Query: rule covering Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the
Matching passage: Sigma rule: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Powershell Search Order Hijacking - Task id: b66474aa-bd92-4333-a16c-298155b120df related: - id: 6e8811ee-90ba-441e-8486-5653e68b2299 type: similar status: test description: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader references: - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-04-08 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage: C:\WINDOWS\System32\svchost.exe ParentCommandLine|contains|all: - -k netsvcs - -s Schedule CommandLine|endswith: - ' -windowstyle hidden' - ' -w hidden' - ' -ep bypass' - ' -noni' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter). Logsource: windows / process_creation. Rule: title: Suspicious SYSTEM User Process Creation id: 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 status: test description: Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter) references: - Internal Research - https://tools.thehacker.recipes/mimikatz/modules author: Florian Roth (Nextron Systems), David ANDRE (additional keywords) date: 2021-12-20 modified: 2025-10-19 tags: - attack.credential-access - attack.privilege-escalation - attack.stealth - attack.t1134 - attack.t1003 - attack.t1027 logsource: category: process_creation product: windows detection: selection: IntegrityLevel: - System - S-1-16-16384 User|contains: - AUTHORI - AUTORI selection_special: - Image|endswith: - \calc.exe - \cscript.exe - \forfiles.exe - \hh.exe - \mshta.exe - \ping.exe - \wscript.exe - CommandLine|re: net\s+user\s+ - CommandLine|contains: - ' -NoP ' - ' -W Hidden ' - ' -decode ' - ' /decode ' - ' /urlcache ' - ' -urlcache ' - ' -e* JAB' - ' -e* SUVYI' - ' -e* SQBFAFgA' - ' -e* aWV4I' - ' -e* IAB' - ' -e* PAA' - ' -e* aQBlAHgA' - vssadmin delete shadows - reg SAVE HKLM - ' -ma ' - Microsoft\Windows\CurrentVersion\Run - .downloadstring( - .downloadfile( - ' /ticket:' - 'dpapi::' - event::clear - event::drop - id::modify - 'kerberos::' - 'lsadump::' - 'misc::' - 'privilege::' - 'rpc::' - 'sekurlsa::' - 'sid::' - 'token::' - vault::cred - vault::list - ' p::d ' - ;iex( - MiniDump filter_main_ping: CommandLine|contains|all: - ping - 127.0.0.1 - ' -n ' filter_vs: Image|endswith: \PING.EXE ParentCommandLine|contains: \DismFoDInstall.cmd filter_config_mgr: ParentImage|contains: :\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ filter_java: ParentImage|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ ParentImage|endswith: \bin\javaws.exe Image|contains: - :\Program Files (x86)\Java\ - :\Program Files\Java\ Image|endswith: \bin\jp2launcher.exe CommandLine|contains: ' -ma ' condition: all of selection* and not 1 of filter_* falsepositives: - Administrative activity - Scripts and administrative tools used in the monitored environment - Monitoring activity level: high