Query: write Sigma for Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Grou
Matching passage: Sigma rule: Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Grou. Logsource: windows / process_creation. Rule: title: Windows Default Domain GPO Modification via GPME id: dcff7e85-d01f-4eb5-badd-84e2e6be8294 related: - id: e5ac86dd-2da1-454b-be74-05d26c769d7d type: similar status: experimental description: 'Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion. ' references: - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html - https://adsecurity.org/?p=3377 - https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/ - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/ author: TropChaud date: 2025-11-22 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows category: process_creation detection: selection_mmc: - Image|endswith: \mmc.exe - OriginalFileName: MMC.exe selection_gpme: CommandLine|contains|all: - gpme.msc - 'gpobject:' selection_default_gpos: CommandLine|contains: - 31B2F340-016D-11D2-945F-00C04FB984F9 - 6AC1786C-016F-11D2-945F-00C04FB984F9 condition: all of selection_* falsepositives: - Legitimate use of GPME to modify GPOs level: medium
Near-miss passage: Sigma rule: Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze se. Logsource: windows / process_creation. Rule: title: PPL Tampering Via WerFaultSecure id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 related: - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c type: similar - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b type: similar status: experimental description: 'Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated. ' references: - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53 - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251 author: Jason (https://github.com/0xbcf) date: 2025-09-23 modified: 2025-11-23 tags: - attack.defense-impairment - attack.t1685 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \WerFaultSecure.exe - OriginalFileName: WerFaultSecure.exe selection_args: CommandLine|contains|all: - ' /h ' - ' /pid ' - ' /tid ' - ' /encfile ' - ' /cancel ' - ' /type ' - ' 268310' condition: all of selection_* falsepositives: - Legitimate usage of WerFaultSecure for debugging purposes level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml