.org/?p=2053", "https://blog.harmj0y.net/redteaming/another-word-on-delegation/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml", "filename": "win_security_alert_enable_weak_encryption.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "24549159-ac1b-479c-8175-d42aea947cae", "title": "Hacktool Ruler", "sysmon_eids": [ 4624, 4625, 4776 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1087", "technique": "", "level": "high", "description": "This events that are generated when using the hacktool Ruler by Sensepost", "author": "Florian Roth (Nextron Systems)", "date": "2017-05-31", "modified": "2022-10-09", "detection_yaml": "condition: (1 of selection*)\nselection1:\n EventID: 4776\n Workstation: RULER\nselection2:\n EventID:\n - 4624\n - 4625\n WorkstationName: RULER", "false_positives": [ "Go utilities that use staaldraad awesome NTLM library" ], "references": [ "https://github.com/sensepost/ruler", "https://github.com/sensepost/ruler/issues/47", "https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_alert_ruler.yml", "filename": "win_security_alert_ruler.yml", "curated": true, "technique_ids": [ "T1087", "T1114", "T1059", "T1550.002" ], "tactic_tags": [ "discovery", "execution", "collection" ] }, { "id": "8cd538a4-62d5-4e83-810b-12d41e428d6e", "title": "Processes Accessing the Microphone and Webcam", "sysmon_eids": [ 4657 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1123", "technique": "", "level": "medium", "description": "Potential adversaries accessing the microphone and webcam in an endpoint.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-06-07", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4657\n - 4656\n - 4663\n ObjectName|contains:\n - \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\microphone\\NonPackaged\n - \\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\webcam\\NonPackaged", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/duzvik/status/1269671601852813320", "https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_camera_microphone_access.yml", "filename": "win_security_camera_microphone_access.yml", "curated": true, "technique_ids": [ "T1123" ], "tactic_tags": [ "collection" ] }, { "id": "d7a95147-145f-4678-b85d-d1ff4a3bb3f6", "title": "CobaltStrike Service Installations - Security", "sysmon_eids": [ 4697 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "high", "description": "Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement", "author": "Florian Roth (Nextron Systems), Wojciech Lesicki", "date": "2021-05-26", "modified": "2022-11-27", "detection_yaml": "condition: event_id and 1 of selection*\nevent_id:\n EventID: 4697\nselection1:\n ServiceFileName|contains|all:\n - ADMIN$\n - .exe\nselection2:\n ServiceFileName|contains|all:\n - '%COMSPEC%'\n - start\n - powershell\nselection3:\n ServiceFileName|contains: powershell -nop -w hidden -encodedcommand\nselection4:\n ServiceFileName|base64offset|contains: 'IEX (New-Object Net.Webclient).DownloadString(''http://127.0.0.1:'", "false_positives": [ "Unknown" ], "references": [ "https://www.sans.org/webcasts/119395", "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/", "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml", "filename": "win_security_cobaltstrike_service_installs.yml", "curated": true, "technique_ids": [ "T1021.002", "T1543.003", "T1569.002" ], "tactic_tags": [ "persistence", "execution" ] }, { "id": "470ec5fa-7b4e-4071-b200-4c753100f49b", "title": "Failed Code Integrity Checks", "sysmon_eids": [ 5038 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027.001", "technique": "", "level": "informational", "description": "Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.", "author": "Thomas Patzke", "date": "2019-12-03", "modified": "2025-01-19", "detection_yaml": "condition: selection and not 1 of filter_optional_*\nfilter_optional_crowdstrike:\n param1|contains:\n - \\CSFalconServiceUninstallTool_\n - \\Program Files\\CrowdStrike\\\n - \\System32\\drivers\\CrowdStrike\\\n - \\Windows\\System32\\ScriptControl64_\nfilter_optional_sophos:\n param1|contains: \\Program Files\\Sophos\\\nselection:\n EventID:\n - 5038\n - 6281", "false_positives": [ "Disk device errors" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_codeintegrity_check_failure.yml", "filename": "win_security_codeintegrity_check_failure.yml", "curated": true, "technique_ids": [ "T1027.001" ], "tactic_tags": [ "stealth" ] }, { "id": "c39f0c81-7348-4965-ab27-2fde35a1b641", "title": "DCOM InternetExplorer.Application Iertutil DLL Hijack - Security", "sysmon_eids": [ 5145 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "high", "description": "Detects a threat actor creating a file named `iertutil.dll` in the `C:\\Program Files\\Internet Explorer\\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.", "author": "Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)", "date": "2020-10-12", "modified": "2022-11-26", "detection_yaml": "condition: selection and not filter\nfilter:\n SubjectUserName|endswith: $\nselection:\n EventID: 5145\n RelativeTargetName|endswith: \\Internet Explorer\\iertutil.dll", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dcom_iertutil_dll_hijack.yml", "filename": "win_security_dcom_iertutil_dll_hijack.yml", "curated": true, "technique_ids": [ "T1021.002", "T1021.003" ], "tactic_tags": [] }, { "id": "611eab06-a145-4dfa-a295-3ccc5c20f59a", "title": "Mimikatz DC Sync", "sysmon_eids": [ 4662 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.006", "technique": "", "level": "high", "description": "Detects Mimikatz DC sync security events", "author": "Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermott, Sorina Ionescu", "date": "2018-06-03", "modified": "2022-04-26", "detection_yaml": "condition: selection and not 1 of filter*\nfilter1:\n SubjectDomainName: Window Manager\nfilter2:\n SubjectUserName|startswith:\n - NT AUT\n - MSOL_\nfilter3:\n SubjectUserName|endswith: $\nselection:\n AccessMask: '0x100'\n EventID: 4662\n Properties|contains:\n - Replicating Directory Changes All\n - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2\n - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2\n - 9923a32a-3607-11d2-b9be-0000f87a36b2\n - 89e95b76-444d-4c62-991a-0facbeda640c", "false_positives": [ "Valid DC Sync that is not covered by the filters; please report", "Local Domain Admin account used for Azure AD Connect" ], "references": [ "https://twitter.com/gentilkiwi/status/1003236624925413376", "https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2", "https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dcsync.yml", "filename": "win_security_dcsync.yml", "curated": true, "technique_ids": [ "T1003.006" ], "tactic_tags": [] }, { "id": "69aeb277-f15f-4d2d-b32a-55e883609563", "title": "Windows Event Auditing Disabled", "sysmon_eids": [ 4719 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "low", "description": "Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled.\nThis may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed.\nAlso, it is recommended to turn off \"Local Group Policy Object Processing\" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as \"gpedit.msc\".\nPlease note, that disabling \"Local G...", "author": "@neu5ron, Nasreddine Bencherchali (Nextron Systems)", "date": "2017-11-19", "modified": "2023-11-15", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_guid:\n SubcategoryGuid:\n - '{0CCE9210-69AE-11D9-BED3-505054503030}'\n - '{0CCE9211-69AE-11D9-BED3-505054503030}'\n - '{0CCE9212-69AE-11D9-BED3-505054503030}'\n - '{0CCE9215-69AE-11D9-BED3-505054503030}'\n - '{0CCE9217-69AE-11D9-BED3-505054503030}'\n - '{0CCE921B-69AE-11D9-BED3-505054503030}'\n - '{0CCE922B-69AE-11D9-BED3-505054503030}'\n - '{0CCE922F-69AE-11D9-BED3-505054503030}'\n - '{0CCE9230-69AE-11D9-BED3-505054503030}'\n - '{0CCE9235-69AE-11D9-BED3-505054503030}'\n - '{0CCE9236-69AE-11D9-BED3-505054503030}'\n - '{0CCE9237-69AE-11D9-BED3-505054503030}'\n - '{0CCE923F-69AE-11D9-BED3-505054503030}'\n - '{0CCE9240-69AE-11D9-BED3-505054503030}'\n - '{0CCE9242-69AE-11D9-BED3-505054503030}'\nselection:\n AuditPolicyChanges|contains:\n - '%%8448'\n - '%%8450'\n EventID: 4719", "false_positives": [ "Unknown" ], "references": [ "https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_disable_event_auditing.yml", "filename": "win_security_disable_event_auditing.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1", "title": "Important Windows Event Auditing Disabled", "sysmon_eids": [ 4719 ], "tactic": "", "tactic_id": "", "technique_id": "T1685.001", "technique": "", "level": "high", "description": "Detects scenarios where system auditing for important events such as \"Process Creation\" or \"Logon\" events is disabled.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2023-06-20", "modified": "2023-11-17", "detection_yaml": "condition: 1 of selection_*\nselection_state_success_and_failure:\n AuditPolicyChanges|contains:\n - '%%8448'\n - '%%8450'\n EventID: 4719\n SubcategoryGuid:\n - '{0CCE9210-69AE-11D9-BED3-505054503030}'\n - '{0CCE9211-69AE-11D9-BED3-505054503030}'\n - '{0CCE9212-69AE-11D9-BED3-505054503030}'\n - '{0CCE9215-69AE-11D9-BED3-505054503030}'\n - '{0CCE921B-69AE-11D9-BED3-505054503030}'\n - '{0CCE922B-69AE-11D9-BED3-505054503030}'\n - '{0CCE922F-69AE-11D9-BED3-505054503030}'\n - '{0CCE9230-69AE-11D9-BED3-505054503030}'\n - '{0CCE9235-69AE-11D9-BED3-505054503030}'\n - '{0CCE9236-69AE-11D9-BED3-505054503030}'\n - '{0CCE9237-69AE-11D9-BED3-505054503030}'\n - '{0CCE923F-69AE-11D9-BED3-505054503030}'\n - '{0CCE9240-69AE-11D9-BED3-505054503030}'\n - '{0CCE9242-69AE-11D9-BED3-505054503030}'\nselection_state_success_only:\n AuditPolicyChanges|contains: '%%8448'\n EventID: 4719\n SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}'", "false_positives": [ "Unlikely" ], "references": [ "https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit", "https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml", "filename": "win_security_disable_event_auditing_critical.yml", "curated": true, "technique_ids": [ "T1685.001" ], "tactic_tags": [] }, { "id": "a4c90ea1-2634-4ca0-adbb-35eae169b6fc", "title": "ETW Logging Disabled In .NET Processes - Registry", "sysmon_eids": [ 4657 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Potential adversaries stopping ETW providers recording loaded .NET assemblies.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-06-05", "modified": "2022-12-20", "detection_yaml": "condition: 1 of selection_*\nselection_complus:\n EventID: 4657\n NewValue: 0\n ObjectName|contains: \\Environment\n ObjectValueName:\n - COMPlus_ETWEnabled\n - COMPlus_ETWFlags\nselection_etw_enabled:\n EventID: 4657\n NewValue: 0\n ObjectName|endswith: \\SOFTWARE\\Microsoft\\.NETFramework\n ObjectValueName: ETWEnabled", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/_xpn_/status/1268712093928378368", "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables", "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml", "filename": "win_security_dot_net_etw_tamper.yml", "curated": true, "technique_ids": [ "T1112", "T1685" ], "tactic_tags": [ "persistence" ] }, { "id": "4ac1f50b-3bd0-4968-902d-868b4647937e", "title": "DPAPI Domain Backup Key Extraction", "sysmon_eids": [ 4662 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.004", "technique": "", "level": "high", "description": "Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-06-20", "modified": "2022-02-24", "detection_yaml": "condition: selection\nselection:\n AccessMask: '0x2'\n EventID: 4662\n ObjectName|contains: BCKUPKEY\n ObjectType: SecretObject", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dpapi_domain_backupkey_extraction.yml", "filename": "win_security_dpapi_domain_backupkey_extraction.yml", "curated": true, "technique_ids": [ "T1003.004" ], "tactic_tags": [] }, { "id": "39a94fd1-8c9a-4ff6-bf22-c058762f8014", "title": "DPAPI Domain Master Key Backup Attempt", "sysmon_eids": [ 4692 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.004", "technique": "", "level": "medium", "description": "Detects anyone attempting a backup for the DPAPI Master Key. This events gets generated at the source and not the Domain Controller.", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-08-10", "modified": "2023-03-15", "detection_yaml": "condition: selection\nselection:\n EventID: 4692", "false_positives": [ "If a computer is a member of a domain, DPAPI has a backup mechanism to allow unprotection of the data. Which will trigger this event." ], "references": [ "https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_dpapi_domain_masterkey_backup_attempt.yml", "filename": "win_security_dpapi_domain_masterkey_backup_attempt.yml", "curated": true, "technique_ids": [ "T1003.004" ], "tactic_tags": [] }, { "id": "a8f29a7b-b137-4446-80a0-b804272f3da2", "title": "Persistence and Execution at Scale via GPO Scheduled Task", "sysmon_eids": [ 4417, 4633, 4691, 5136, 5145 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1053.005", "technique": "", "level": "high", "description": "Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale", "author": "Samir Bousseaden", "date": "2019-04-03", "modified": "2024-09-04", "detection_yaml": "condition: 1 of selection_*\nselection_5136:\n AttributeLDAPDisplayName:\n - gPCMachineExtensionNames\n - gPCUserExtensionNames\n AttributeValue|contains:\n - CAB54552-DEEA-4691-817E-ED4A4D1AFC72\n - AADCED64-746C-4633-A97C-D61349046527\n EventID: 5136\nselection_5145:\n AccessList|contains:\n - WriteData\n - '%%4417'\n EventID: 5145\n RelativeTargetName|endswith: ScheduledTasks.xml\n ShareName|endswith: \\SYSVOL", "false_positives": [ "If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks." ], "references": [ "https://twitter.com/menasec1/status/1106899890377052160", "https://www.secureworks.com/blog/ransomware-as-a-distraction", "https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_gpo_scheduledtasks.yml", "filename": "win_security_gpo_scheduledtasks.yml", "curated": true, "technique_ids": [ "T1053.005" ], "tactic_tags": [ "execution", "persistence" ] }, { "id": "7b449a5e-1db5-4dd0-a2dc-4e3a67282538", "title": "Hidden Local User Creation", "sysmon_eids": [ 4720 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1136.001", "technique": "", "level": "high", "description": "Detects the creation of a local hidden user account which should not happen for event ID 4720.", "author": "Christian Burkard (Nextron Systems)", "date": "2021-05-03", "modified": "2024-01-16", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_homegroup:\n TargetUserName: HomeGroupUser$\nselection:\n EventID: 4720\n TargetUserName|endswith: $", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SBousseaden/status/1387743867663958021" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hidden_user_creation.yml", "filename": "win_security_hidden_user_creation.yml", "curated": true, "technique_ids": [ "T1136.001" ], "tactic_tags": [ "persistence" ] }, { "id": "98054878-5eab-434c-85d4-72d4e5a3361b", "title": "HackTool - EDRSilencer Execution - Filter Added", "sysmon_eids": [ 5441, 5447 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects execution of EDRSilencer, a tool that abuses the Windows Filtering Platform (WFP) to block the outbound traffic of running EDR agents based on specific hardcoded filter names.", "author": "Thodoris Polyzos (@SmoothDeploy)", "date": "2024-01-29", "modified": "2024-01-30", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 5441\n - 5447\n FilterName|contains: Custom Outbound Filter", "false_positives": [ "Unknown" ], "references": [ "https://github.com/netero1010/EDRSilencer" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_edr_silencer.yml", "filename": "win_security_hktl_edr_silencer.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "7b14c76a-c602-4ae6-9717-eff868153fc0", "title": "HackTool - NoFilter Execution", "sysmon_eids": [ 5447, 5449 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1134", "technique": "", "level": "high", "description": "Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators", "author": "Stamatis Chatzimangou (st0pp3r)", "date": "2024-01-05", "modified": "", "detection_yaml": "condition: 1 of selection_*\nselection_5447:\n EventID: 5447\n FilterName|contains: RonPolicy\nselection_5449:\n EventID: 5449\n ProviderContextName|contains: RonPolicy", "false_positives": [ "Unknown" ], "references": [ "https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp", "https://github.com/deepinstinct/NoFilter", "https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation", "https://x.com/_st0pp3r_/status/1742203752361128162?s=20" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hktl_nofilter.yml", "filename": "win_security_hktl_nofilter.yml", "curated": true, "technique_ids": [ "T1134", "T1134.001" ], "tactic_tags": [ "stealth" ] }, { "id": "0ee4d8a5-4e67-4faf-acfa-62a78457d1f2", "title": "HybridConnectionManager Service Installation", "sysmon_eids": [ 4697 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1554", "technique": "", "level": "high", "description": "Rule to detect the Hybrid Connection Manager service installation.", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2021-04-12", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n EventID: 4697\n ServiceFileName|contains: HybridConnectionManager\n ServiceName: HybridConnectionManager", "false_positives": [ "Legitimate use of Hybrid Connection Manager via Azure function apps." ], "references": [ "https://twitter.com/Cyb3rWard0g/status/1381642789369286662" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_hybridconnectionmgr_svc_installation.yml", "filename": "win_security_hybridconnectionmgr_svc_installation.yml", "curated": true, "technique_ids": [ "T1554" ], "tactic_tags": [ "persistence" ] }, { "id": "32d56ea1-417f-44ff-822b-882873f5f43b", "title": "Impacket PsExec Execution", "sysmon_eids": [ 5145 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "high", "description": "Detects execution of Impacket's psexec.py.", "author": "Bhabesh Raj", "date": "2020-12-14", "modified": "2022-09-22", "detection_yaml": "condition: selection1\nselection1:\n EventID: 5145\n RelativeTargetName|contains:\n - RemCom_stdin\n - RemCom_stdout\n - RemCom_stderr\n ShareName: \\\\\\\\\\*\\\\IPC$", "false_positives": [ "Unknown" ], "references": [ "https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_impacket_psexec.yml", "filename": "win_security_impacket_psexec.yml", "curated": true, "technique_ids": [ "T1021.002" ], "tactic_tags": [] }, { "id": "252902e3-5830-4cf6-bf21-c22083dfd5cf", "title": "Possible Impacket SecretDump Remote Activity", "sysmon_eids": [ 5145 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.002", "technique": "", "level": "high", "description": "Detect AD credential dumping using impacket secretdump HKTL", "author": "Samir Bousseaden, wagga", "date": "2019-04-03", "modified": "2022-08-11", "detection_yaml": "condition: selection\nselection:\n EventID: 5145\n RelativeTargetName|contains|all:\n - SYSTEM32\\\n - .tmp\n ShareName: \\\\\\\\\\*\\\\ADMIN$", "false_positives": [ "Unknown" ], "references": [ "https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_impacket_secretdump.yml", "filename": "win_security_impacket_secretdump.yml", "curated": true, "technique_ids": [ "T1003.002", "T1003.004", "T1003.003" ], "tactic_tags": [] }, { "id": "4edf51e1-cb83-4e1a-bc39-800e396068e3", "title": "Invoke-Obfuscation CLIP+ Launcher - Security", "sysmon_eids": [ 4697 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027", "technique": "", "level": "high", "description": "Detects Obfuscated use of Clip.exe to execute PowerShell", "author": "Jonathan Cheong, oscd.community", "date": "2020-10-13", "modified": "2022-11-27", "detection_yaml": "condition: selection\nselection:\n EventID: 4697\n ServiceFileName|contains|all:\n - cmd\n - '&&'\n - 'clipboard]::'", "false_positives": [ "Unknown" ], "references": [ "https://github.com/SigmaHQ/sigma/issues/1009" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml", "filename": "win_security_invoke_obfuscation_clip_services_security.yml", "curated": true, "technique_ids": [ "T1027", "T1059.001" ], "tactic_tags": [ "stealth", "execution" ] }, { "id": "fd0f5778-d3cb-4c9a-9695-66759d04702a", "title": "Invoke-Obfuscation Obfuscated IEX Invocation - Security", "sysmon_eids": [ 4697 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027", "technique": "", "level": "high", "description": "Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references", "author": "Daniel Bohannon (@Mandiant/@FireEye), oscd.community", "date": "2019-11-08", "modified": "2022-11-27", "detection_yaml": "condition: all of selection_*\nselection_eid:\n EventID: 4697\nselection_servicefilename:\n- ServiceFileName|re: \\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[\n- ServiceFileName|re: \\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[\n- ServiceFileName|re: \\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[\n- ServiceFileName|re: \\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}\n- ServiceFileName|re: \\\\*mdr\\*\\W\\s*\\)\\.Name\n- ServiceFileName|re: \\$VerbosePreference\\.ToString\\(\n- ServiceFileName|re: \\String\\]\\s*\\$VerbosePreference", "false_positives": [ "Unknown" ], "references": [ "https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_obfuscated_iex_services_security.yml", "filename": "win_security_invoke_obfuscation_obfuscated_iex_services_security.yml", "curated": true, "technique_ids": [ "T1027" ], "tactic_tags": [ "stealth" ] }, { "id": "d04ae2b8-ad54-4de0-bd87-4bc1da66aa59", "title": "Kerberoasting Activity - Initial Query", "sysmon_eids": [ 4769 ], "tactic": "", "tactic_id": "", "technique_id": "T1558.003", "technique": "", "level": "medium", "description": "This rule will collect the data needed to start looking into possible kerberoasting activity.\nFurther analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.\nYou can then set a threshold for the number of requests and time between the requests to turn this into an alert.", "author": "@kostastsale", "date": "2022-01-21", "modified": "2025-10-19", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_krbtgt:\n ServiceName|endswith:\n - krbtgt\n - $\nfilter_main_machine_accounts:\n TargetUserName|contains: $@\nselection:\n EventID: 4769\n Status: '0x0'\n TicketEncryptionType: '0x17'", "false_positives": [ "Legacy applications." ], "references": [ "https://www.trustedsec.com/blog/art_of_kerberoast/", "https://adsecurity.org/?p=3513" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberoasting_activity.yml", "filename": "win_security_kerberoasting_activity.yml", "curated": true, "technique_ids": [ "T1558.003" ], "tactic_tags": [] }, { "id": "3e2f1b2c-4d5e-11ee-be56-0242ac120002", "title": "Potential AS-REP Roasting via Kerberos TGT Requests", "sysmon_eids": [ 4768 ], "tactic": "", "tactic_id": "", "technique_id": "", "technique": "", "level": "medium", "description": "Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC.\nThis may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.", "author": "ANosir", "date": "2025-05-22", "modified": "2025-07-04", "detection_yaml": "condition: selection\nselection:\n EventID: 4768\n PreAuthType: 0\n ServiceName: krbtgt\n TicketEncryptionType: '0x17'", "false_positives": [ "Legacy systems or applications that legitimately use RC4 encryption", "Misconfigured accounts with pre-authentication disabled" ], "references": [ "https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714", "https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_asrep_roasting.yml", "filename": "win_security_kerberos_asrep_roasting.yml", "curated": true, "technique_ids": [], "tactic_tags": [] }, { "id": "b07e58cf-cacc-4135-8473-ccb2eba63dd2", "title": "Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation", "sysmon_eids": [ 4662, 5136, 5137 ], "tactic": "Collection", "tactic_id": "", "technique_id": "T1557.003", "technique": "", "level": "high", "description": "Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob\nmatching the pattern \"1UWhRCAAAAA...BAAAA\". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,\ncommonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to\nattacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.\nwhere adve...", "author": "Swachchhanda Shrawan Poudel (Nextron Systems)", "date": "2025-06-20", "modified": "", "detection_yaml": "condition: 1 of selection_*\nselection_directory_service_access:\n AdditionalInfo|contains|all:\n - UWhRCA\n - BAAAA\n - CN=MicrosoftDNS\n EventID: 4662\nselection_directory_service_changes:\n EventID:\n - 5136\n - 5137\n ObjectClass: dnsNode\n ObjectDN|contains|all:\n - UWhRCA\n - BAAAA\n - CN=MicrosoftDNS", "false_positives": [ "Unknown" ], "references": [ "https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html", "https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_kerberos_coercion_via_dns_object.yml", "filename": "win_security_kerberos_coercion_via_dns_object.yml", "curated": true, "technique_ids": [ "T1557.003" ], "tactic_tags": [ "collection", "persistence" ] }, { "id": "52d8b0c6-53d6-439a-9e41-52ad442ad9ad", "title": "First Time Seen Remote Named Pipe", "sysmon_eids": [ 5145 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "high", "description": "This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes", "author": "Samir Bousseaden", "date": "2019-04-03", "modified": "2023-03-14", "detection_yaml": "condition: selection1 and not false_positives\nfalse_positives:\n RelativeTargetName:\n - atsvc\n - samr\n - lsarpc\n - lsass\n - winreg\n - netlogon\n - srvsvc\n - protected_storage\n - wkssvc\n - browser\n - netdfs\n - svcctl\n - spoolss\n - ntsvcs\n - LSM_API_service\n - HydraLsPipe\n - TermSrv_API_service\n - MsFteWds\n - sql\\query\n - eventlog\nselection1:\n EventID: 5145\n ShareName: \\\\\\\\\\*\\\\IPC$", "false_positives": [ "Update the excluded named pipe to filter out any newly observed legit named pipe" ], "references": [ "https://twitter.com/menasec1/status/1104489274387451904" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_lm_namedpipe.yml", "filename": "win_security_lm_namedpipe.yml", "curated": true, "technique_ids": [ "T1021.002" ], "tactic_tags": [] }, { "id": "f0d1feba-4344-4ca9-8121-a6c97bd6df52", "title": "Credential Dumping Tools Service Execution - Security", "sysmon_eids": [ 4697 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects well-known credential dumping tools execution via service execution events", "author": "Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community", "date": "2017-03-05", "modified": "2022-11-29", "detection_yaml": "condition: selection\nselection:\n EventID: 4697\n ServiceFileName|contains:\n - cachedump\n - dumpsvc\n - fgexec\n - gsecdump\n - mimidrv\n - pwdump\n - servpw", "false_positives": [ "Legitimate Administrator using credential dumping tool for password recovery" ], "references": [ "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_mal_creddumper.yml", "filename": "win_security_mal_creddumper.yml", "curated": true, "technique_ids": [ "T1003.001", "T1003.002", "T1003.004", "T1003.005", "T1003.006", "T1569.002" ], "tactic_tags": [ "execution" ] }, { "id": "1de68c67-af5c-4097-9c85-fe5578e09e67", "title": "WCE wceaux.dll Access", "sysmon_eids": [ 4656, 4663 ], "tactic": "", "tactic_id": "", "technique_id": "T1003", "technique": "", "level": "critical", "description": "Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host", "author": "Thomas Patzke", "date": "2017-06-14", "modified": "2025-01-30", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4656\n - 4663\n ObjectName|endswith: \\wceaux.dll", "false_positives": [ "Unknown" ], "references": [ "https://www.jpcert.or.jp/english/pub/sr/ir_research.html", "https://jpcertcc.github.io/ToolAnalysisResultSheet" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_mal_wceaux_dll.yml", "filename": "win_security_mal_wceaux_dll.yml", "curated": true, "technique_ids": [ "T1003" ], "tactic_tags": [] }, { "id": "72124974-a68b-4366-b990-d30e0b2a190d", "title": "Metasploit SMB Authentication", "sysmon_eids": [ 4624, 4625, 4776 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.002", "technique": "", "level": "high", "description": "Alerts on Metasploit host's authentications on the domain.", "author": "Chakib Gzenayi (@Chak092), Hosni Mribah", "date": "2020-05-06", "modified": "2024-01-25", "detection_yaml": "condition: 1 of selection*\nselection1:\n AuthenticationPackageName: NTLM\n EventID:\n - 4625\n - 4624\n LogonType: 3\n WorkstationName|re: ^[A-Za-z0-9]{16}$\nselection2:\n EventID: 4776\n Workstation|re: ^[A-Za-z0-9]{16}$", "false_positives": [ "Linux hostnames composed of 16 characters." ], "references": [ "https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_metasploit_authentication.yml", "filename": "win_security_metasploit_authentication.yml", "curated": true, "technique_ids": [ "T1021.002" ], "tactic_tags": [] }, { "id": "d3abac66-f11c-4ed0-8acb-50cc29c97eed", "title": "NetNTLM Downgrade Attack", "sysmon_eids": [ 4657 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "high", "description": "Detects NetNTLM downgrade attack", "author": "Florian Roth (Nextron Systems), wagga", "date": "2018-03-20", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n EventID: 4657\n ObjectName|contains|all:\n - \\REGISTRY\\MACHINE\\SYSTEM\n - ControlSet\n - \\Control\\Lsa\n ObjectValueName:\n - LmCompatibilityLevel\n - NtlmMinClientSec\n - RestrictSendingNTLMTraffic", "false_positives": [ "Unknown" ], "references": [ "https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_net_ntlm_downgrade.yml", "filename": "win_security_net_ntlm_downgrade.yml", "curated": true, "technique_ids": [ "T1685", "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "cfeed607-6aa4-4bbd-9627-b637deb723c8", "title": "New or Renamed User Account with '$' Character", "sysmon_eids": [ 4720, 4781 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1036", "technique": "", "level": "medium", "description": "Detects the creation of a user with the \"$\" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.", "author": "Ilyas Ochkov, oscd.community", "date": "2019-10-25", "modified": "2024-01-16", "detection_yaml": "condition: 1 of selection_* and not 1 of filter_main_*\nfilter_main_homegroup:\n EventID: 4720\n TargetUserName: HomeGroupUser$\nselection_create:\n EventID: 4720\n SamAccountName|contains: $\nselection_rename:\n EventID: 4781\n NewTargetUserName|contains: $", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SBousseaden/status/1387743867663958021" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_new_or_renamed_user_account_with_dollar_sign.yml", "filename": "win_security_new_or_renamed_user_account_with_dollar_sign.yml", "curated": true, "technique_ids": [ "T1036" ], "tactic_tags": [ "stealth" ] }, { "id": "8e5c03fa-b7f0-11ea-b242-07e0576828d9", "title": "Denied Access To Remote Desktop", "sysmon_eids": [ 4825 ], "tactic": "", "tactic_id": "", "technique_id": "T1021.001", "technique": "", "level": "medium", "description": "This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.\nOften, this event can be generated by attackers when searching for available windows servers in the network.", "author": "Pushkarev Dmitry", "date": "2020-06-27", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n EventID: 4825", "false_positives": [ "Valid user was not added to RDP group" ], "references": [ "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_not_allowed_rdp_access.yml", "filename": "win_security_not_allowed_rdp_access.yml", "curated": true, "technique_ids": [ "T1021.001" ], "tactic_tags": [] }, { "id": "12ba6a38-adb3-4d6b-91ba-a7fb248e3199", "title": "Password Policy Enumerated", "sysmon_eids": [ 4661, 5392 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1201", "technique": "", "level": "medium", "description": "Detects when the password policy is enumerated.", "author": "Zach Mathis", "date": "2023-05-19", "modified": "", "detection_yaml": "condition: selection\nselection:\n AccessList|contains: '%%5392'\n EventID: 4661\n ObjectServer: Security Account Manager", "false_positives": [], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661", "https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_password_policy_enumerated.yml", "filename": "win_security_password_policy_enumerated.yml", "curated": true, "technique_ids": [ "T1201" ], "tactic_tags": [ "discovery" ] }, { "id": "6a53d871-682d-40b6-83e0-b7c1a6c4e3a5", "title": "PetitPotam Suspicious Kerberos TGT Request", "sysmon_eids": [ 4768 ], "tactic": "", "tactic_id": "", "technique_id": "T1187", "technique": "", "level": "high", "description": "Detect suspicious Kerberos TGT requests.\nOnce an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.\nOne way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.\nThis request will generate a 4768 event with some unusual fields depending on the environment.\nThis analytic will require tuning, we recommend filtering Acco...", "author": "Mauricio Velazco, Michael Haag", "date": "2021-09-02", "modified": "2022-10-05", "detection_yaml": "condition: selection and not 1 of filter_*\nfilter_local:\n IpAddress: ::1\nfilter_thumbprint:\n CertThumbprint: ''\nselection:\n CertThumbprint|contains: '*'\n EventID: 4768\n TargetUserName|endswith: $", "false_positives": [ "False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts." ], "references": [ "https://github.com/topotam/PetitPotam", "https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/", "https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml", "filename": "win_security_petitpotam_susp_tgt_request.yml", "curated": true, "technique_ids": [ "T1187" ], "tactic_tags": [] }, { "id": "32e19d25-4aed-4860-a55a-be99cb0bf7ed", "title": "Possible DC Shadow Attack", "sysmon_eids": [ 4742 ], "tactic": "", "tactic_id": "", "technique_id": "T1207", "technique": "", "level": "medium", "description": "Detects DCShadow via create new SPN", "author": "Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah", "date": "2019-10-25", "modified": "2022-10-17", "detection_yaml": "condition: 1 of selection*\nselection1:\n EventID: 4742\n ServicePrincipalNames|contains: GC/\nselection2:\n AttributeLDAPDisplayName: servicePrincipalName\n AttributeValue|startswith: GC/\n EventID: 5136", "false_positives": [ "Valid on domain controllers; exclude known DCs" ], "references": [ "https://twitter.com/gentilkiwi/status/1003236624925413376", "https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2", "https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_possible_dc_shadow.yml", "filename": "win_security_possible_dc_shadow.yml", "curated": true, "technique_ids": [ "T1207" ], "tactic_tags": [] }, { "id": "5bed80b6-b3e8-428e-a3ae-d3c757589e41", "title": "RDP over Reverse SSH Tunnel WFP", "sysmon_eids": [ 5156 ], "tactic": "", "tactic_id": "", "technique_id": "T1090.001", "technique": "", "level": "high", "description": "Detects svchost hosting RDP termsvcs communicating with the loopback address", "author": "Samir Bousseaden", "date": "2019-02-16", "modified": "2022-09-02", "detection_yaml": "condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter*\ndestinationRDP:\n DestPort: 3389\n SourceAddress:\n - 127.*\n - ::1\nfilter_app_container:\n FilterOrigin: AppContainer Loopback\nfilter_thor:\n Application|endswith:\n - \\thor.exe\n - \\thor64.exe\nselection:\n EventID: 5156\nsourceRDP:\n DestAddress:\n - 127.*\n - ::1\n SourcePort: 3389", "false_positives": [ "Programs that connect locally to the RDP port" ], "references": [ "https://twitter.com/SBousseaden/status/1096148422984384514", "https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_rdp_reverse_tunnel.yml", "filename": "win_security_rdp_reverse_tunnel.yml", "curated": true, "technique_ids": [ "T1090.001", "T1090.002", "T1021.001" ], "tactic_tags": [] }, { "id": "12e6d621-194f-4f59-90cc-1959e21e69f7", "title": "Register new Logon Process by Rubeus", "sysmon_eids": [ 4611 ], "tactic": "", "tactic_id": "", "technique_id": "T1558.003", "technique": "", "level": "high", "description": "Detects potential use of Rubeus via registered new trusted logon process", "author": "Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community", "date": "2019-10-24", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n EventID: 4611\n LogonProcessName: User32LogonProcesss", "false_positives": [ "Unknown" ], "references": [ "https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_register_new_logon_process_by_rubeus.yml", "filename": "win_security_register_new_logon_process_by_rubeus.yml", "curated": true, "technique_ids": [ "T1558.003" ], "tactic_tags": [] }, { "id": "13acf386-b8c6-4fe0-9a6e-c4756b974698", "title": "Remote PowerShell Sessions Network Connections (WinRM)", "sysmon_eids": [ 5156 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1059.001", "technique": "", "level": "high", "description": "Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-09-12", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n DestPort:\n - 5985\n - 5986\n EventID: 5156\n LayerRTID: 44", "false_positives": [ "Legitimate use of remote PowerShell execution" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_remote_powershell_session.yml", "filename": "win_security_remote_powershell_session.yml", "curated": true, "technique_ids": [ "T1059.001" ], "tactic_tags": [ "execution" ] }, { "id": "5a44727c-3b85-4713-8c44-4401d5499629", "title": "Replay Attack Detected", "sysmon_eids": [ 4649 ], "tactic": "", "tactic_id": "", "technique_id": "T1558", "technique": "", "level": "high", "description": "Detects possible Kerberos Replay Attack on the domain controllers when \"KRB_AP_ERR_REPEAT\" Kerberos response is sent to the client", "author": "frack113", "date": "2022-10-14", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID: 4649", "false_positives": [ "Unknown" ], "references": [ "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_replay_attack_detected.yml", "filename": "win_security_replay_attack_detected.yml", "curated": true, "technique_ids": [ "T1558" ], "tactic_tags": [] }, { "id": "f8748f2c-89dc-4d95-afb0-5a2dfdbad332", "title": "SAM Registry Hive Handle Request", "sysmon_eids": [ 4656 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1012", "technique": "", "level": "high", "description": "Detects handles requested to SAM registry hive", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-08-12", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n EventID: 4656\n ObjectName|endswith: \\SAM\n ObjectType: Key", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sam_registry_hive_handle_request.yml", "filename": "win_security_sam_registry_hive_handle_request.yml", "curated": true, "technique_ids": [ "T1012", "T1552.002" ], "tactic_tags": [ "discovery" ] }, { "id": "dae8171c-5ec6-4396-b210-8466585b53e9", "title": "SCM Database Privileged Operation", "sysmon_eids": [ 4674 ], "tactic": "", "tactic_id": "", "technique_id": "T1548", "technique": "", "level": "medium", "description": "Detects non-system users performing privileged operation os the SCM database", "author": "Roberto Rodriguez @Cyb3rWard0g, Tim Shelton", "date": "2019-08-15", "modified": "2022-09-18", "detection_yaml": "condition: selection and not filter\nfilter:\n ProcessName|endswith: :\\Windows\\System32\\services.exe\n SubjectLogonId: '0x3e4'\nselection:\n EventID: 4674\n ObjectName: servicesactive\n ObjectType: SC_MANAGER OBJECT\n PrivilegeList: SeTakeOwnershipPrivilege", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_scm_database_privileged_operation.yml", "filename": "win_security_scm_database_privileged_operation.yml", "curated": true, "technique_ids": [ "T1548" ], "tactic_tags": [] }, { "id": "39a80702-d7ca-4a83-b776-525b1f86a36d", "title": "Potential Secure Deletion with SDelete", "sysmon_eids": [ 4658 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1070.004", "technique": "", "level": "medium", "description": "Detects files that have extensions commonly seen while SDelete is used to wipe files.", "author": "Thomas Patzke", "date": "2017-06-14", "modified": "2024-12-13", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4656\n - 4663\n - 4658\n ObjectName|endswith:\n - .AAA\n - .ZZZ", "false_positives": [ "Legitimate usage of SDelete", "Files that are interacted with that have these extensions legitimately" ], "references": [ "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm", "https://www.jpcert.or.jp/english/pub/sr/ir_research.html", "https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sdelete_potential_secure_deletion.yml", "filename": "win_security_sdelete_potential_secure_deletion.yml", "curated": true, "technique_ids": [ "T1070.004", "T1027.005", "T1485", "T1553.002" ], "tactic_tags": [ "impact", "stealth" ] }, { "id": "0255a820-e564-4e40-af2b-6ac61160335c", "title": "A New Trust Was Created To A Domain", "sysmon_eids": [ 4706 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "medium", "description": "Addition of domains is seldom and should be verified for legitimacy.", "author": "Thomas Patzke", "date": "2019-12-03", "modified": "2024-01-16", "detection_yaml": "condition: selection\nselection:\n EventID: 4706", "false_positives": [ "Legitimate extension of domain structure" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_domain_trust.yml", "filename": "win_security_susp_add_domain_trust.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "2632954e-db1c-49cb-9936-67d1ef1d17d2", "title": "Addition of SID History to Active Directory Object", "sysmon_eids": [ 4738, 4765, 4766 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1134.005", "technique": "", "level": "medium", "description": "An attacker can use the SID history attribute to gain additional privileges.", "author": "Thomas Patzke, @atc_project (improvements)", "date": "2017-02-19", "modified": "", "detection_yaml": "condition: selection1 or (selection2 and not selection3 and not filter_null)\nfilter_null:\n SidHistory: null\nselection1:\n EventID:\n - 4765\n - 4766\nselection2:\n EventID: 4738\nselection3:\n SidHistory:\n - '-'\n - '%%1793'", "false_positives": [ "Migration of an account into a new domain" ], "references": [ "https://adsecurity.org/?p=1772" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_add_sid_history.yml", "filename": "win_security_susp_add_sid_history.yml", "curated": true, "technique_ids": [ "T1134.005" ], "tactic_tags": [ "persistence", "stealth" ] }, { "id": "53ad8e36-f573-46bf-97e4-15ba5bf4bb51", "title": "Password Change on Directory Service Restore Mode (DSRM) Account", "sysmon_eids": [ 4794 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1098", "technique": "", "level": "high", "description": "Detects potential attempts made to set the Directory Services Restore Mode administrator password.\nThe Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.\nAttackers may change the password in order to obtain persistence.", "author": "Thomas Patzke", "date": "2017-02-19", "modified": "2020-08-23", "detection_yaml": "condition: selection\nselection:\n EventID: 4794", "false_positives": [ "Initial installation of a domain controller." ], "references": [ "https://adsecurity.org/?p=1714", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_dsrm_password_change.yml", "filename": "win_security_susp_dsrm_password_change.yml", "curated": true, "technique_ids": [ "T1098" ], "tactic_tags": [ "persistence" ] }, { "id": "9eb99343-d336-4020-a3cd-67f3819e68ee", "title": "Account Tampering - Suspicious Failed Logon Reasons", "sysmon_eids": [ 4625, 4776 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1078", "technique": "", "level": "medium", "description": "This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.", "author": "Florian Roth (Nextron Systems)", "date": "2017-02-19", "modified": "2025-10-17", "detection_yaml": "condition: all of selection_* and not filter\nfilter:\n SubjectUserSid: S-1-0-0\nselection_eid:\n EventID:\n - 4625\n - 4776\nselection_status:\n- Status:\n - '0xC0000072'\n - '0xC000006F'\n - '0xC0000070'\n - '0xC0000413'\n - '0xC000018C'\n - '0xC000015B'\n- SubStatus:\n - '0xC0000072'\n - '0xC000006F'\n - '0xC0000070'\n - '0xC0000413'\n - '0xC000018C'\n - '0xC000015B'", "false_positives": [ "User using a disabled account" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625", "https://twitter.com/SBousseaden/status/1101431884540710913" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml", "filename": "win_security_susp_failed_logon_reasons.yml", "curated": true, "technique_ids": [ "T1078" ], "tactic_tags": [ "persistence", "stealth" ] }, { "id": "123e4e6d-b123-48f8-b261-7214938acaf0", "title": "Startup/Logon Script Added to Group Policy Object", "sysmon_eids": [ 4417, 4972 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1484.001", "technique": "", "level": "medium", "description": "Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.", "author": "Elastic, Josh Nickels, Marius Rothenb\u00fccher", "date": "2024-09-06", "modified": "", "detection_yaml": "condition: selection_eventid and (all of selection_attributes_* or selection_share)\nselection_attributes_main:\n AttributeLDAPDisplayName:\n - gPCMachineExtensionNames\n - gPCUserExtensionNames\n AttributeValue|contains: 42B5FAAE-6536-11D2-AE5A-0000F87571E3\nselection_attributes_optional:\n AttributeValue|contains:\n - 40B6664F-4972-11D1-A7CA-0000F87571E3\n - 40B66650-4972-11D1-A7CA-0000F87571E3\nselection_eventid:\n EventID:\n - 5136\n - 5145\nselection_share:\n AccessList|contains: '%%4417'\n RelativeTargetName|endswith:\n - \\scripts.ini\n - \\psscripts.ini\n ShareName|endswith: \\SYSVOL", "false_positives": [ "Legitimate execution by system administrators." ], "references": [ "https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_group_policy_startup_script_added_to_gpo.yml", "filename": "win_security_susp_group_policy_startup_script_added_to_gpo.yml", "curated": true, "technique_ids": [ "T1484.001", "T1547" ], "tactic_tags": [ "persistence" ] }, { "id": "f7644214-0eb0-4ace-9455-331ec4c09253", "title": "Kerberos Manipulation", "sysmon_eids": [ 4768, 4769, 4771 ], "tactic": "", "tactic_id": "", "technique_id": "T1212", "technique": "", "level": "high", "description": "Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.", "author": "Florian Roth (Nextron Systems)", "date": "2017-02-10", "modified": "2024-01-16", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 675\n - 4768\n - 4769\n - 4771\n Status:\n - '0x9'\n - '0xA'\n - '0xB'\n - '0xF'\n - '0x10'\n - '0x11'\n - '0x13'\n - '0x14'\n - '0x1A'\n - '0x1F'\n - '0x21'\n - '0x22'\n - '0x23'\n - '0x24'\n - '0x26'\n - '0x27'\n - '0x28'\n - '0x29'\n - '0x2C'\n - '0x2D'\n - '0x2E'\n - '0x2F'\n - '0x31'\n - '0x32'\n - '0x3E'\n - '0x3F'\n - '0x40'\n - '0x41'\n - '0x43'\n - '0x44'", "false_positives": [ "Faulty legacy applications" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_kerberos_manipulation.yml", "filename": "win_security_susp_kerberos_manipulation.yml", "curated": true, "technique_ids": [ "T1212" ], "tactic_tags": [] }, { "id": "1bbf25b9-8038-4154-a50b-118f2a32be27", "title": "Suspicious Windows ANONYMOUS LOGON Local Account Created", "sysmon_eids": [ 4720 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1136.001", "technique": "", "level": "high", "description": "Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.", "author": "James Pemberton / @4A616D6573", "date": "2019-10-31", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n EventID: 4720\n SamAccountName|contains|all:\n - ANONYMOUS\n - LOGON", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/SBousseaden/status/1189469425482829824" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_local_anon_logon_created.yml", "filename": "win_security_susp_local_anon_logon_created.yml", "curated": true, "technique_ids": [ "T1136.001", "T1136.002" ], "tactic_tags": [ "persistence" ] }, { "id": "941e5c45-cda7-4864-8cea-bbb7458d194a", "title": "Suspicious Remote Logon with Explicit Credentials", "sysmon_eids": [ 4648 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1078", "technique": "", "level": "medium", "description": "Detects suspicious processes logging on with explicit credentials", "author": "oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton", "date": "2020-10-05", "modified": "2022-08-03", "detection_yaml": "condition: selection and not 1 of filter*\nfilter1:\n TargetServerName: localhost\nfilter2:\n SubjectUserName|endswith: $\n TargetUserName|endswith: $\nselection:\n EventID: 4648\n ProcessName|endswith:\n - \\cmd.exe\n - \\powershell.exe\n - \\pwsh.exe\n - \\winrs.exe\n - \\wmic.exe\n - \\net.exe\n - \\net1.exe\n - \\reg.exe", "false_positives": [ "Administrators that use the RunAS command or scheduled tasks" ], "references": [ "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_logon_explicit_credentials.yml", "filename": "win_security_susp_logon_explicit_credentials.yml", "curated": true, "technique_ids": [ "T1078" ], "tactic_tags": [ "persistence", "stealth" ] }, { "id": "aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c", "title": "Password Dumper Activity on LSASS", "sysmon_eids": [ 4656 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "high", "description": "Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN", "author": "sigma", "date": "2017-02-12", "modified": "2022-10-09", "detection_yaml": "condition: selection\nselection:\n AccessMask: '0x705'\n EventID: 4656\n ObjectType: SAM_DOMAIN\n ProcessName|endswith: \\lsass.exe", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/jackcr/status/807385668833968128" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump.yml", "filename": "win_security_susp_lsass_dump.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76", "title": "Potentially Suspicious AccessMask Requested From LSASS", "sysmon_eids": [ 4484 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.001", "technique": "", "level": "medium", "description": "Detects process handle on LSASS process with certain access mask", "author": "Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)", "date": "2019-11-01", "modified": "2026-06-29", "detection_yaml": "condition: 1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_aurora:\n AccessList|contains: '%%4484'\n ProcessName|contains: :\\Windows\\Temp\\asgard2-agent-sc\\aurora\\\n ProcessName|endswith: \\aurora-agent-64.exe\nfilter_main_avira1:\n AccessList|contains: '%%4484'\n ProcessName|contains|all:\n - :\\Users\\\n - \\AppData\\Local\\Temp\\is-\n ProcessName|endswith: \\avira_system_speedup.tmp\nfilter_main_avira2:\n AccessList|contains: '%%4484'\n ProcessName|contains: :\\Windows\\Temp\\\n ProcessName|endswith: \\avira_speedup_setup_update.tmp\nfilter_main_exact:\n ProcessName|endswith:\n - :\\Windows\\System32\\taskhostw.exe\n - :\\Windows\\System32\\msiexec.exe\n - :\\Windows\\CCM\\CcmExec.exe\nfilter_main_generic:\n ProcessName|contains: :\\Program Files\nfilter_main_googleupdate:\n AccessList|contains: '%%4484'\n ProcessName|contains: :\\Windows\\SystemTemp\\\n ProcessName|endswith: \\GoogleUpdate.exe\nfilter_main_scenarioengine:\n AccessList|contains: '%%4484'\n ProcessName|endsw...", "false_positives": [ "Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it" ], "references": [ "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_lsass_dump_generic.yml", "filename": "win_security_susp_lsass_dump_generic.yml", "curated": true, "technique_ids": [ "T1003.001" ], "tactic_tags": [] }, { "id": "968eef52-9cff-4454-8992-1e74b9cbad6c", "title": "Reconnaissance Activity", "sysmon_eids": [ 4661 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1087.002", "technique": "", "level": "high", "description": "Detects activity as \"net user administrator /domain\" and \"net group domain admins /domain\"", "author": "Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community", "date": "2017-03-07", "modified": "2022-08-22", "detection_yaml": "condition: selection\nselection:\n AccessMask: '0x2d'\n EventID: 4661\n ObjectName|endswith:\n - '-500'\n - '-512'\n ObjectName|startswith: S-1-5-21-\n ObjectType:\n - SAM_USER\n - SAM_GROUP", "false_positives": [ "Administrator activity" ], "references": [ "https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_net_recon_activity.yml", "filename": "win_security_susp_net_recon_activity.yml", "curated": true, "technique_ids": [ "T1087.002", "T1069.002" ], "tactic_tags": [ "discovery" ] }, { "id": "00ba9da1-b510-4f6b-b258-8d338836180f", "title": "Password Protected ZIP File Opened", "sysmon_eids": [ 5379 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027", "technique": "", "level": "medium", "description": "Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.", "author": "Florian Roth (Nextron Systems)", "date": "2022-05-09", "modified": "", "detection_yaml": "condition: selection and not filter\nfilter:\n TargetName|contains: \\Temporary Internet Files\\Content.Outlook\nselection:\n EventID: 5379\n TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename", "false_positives": [ "Legitimate used of encrypted ZIP files" ], "references": [ "https://twitter.com/sbousseaden/status/1523383197513379841" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip.yml", "filename": "win_security_susp_opened_encrypted_zip.yml", "curated": true, "technique_ids": [ "T1027" ], "tactic_tags": [ "stealth" ] }, { "id": "54f0434b-726f-48a1-b2aa-067df14516e4", "title": "Password Protected ZIP File Opened (Suspicious Filenames)", "sysmon_eids": [ 5379 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027", "technique": "", "level": "high", "description": "Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.", "author": "Florian Roth (Nextron Systems)", "date": "2022-05-09", "modified": "", "detection_yaml": "condition: selection and selection_filename\nselection:\n EventID: 5379\n TargetName|contains: Microsoft_Windows_Shell_ZipFolder:filename\nselection_filename:\n TargetName|contains:\n - invoice\n - new order\n - rechnung\n - factura\n - delivery\n - purchase\n - order\n - payment", "false_positives": [ "Legitimate used of encrypted ZIP files" ], "references": [ "https://twitter.com/sbousseaden/status/1523383197513379841" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_filename.yml", "filename": "win_security_susp_opened_encrypted_zip_filename.yml", "curated": true, "technique_ids": [ "T1027", "T1105", "T1036" ], "tactic_tags": [ "stealth" ] }, { "id": "571498c8-908e-40b4-910b-d2369159a3da", "title": "Password Protected ZIP File Opened (Email Attachment)", "sysmon_eids": [ 5379 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1027", "technique": "", "level": "high", "description": "Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.", "author": "Florian Roth (Nextron Systems)", "date": "2022-05-09", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID: 5379\n TargetName|contains|all:\n - Microsoft_Windows_Shell_ZipFolder:filename\n - \\Temporary Internet Files\\Content.Outlook", "false_positives": [ "Legitimate used of encrypted ZIP files" ], "references": [ "https://twitter.com/sbousseaden/status/1523383197513379841" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_opened_encrypted_zip_outlook.yml", "filename": "win_security_susp_opened_encrypted_zip_outlook.yml", "curated": true, "technique_ids": [ "T1027", "T1566.001" ], "tactic_tags": [ "stealth" ] }, { "id": "eca91c7c-9214-47b9-b4c5-cb1d7e4f2350", "title": "Uncommon Outbound Kerberos Connection - Security", "sysmon_eids": [ 5156 ], "tactic": "", "tactic_id": "", "technique_id": "T1558.003", "technique": "", "level": "medium", "description": "Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.", "author": "Ilyas Ochkov, oscd.community", "date": "2019-10-24", "modified": "2024-03-15", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_lsass:\n Application|endswith: \\Windows\\System32\\lsass.exe\n Application|startswith:\n - \\device\\harddiskvolume\n - 'C:'\nfilter_optional_chrome:\n Application|endswith:\n - \\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe\n - \\Program Files\\Google\\Chrome\\Application\\chrome.exe\n Application|startswith:\n - \\device\\harddiskvolume\n - 'C:'\nfilter_optional_firefox:\n Application|endswith:\n - \\Program Files (x86)\\Mozilla Firefox\\firefox.exe\n - \\Program Files\\Mozilla Firefox\\firefox.exe\n Application|startswith:\n - \\device\\harddiskvolume\n - 'C:'\nfilter_optional_tomcat:\n Application|endswith: \\tomcat\\bin\\tomcat8.exe\nselection:\n DestPort: 88\n EventID: 5156", "false_positives": [ "Web Browsers and third party application might generate similar activity. An initial baseline is required." ], "references": [ "https://github.com/GhostPack/Rubeus" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_outbound_kerberos_connection.yml", "filename": "win_security_susp_outbound_kerberos_connection.yml", "curated": true, "technique_ids": [ "T1558.003" ], "tactic_tags": [] }, { "id": "f598ea0c-c25a-4f72-a219-50c44411c791", "title": "Possible Shadow Credentials Added", "sysmon_eids": [ 5136 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1556", "technique": "", "level": "high", "description": "Detects possible addition of shadow credentials to an active directory object.", "author": "Nasreddine Bencherchali (Nextron Systems), Elastic (idea)", "date": "2022-10-17", "modified": "", "detection_yaml": "condition: selection\nselection:\n AttributeLDAPDisplayName: msDS-KeyCredentialLink\n EventID: 5136", "false_positives": [ "Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)" ], "references": [ "https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html", "https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/", "https://twitter.com/SBousseaden/status/1581300963650187264?" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml", "filename": "win_security_susp_possible_shadow_credentials_added.yml", "curated": true, "technique_ids": [ "T1556" ], "tactic_tags": [ "persistence" ] }, { "id": "496a0e47-0a33-4dca-b009-9e6ca3591f39", "title": "Suspicious Kerberos RC4 Ticket Encryption", "sysmon_eids": [ 4769 ], "tactic": "", "tactic_id": "", "technique_id": "T1558.003", "technique": "", "level": "medium", "description": "Detects service ticket requests using RC4 encryption type", "author": "Florian Roth (Nextron Systems)", "date": "2017-02-06", "modified": "2022-06-19", "detection_yaml": "condition: selection and not reduction\nreduction:\n ServiceName|endswith: $\nselection:\n EventID: 4769\n TicketEncryptionType: '0x17'\n TicketOptions: '0x40810000'", "false_positives": [ "Service accounts used on legacy systems (e.g. NetApp)", "Windows Domains with DFL 2003 and legacy systems" ], "references": [ "https://adsecurity.org/?p=3458", "https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml", "filename": "win_security_susp_rc4_kerberos.yml", "curated": true, "technique_ids": [ "T1558.003" ], "tactic_tags": [] }, { "id": "3a734d25-df5c-4b99-8034-af1ddb5883a4", "title": "Suspicious Scheduled Task Creation", "sysmon_eids": [ 4698 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1053.005", "technique": "", "level": "high", "description": "Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-12-05", "modified": "2022-12-07", "detection_yaml": "condition: all of selection_*\nselection_commands:\n TaskContent|contains:\n - regsvr32\n - rundll32\n - cmd.exe\n - cmd\n - '/c '\n - '/k '\n - '/r '\n - powershell\n - pwsh\n - mshta\n - wscript\n - cscript\n - certutil\n - bitsadmin\n - bash.exe\n - 'bash '\n - scrcons\n - 'wmic '\n - wmic.exe\n - forfiles\n - scriptrunner\n - hh.exe\nselection_eid:\n EventID: 4698\nselection_paths:\n TaskContent|contains:\n - \\AppData\\Local\\Temp\\\n - \\AppData\\Roaming\\\n - \\Users\\Public\\\n - \\WINDOWS\\Temp\\\n - C:\\Temp\\\n - \\Desktop\\\n - \\Downloads\\\n - \\Temporary Internet\n - C:\\ProgramData\\\n - C:\\Perflogs\\", "false_positives": [ "Unknown" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_creation.yml", "filename": "win_security_susp_scheduled_task_creation.yml", "curated": true, "technique_ids": [ "T1053.005" ], "tactic_tags": [ "execution", "persistence" ] }, { "id": "7595ba94-cf3b-4471-aa03-4f6baa9e5fad", "title": "Important Scheduled Task Deleted/Disabled", "sysmon_eids": [ 4699, 4701 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1053.005", "technique": "", "level": "high", "description": "Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-12-05", "modified": "2023-03-13", "detection_yaml": "condition: selection and not 1 of filter_main_*\nfilter_main_defender_update:\n EventID: 4699\n SubjectUserName|endswith: $\n TaskName|contains: \\Windows\\Windows Defender\\\nselection:\n EventID:\n - 4699\n - 4701\n TaskName|contains:\n - \\Windows\\SystemRestore\\SR\n - \\Windows\\Windows Defender\\\n - \\Windows\\BitLocker\n - \\Windows\\WindowsBackup\\\n - \\Windows\\WindowsUpdate\\\n - \\Windows\\UpdateOrchestrator\\Schedule\n - \\Windows\\ExploitGuard", "false_positives": [ "Unknown" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml", "filename": "win_security_susp_scheduled_task_delete_or_disable.yml", "curated": true, "technique_ids": [ "T1053.005" ], "tactic_tags": [ "execution", "persistence" ] }, { "id": "614cf376-6651-47c4-9dcc-6b9527f749f4", "title": "Suspicious Scheduled Task Update", "sysmon_eids": [ 4702 ], "tactic": "Execution", "tactic_id": "", "technique_id": "T1053.005", "technique": "", "level": "high", "description": "Detects update to a scheduled task event that contain suspicious keywords.", "author": "Nasreddine Bencherchali (Nextron Systems)", "date": "2022-12-05", "modified": "", "detection_yaml": "condition: all of selection_*\nselection_commands:\n TaskContentNew|contains:\n - regsvr32\n - rundll32\n - cmd.exe\n - cmd\n - '/c '\n - '/k '\n - '/r '\n - powershell\n - pwsh\n - mshta\n - wscript\n - cscript\n - certutil\n - bitsadmin\n - bash.exe\n - 'bash '\n - scrcons\n - 'wmic '\n - wmic.exe\n - forfiles\n - scriptrunner\n - hh.exe\nselection_eid:\n EventID: 4702\nselection_paths:\n TaskContentNew|contains:\n - \\AppData\\Local\\Temp\\\n - \\AppData\\Roaming\\\n - \\Users\\Public\\\n - \\WINDOWS\\Temp\\\n - C:\\Temp\\\n - \\Desktop\\\n - \\Downloads\\\n - \\Temporary Internet\n - C:\\ProgramData\\\n - C:\\Perflogs\\", "false_positives": [ "Unknown" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_scheduled_task_update.yml", "filename": "win_security_susp_scheduled_task_update.yml", "curated": true, "technique_ids": [ "T1053.005" ], "tactic_tags": [ "execution", "persistence" ] }, { "id": "faa031b5-21ed-4e02-8881-2591f98d82ed", "title": "Unauthorized System Time Modification", "sysmon_eids": [ 4616 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1070.006", "technique": "", "level": "low", "description": "Detect scenarios where a potentially unauthorized application or user is modifying the system time.", "author": "@neu5ron", "date": "2019-02-05", "modified": "2025-12-03", "detection_yaml": "condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*\nfilter_main_svchost:\n ProcessName: C:\\Windows\\System32\\svchost.exe\n SubjectUserSid: S-1-5-19\nfilter_optional_vmtools:\n ProcessName:\n - C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe\n - C:\\Program Files (x86)\\VMware\\VMware Tools\\vmtoolsd.exe\n - C:\\Windows\\System32\\VBoxService.exe\n - C:\\Windows\\System32\\oobe\\msoobe.exe\nselection:\n EventID: 4616", "false_positives": [ "HyperV or other virtualization technologies with binary not listed in filter portion of detection" ], "references": [ "Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)", "Live environment caused by malware", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_susp_time_modification.yml", "filename": "win_security_susp_time_modification.yml", "curated": true, "technique_ids": [ "T1070.006" ], "tactic_tags": [ "stealth" ] }, { "id": "9a4ff3b8-6187-4fd2-8e8b-e0eae1129495", "title": "SysKey Registry Keys Access", "sysmon_eids": [ 4656, 4663 ], "tactic": "Discovery", "tactic_id": "", "technique_id": "T1012", "technique": "", "level": "high", "description": "Detects handle requests and access operations to specific registry keys to calculate the SysKey", "author": "Roberto Rodriguez @Cyb3rWard0g", "date": "2019-08-12", "modified": "2021-11-27", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4656\n - 4663\n ObjectName|endswith:\n - lsa\\JD\n - lsa\\GBG\n - lsa\\Skew1\n - lsa\\Data\n ObjectType: key", "false_positives": [ "Unknown" ], "references": [ "https://threathunterplaybook.com/hunts/windows/190625-RegKeyAccessSyskey/notebook.html" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_syskey_registry_access.yml", "filename": "win_security_syskey_registry_access.yml", "curated": true, "technique_ids": [ "T1012" ], "tactic_tags": [ "discovery" ] }, { "id": "18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc", "title": "Sysmon Channel Reference Deletion", "sysmon_eids": [ 4657, 4663 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1112", "technique": "", "level": "high", "description": "Potential threat actor tampering with Sysmon manifest and eventually disabling it", "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)", "date": "2020-07-14", "modified": "2025-10-22", "detection_yaml": "condition: 1 of selection*\nselection1:\n EventID: 4657\n NewValue: 0\n ObjectName|contains:\n - WINEVT\\Publishers\\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\n - WINEVT\\Channels\\Microsoft-Windows-Sysmon/Operational\n ObjectValueName: Enabled\nselection2:\n AccessMask: '0x10000'\n EventID: 4663\n ObjectName|contains:\n - WINEVT\\Publishers\\{5770385f-c22a-43e0-bf4c-06f5698ffbd9}\n - WINEVT\\Channels\\Microsoft-Windows-Sysmon/Operational", "false_positives": [ "Unknown" ], "references": [ "https://twitter.com/Flangvik/status/1283054508084473861", "https://twitter.com/SecurityJosh/status/1283027365770276866", "https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html", "https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml", "filename": "win_security_sysmon_channel_reference_deletion.yml", "curated": true, "technique_ids": [ "T1112" ], "tactic_tags": [ "persistence" ] }, { "id": "25cde13e-8e20-4c29-b949-4e795b76f16f", "title": "Suspicious Teams Application Related ObjectAcess Event", "sysmon_eids": [ 4663 ], "tactic": "", "tactic_id": "", "technique_id": "T1528", "technique": "", "level": "high", "description": "Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.", "author": "@SerkinValery", "date": "2022-09-16", "modified": "", "detection_yaml": "condition: selection and not filter\nfilter:\n ProcessName|contains: \\Microsoft\\Teams\\current\\Teams.exe\nselection:\n EventID: 4663\n ObjectName|contains:\n - \\Microsoft\\Teams\\Cookies\n - \\Microsoft\\Teams\\Local Storage\\leveldb", "false_positives": [ "Unknown" ], "references": [ "https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/", "https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_teams_suspicious_objectaccess.yml", "filename": "win_security_teams_suspicious_objectaccess.yml", "curated": true, "technique_ids": [ "T1528" ], "tactic_tags": [] }, { "id": "c265cf08-3f99-46c1-8d59-328247057d57", "title": "User Added to Local Administrator Group", "sysmon_eids": [ 4732 ], "tactic": "Stealth", "tactic_id": "", "technique_id": "T1078", "technique": "", "level": "medium", "description": "Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity", "author": "Florian Roth (Nextron Systems)", "date": "2017-03-14", "modified": "2021-01-17", "detection_yaml": "condition: all of selection_* and not 1 of filter_*\nfilter_main_computer_accounts:\n SubjectUserName|endswith: $\nselection_eid:\n EventID: 4732\nselection_group:\n- TargetUserName|startswith: Administr\n- TargetSid: S-1-5-32-544", "false_positives": [ "Legitimate administrative activity" ], "references": [ "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732", "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_added_to_local_administrators.yml", "filename": "win_security_user_added_to_local_administrators.yml", "curated": true, "technique_ids": [ "T1078", "T1098" ], "tactic_tags": [ "stealth", "persistence" ] }, { "id": "6daac7fc-77d1-449a-a71a-e6b4d59a0e54", "title": "User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'", "sysmon_eids": [ 4673 ], "tactic": "", "tactic_id": "", "technique_id": "T1558.003", "technique": "", "level": "high", "description": "The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.", "author": "Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community", "date": "2019-10-24", "modified": "2022-12-25", "detection_yaml": "condition: selection\nselection:\n EventID: 4673\n Keywords: '0x8010000000000000'\n Service: LsaRegisterLogonProcess()", "false_positives": [ "Unknown" ], "references": [ "https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml", "filename": "win_security_user_couldnt_call_priv_service_lsaregisterlogonprocess.yml", "curated": true, "technique_ids": [ "T1558.003" ], "tactic_tags": [] }, { "id": "66b6be3d-55d0-4f47-9855-d69df21740ea", "title": "Local User Creation", "sysmon_eids": [ 4720 ], "tactic": "Persistence", "tactic_id": "", "technique_id": "T1136.001", "technique": "", "level": "low", "description": "Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.", "author": "Patrick Bareiss", "date": "2019-04-18", "modified": "2021-01-17", "detection_yaml": "condition: selection\nselection:\n EventID: 4720", "false_positives": [ "Domain Controller Logs", "Local accounts managed by privileged account management tools" ], "references": [ "https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_creation.yml", "filename": "win_security_user_creation.yml", "curated": true, "technique_ids": [ "T1136.001" ], "tactic_tags": [ "persistence" ] }, { "id": "0badd08f-c6a3-4630-90d3-6875cca440be", "title": "User Logoff Event", "sysmon_eids": [ 4634, 4647 ], "tactic": "Impact", "tactic_id": "", "technique_id": "T1531", "technique": "", "level": "informational", "description": "Detects a user log-off activity. Could be used for example to correlate information during forensic investigations", "author": "frack113", "date": "2022-10-14", "modified": "", "detection_yaml": "condition: selection\nselection:\n EventID:\n - 4634\n - 4647", "false_positives": [ "Unknown" ], "references": [ "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_user_logoff.yml", "filename": "win_security_user_logoff.yml", "curated": true, "technique_ids": [ "T1531" ], "tactic_tags": [ "impact" ] }, { "id": "e9faba72-4974-4ab2-a4c5-46e25ad59e9b", "title": "VSSAudit Security Event Source Registration", "sysmon_eids": [ 4904, 4905 ], "tactic": "", "tactic_id": "", "technique_id": "T1003.002", "technique": "", "level": "informational", "description": "Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.", "author": "Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)", "date": "2020-10-20", "modified": "2022-04-28", "detection_yaml": "condition: selection\nselection:\n AuditSourceName: VSSAudit\n EventID:\n - 4904\n - 4905", "false_positives": [ "Legitimate use of VSSVC. Maybe backup operations. It would usually be done by C:\\Windows\\System32\\VSSVC.exe." ], "references": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_vssaudit_secevent_source_registration.yml", "filename": "win_security_vssaudit_secevent_source_registration.yml", "curated": true, "technique_ids": [ "T1003.002" ], "tactic_tags": [] }, { "id": "46a68649-f218-4f86-aea1-16a759d81820", "title": "Windows Defender Exclusion List Modified", "sysmon_eids": [ 4657 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "medium", "description": "Detects modifications to the Windows Defender exclusion registry key. This could indicate a potentially suspicious or even malicious activity by an attacker trying to add a new exclusion in order to bypass security.", "author": "@BarryShooshooga", "date": "2019-10-26", "modified": "2023-11-11", "detection_yaml": "condition: selection\nselection:\n EventID: 4657\n ObjectName|contains: \\Microsoft\\Windows Defender\\Exclusions\\", "false_positives": [ "Intended exclusions by administrators" ], "references": [ "https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_windows_defender_exclusions_registry_modified.yml", "filename": "win_security_windows_defender_exclusions_registry_modified.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d", "title": "Windows Defender Exclusion Registry Key - Write Access Requested", "sysmon_eids": [ 4417, 4418 ], "tactic": "", "tactic_id": "", "technique_id": "T1685", "technique": "", "level": "medium", "description": "Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.", "author": "@BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)", "date": "2019-10-26", "modified": "2023-11-11", "detection_yaml": "condition: selection\nselection:\n AccessList|contains:\n - '%%4417'\n - '%%4418'\n EventID:\n - 4656\n - 4663\n ObjectName|contains: \\Microsoft\\Windows Defender\\Exclusions\\", "false_positives": [ "Unknown" ], "references": [ "https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_windows_defender_exclusions_write_access.yml", "filename": "win_security_windows_defender_exclusions_write_access.yml", "curated": true, "technique_ids": [ "T1685" ], "tactic_tags": [] }, { "id": "411742ad-89b0-49cb-a7b0-3971b5c1e0a4", "title": "Locked Workstation", "sysmon_eids": [ 4800 ], "tactic": "Impact", "tactic_id": "", "technique_id": "", "technique": "", "level": "informational", "description": "Detects locked workstation session events that occur automatically after a standard period of inactivity.", "author": "Alexandr Yampolskyi, SOC Prime", "date": "2019-03-26", "modified": "2023-12-11", "detection_yaml": "condition: selection\nselection:\n EventID: 4800", "false_positives": [ "Likely" ], "references": [ "https://www.cisecurity.org/controls/cis-controls-list/", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800" ], "github_url": "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_workstation_was_locked.yml", "filename": "win_security_workstation_was_locked.yml", "curated": true, "technique_ids": [], "tactic_tags": [ "impact" ] } ], "event_to_rules": { "1": [ "4f647cfa-b598-4e12-ad69-c68dd16caef8", "d78b5d61-187d-44b6-bf02-93486a80de5a", "2704ab9e-afe2-4854-a3b1-0c0706d03578", "3268b746-88d8-4cd3-bffc-30077d02c787", "b18c9d4c-fac9-4708-bd06-dd5bfacf200f", "b99a1518-1ad5-4f65-bc95-1ffff97a8fd0", "ff23ffbc-3378-435e-992f-0624dcf93ab4", "7ec2c172-dceb-4c10-92c9-87c1881b7e18", "b1876533-4ed5-4a83-90f3-b8645840a413", "7679d464-4f74-45e2-9e01-ac66c5eb041a", "c484e533-ee16-4a93-b6ac-f0ea4868b2f1", "42333b2c-b425-441c-b70e-99404a17170f", "8a7e90c5-fe6e-45dc-889e-057fe4378bd9", "7aa7009a-28b9-4344-8c1f-159489a390df", "24e3e58a-646b-4b50-adef-02ef935b9fc8", "1070db9a-3e5d-412e-8e7b-7183b616e1b3", "c8da0dfd-4ed0-4b68-962d-13c9c884384e", "5589ab4f-a767-433c-961d-c91f3f704db1", "f1086bf7-a0c4-4a37-9102-01e573caf4a0", "2fdefcb3-dbda-401e-ae23-f0db027628bc", "d55b793d-f847-4eea-b59a-5ab09908ac90", "889719ef-dd62-43df-86c3-768fb08dc7c0", "4ac47ed3-44c2-4b1f-9d51-bf46e8914126", "797011dc-44f4-4e6f-9f10-a8ceefbe566b", "c86500e9-a645-4680-98d7-f882c70c1ea3", "514e4c3a-c77d-4cde-a00f-046425e2301e", "d522eca2-2973-4391-a3e0-ef0374321dae", "81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2", "d7662ff6-9e97-4596-a61d-9839e32dee8d", "639c9081-f482-47d3-a0bd-ddee3d4ecd76", "6c8fbee5-dee8-49bc-851d-c3142d02aa47", "863218bd-c7d0-4c52-80cd-0a96c09f54af", "0ed99dda-6a35-11ef-8c99-0242ac120002", "0a13e132-651d-11eb-ae93-0242ac130002", "c6c56ada-612b-42d1-9a29-adad3c5c2c1e", "a7c3d773-caef-227e-a7e7-c2f13c622329", "e32d4572-9826-4738-b651-95fa63747e8a", "22e58743-4ac8-4a9f-bf19-00a0428d8c5f", "1444443e-6757-43e4-9ea4-c8fc705f79a2", "e66779cc-383e-4224-a3a4-267eeb585c40" ], "2": [ "9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3" ], "3": [ "3ab65069-d82a-4d44-a759-466661a082d1", "1d08ac94-400d-4469-a82f-daee9a908849", "e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97", "fa5b1358-b040-4403-9868-15f7d9ab6329", "5205613d-2a63-4412-a895-3a2458b587b3", "a66bc059-c370-472c-a0d7-f8fd1bf9d583", "8d7e392e-9b28-49e1-831d-5949c6281228", "7b434893-c57d-4f41-908d-6a17bf1ae98f", "e81528db-fc02-45e8-8e98-4e84aba1f10b", "2fdaf50b-9fd5-449f-ba69-f17248119af6", "297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7", "efafe0bf-4238-479e-af8f-797bd3490d2d", "37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1", "992a6cae-db6a-43c8-9cec-76d7195c96fc", "ed74fe75-7594-4b4b-ae38-e38e3fd2eb23", "c539afac-c12a-46ed-b1bd-5a5567c9f045", "4b89abaa-99fe-4232-afdd-8f9aa4d20382", "18249279-932f-45e2-b37a-8925f2597670", "5f699bc5-5446-4a4a-a0b7-5ef2885a3eb4", "b1e5da3b-ca8e-4adf-915c-9921f3d85481", "50e54b8d-ad73-43f8-96a1-5191685b17a4", "25eabf56-22f0-4915-a1ed-056b8dae0a68", "20384606-a124-4fec-acbb-8bd373728613", "0dba975d-a193-4ed1-a067-424df57570d1", "6d8c3d20-a5e1-494f-8412-4571d716cf5c", "08249dc0-a28d-4555-8ba5-9255a198e08c", "9f2cc74d-78af-4eb2-bb64-9cd1d292b87b", "07837ab9-60e1-481f-a74d-c31fb496a94c", "c7e91a02-d771-4a6d-a700-42587e0b1095", "5c80b618-0dbb-46e6-acbb-03d90bcb6d83", "9e02c8ec-02b9-43e8-81eb-34a475ba7965", "7cd1dcdc-6edf-4896-86dc-d1f19ad64903", "9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4", "4b657234-038e-4ad5-997c-4be42340bce4", "3b5ba899-9842-4bc2-acc2-12308498bf42", "75e33ce3-ae32-4dcc-9aa8-a2a3029d6f84", "7610a4ea-c06d-495f-a2ac-0a696abcfd3b", "c649a6c7-cd8c-4a78-9c04-000fc76df954", "bef0bc5a-b9ae-425d-85c6-7b2d705980c6", "0531e43a-d77d-47c2-b89f-5fe50321c805", "d58ba5c6-0ed7-4b9d-a433-6878379efda9", "cdc8da7d-c303-42f8-b08c-b4ab47230263", "edf3485d-dac4-4d50-90e4-b0e5813f7e60", "7e9cf7b6-e827-11ed-a05b-0242ac120003", "c3dbbc9f-ef1d-470a-a90a-d343448d5875", "9976fa64-2804-423c-8a5b-646ade840773", "786cdae8-fefb-4eb2-9227-04e34060db01", "b3ad3c0f-c949-47a1-a30e-b0491ccae876", "e54979bd-c5f9-4d6c-967b-a04b19ac4c74", "fdeebdf0-9f3f-4d08-84a6-4c4d13e39fe4", "7e9cf7b6-e827-11ed-a05b-15959c120003" ], "6": [ "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "67add051-9ee7-4ad3-93ba-42935615ae8d", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "295c9289-acee-4503-a571-8eacaef36b28", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "679085d5-f427-4484-9f58-1dc30a7c426d", "39b64854-5497-4b57-a448-40977b8c9679", "10cb6535-b31d-4512-9962-513dcbc42cc1", "72cd00d6-490c-4650-86ff-1d11f491daa1" ], "7": [ "f354eba5-623b-450f-b073-0b5b2773b6aa", "799a5f48-0ac1-4e0f-9152-71d137d48c2a", "90ae0469-0cee-4509-b67f-e5efcef040f7", "6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984", "75e508f7-932d-4ebc-af77-269237a84ce1", "ee4c5d06-3abc-48cc-8885-77f1c20f4451", "ec8c4047-fad9-416a-8c81-0f479353d7f6", "4508a70e-97ef-4300-b62b-ff27992990ea", "828af599-4c53-4ed2-ba4a-a9f835c434ea", "90217a70-13fc-48e4-b3db-0d836c5824ac", "75c505b1-711d-4f68-a357-8c3fe37dbf2d", "49329257-089d-46e6-af37-4afce4290685", "b48492dc-c5ef-4572-8dff-32bc241c15c8", "829a3bdf-34da-4051-9cf4-8ed221a8ae4f", "84b0a8f3-680b-4096-a45b-e9a89221727c", "d2451be2-b582-4e15-8701-4196ac180260", "6b98b92b-4f00-4f62-b4fe-4d1920215771", "9313dc13-d04c-46d8-af4a-a930cc55d93b", "6360757a-d460-456c-8b13-74cf0e60cceb", "edd3ddc3-386f-4ba5-9ada-4376b2cfa7b5" ], "8": [ "2e4e488a-6164-4811-9ea1-f960c7359c40", "6309645e-122d-4c5b-bb2b-22e4f9c2fa42", "f239b326-2f41-4d6b-9dfa-c846a60ef505", "fb656378-f909-47c1-8747-278bf09f4f4f", "02d1d718-dd13-41af-989d-ea85c7fab93f", "77564cc2-7382-438b-a7f6-395c2ae53b9a", "c0aac16a-b1e7-4330-bab0-3c27bb4987c7", "c15e99a3-c474-48ab-b9a7-84549a7a9d16", "66d31e5f-52d6-40a4-9615-002d3789a119", "a1a144b7-5c9b-4853-a559-2172be8d4a03", "99b97608-3e21-4bfe-8217-2a127c396a0e" ], "9": [ "db809f10-56ce-4420-8c86-d6a7d793c79c" ], "10": [ "3b4b232a-af90-427c-a22f-30b0c0837b95", "f8be3e82-46a3-4e4e-ada5-8e538ae8b9c9", "174afcfa-6e40-4ae9-af64-496546389294", "e5b33f7d-eb93-48b6-9851-09e1e610b6d7", "09706624-b7f6-455d-9d02-adee024cee1d", "d0d2f720-d14f-448d-8242-51ff396a334e", "b1bd3a59-c1fd-4860-9f40-4dd161a7d1f5", "7bdde3bf-2a42-4c39-aa31-a92b3e17afac", "d29ada0f-af45-4f27-8f32-f7b77c3dbc4e", "4be8b654-0c01-4c9d-a10c-6b28467fc651", "9bd012ee-0dff-44d7-84a0-aa698cfd87a3", "a49fa4d5-11db-418c-8473-1e014a8dd462", "aa35a627-33fb-4d04-a165-d33b4afca3e8", "472159c5-31b9-4f56-b794-b766faa8b0a7", "387df17d-3b04-448f-8669-9e7fd5e5fd8c", "9f5c1d59-33be-4e60-bcab-85d2f566effd", "166e9c50-8cd9-44af-815d-d1f0c0e90dde", "4f6c43e2-f989-4ea5-bcd8-843b49a0317c", "fb3722e4-1a06-46b6-b772-253e2e7db933", "5ef9853e-4d0e-4a70-846f-a9ca37d876da", "3f3f3506-1895-401b-9cc3-e86b16e630d0", "a18dd26b-6450-46de-8c91-9659150cf088", "a24e5861-c6ca-4fde-a93c-ba9256feddf0" ], "11": [ "93d94efc-d7ad-4161-ad7d-1638c4f908d8", "bb09dd3e-2b78-4819-8e35-a7c1b874e449", "9e099d99-44c2-42b6-a6d8-54c3545cab29", "847def9e-924d-4e90-b7c4-5f581395a2b4", "2f7979ae-f82b-45af-ac1d-2b10e93b0baa", "8d5aca11-22b3-4f22-b7ba-90e60533e1fb", "614a7e17-5643-4d89-b6fe-f9df1a79641c", "fccfb43e-09a7-4bd2-8b37-a5a7df33386d", "0bcfabcb-7929-47f4-93d6-b33fb67d34d1", "02773bed-83bf-469f-b7ff-e676e7d78bab", "8c3c76ca-8f8b-4b1d-aaf3-81aebcd367c9", "8fbf3271-1ef6-4e94-8210-03c2317947f6", "b6f91281-20aa-446a-b986-38a92813a18f", "7892ec59-c5bb-496d-8968-e5d210ca3ac4", "318557a5-150c-4c8d-b70e-a9910e199857", "c7a74c80-ba5a-486e-9974-ab9e682bc5e4", "736ffa74-5f6f-44ca-94ef-1c0df4f51d2a", "03f4ca17-de95-428d-a75a-4ee78b047256", "cad1fe90-2406-44dc-bd03-59d0b58fe722", "efc21479-9e83-41da-8cf1-122e06ba8db3" ], "12": [ "55e29995-75e7-451a-bef0-6225e2f13597", "f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7", "baca5663-583c-45f9-b5dc-ea96a22ce542", "a6b33c02-8305-488f-8585-03cb2a7763f2", "b6d235fc-1d38-4b12-adbe-325f06728f37", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "b3503044-60ce-4bf4-bbcb-e3db98788823", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "5aad0995-46ab-41bd-a9ff-724f41114971", "272e55a4-9e6b-4211-acb6-78f51f0b1b40", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "5b175490-b652-4b02-b1de-5b5b4083c5f8" ], "13": [ "55e29995-75e7-451a-bef0-6225e2f13597", "f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7", "baca5663-583c-45f9-b5dc-ea96a22ce542", "a6b33c02-8305-488f-8585-03cb2a7763f2", "aa37cbb0-da36-42cb-a90f-fdf216fc7467", "833ef470-fa01-4631-a79b-6f291c9ac498", "31e124fb-5dc4-42a0-83b3-44a69c77b271", "46dd5308-4572-4d12-aa43-8938f0184d4f", "674202d0-b22a-4af4-ae5f-2eda1f3da1af", "724ea201-6514-4f38-9739-e5973c34f49a", "b6d235fc-1d38-4b12-adbe-325f06728f37", "07743f65-7ec9-404a-a519-913db7118a8d", "790317c0-0a36-4a6a-a105-6e576bf99a14", "e3fdf743-f05b-4051-990a-b66919be1743", "7d9263bd-dc47-4a58-bc92-5474abab390c", "9e3357ba-09d4-4fbd-a7c5-ad6386314513", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "7530b96f-ad8e-431d-a04d-ac85cc461fdc", "9d3436ef-9476-4c43-acca-90ce06bdf33a", "b3503044-60ce-4bf4-bbcb-e3db98788823" ], "14": [ "55e29995-75e7-451a-bef0-6225e2f13597", "f7f9ab88-7557-4a69-b30e-0a8f91b3a0e7", "baca5663-583c-45f9-b5dc-ea96a22ce542", "a6b33c02-8305-488f-8585-03cb2a7763f2", "b6d235fc-1d38-4b12-adbe-325f06728f37", "460479f3-80b7-42da-9c43-2cc1d54dbccd", "b3503044-60ce-4bf4-bbcb-e3db98788823", "919f2ef0-be2d-4a7a-b635-eb2b41fde044", "5aad0995-46ab-41bd-a9ff-724f41114971", "ac8866c7-ce44-46fd-8c17-b24acff96ca8", "f663a6d9-9d1b-49b8-b2b1-0637914d199a", "d67572a0-e2ec-45d6-b8db-c100d14b8ef2", "1c8e96cd-2bed-487d-9de0-b46c90cade56", "5b175490-b652-4b02-b1de-5b5b4083c5f8", "277efb8f-60be-4f10-b4d3-037802f37167", "eeb30123-9fbd-4ee8-aaa0-2e545bbed6dc", "152f3630-77c1-4284-bcc0-4cc68ab2f6e7", "62120148-6b7a-42be-8b91-271c04e281a3", "9c5037d1-c568-49b3-88c7-9846a5bdc2be", "6ea3bf32-9680-422d-9f50-e90716b12a66", "b98968aa-dbc0-4a9c-ac35-108363cbf8d5", "1a2d6c47-75b0-45bd-b133-2c0be75349fd", "5a9e1b2c-8f7d-4a1e-9b3c-0f6d7e5a4b1f", "9577edbb-851f-4243-8c91-1d5b50c1a39b", "6aa1d992-5925-4e9f-a49b-845e51d1de01", "4f84b697-c9ed-4420-8ab5-e09af5b2345d", "a54f842a-3713-4b45-8c84-5f136fdebd3c", "3d27f6dd-1c74-4687-b4fa-ca849d128d1c", "67a6c006-3fbe-46a7-9074-2ba3b82c3000", "7f4c43f9-b1a5-4c7d-b24a-b41bf3a3ebf2", "c74d7efc-8826-45d9-b8bb-f04fac9e4eff", "295a59c1-7b79-4b47-a930-df12c15fc9c2" ], "15": [ "0d7a9363-af70-4e7b-a3b7-1a176b7fbe84", "19b041f6-e583-40dc-b842-d6fa8011493f", "a3f5c081-e75b-43a0-9f5b-51f26fe5dba2", "0bb4bbeb-fe52-4044-b40c-430a04577ebe", "52182dfb-afb7-41db-b4bc-5336cb29b464", "025bd229-fd1f-4fdb-97ab-20006e1a5368", "573df571-a223-43bc-846e-3f98da481eca", "b69888d4-380c-45ce-9cf9-d9ce46e67821", "ae02ed70-11aa-4a22-b397-c0d0e8f6ea99" ], "16": [ "815cd91b-7dbc-4247-841a-d7dd1392b0a8", "1f2b5353-573f-4880-8e33-7d04dcf97744" ], "17": [ "d5601f8c-b26f-4ab0-9035-69e11a8d4ad2", "0e7163d4-9e19-4fa7-9be6-000c61aad77a", "961d0ba2-3eea-4303-a930-2cf78bbfcc5e", "1f7025a6-e747-4130-aac4-961eb47015f1", "0adc67e0-a68f-4ffd-9c43-28905aad5d6a", "fe3ac066-98bb-432a-b1e7-a5229cb39d4a", "85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7", "4d0083b3-580b-40da-9bba-626c19fe4033", "637f689e-b4a5-4a86-be0e-0100a0a33ba2", "1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3", "58cb02d5-78ce-4692-b3e1-dce850aae41a", "f318b911-ea88-43f4-9281-0de23ede628e", "f6451de4-df0a-41fa-8d72-b39f54a08db5", "d36f87ea-c403-44d2-aa79-1a0ac7c24456", "41504465-5e3a-4a5b-a5b4-2a0baadd4463", "493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb", "ac7102b4-9e1e-4802-9b4f-17c5524c015c" ], "18": [ "d5601f8c-b26f-4ab0-9035-69e11a8d4ad2", "0e7163d4-9e19-4fa7-9be6-000c61aad77a", "961d0ba2-3eea-4303-a930-2cf78bbfcc5e", "1f7025a6-e747-4130-aac4-961eb47015f1", "0adc67e0-a68f-4ffd-9c43-28905aad5d6a", "fe3ac066-98bb-432a-b1e7-a5229cb39d4a", "85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7", "4d0083b3-580b-40da-9bba-626c19fe4033", "637f689e-b4a5-4a86-be0e-0100a0a33ba2", "1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3", "58cb02d5-78ce-4692-b3e1-dce850aae41a", "f318b911-ea88-43f4-9281-0de23ede628e", "f6451de4-df0a-41fa-8d72-b39f54a08db5", "d36f87ea-c403-44d2-aa79-1a0ac7c24456", "41504465-5e3a-4a5b-a5b4-2a0baadd4463", "493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb", "ac7102b4-9e1e-4802-9b4f-17c5524c015c" ], "19": [ "83844185-1c5b-45bc-bcf3-b5bf3084ca5b", "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "0f06a3a5-6a09-413f-8743-e6cf35561297" ], "20": [ "83844185-1c5b-45bc-bcf3-b5bf3084ca5b", "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "0f06a3a5-6a09-413f-8743-e6cf35561297" ], "21": [ "83844185-1c5b-45bc-bcf3-b5bf3084ca5b", "fe21810c-2a8c-478f-8dd3-5a287fb2a0e0", "0f06a3a5-6a09-413f-8743-e6cf35561297" ], "22": [ "f356a9c4-effd-4608-bbf8-408afd5cd006", "7bd3902d-8b8b-4dd4-838a-c6862d40150d", "b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544", "c082c2b0-525b-4dbc-9a26-a57dc4692074", "065cceea-77ec-4030-9052-fc0affea7110", "e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c", "7cff77e1-9663-46a3-8260-17f2e1aa9d0a", "a1d9eec5-33b2-4177-8d24-27fe754d0812", "36e037c4-c228-4866-b6a3-48eb292b9955", "e043f529-8514-4205-8ab0-7f7d2927b400", "f8c1e80b-c73a-476a-ae24-6c72528b1521", "1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b", "613c03ba-0779-4a53-8a1f-47f914a4ded3", "4d07b1f4-cb00-4470-b9f8-b0191d48ff52", "b3e6418f-7c7a-4fad-993a-93b65027a9f1", "2074e137-1b73-4e2d-88ba-5a3407dbdce0", "ec82e2a5-81ea-4211-a1f8-37a0286df2c2", "778ba9a8-45e4-4b80-8e3e-34a419f0b85e", "882e858a-3233-4ba8-855e-2f3d3575803d", "df68f791-ad95-447f-a271-640a0dab9cf8", "1cbbeaaf-3c8c-4e4c-9d72-49485b6a176b", "a21bcd7e-38ec-49ad-b69a-9ea17e69509e" ], "23": [ "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "06125661-3814-4e03-bfa2-1e4411c60ac3", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "3eb8c339-a765-48cc-a150-4364c04652bf", "ff301988-c231-4bd0-834c-ac9d73b86586", "f01d1f70-cd41-42ec-9c0b-26dd9c22bf29", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "b1decb61-ed83-4339-8e95-53ea51901720" ], "25": [ "c4b890e5-8d8c-4496-8c66-c805753817cd" ], "26": [ "a55349d8-9588-4c5a-8e3b-1925fe2a4ffe", "0a1f9d29-6465-4776-b091-7f43b26e4c89", "8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0", "3109530e-ab47-4cc6-a953-cac5ebcc93ae", "06125661-3814-4e03-bfa2-1e4411c60ac3", "63c779ba-f638-40a0-a593-ddd45e8b1ddc", "6ddab845-b1b8-49c2-bbf7-1a11967f64bc", "3eb8c339-a765-48cc-a150-4364c04652bf", "ff301988-c231-4bd0-834c-ac9d73b86586", "f01d1f70-cd41-42ec-9c0b-26dd9c22bf29", "270185ff-5f50-4d6d-a27f-24c3b8c9fef8", "b1decb61-ed83-4339-8e95-53ea51901720" ], "29": [ "2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75", "05296024-fe8a-4baf-8f3d-9a5f5624ceb2", "67add051-9ee7-4ad3-93ba-42935615ae8d", "7aaaf4b8-e47c-4295-92ee-6ed40a6f60c8", "295c9289-acee-4503-a571-8eacaef36b28", "1a42dfa6-6cb2-4df9-9b48-295be477e835", "679085d5-f427-4484-9f58-1dc30a7c426d", "39b64854-5497-4b57-a448-40977b8c9679", "10cb6535-b31d-4512-9962-513dcbc42cc1", "72cd00d6-490c-4650-86ff-1d11f491daa1" ], "4417": [ "a8f29a7b-b137-4446-80a0-b804272f3da2", "123e4e6d-b123-48f8-b261-7214938acaf0", "e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d" ], "4418": [ "e9c8808f-4cfb-4ba9-97d4-e5f3beaa244d" ], "4484": [ "4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76" ], "4611": [ "12e6d621-194f-4f59-90cc-1959e21e69f7" ], "4616": [ "faa031b5-21ed-4e02-8881-2591f98d82ed" ], "4624": [ "2111118f-7e46-4fc8-974a-59fd8ec95196", "78d5cab4-557e-454f-9fb9-a222bd0d5edc", "24549159-ac1b-479c-8175-d42aea947cae", "72124974-a68b-4366-b990-d30e0b2a190d", "749c9f5e-b353-4b90-a9c1-05243357ca4b" ], "4625": [ "24549159-ac1b-479c-8175-d42aea947cae", "72124974-a68b-4366-b990-d30e0b2a190d", "9eb99343-d336-4020-a3cd-67f3819e68ee", "f88e112a-21aa-44bd-9b01-6ee2a2bbbed1" ], "4633": [ "a8f29a7b-b137-4446-80a0-b804272f3da2" ], "4634": [ "0badd08f-c6a3-4630-90d3-6875cca440be" ], "4647": [ "0badd08f-c6a3-4630-90d3-6875cca440be" ], "4648": [ "941e5c45-cda7-4864-8cea-bbb7458d194a" ], "4649": [ "5a44727c-3b85-4713-8c44-4401d5499629" ], "4656": [ "1de68c67-af5c-4097-9c85-fe5578e09e67", "aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c", "f8748f2c-89dc-4d95-afb0-5a2dfdbad332", "9a4ff3b8-6187-4fd2-8e8b-e0eae1129495", "ff151c33-45fa-475d-af4f-c2f93571f4fe" ], "4657": [ "a4c90ea1-2634-4ca0-adbb-35eae169b6fc", "d3abac66-f11c-4ed0-8acb-50cc29c97eed", "18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc", "8cd538a4-62d5-4e83-810b-12d41e428d6e", "46a68649-f218-4f86-aea1-16a759d81820" ], "4658": [ "39a80702-d7ca-4a83-b776-525b1f86a36d" ], "4661": [ "35ba1d85-724d-42a3-889f-2e2362bcaf23", "968eef52-9cff-4454-8992-1e74b9cbad6c", "12ba6a38-adb3-4d6b-91ba-a7fb248e3199" ], "4662": [ "028c7842-4243-41cd-be6f-12f3cf1a26c7", "17d619c1-e020-4347-957e-1d1207455c93", "4ac1f50b-3bd0-4968-902d-868b4647937e", "611eab06-a145-4dfa-a295-3ccc5c20f59a", "b07e58cf-cacc-4135-8473-ccb2eba63dd2" ], "4663": [ "1de68c67-af5c-4097-9c85-fe5578e09e67", "25cde13e-8e20-4c29-b949-4e795b76f16f", "9a4ff3b8-6187-4fd2-8e8b-e0eae1129495", "18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc", "ff151c33-45fa-475d-af4f-c2f93571f4fe" ], "4673": [ "6daac7fc-77d1-449a-a71a-e6b4d59a0e54" ], "4674": [ "dae8171c-5ec6-4396-b210-8466585b53e9" ], "4691": [ "a8f29a7b-b137-4446-80a0-b804272f3da2" ], "4692": [ "39a94fd1-8c9a-4ff6-bf22-c058762f8014" ], "4697": [ "d7a95147-145f-4678-b85d-d1ff4a3bb3f6", "f0d1feba-4344-4ca9-8121-a6c97bd6df52", "0ee4d8a5-4e67-4faf-acfa-62a78457d1f2", "4edf51e1-cb83-4e1a-bc39-800e396068e3", "fd0f5778-d3cb-4c9a-9695-66759d04702a" ], "4698": [ "3a734d25-df5c-4b99-8034-af1ddb5883a4" ], "4699": [ "7595ba94-cf3b-4471-aa03-4f6baa9e5fad" ], "4701": [ "7595ba94-cf3b-4471-aa03-4f6baa9e5fad" ], "4702": [ "614cf376-6651-47c4-9dcc-6b9527f749f4" ], "4704": [ "311b6ce2-7890-4383-a8c2-663a9f6b43cd" ], "4706": [ "0255a820-e564-4e40-af2b-6ac61160335c" ], "4719": [ "ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1", "69aeb277-f15f-4d2d-b32a-55e883609563" ], "4720": [ "7b449a5e-1db5-4dd0-a2dc-4e3a67282538", "1bbf25b9-8038-4154-a50b-118f2a32be27", "cfeed607-6aa4-4bbd-9627-b637deb723c8", "66b6be3d-55d0-4f47-9855-d69df21740ea" ], "4728": [ "c43c26be-2e87-46c7-8661-284588c5a53e" ], "4729": [ "02c39d30-02b5-45d2-b435-8aebfe5a8629" ], "4730": [ "b237c54b-0f15-4612-a819-44b735e0de27" ], "4732": [ "c265cf08-3f99-46c1-8d59-328247057d57" ], "4738": [ "300bac00-e041-4ee2-9c36-e262656a6ecc", "f6de9536-0441-4b3f-a646-f4e00f300ffd", "2632954e-db1c-49cb-9936-67d1ef1d17d2" ], "4741": [ "20d96d95-5a20-4cf1-a483-f3bda8a7c037" ], "4742": [ "32e19d25-4aed-4860-a55a-be99cb0bf7ed" ], "4743": [ "20d96d95-5a20-4cf1-a483-f3bda8a7c037" ], "4765": [ "2632954e-db1c-49cb-9936-67d1ef1d17d2" ], "4766": [ "2632954e-db1c-49cb-9936-67d1ef1d17d2" ], "4768": [ "f7644214-0eb0-4ace-9455-331ec4c09253", "6a53d871-682d-40b6-83e0-b7c1a6c4e3a5", "3e2f1b2c-4d5e-11ee-be56-0242ac120002" ], "4769": [ "f7644214-0eb0-4ace-9455-331ec4c09253", "d04ae2b8-ad54-4de0-bd87-4bc1da66aa59", "496a0e47-0a33-4dca-b009-9e6ca3591f39" ], "4771": [ "f7644214-0eb0-4ace-9455-331ec4c09253" ], "4776": [ "24549159-ac1b-479c-8175-d42aea947cae", "72124974-a68b-4366-b990-d30e0b2a190d", "9eb99343-d336-4020-a3cd-67f3819e68ee" ], "4781": [ "cfeed607-6aa4-4bbd-9627-b637deb723c8" ], "4794": [ "53ad8e36-f573-46bf-97e4-15ba5bf4bb51" ], "4800": [ "411742ad-89b0-49cb-a7b0-3971b5c1e0a4" ], "4825": [ "8e5c03fa-b7f0-11ea-b242-07e0576828d9" ], "4898": [ "bfbd3291-de87-4b7c-88a2-d6a5deb28668", "5ee3a654-372f-11ec-8d3d-0242ac130003" ], "4899": [ "bfbd3291-de87-4b7c-88a2-d6a5deb28668", "5ee3a654-372f-11ec-8d3d-0242ac130003" ], "4904": [ "e9faba72-4974-4ab2-a4c5-46e25ad59e9b" ], "4905": [ "e9faba72-4974-4ab2-a4c5-46e25ad59e9b" ], "4972": [ "123e4e6d-b123-48f8-b261-7214938acaf0" ], "5038": [ "470ec5fa-7b4e-4071-b200-4c753100f49b" ], "5136": [ "300bac00-e041-4ee2-9c36-e262656a6ecc", "a8f29a7b-b137-4446-80a0-b804272f3da2", "f598ea0c-c25a-4f72-a219-50c44411c791", "b07e58cf-cacc-4135-8473-ccb2eba63dd2", "2c99737c-585d-4431-b61a-c911d86ff32f" ], "5137": [ "b07e58cf-cacc-4135-8473-ccb2eba63dd2" ], "5140": [ "098d7118-55bc-4912-a836-dc6483a8d150" ], "5145": [ "c39f0c81-7348-4965-ab27-2fde35a1b641", "52d8b0c6-53d6-439a-9e41-52ad442ad9ad", "32d56ea1-417f-44ff-822b-882873f5f43b", "a8f29a7b-b137-4446-80a0-b804272f3da2", "252902e3-5830-4cf6-bf21-c22083dfd5cf" ], "5156": [ "5bed80b6-b3e8-428e-a3ae-d3c757589e41", "13acf386-b8c6-4fe0-9a6e-c4756b974698", "eca91c7c-9214-47b9-b4c5-cb1d7e4f2350" ], "5379": [ "571498c8-908e-40b4-910b-d2369159a3da", "54f0434b-726f-48a1-b2aa-067df14516e4", "00ba9da1-b510-4f6b-b258-8d338836180f" ], "5392": [ "12ba6a38-adb3-4d6b-91ba-a7fb248e3199" ], "5441": [ "98054878-5eab-434c-85d4-72d4e5a3361b" ], "5447": [ "98054878-5eab-434c-85d4-72d4e5a3361b", "7b14c76a-c602-4ae6-9717-eff868153fc0" ], "5449": [ "7b14c76a-c602-4ae6-9717-eff868153fc0" ] } }