Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious PowerShell invocation with a parameter substring. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parameter Substring id: 36210e0d-5b19-485d-a087-c096088885f0 status: test description: Detects suspicious PowerShell invocation with a parameter substring references: - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix) date: 2019-01-16 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -windowstyle h ' - ' -windowstyl h' - ' -windowsty h' - ' -windowst h' - ' -windows h' - ' -windo h' - ' -wind h' - ' -win h' - ' -wi h' - ' -win h ' - ' -win hi ' - ' -win hid ' - ' -win hidd ' - ' -win hidde ' - ' -NoPr ' - ' -NoPro ' - ' -NoProf ' - ' -NoProfi ' - ' -NoProfil ' - ' -nonin ' - ' -nonint ' - ' -noninte ' - ' -noninter ' - ' -nonintera ' - ' -noninterac ' - ' -noninteract ' - ' -noninteracti ' - ' -noninteractiv ' - ' -ec ' - ' -encodedComman ' - ' -encodedComma ' - ' -encodedComm ' - ' -encodedCom ' - ' -encodedCo ' - ' -encodedC ' - ' -encoded ' - ' -encode ' - ' -encod ' - ' -enco ' - ' -en ' - ' -executionpolic ' - ' -executionpoli ' - ' -executionpol ' - ' -executionpo ' - ' -executionp ' - ' -execution bypass' - ' -executio bypass' - ' -executi bypass' - ' -execut bypass' - ' -execu bypass' - ' -exec bypass' - ' -exe bypass' - ' -ex bypass' - ' -ep bypass' - ' /windowstyle h ' - ' /windowstyl h' - ' /windowsty h' - ' /windowst h' - ' /windows h' - ' /windo h' - ' /wind h' - ' /win h' - ' /wi h' - ' /win h ' - ' /win hi ' - ' /win hid ' - ' /win hidd ' - ' /win hidde ' - ' /NoPr ' - ' /NoPro ' - ' /NoProf ' - ' /NoProfi ' - ' /NoProfil ' - ' /nonin ' - ' /nonint ' - ' /noninte ' - ' /noninter ' - ' /nonintera ' - ' /noninterac ' - ' /noninteract ' - ' /noninteracti ' - ' /noninteractiv ' - ' /ec ' - ' /encodedComman ' - ' /encodedComma ' - ' /encodedComm ' - ' /encodedCom ' - ' /encodedCo ' - ' /encodedC ' - ' /encoded ' - ' /encode ' - ' /encod ' - ' /enco ' - ' /en ' - ' /executionpolic ' - ' /executionpoli ' - ' /executionpol ' - ' /executionpo ' - ' /executionp ' - ' /execution bypass' - ' /executio bypass' - ' /executi bypass' - ' /execut bypass' - ' /execu bypass' - ' /exec bypass' - ' /exe bypass' - ' /ex bypass' - ' /ep bypass' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - GoToAssist Execution id: b6d98a4f-cef0-4abf-bbf6-24132854a83d status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows author: frack113 date: 2022-02-13 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: GoTo Opener - Product: GoTo Opener - Company: LogMeIn, Inc. condition: selection falsepositives: - Legitimate use level: medium