Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS,. Logsource: windows / process_creation. Rule: title: Uncommon System Information Discovery Via Wmic.EXE id: 9d5a1274-922a-49d0-87f3-8c653483b909 related: - id: d85ecdd7-b855-4e6e-af59-d9c78b5b861e type: derived status: test description: 'Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/ - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/ - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/ - https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior author: TropChaud date: 2023-01-26 modified: 2023-12-19 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection_wmic: - Description: WMI Commandline Utility - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_commands: CommandLine|contains: - LOGICALDISK get Name,Size,FreeSpace - os get Caption,OSArchitecture,Version condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: System Information Discovery with WMIC technique: T1082 atomic_guid: 8851b73a-3624-4bf7-8704-aa312411565c regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_uncommon/info.yml
Near-miss passage: Sigma rule: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this. Logsource: windows / registry_set. Rule: title: Registry Explorer Policy Modification id: 1c3121ed-041b-4d97-a075-07f54f20fb4a status: test description: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu Details: DWORD (0x00000001) condition: selection_set_1 falsepositives: - Legitimate admin script level: medium