Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the exe. Logsource: windows / process_creation. Rule: title: Potential Binary Impersonating Sysinternals Tools id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9 status: test description: 'Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2025-04-12 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_exe: Image|endswith: - \accesschk.exe - \accesschk64.exe - \AccessEnum.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADInsight.exe - \ADInsight64.exe - \adrestore.exe - \adrestore64.exe - \Autologon.exe - \Autologon64.exe - \Autoruns.exe - \Autoruns64.exe - \autorunsc.exe - \autorunsc64.exe - \Bginfo.exe - \Bginfo64.exe - \Cacheset.exe - \Cacheset64.exe - \Clockres.exe - \Clockres64.exe - \Contig.exe - \Contig64.exe - \Coreinfo.exe - \Coreinfo64.exe - \CPUSTRES.EXE - \CPUSTRES64.EXE - \ctrl2cap.exe - \Dbgview.exe - \dbgview64.exe - \Desktops.exe - \Desktops64.exe - \disk2vhd.exe - \disk2vhd64.exe - \diskext.exe - \diskext64.exe - \Diskmon.exe - \Diskmon64.exe - \DiskView.exe - \DiskView64.exe - \du.exe - \du64.exe - \efsdump.exe - \FindLinks.exe - \FindLinks64.exe - \handle.exe - \handle64.exe - \hex2dec.exe - \hex2dec64.exe - \junction.exe - \junction64.exe - \ldmdump.exe - \listdlls.exe - \listdlls64.exe - \livekd.exe - \livekd64.exe - \loadOrd.exe - \loadOrd64.exe - \loadOrdC.exe - \loadOrdC64.exe - \logonsessions.exe - \logonsessions64.exe - \movefile.exe - \movefile64.exe - \notmyfault.exe - \notmyfault64.exe - \notmyfaultc.exe - \notmyfaultc64.exe - \ntfsinfo.exe - \ntfsinfo64.exe - \pendmoves.exe - \pendmoves64.exe - \pipelist.exe - \pipelist64.exe - \portmon.exe - \procdump.exe - \procdump64.exe - \procexp.exe - \procexp64.exe - \Procmon.exe - \Procmon64.exe - \psExec.exe - \psExec64.exe - \psfile.exe - \psfile64.exe - \psGetsid.exe - \psGetsid64.exe - \psInfo.exe - \psInfo64.exe - \pskill.exe - \pskill64.exe - \pslist.exe - \pslist64.exe - \psLoggedon.exe - \psLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \pspasswd.exe - \pspasswd64.exe - \psping.exe - \psping64.exe - \psService.exe - \p
Near-miss passage: Sigma rule: Detects a copy command or a copy utility execution to or from an Admin share or remote. Logsource: windows / process_creation. Rule: title: Copy From Or To Admin Share Or Sysvol Folder id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 status: test description: Detects a copy command or a copy utility execution to or from an Admin share or remote references: - https://twitter.com/SBousseaden/status/1211636381086339073 - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali date: 2019-12-30 modified: 2025-10-22 tags: - attack.lateral-movement - attack.collection - attack.exfiltration - attack.t1039 - attack.t1048 - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_target: CommandLine|contains: - \\\\*\\*$ - \Sysvol\ selection_other_tools: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: copy selection_pwsh_img: - Image|contains: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell_ise.exe - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: - copy-item - 'copy ' - 'cpi ' - ' cp ' - 'move ' - ' move-item' - ' mi ' - ' mv ' condition: selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*) falsepositives: - Administrative scripts level: medium