Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial basel. Logsource: windows / network_connection. Rule: title: Outbound RDP Connections Over Non-Standard Tools id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23 status: test description: 'Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use. ' references: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 author: Markus Neis date: 2019-05-15 modified: 2024-02-09 tags: - attack.lateral-movement - attack.t1021.001 - car.2013-07-002 logsource: category: network_connection product: windows detection: selection: DestinationPort: 3389 Initiated: 'true' filter_main_mstsc: Image: - C:\Windows\System32\mstsc.exe - C:\Windows\SysWOW64\mstsc.exe filter_optional_dns: Image: C:\Windows\System32\dns.exe SourcePort: 53 Protocol: udp filter_optional_avast: Image|endswith: - \Avast Software\Avast\AvastSvc.exe - \Avast\AvastSvc.exe filter_optional_sysinternals_rdcman: Image|endswith: \RDCMan.exe filter_optional_chrome: Image: C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_third_party: Image|endswith: - \FSAssessment.exe - \FSDiscovery.exe - \MobaRTE.exe - \mRemote.exe - \mRemoteNG.exe - \Passwordstate.exe - \RemoteDesktopManager.exe - \RemoteDesktopManager64.exe - \RemoteDesktopManagerFree.exe - \RSSensor.exe - \RTS2App.exe - \RTSApp.exe - \spiceworks-finder.exe - \Terminals.exe - \ws_TunnelService.exe filter_optional_thor: Image|endswith: - \thor.exe - \thor64.exe filter_optional_splunk: Image|startswith: C:\Program Files\SplunkUniversalForwarder\bin\ filter_optional_sentinel_one: Image|endswith: \Ranger\SentinelRanger.exe filter_optional_firefox: Image: C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tsplus: Image: - C:\Program Files\TSplus\Java\bin\HTML5service.exe - C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe filter_optional_null: Image: null filter_optional_empty: Image: '' filter_optional_unknown: Image: <unknown process> condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Third party RDP tools level: high
Near-miss passage: Sigma rule: Detects the use of NSudo tool for command execution. Logsource: windows / process_creation. Rule: title: PUA - NSudo Execution id: 771d1eb5-9587-4568-95fb-9ec44153a012 status: test description: Detects the use of NSudo tool for command execution references: - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/ - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \NSudo.exe - \NSudoLC.exe - \NSudoLG.exe - OriginalFileName: - NSudo.exe - NSudoLC.exe - NSudoLG.exe selection_cli: CommandLine|contains: - '-U:S ' - '-U:T ' - '-U:E ' - '-P:E ' - '-M:S ' - '-M:H ' - '-U=S ' - '-U=T ' - '-U=E ' - '-P=E ' - '-M=S ' - '-M=H ' - -ShowWindowMode:Hide condition: all of selection_* falsepositives: - Legitimate use by administrators level: high