Query: alert when Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords
Matching passage: Sigma rule: Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords. Logsource: windows / process_creation. Rule: title: Microsoft IIS Service Account Password Dumped id: 2d3cdeec-c0db-45b4-aa86-082f7eb75701 status: test description: Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords references: - https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html - https://twitter.com/0gtweet/status/1588815661085917186?cxt=HHwWhIDUyaDbzYwsAAAA - https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/ author: Tim Rauch, Janantha Marasinghe, Elastic (original idea) date: 2022-11-08 modified: 2023-01-22 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_base_name: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_base_list: CommandLine|contains: 'list ' selection_standalone: CommandLine|contains: - ' /config' - ' /xml' - ' -config' - ' -xml' selection_cmd_flags: CommandLine|contains: - ' /@t' - ' /text' - ' /show' - ' -@t' - ' -text' - ' -show' selection_cmd_grep: CommandLine|contains: - :\* - password condition: all of selection_base_* and (selection_standalone or all of selection_cmd_*) falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a named pipe as used by CobaltStrike. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 related: - id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 type: similar - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar status: test description: Detects the creation of a named pipe as used by CobaltStrike references: - https://twitter.com/d4rksystem/status/1357010969264873472 - https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/ - https://github.com/SigmaHQ/sigma/issues/253 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ - https://redcanary.com/threat-detection-report/threats/cobalt-strike/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-25 modified: 2022-10-31 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_MSSE: PipeName|contains|all: - \MSSE- - -server selection_postex: PipeName|startswith: \postex_ selection_status: PipeName|startswith: \status_ selection_msagent: PipeName|startswith: \msagent_ selection_mojo: PipeName|startswith: \mojo_ selection_interprocess: PipeName|startswith: \interprocess_ selection_samr: PipeName|startswith: \samr_ selection_netlogon: PipeName|startswith: \netlogon_ selection_srvsvc: PipeName|startswith: \srvsvc_ selection_lsarpc: PipeName|startswith: \lsarpc_ selection_wkssvc: PipeName|startswith: \wkssvc_ condition: 1 of selection* falsepositives: - Unknown level: critical