Query: detect Detects service installation of different remote access tools software. These software are often abused by threat actors in logs
Matching passage: Sigma rule: Detects service installation of different remote access tools software. These software are often abused by threat actors. Logsource: windows / system. Rule: title: Remote Access Tool Services Have Been Installed - System id: 1a31b18a-f00c-4061-9900-f735b96c99fc related: - id: c8b00925-926c-47e3-beea-298fd563728e type: similar status: test description: Detects service installation of different remote access tools software. These software are often abused by threat actors to perform references: - https://redcanary.com/blog/misbehaving-rats/ author: Connor Martin, Nasreddine Bencherchali date: 2022-12-23 modified: 2023-06-22 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: - 7045 - 7036 ServiceName|contains: - AmmyyAdmin - Atera - BASupportExpressSrvcUpdater - BASupportExpressStandaloneService - chromoting - GoToAssist - GoToMyPC - jumpcloud - LMIGuardianSvc - LogMeIn - monblanking - Parsec - RManService - RPCPerformanceService - RPCService - SplashtopRemoteService - SSUService - TeamViewer - TightVNC - vncserver - Zoho condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (ED. Logsource: windows / security. Rule: title: Windows Filtering Platform Blocked Connection From EDR Agent Binary id: bacf58c6-e199-4040-a94f-95dea0f1e45a status: test description: 'Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents. Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events. ' references: - https://github.com/netero1010/EDRSilencer - https://github.com/amjcyber/EDRNoiseMaker - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983 author: '@gott_cyber' date: 2024-01-08 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Filtering Platform Connection needs to be enabled' detection: selection: EventID: 5157 Application|endswith: - \AmSvc.exe - \cb.exe - \CETASvc.exe - \CNTAoSMgr.exe - \CrAmTray.exe - \CrsSvc.exe - \CSFalconContainer.exe - \CSFalconService.exe - \CybereasonAV.exe - \CylanceSvc.exe - \cyserver.exe - \CyveraService.exe - \CyvrFsFlt.exe - \EIConnector.exe - \elastic-agent.exe - \elastic-endpoint.exe - \EndpointBasecamp.exe - \ExecutionPreventionSvc.exe - \filebeat.exe - \fortiedr.exe - \hmpalert.exe - \hurukai.exe - \LogProcessorService.exe - \mcsagent.exe - \mcsclient.exe - \MsMpEng.exe - \MsSense.exe - \Ntrtscan.exe - \PccNTMon.exe - \QualysAgent.exe - \RepMgr.exe - \RepUtils.exe - \RepUx.exe - \RepWAV.exe - \RepWSC.exe - \sedservice.exe - \SenseCncProxy.exe - \SenseIR.exe - \SenseNdr.exe - \SenseSampleUploader.exe - \SentinelAgent.exe - \SentinelAgentWorker.exe - \SentinelBrowserNativeHost.exe - \SentinelHelperService.exe - \SentinelServiceHost.exe - \SentinelStaticEngine.exe - \SentinelStaticEngineScanner.exe - \sfc.exe - \sophos ui.exe - \sophosfilescanner.exe - \sophosfs.exe - \sophoshealth.exe - \sophosips.exe - \sophosLivequeryservice.exe - \sophosnetfilter.exe - \sophosntpservice.exe - \sophososquery.exe - \sspservice.exe - \TaniumClient.exe - \TaniumCX.exe - \TaniumDetectEngine.exe - \TMBMSRV.exe - \TmCCSF.exe - \TmListen.exe - \TmWSCSvc.exe - \Traps.exe - \winlogbeat.exe - \WSCommunicator.exe - \xagt.exe condition: selection falsepositives: - Unlikely level: high