Query: write Sigma for Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh
Matching passage: Sigma rule: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh. Logsource: windows / process_creation. Rule: title: Windows Shell/Scripting Processes Spawning Suspicious Programs id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde status: test description: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc. references: - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Florian Roth (Nextron Systems), Tim Shelton date: 2018-04-06 modified: 2023-05-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.001 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \mshta.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \cscript.exe - \wscript.exe - \wmiprvse.exe - \regsvr32.exe Image|endswith: - \schtasks.exe - \nslookup.exe - \certutil.exe - \bitsadmin.exe - \mshta.exe filter_ccmcache: CurrentDirectory|contains: \ccmcache\ filter_amazon: ParentCommandLine|contains: - \Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1 - \nessus_ filter_nessus: CommandLine|contains: \nessus_ filter_sccm_install: ParentImage|endswith: \mshta.exe Image|endswith: \mshta.exe ParentCommandLine|contains|all: - C:\MEM_Configmgr_ - \splash.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' CommandLine|contains|all: - C:\MEM_Configmgr_ - \SMSSETUP\BIN\ - \autorun.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' condition: selection and not 1 of filter_* falsepositives: - Administrative scripts - Microsoft SCCM level: high
Near-miss passage: Sigma rule: Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name locate. Logsource: windows / system. Rule: title: Critical Hive In Suspicious Location Access Bits Cleared id: 39f919f3-980b-4e6f-a975-8af7e507ef2b related: - id: 839dd1e8-eda8-4834-8145-01beeee33acd type: obsolete status: test description: 'Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset. This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default). Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior. ' references: - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md author: Florian Roth (Nextron Systems) date: 2017-05-15 modified: 2024-01-18 tags: - attack.credential-access - attack.t1003.002 logsource: product: windows service: system detection: selection: EventID: 16 Provider_Name: Microsoft-Windows-Kernel-General HiveName|contains: - \Temp\SAM - \Temp\SECURITY condition: selection falsepositives: - Unknown level: high