Query: rule covering Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Matching passage: Sigma rule: Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.. Logsource: windows / security. Rule: title: External Remote SMB Logon from Public IP id: 78d5cab4-557e-454f-9fb9-a222bd0d5edc related: - id: 259a9cdf-c4dd-4fa2-b243-2269e5ab18a2 type: derived status: test description: Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port. references: - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html - https://twitter.com/Purp1eW0lf/status/1616144561965002752 author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity) date: 2023-01-19 modified: 2024-03-11 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.credential-access - attack.stealth - attack.t1133 - attack.t1078 - attack.t1110 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 3 filter_main_local_ranges: IpAddress|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - fc00::/7 - fe80::/10 filter_main_empty: IpAddress: '-' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate or intentional inbound connections from public IP addresses on the SMB port. level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicio. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft OneNote Child Process id: c27515df-97a9-4162-8a60-dc0eeb51b775 related: - id: 438025f9-5856-4663-83f7-52f878a70a50 type: derived status: test description: Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb5666427602ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18 - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0 author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea) date: 2022-10-21 modified: 2023-02-10 tags: - attack.t1566 - attack.t1566.001 - attack.initial-access logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \onenote.exe selection_opt_img: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe - MSHTA.EXE - msiexec.exe - Msxsl.exe - odbcconf.exe - pcalua.exe - PowerShell.EXE - RegAsm.exe - RegSvcs.exe - REGSVR32.exe - RUNDLL32.exe - schtasks.exe - ScriptRunner.exe - wmic.exe - WorkFolders.exe - wscript.exe - Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \certoc.exe - \certutil.exe - \cmd.exe - \cmstp.exe - \control.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \ieexec.exe - \installutil.exe - \javaw.exe - \mftrace.exe - \Microsoft.Workflow.Compiler.exe - \msbuild.exe - \msdt.exe - \mshta.exe - \msidb.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \pcalua.exe - \powershell.exe - \pwsh.exe - \regasm.exe - \regsvcs.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \svchost.exe - \verclsid.exe - \wmic.exe - \workfolders.exe - \wscript.exe selection_opt_explorer: Image|endswith: \explorer.exe CommandLine|contains: - .hta - .vb - .wsh - .js - .ps - .scr - .pif - .bat - .cmd selection_opt_paths: Image|contains: - \AppData\ - \Users\Public\ - \ProgramData\ - \Windows\Tasks\ - \Windows\Temp\ - \Windows\System32\Tasks\ filter_teams: Image|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe CommandLine|endswith: -Embedding filter_onedrive: Image|contains: \AppData\Local\Microsoft\OneDrive\ Image|endswith: \FileCoAuth.exe CommandLine|endswith