Query: detect Detects enumeration of local or remote network services. in logs
Matching passage: Sigma rule: Detects enumeration of local or remote network services.. Logsource: macos / process_creation. Rule: title: MacOS Network Service Scanning id: 84bae5d4-b518-4ae0-b331-6d4afd34d00f status: test description: Detects enumeration of local or remote network services. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2021-11-27 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: macos detection: selection_1: Image|endswith: - /nc - /netcat selection_2: Image|endswith: - /nmap - /telnet filter: CommandLine|contains: l condition: (selection_1 and not filter) or selection_2 falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).. Logsource: windows / image_load. Rule: title: Potential System DLL Sideloading From Non System Locations id: 4fc0deee-0057-4998-ab31-d24e46e0aba4 status: test description: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.). references: - https://hijacklibs.net/ - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ - https://www.sophos.com/en-us/blog/finding-minhook-in-a-sideloading-attack-and-sweden-too author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2026-07-10 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \aclui.dll - \activeds.dll - \adsldpc.dll - \aepic.dll - \apphelp.dll - \applicationframe.dll - \appvpolicy.dll - \appxalluserstore.dll - \appxdeploymentclient.dll - \archiveint.dll - \atl.dll - \audioses.dll - \auditpolcore.dll - \authfwcfg.dll - \authz.dll - \avrt.dll - \batmeter.dll - \bcd.dll - \bcp47langs.dll - \bcp47mrm.dll - \bcrypt.dll - \bderepair.dll - \bootmenuux.dll - \bootux.dll - \cabinet.dll - \cabview.dll - \certcli.dll - \certenroll.dll - \cfgmgr32.dll - \cldapi.dll - \clipc.dll - \clusapi.dll - \cmpbk32.dll - \cmutil.dll - \coloradapterclient.dll - \colorui.dll - \comdlg32.dll - \configmanager2.dll - \connect.dll - \coredplus.dll - \coremessaging.dll - \coreuicomponents.dll - \credui.dll - \cryptbase.dll - \cryptdll.dll - \cryptsp.dll - \cryptui.dll - \cryptxml.dll - \cscapi.dll - \cscobj.dll - \cscui.dll - \d2d1.dll - \d3d10_1.dll - \d3d10_1core.dll - \d3d10.dll - \d3d10core.dll - \d3d10warp.dll - \d3d11.dll - \d3d12.dll - \d3d9.dll - \d3dx9_43.dll - \dataexchange.dll - \davclnt.dll - \dcntel.dll - \dcomp.dll - \defragproxy.dll - \desktopshellext.dll - \deviceassociation.dll - \devicecredential.dll - \devicepairing.dll - \devobj.dll - \devrtl.dll - \dhcpcmonitor.dll - \dhcpcsvc.dll - \dhcpcsvc6.dll - \directmanipulation.dll - \dismapi.dll - \dismcore.dll - \dmcfgutils.dll - \dmcmnutils.dll - \dmcommandlineutils.dll - \dmenrollengine.dll - \dmenterprisediagnostics.dll - \dmiso8601utils.dll - \dmoleaututils.dll - \dmprocessxmlfiltered.dll - \