Query: detect Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature in logs
Matching passage: Sigma rule: Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation id: f8931561-97f5-4c46-907f-0a4a592e47a7 status: experimental description: 'Detects attempted file load events that did not meet the signing level requirements. It often means the file''s signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation. ' references: - https://twitter.com/SBousseaden/status/1483810148602814466 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-20 modified: 2025-02-28 tags: - attack.execution logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3033 - 3034 filter_optional_dtrace: FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll ProcessNameBuffer|endswith: \Windows\System32\svchost.exe RequestedPolicy: 12 filter_optional_av_generic: FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\ FileNameBuffer|endswith: \igd10iumd64.dll RequestedPolicy: 7 filter_optional_electron_based_app: FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll ProcessNameBuffer|endswith: - \AppData\Local\Keybase\Gui\Keybase.exe - \Microsoft\Teams\stage\Teams.exe RequestedPolicy: 8 filter_optional_bonjour: FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll ProcessNameBuffer|endswith: - \Windows\System32\svchost.exe - \Windows\System32\SIHClient.exe RequestedPolicy: - 8 - 12 filter_optional_msoffice_1: FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE FileNameBuffer|endswith: \MSOXMLMF.DLL RequestedPolicy: 7 filter_optional_msoffice_2: ProcessNameBuffer|contains: \Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office FileNameBuffer|contains: \Windows\System32\ RequestedPolicy: 8 filter_optional_slack: FileNameBuffer|endsw
Near-miss passage: Sigma rule: Detects common NTLM brute force device names. Logsource: windows / ntlm. Rule: title: NTLM Brute Force id: 9c8acf1a-cbf9-4db6-b63c-74baabe03e59 status: test description: Detects common NTLM brute force device names references: - https://www.varonis.com/blog/investigate-ntlm-brute-force author: Jerry Shockley '@jsh0x' date: 2022-02-02 tags: - attack.credential-access - attack.t1110 logsource: product: windows service: ntlm definition: Requires events from Microsoft-Windows-NTLM/Operational detection: selection: EventID: 8004 devicename: WorkstationName: - Rdesktop - Remmina - Freerdp - Windows7 - Windows8 - Windows2012 - Windows2016 - Windows2019 condition: selection and devicename falsepositives: - Systems with names equal to the spoofed ones used by the brute force tools level: medium