Query: Sigma YAML for windows / network_connection
Matching passage: Sigma rule: Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 related: - id: e043f529-8514-4205-8ab0-7f7d2927b400 type: derived status: test description: 'Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 modified: 2024-07-16 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: azurewebsites.net filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_chrome_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_firefox_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_safari: Image|contains: - C:\Program Files (x86)\Safari\ - C:\Program Files\Safari\ Image|endswith: \safari.exe filter_main_defender: Image|contains: - C:\Program Files\Windows Defender Advanced Threat Protection\ - C:\Program Files\Windows Defender\ - C:\Pro
Near-miss passage: Sigma rule: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.. Logsource: windows / file_event. Rule: title: ADSI-Cache File Creation By Uncommon Tool id: 75bf09fa-1dd7-4d18-9af9-dd9e492562eb status: test description: Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool. references: - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961 - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/ - https://github.com/fox-it/LDAPFragger author: xknow @xknow_infosec, Tim Shelton date: 2019-03-24 modified: 2023-10-18 tags: - attack.t1001.003 - attack.command-and-control logsource: product: windows category: file_event detection: selection: TargetFilename|contains: \Local\Microsoft\Windows\SchCache\ TargetFilename|endswith: .sch filter_main_generic: - Image|endswith: - :\Program Files\Cylance\Desktop\CylanceSvc.exe - :\Windows\CCM\CcmExec.exe - :\windows\system32\dllhost.exe - :\Windows\system32\dsac.exe - :\Windows\system32\efsui.exe - :\windows\system32\mmc.exe - :\windows\system32\svchost.exe - :\Windows\System32\wbem\WmiPrvSE.exe - :\windows\system32\WindowsPowerShell\v1.0\powershell.exe - Image|contains: - :\Windows\ccmsetup\autoupgrade\ccmsetup - :\Program Files\SentinelOne\Sentinel Agent filter_main_office: Image|contains|all: - :\Program Files\ - \Microsoft Office Image|endswith: \OUTLOOK.EXE filter_optional_ldapwhoami: Image|endswith: \LANDesk\LDCLient\ldapwhoami.exe filter_optional_citrix: Image|endswith: :\Program Files\Citrix\Receiver StoreFront\Services\DefaultDomainServices\Citrix.DeliveryServices.DomainServices.ServiceHost.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legimate tools, which do ADSI (LDAP) operations, e.g. any remoting activity by MMC, Powershell, Windows etc. level: medium