Query: detection rule: Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr
Matching passage: Sigma rule: Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr. Logsource: windows / process_creation. Rule: title: HackTool - SharpMove Tool Execution id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d status: test description: 'Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options. ' references: - https://github.com/0xthirteen/SharpMove/ - https://pentestlab.blog/tag/sharpmove/ author: Luca Di Bartolomeo (CrimpSec) date: 2024-01-29 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SharpMove.exe - OriginalFileName: SharpMove.exe selection_cli_computer: CommandLine|contains: computername= selection_cli_actions: CommandLine|contains: - action=create - action=dcom - action=executevbs - action=hijackdcom - action=modschtask - action=modsvc - action=query - action=scm - action=startservice - action=taskscheduler condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Google API id: 7e9cf7b6-e827-11ed-a05b-0242ac120003 status: experimental description: 'Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet) ' references: - https://github.com/looCiprian/GC2-sheet - https://youtu.be/n2dFlSaBBKo - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/ - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/ author: Gavin Knapp date: 2023-05-01 modified: 2025-02-22 tags: - attack.command-and-control - attack.t1102 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: - drive.googleapis.com - oauth2.googleapis.com - sheets.googleapis.com - www.googleapis.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image|endswith: - :\Program Files\Google\Chrome\Application\chrome.exe - :\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_google_drive: Image|contains: :\Program Files\Google\Drive File Stream\ Image|endswith: \GoogleDriveFS.exe filter_optional_firefox: Image|endswith: - :\Program Files\Mozilla Firefox\firefox.exe - :\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image|endswith: - :\Program Files (x86)\Internet Explorer\iexplore.exe - :\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|contains: :\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: - :\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - :\Program Files\Microsoft\Edge\Application\msedge.exe - \WindowsApps\MicrosoftEdge.exe filter_optional_edge_2: Image|contains: - :\Program Files (x86)\Microsoft\EdgeCore\ - :\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_opera: Image|endswith: \opera.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_seamonkey: Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|endswith: \vivaldi.exe filter_optional_whale: Image|endswith: \whale.exe filter_optional_googleupdate: Image|endswith: \GoogleUpdate.exe filter_optional_outlook_exe: Image|endswith: \outlook.exe filter_main_null: Image: nul