Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware. Logsource: windows / process_creation. Rule: title: Windows Backup Deleted Via Wbadmin.EXE id: 89f75308-5b1b-4390-b2d8-d6b2340efaf8 related: - id: 639c9081-f482-47d3-a0bd-ddee3d4ecd76 type: derived status: test description: 'Detects the deletion of backups or system state backups via "wbadmin.exe". This technique is used by numerous ransomware families and actors. This may only be successful on server platforms that have Windows Backup enabled. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/ - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - 'delete ' - backup filter_main_keep_versions: CommandLine|contains: keepVersions:0 condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate backup activity from administration scripts and software. level: medium
Near-miss passage: Sigma rule: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Event Viewer Child Process id: be344333-921d-4c4d-8bb8-e584cf584780 related: - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6 type: derived status: test description: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt references: - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/ - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100 author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2023-09-28 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \eventvwr.exe filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\System32\WerFault.exe - :\Windows\SysWOW64\WerFault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high