Query: alert when Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate
Matching passage: Sigma rule: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate. Logsource: windows / pipe_created. Rule: title: PsExec Tool Execution From Suspicious Locations - PipeName id: 41504465-5e3a-4a5b-a5b4-2a0baadd4463 related: - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c type: derived status: test description: Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-04 modified: 2023-09-20 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: pipe_created product: windows definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \PSEXESVC Image|contains: - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ condition: selection falsepositives: - Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment. level: medium
Near-miss passage: Sigma rule: Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Google API id: 7e9cf7b6-e827-11ed-a05b-0242ac120003 status: experimental description: 'Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet) ' references: - https://github.com/looCiprian/GC2-sheet - https://youtu.be/n2dFlSaBBKo - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/ - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/ author: Gavin Knapp date: 2023-05-01 modified: 2025-02-22 tags: - attack.command-and-control - attack.t1102 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: - drive.googleapis.com - oauth2.googleapis.com - sheets.googleapis.com - www.googleapis.com filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image|endswith: - :\Program Files\Google\Chrome\Application\chrome.exe - :\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_google_drive: Image|contains: :\Program Files\Google\Drive File Stream\ Image|endswith: \GoogleDriveFS.exe filter_optional_firefox: Image|endswith: - :\Program Files\Mozilla Firefox\firefox.exe - :\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image|endswith: - :\Program Files (x86)\Internet Explorer\iexplore.exe - :\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|contains: :\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: - :\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - :\Program Files\Microsoft\Edge\Application\msedge.exe - \WindowsApps\MicrosoftEdge.exe filter_optional_edge_2: Image|contains: - :\Program Files (x86)\Microsoft\EdgeCore\ - :\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_opera: Image|endswith: \opera.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_seamonkey: Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|endswith: \vivaldi.exe filter_optional_whale: Image|endswith: \whale.exe filter_optional_googleupdate: Image|endswith: \GoogleUpdate.exe filter_optional_outlook_exe: Image|endswith: \outlook.exe filter_main_null: Image: nul