Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects process access requests from hacktool processes based on their default image name. Logsource: windows / process_access. Rule: title: HackTool - Generic Process Access id: d0d2f720-d14f-448d-8242-51ff396a334e status: test description: Detects process access requests from hacktool processes based on their default image name references: - https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158 - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-11-27 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: - SourceImage|endswith: - \Akagi.exe - \Akagi64.exe - \atexec_windows.exe - \Certify.exe - \Certipy.exe - \CoercedPotato.exe - \crackmapexec.exe - \CreateMiniDump.exe - \dcomexec_windows.exe - \dpapi_windows.exe - \findDelegation_windows.exe - \GetADUsers_windows.exe - \GetNPUsers_windows.exe - \getPac_windows.exe - \getST_windows.exe - \getTGT_windows.exe - \GetUserSPNs_windows.exe - \gmer.exe - \hashcat.exe - \htran.exe - \ifmap_windows.exe - \impersonate.exe - \Inveigh.exe - \LocalPotato.exe - \mimikatz_windows.exe - \mimikatz.exe - \netview_windows.exe - \nmapAnswerMachine_windows.exe - \opdump_windows.exe - \PasswordDump.exe - \Potato.exe - \PowerTool.exe - \PowerTool64.exe - \psexec_windows.exe - \PurpleSharp.exe - \pypykatz.exe - \QuarksPwDump.exe - \rdp_check_windows.exe - \Rubeus.exe - \SafetyKatz.exe - \sambaPipe_windows.exe - \SelectMyParent.exe - \SharpChisel.exe - \SharPersist.exe - \SharpEvtMute.exe - \SharpImpersonation.exe - \SharpLDAPmonitor.exe - \SharpLdapWhoami.exe - \SharpUp.exe - \SharpView.exe - \smbclient_windows.exe - \smbserver_windows.exe - \sniff_windows.exe - \sniffer_windows.exe - \split_windows.exe - \SpoolSample.exe - \Stracciatella.exe - \SysmonEOP.exe - \temp\rot.exe - \ticketer_windows.exe - \TruffleSnout.exe - \winPEASany_ofs.exe - \winPEASany.exe - \winPEASx64_ofs.exe - \winPEASx64.exe - \winPEASx86_ofs.exe - \winPEASx86.exe - \xordump.exe - SourceImage|contains: - \goldenPac - \just_dce_ - \karmaSMB - \kintercept - \LocalPotato - \ntlmrelayx - \rpcdump - \samrdump - \secretsdump - \smbexec - \smbrelayx - \wmiexec - \wmipersist - HotPotato - Juicy Potato - JuicyPotato - PetitPotam - RottenPotato condition: selection falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operati. Logsource: windows / file_delete. Rule: title: Backup Files Deleted id: 06125661-3814-4e03-bfa2-1e4411c60ac3 status: test description: Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files author: frack113 date: 2022-01-02 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: product: windows category: file_delete detection: selection: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe - \wt.exe - \rundll32.exe - \regsvr32.exe TargetFilename|endswith: - .VHD - .bac - .bak - .wbcat - .bkf - .set - .win - .dsk condition: selection falsepositives: - Legitimate usage level: medium