Query: detection rule: Detects potentially suspicious child processes of KeyScrambler.exe
Matching passage: Sigma rule: Detects potentially suspicious child processes of KeyScrambler.exe. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process of KeyScrambler.exe id: ca5583e9-8f80-46ac-ab91-7f314d13b984 related: - id: d2451be2-b582-4e15-8701-4196ac180260 type: similar status: test description: Detects potentially suspicious child processes of KeyScrambler.exe references: - https://twitter.com/DTCERT/status/1712785421845790799 author: Swachchhanda Shrawan Poudel date: 2024-05-13 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.stealth - attack.t1203 - attack.t1574.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \KeyScrambler.exe selection_binaries: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - mshta.exe - PowerShell.EXE - pwsh.dll - regsvr32.exe - RUNDLL32.EXE - wscript.exe condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes,. Logsource: windows / process_creation. Rule: title: Service Reconnaissance Via Wmic.EXE id: 76f55eaa-d27f-4213-9d45-7b0e4b60bbae related: - id: 68bcd73b-37ef-49cb-95fc-edc809730be6 type: similar status: test description: 'An adversary might use WMI to check if a certain remote service is running on a remote device. When the test completes, a service information will be displayed on the screen if it exists. A common feedback message is that "No instance(s) Available" if the service queried is not running. A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 modified: 2026-01-07 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \WMIC.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: service filter_main_manipulation: CommandLine|contains: - stopservice - startservice filter_main_win32_methods: CommandLine|contains: - Change - Create - Delete - PauseService - ResumeService - SetSecurityDescriptor - StartService - StopService - UserControlService condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium simulation: - type: atomic-red-team name: WMI Reconnaissance List Remote Services technique: T1047 atomic_guid: 0fd48ef7-d890-4e93-a533-f7dedd5191d3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_service/info.yml