Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation STDIN+ Launcher - PowerShell Module id: 9ac8b09b-45de-4a07-9da1-0de8c09304a3 related: - id: 779c8c12-0eb1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+" condition: selection_4103 falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Google API id: 7e9cf7b6-e827-11ed-a05b-0242ac120003 status: experimental description: 'Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet) ' references: - https://github.com/looCiprian/GC2-sheet - https://youtu.be/n2dFlSaBBKo - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/ - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/ author: Gavin Knapp date: 2023-05-01 modified: 2025-02-22 tags: - attack.command-and-control - attack.t1102 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: - drive.googleapis.com - oauth2.googleapis.com - sheets.googleapis.com - www.googleapis.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image|endswith: - :\Program Files\Google\Chrome\Application\chrome.exe - :\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_google_drive: Image|contains: :\Program Files\Google\Drive File Stream\ Image|endswith: \GoogleDriveFS.exe filter_optional_firefox: Image|endswith: - :\Program Files\Mozilla Firefox\firefox.exe - :\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image|endswith: - :\Program Files (x86)\Internet Explorer\iexplore.exe - :\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|contains: :\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: - :\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - :\Program Files\Microsoft\Edge\Application\msedge.exe - \WindowsApps\MicrosoftEdge.exe filter_optional_edge_2: Image|contains: - :\Program Files (x86)\Microsoft\EdgeCore\ - :\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_opera: Image|endswith: \opera.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_seamonkey: Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|endswith: \vivaldi.exe filter_optional_whale: Image|endswith: \whale.exe filter_optional_googleupdate: Image|endswith: \GoogleUpdate.exe filter_optional_outlook_exe: Image|endswith: \outlook.exe filter_main_null: Image: nul