Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. Logsource: windows / security. Rule: title: Active Directory Replication from Non Machine Account - DcSync Indicator id: 17d619c1-e020-4347-957e-1d1207455c93 related: - id: 611eab06-a145-4dfa-a295-3ccc5c20f59a type: similar status: test description: Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials. references: - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html - https://threathunterplaybook.com/library/windows/active_directory_replication.html - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-07-26 modified: 2026-07-30 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows service: security definition: 'Requirements: A SACL must be configured on the domain NC root object (e.g. DC=domain,DC=com) to generate Event 4662. Add via ADSI Edit: navigate to the domain NC root → Properties → Security → Advanced → Auditing → add an ACE for Everyone, Type: Success, Applies to: This object only, rights: DS-Replication-Get-Changes and DS-Replication-Get-Changes-All. The OS audit subcategory must also be enabled: auditpol /set /subcategory:"Directory Service Access" /success:enable ' detection: selection: EventID: 4662 Properties|contains: - 1131f6ad-9c07-11d1-f79f-00c04fc2dcd2 - 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2 - 9923a32a-3607-11d2-b9be-0000f87a36b2 - 89e95b76-444d-4c62-991a-0facbeda640c filter_main_machine_accounts: SubjectUserName|endswith: $ filter_optional_subject_domain: SubjectDomainName: Window Manager filter_optional_subject_usersid: SubjectUserName|startswith: - NT AUT - MSOL_ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidum. Logsource: windows / process_creation. Rule: title: Process Memory Dump Via Comsvcs.DLL id: 646ea171-dded-4578-8a4d-65e9822892e3 related: - id: 09e6d5c0-05b8-4ff8-9eeb-043046ec774c type: obsolete status: test description: Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.) references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://twitter.com/pythonresponder/status/1385064506049630211?s=21 - https://twitter.com/Hexacorn/status/1224848930795552769 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ - https://twitter.com/SBousseaden/status/1167417096374050817 - https://twitter.com/Wietze/status/1542107456507203586 - https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2020-02-18 modified: 2025-02-23 tags: - attack.credential-access - attack.stealth - attack.t1036 - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: rundll32 selection_cli_1: CommandLine|contains|all: - comsvcs - full CommandLine|contains: - '#-' - '#+' - '#24' - '24 ' - MiniDump - '#65560' selection_generic: CommandLine|contains|all: - '24' - comsvcs - full CommandLine|contains: - ' #' - ',#' - ', #' - '"#' condition: (selection_img and 1 of selection_cli_*) or selection_generic falsepositives: - Unlikely level: high