Query: Sigma rule for Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a
Matching passage: Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / ps_script. Rule: title: AADInternals PowerShell Cmdlets Execution - PsScript id: 91e69562-2426-42ce-a647-711b8152ced6 related: - id: c86500e9-a645-4680-98d7-f882c70c1ea3 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: ps_script definition: Script Block Logging must be enable detection: selection: ScriptBlockText|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: selection falsepositives: - Legitimate use of the library for administrative activity level: high
Near-miss passage: Sigma rule: Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microso. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Appvlp.EXE id: 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43 status: test description: 'Detects uncommon child processes of Appvlp.EXE Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands. Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder or to mark a file as a system file. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/ author: Sreeman date: 2020-03-13 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \appvlp.exe filter_main_generic: Image|endswith: - :\Windows\SysWOW64\rundll32.exe - :\Windows\System32\rundll32.exe filter_optional_office_msoasb: Image|contains: :\Program Files\Microsoft Office Image|endswith: \msoasb.exe filter_optional_office_skype: Image|contains|all: - :\Program Files\Microsoft Office - \SkypeSrv\ Image|endswith: \SKYPESERVER.EXE filter_optional_office_msouc: Image|contains: :\Program Files\Microsoft Office Image|endswith: \MSOUC.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium