Query: Sigma rule for Detect suspicious parent processes of well-known Windows processes
Matching passage: Sigma rule: Detect suspicious parent processes of well-known Windows processes. Logsource: windows / process_creation. Rule: title: Windows Processes Suspicious Parent Directory id: 96036718-71cc-4027-a538-d1587e0006a7 status: test description: Detect suspicious parent processes of well-known Windows processes references: - https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2 - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/ - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf author: vburov date: 2019-02-23 modified: 2025-03-06 tags: - attack.stealth - attack.t1036.003 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \svchost.exe - \taskhost.exe - \lsm.exe - \lsass.exe - \services.exe - \lsaiso.exe - \csrss.exe - \wininit.exe - \winlogon.exe filter_sys: - ParentImage|endswith: - \SavService.exe - \ngen.exe - ParentImage|contains: - \System32\ - \SysWOW64\ filter_msmpeng: ParentImage|contains: - \Windows Defender\ - \Microsoft Security Client\ ParentImage|endswith: \MsMpEng.exe filter_null: - ParentImage: null - ParentImage: - '' - '-' condition: selection and not 1 of filter_* falsepositives: - Some security products seem to spawn these level: low
Near-miss passage: Sigma rule: Identifies clients that may be performing DNS lookups associated with common currency mining pools.. Logsource: zeek / dns. Rule: title: DNS Events Related To Mining Pools id: bf74135c-18e8-4a72-a926-0e4f47888c19 status: test description: Identifies clients that may be performing DNS lookups associated with common currency mining pools. references: - https://github.com/Azure/Azure-Sentinel/blob/fa0411f9424b6c47b4d5a20165e4f1b168c1f103/Detections/ASimDNS/imDNS_Miners.yaml author: Saw Winn Naung, Azure-Sentinel, @neu5ron date: 2021-08-19 modified: 2022-07-07 tags: - attack.execution - attack.t1569.002 - attack.impact - attack.t1496 logsource: service: dns product: zeek detection: selection: query|endswith: - monerohash.com - do-dear.com - xmrminerpro.com - secumine.net - xmrpool.com - minexmr.org - hashanywhere.com - xmrget.com - mininglottery.eu - minergate.com - moriaxmr.com - multipooler.com - moneropools.com - xmrpool.eu - coolmining.club - supportxmr.com - minexmr.com - hashvault.pro - xmrpool.net - crypto-pool.fr - xmr.pt - miner.rocks - walpool.com - herominers.com - gntl.co.uk - semipool.com - coinfoundry.org - cryptoknight.cc - fairhash.org - baikalmine.com - tubepool.xyz - fairpool.xyz - asiapool.io - coinpoolit.webhop.me - nanopool.org - moneropool.com - miner.center - prohash.net - poolto.be - cryptoescrow.eu - monerominers.net - cryptonotepool.org - extrmepool.org - webcoin.me - kippo.eu - hashinvest.ws - monero.farm - linux-repository-updates.com - 1gh.com - dwarfpool.com - hash-to-coins.com - pool-proxy.com - hashfor.cash - fairpool.cloud - litecoinpool.org - mineshaft.ml - abcxyz.stream - moneropool.ru - cryptonotepool.org.uk - extremepool.org - extremehash.com - hashinvest.net - unipool.pro - crypto-pools.org - monero.net - backup-pool.com - mooo.com - freeyy.me - cryptonight.net - shscrypto.net exclude_answers: answers: - 127.0.0.1 - 0.0.0.0 exclude_rejected: rejected: 'true' condition: selection and not 1 of exclude_* falsepositives: - A DNS lookup does not necessarily mean a successful attempt, verify a) if there was a response using the zeek answers field, if there was then verify the connections (conn.log) to those IPs. b) verify if HTTP, SSL, or TLS activity to the domain that was queried. http.log field is 'host' and ssl/tls is 'server_name'. level: low