Query: detect Detects when changes are made to the SSH certificate configuration of the organization. in logs
Matching passage: Sigma rule: Detects when changes are made to the SSH certificate configuration of the organization.. Logsource: github / audit. Rule: title: Github SSH Certificate Configuration Changed id: 2f575940-d85e-4ddc-af13-17dad6f1a0ef status: test description: Detects when changes are made to the SSH certificate configuration of the organization. references: - https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-git-access-to-your-organizations-repositories/about-ssh-certificate-authorities - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - ssh_certificate_authority.create - ssh_certificate_requirement.disable condition: selection falsepositives: - Allowed administrative activities. level: medium
Near-miss passage: Sigma rule: Detects potentially suspicious child processes launched via the ScreenConnect client service.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution id: 7b582f1a-b318-4c6a-bf4e-66fe49bf55a5 related: - id: d1a401ab-8c47-4e86-a7d8-2460b6a53e4a type: derived status: test description: 'Detects potentially suspicious child processes launched via the ScreenConnect client service. ' references: - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale date: 2022-02-25 modified: 2024-02-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: process_creation detection: selection: ParentCommandLine|contains|all: - :\Windows\TEMP\ScreenConnect\ - run.cmd Image|endswith: - \bitsadmin.exe - \cmd.exe - \curl.exe - \dllhost.exe - \net.exe - \nltest.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \wevtutil.exe condition: selection falsepositives: - If the script being executed make use of any of the utilities mentioned in the detection then they should filtered out or allowed. level: medium