Query: Sigma rule for Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse
Matching passage: Sigma rule: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Electron Application CommandLine id: 378a05d8-963c-46c9-bcce-13c7657eac99 related: - id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 type: similar status: test description: Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary. references: - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf - https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-09-05 modified: 2023-11-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \chrome.exe - \code.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge_proxy.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \Teams.exe - OriginalFileName: - chrome.exe - code.exe - discord.exe - GitHubDesktop.exe - keybase.exe - msedge_proxy.exe - msedge.exe - msedgewebview2.exe - msteams.exe - slack.exe - Teams.exe selection_cli: CommandLine|contains: - --browser-subprocess-path - --gpu-launcher - --renderer-cmd-prefix - --utility-cmd-prefix condition: all of selection_* falsepositives: - Legitimate usage for debugging purposes level: medium
Near-miss passage: Sigma rule: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy". Logsource: windows / ps_script. Rule: title: Change PowerShell Policies to an Insecure Level - PowerShell id: 61d0475c-173f-4844-86f7-f3eebae1c66b related: - id: cf2e938e-9a3e-4fe8-a347-411642b28a9f type: similar - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 type: similar - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: similar status: test description: Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet. references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4 - https://adsecurity.org/?p=2604 author: frack113 date: 2021-10-20 modified: 2023-12-14 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: Set-ExecutionPolicy selection_option: ScriptBlockText|contains: - Unrestricted - bypass filter_optional_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1') - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Administrator script level: medium