Query: write Sigma for Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili
Matching passage: Sigma rule: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili. Logsource: windows / process_creation. Rule: title: Potential Register_App.Vbs LOLScript Abuse id: 28c8f68b-098d-45af-8d43-8089f3e35403 status: test description: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs author: Austin Songer @austinsonger date: 2021-11-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: '.vbs -register ' condition: all of selection* falsepositives: - Other VB scripts that leverage the same starting command line flags level: medium
Near-miss passage: Sigma rule: Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'. This includes the. Logsource: linux / auditd. Rule: title: Suspicious C2 Activities id: f7158a64-6204-4d6d-868a-6e6378b467e0 status: test description: 'Detects suspicious activities as declared by Florian Roth in its ''Best Practice Auditd Configuration''. This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap. These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132) ' references: - https://github.com/Neo23x0/auditd author: Marie Euler date: 2020-05-18 modified: 2021-11-27 tags: - attack.command-and-control logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /usr/bin/wget -p x -k susp_activity -w /usr/bin/curl -p x -k susp_activity -w /usr/bin/base64 -p x -k susp_activity -w /bin/nc -p x -k susp_activity -w /bin/netcat -p x -k susp_activity -w /usr/bin/ncat -p x -k susp_activity -w /usr/bin/ss -p x -k susp_activity -w /usr/bin/netstat -p x -k susp_activity -w /usr/bin/ssh -p x -k susp_activity -w /usr/bin/scp -p x -k susp_activity -w /usr/bin/sftp -p x -k susp_activity -w /usr/bin/ftp -p x -k susp_activity -w /usr/bin/socat -p x -k susp_activity -w /usr/bin/wireshark -p x -k susp_activity -w /usr/bin/tshark -p x -k susp_activity -w /usr/bin/rawshark -p x -k susp_activity -w /usr/bin/rdesktop -p x -k susp_activity -w /usr/local/bin/rdesktop -p x -k susp_activity -w /usr/bin/wlfreerdp -p x -k susp_activity -w /usr/bin/xfreerdp -p x -k susp_activity -w /usr/local/bin/xfreerdp -p x -k susp_activity -w /usr/bin/nmap -p x -k susp_activity (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336) ' detection: selection: key: susp_activity condition: selection falsepositives: - Admin or User activity level: medium