Query: Sigma YAML for windows / image_load
Matching passage: Sigma rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE id: d2451be2-b582-4e15-8701-4196ac180260 related: - id: ca5583e9-8f80-46ac-ab91-7f314d13b984 type: similar status: test description: 'Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe". ' references: - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/ - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ - https://twitter.com/Max_Mal_/status/1775222576639291859 - https://twitter.com/DTCERT/status/1712785426895839339 author: Swachchhanda Shrawan Poudel date: 2024-04-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: - \KeyScrambler.exe - \KeyScramblerLogon.exe ImageLoaded|endswith: \KeyScramblerIE.dll filter_main_legitimate_path: Image|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ ImageLoaded|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ filter_main_signature: Signature: QFX Software Corporation SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious execution from an uncommon folder.. Logsource: windows / process_creation. Rule: title: Process Execution From A Potentially Suspicious Folder id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4 status: test description: Detects a potentially suspicious execution from an uncommon folder. references: - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md author: Florian Roth (Nextron Systems), Tim Shelton date: 2019-01-16 modified: 2024-07-12 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Perflogs\ - :\Users\All Users\ - :\Users\Default\ - :\Users\NetworkService\ - :\Windows\addins\ - :\Windows\debug\ - :\Windows\Fonts\ - :\Windows\Help\ - :\Windows\IME\ - :\Windows\Media\ - :\Windows\repair\ - :\Windows\security\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - $Recycle.bin - \config\systemprofile\ - \Intel\Logs\ - \RSA\MachineKeys\ filter_optional_ibm: Image|startswith: C:\Users\Public\IBM\ClientSolutions\Start_Programs\ filter_optional_citrix: Image|startswith: C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ Image|endswith: \CitrixReceiverUpdater.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high