alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded WMI Classes id: 1816994b-42e1-4fb1-afd2-134d88184f71 related: - id: 47688f1b-9f51-4656-b013-3cc49a166a36 type: obsolete status: test description: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc. references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_shadowcopy: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ - cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA - XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A - V2luMzJfU2hhZG93Y29we - dpbjMyX1NoYWRvd2NvcH - XaW4zMl9TaGFkb3djb3B5 selection_cli_scheduledJob: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA - cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA - XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg - V2luMzJfU2NoZWR1bGVkSm9i - dpbjMyX1NjaGVkdWxlZEpvY - XaW4zMl9TY2hlZHVsZWRKb2 selection_cli_process: CommandLine|contains: - VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw - cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA - XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA - V2luMzJfUHJvY2Vzc - dpbjMyX1Byb2Nlc3 - XaW4zMl9Qcm9jZXNz selection_cli_useraccount: CommandLine|contains: - VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A - cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA - XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA - V2luMzJfVXNlckFjY291bn - dpbjMyX1VzZXJBY2NvdW50 - XaW4zMl9Vc2VyQWNjb3Vud selection_cli_loggedonuser: CommandLine|contains: - VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA - cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA - XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg - V2luMzJfTG9nZ2VkT25Vc2Vy - dpbjMyX0xvZ2dlZE9uVXNlc - XaW4zMl9Mb2dnZWRPblVzZX condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Sigma rule: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contai. Logsource: windows / file_event. Rule: title: Suspicious File Created In PerfLogs id: bbb7e38c-0b41-4a11-b306-d2a457b7ac2b status: test description: Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files references: - Internal Research - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.execution - attack.t1059 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\PerfLogs\ TargetFilename|endswith: - .7z - .bat - .bin - .chm - .dll - .exe - .hta - .lnk - .ps1 - .psm1 - .py - .scr - .sys - .vbe - .vbs - .zip condition: selection falsepositives: - Unlikely level: medium
Sigma rule: Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM). Logsource: windows / registry_set. Rule: title: ETW Logging Disabled For SCM id: 4f281b83-0200-4b34-bf35-d24687ea57c2 status: test description: Detects changes to the "TracingDisabled" key in order to disable ETW logging for services.exe (SCM) references: - http://redplait.blogspot.com/2020/07/whats-wrong-with-etw.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-09 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|endswith: Software\Microsoft\Windows NT\CurrentVersion\Tracing\SCM\Regular\TracingDisabled Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting. Logsource: windows / process_creation. Rule: title: Use of OpenConsole id: 814c95cc-8192-4378-a70a-f1aafd877af1 status: test description: Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting references: - https://twitter.com/nas_bench/status/1537563834478645252 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-16 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: OpenConsole.exe - Image|endswith: \OpenConsole.exe filter: Image|startswith: C:\Program Files\WindowsApps\Microsoft.WindowsTerminal condition: selection and not filter falsepositives: - Legitimate use by an administrator level: medium
Sigma rule: Detects audio capture via PowerShell Cmdlet.. Logsource: windows / process_creation. Rule: title: Audio Capture via PowerShell id: 932fb0d8-692b-4b0f-a26e-5643a50fe7d6 status: test description: Detects audio capture via PowerShell Cmdlet. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md - https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html - https://github.com/frgnca/AudioDeviceCmdlets author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-04-06 tags: - attack.collection - attack.t1123 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - WindowsAudioDevice-Powershell-Cmdlet - Toggle-AudioDevice - 'Get-AudioDevice ' - 'Set-AudioDevice ' - 'Write-AudioDevice ' condition: selection falsepositives: - Legitimate audio capture by legitimate user. level: medium
Sigma rule: Detects use of Cobalt Strike commands accidentally entered in the CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Commands id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 related: - id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 type: similar status: test description: Detects use of Cobalt Strike commands accidentally entered in the CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 - stp.1u logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|startswith: - 'cmd ' - cmd.exe - c:\windows\system32\cmd.exe CommandLine|contains: - psinject - spawnas - make_token - remote-exec - rev2self - dcsync - logonpasswords - execute-assembly - getsystem condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSPUB.EXE id: 3b3c7f55-f771-4dd6-8a6e-08d057a17caf status: test description: Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-02-08 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSPUB.exe - OriginalFileName: MSPUB.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects programs that connect to known malware callback ports based on threat intelligence reports.. Logsource: linux / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication - Linux id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376 related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: derived status: test description: 'Detects programs that connect to known malware callback ports based on threat intelligence reports. ' references: - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors author: hasselj date: 2024-05-10 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: linux detection: selection: Initiated: 'true' DestinationPort: - 888 - 999 - 2200 - 2222 - 4000 - 4444 - 6789 - 8531 - 50501 - 51820 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microso. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Appvlp.EXE id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43 status: test description: 'Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ author: Sreeman date: 2020-03-13 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \appvlp.exe filter_main_generic: Image|endswith: - :\Windows\SysWOW64\rundll32.exe - :\Windows\System32\rundll32.exe filter_optional_office_msoasb: Image|contains: :\Program Files\Microsoft Office Image|endswith: \msoasb.exe filter_optional_office_skype: Image|contains|all: - :\Program Files\Microsoft Office - \SkypeSrv\ Image|endswith: \SKYPESERVER.EXE filter_optional_office_msouc: Image|contains: :\Program Files\Microsoft Office Image|endswith: \MSOUC.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon. Logsource: windows / process_access. Rule: title: HackTool - SysmonEnte Execution id: d29ada0f-af45-4f27-8f32-f7b77c3dbc4e status: test description: Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon references: - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html - https://github.com/codewhitesec/SysmonEnte/ - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2026-06-29 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_access product: windows detection: selection_sysmon: TargetImage|contains: - :\Windows\Sysmon.exe - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe GrantedAccess: '0x1400' selection_calltrace: CallTrace: Ente filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ filter_main_msdefender: SourceImage|contains: :\ProgramData\Microsoft\Windows Defender\Platform\ SourceImage|endswith: \MsMpEng.exe condition: ( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace falsepositives: - Unknown level: high
Sigma rule: Detects PowerShell creating a binary executable or a script file.. Logsource: windows / file_event. Rule: title: Potential Binary Or Script Dropper Via PowerShell id: 7047d730-036f-4f40-b9d8-1c63e36d5e62 status: test description: Detects PowerShell creating a binary executable or a script file. references: - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-03-17 modified: 2025-07-04 tags: - attack.persistence logsource: product: windows category: file_event detection: selection: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe TargetFilename|endswith: - .bat - .chm - .cmd - .com - .dll - .exe - .hta - .jar - .js - .ocx - .scr - .sys - .vbe - .vbs - .wsf filter_main_user_temp: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\Local\Temp\ TargetFilename|endswith: - .dll - .exe filter_main_other_temp: TargetFilename|startswith: - C:\Windows\Temp\ - C:\Windows\SystemTemp\ TargetFilename|endswith: - .dll - .exe filter_main_powershell_module: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \WindowsPowerShell\Modules\ TargetFilename|endswith: .dll filter_main_nuget: TargetFilename|startswith: C:\Program Files\PackageManagement\ProviderAssemblies\nuget\ TargetFilename|endswith: \Microsoft.PackageManagement.NuGetProvider.dll condition: selection and not 1 of filter_main_* falsepositives: - False positives will differ depending on the environment and scripts used. Apply additional filters accordingly. level: medium
Sigma rule: Detects a set of suspicious network related commands often used in recon stages. Logsource: windows / process_creation. Rule: title: Network Reconnaissance Activity id: e6313acd-208c-44fc-a0ff-db85d572e90e status: test description: Detects a set of suspicious network related commands often used in recon stages references: - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ author: Florian Roth (Nextron Systems) date: 2022-02-07 tags: - attack.discovery - attack.t1087 - attack.t1082 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - nslookup - _ldap._tcp.dc._msdcs. condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Sigma rule: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.. Logsource: windows / file_event. Rule: title: Process Monitor Driver Creation By Non-Sysinternals Binary id: a05baa88-e922-4001-bc4d-8738135f27de status: test description: Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-06-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1068 logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \procmon TargetFilename|endswith: .sys filter_main_process_explorer: Image|endswith: - \procmon.exe - \procmon64.exe - \procmon64a.exe condition: selection and not 1 of filter_main_* falsepositives: - Some false positives may occur with legitimate renamed process monitor binaries level: medium
Sigma rule: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar. Logsource: windows / ps_script. Rule: title: Enable Windows Remote Management id: 991a9744-f2f0-44f2-bd33-9092eba17dc3 status: test description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2 author: frack113 date: 2022-01-07 tags: - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Enable-PSRemoting ' condition: selection_cmdlet falsepositives: - Legitimate script level: medium
Sigma rule: Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by ad. Logsource: windows / file_event. Rule: title: WinRAR Creating Files in Startup Locations id: 74a2b37d-fea4-41e0-9ac7-c9fbcf1f60cc status: experimental description: 'Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088. ' references: - https://github.com/mulwareX/CVE-2025-6218-POC - https://x.com/0x534c/status/1944694507787710685 - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-16 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: file_event product: windows detection: selection: Image|endswith: - \WinRAR.exe - \Rar.exe TargetFilename|contains: \Start Menu\Programs\Startup\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist. Logsource: windows / process_creation. Rule: title: Hiding User Account Via SpecialAccounts Registry Key - CommandLine id: 9ec9fb1b-e059-4489-9642-f270c207923d related: - id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd type: similar status: test description: 'Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen. ' references: - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: '@Kostastsale, TheDFIRReport' date: 2022-05-14 modified: 2024-08-23 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList - add - /v - /d 0 condition: selection falsepositives: - System administrator activities level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/info.yml
Sigma rule: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential. Logsource: windows / process_creation. Rule: title: Remote XSL Execution Via Msxsl.EXE id: 75d0a94e-6252-448d-a7be-d953dff527bb status: test description: Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.stealth - attack.t1220 logsource: category: process_creation product: windows detection: selection: Image|endswith: \msxsl.exe CommandLine|contains: http condition: selection falsepositives: - Msxsl is not installed by default and is deprecated, so unlikely on most systems. level: high
Sigma rule: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell". Logsource: windows / process_creation. Rule: title: Always Install Elevated MSI Spawned Cmd And Powershell id: 1e53dd56-8d83-4eb4-a43e-b790a05510aa status: test description: Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell" references: - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal-181117201458/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community date: 2020-10-13 modified: 2022-10-20 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - Cmd.Exe - PowerShell.EXE - pwsh.dll selection_parent: ParentImage|contains|all: - \Windows\Installer\ - msi ParentImage|endswith: tmp condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicio. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft OneNote Child Process id: c27515df-97a9-4162-8a60-dc0eeb51b775 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived status: test description: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18 - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0 author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) date: 2022-10-21 modified: 2023-02-10 tags: - attack.t1566 - attack.t1566.001 - attack.initial-access logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \onenote.exe selection_opt_img: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe - MSHTA.EXE - msiexec.exe - Msxsl.exe - odbcconf.exe - pcalua.exe - PowerShell.EXE - RegAsm.exe - RegSvcs.exe - REGSVR32.exe - RUNDLL32.exe - schtasks.exe - ScriptRunner.exe - wmic.exe - WorkFolders.exe - wscript.exe - Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \certoc.exe - \certutil.exe - \cmd.exe - \cmstp.exe - \control.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \ieexec.exe - \installutil.exe - \javaw.exe - \mftrace.exe - \Microsoft.Workflow.Compiler.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msidb.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \pcalua.exe - \powershell.exe - \pwsh.exe - \regasm.exe - \regsvcs.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \verclsid.exe - \wmic.exe - \workfolders.exe - \wscript.exe selection_opt_explorer: Image|endswith: \explorer.exe CommandLine|contains: - .hta - .vb - .wsh - .js - .ps - .scr - .pif - .bat - .cmd selection_opt_paths: Image|contains: - \AppData\ - \Users\Public\ - \ProgramData\ - \Windows\Tasks\ - \Windows\Temp\ - \Windows\System32\Tasks\ filter_teams: Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe CommandLine|endswith: -Embedding filter_onedrive: Image|contains: \AppData\Local\Microsoft\OneDrive\ Image|endswith: \FileCoAuth.exe CommandLine|endswith