Query: alert when Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make s
Matching passage: Sigma rule: Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make s. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Download and Execute Pattern id: e6c54d94-498c-4562-a37c-b469d8e9a275 related: - id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 type: derived status: test description: Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive) references: - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70 - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html author: Florian Roth (Nextron Systems) date: 2022-02-28 modified: 2022-03-01 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - IEX ((New-Object Net.WebClient).DownloadString - IEX (New-Object Net.WebClient).DownloadString - IEX((New-Object Net.WebClient).DownloadString - IEX(New-Object Net.WebClient).DownloadString - ' -command (New-Object System.Net.WebClient).DownloadFile(' - ' -c (New-Object System.Net.WebClient).DownloadFile(' condition: selection falsepositives: - Software installers that pull packages from remote systems and execute them level: high
Near-miss passage: Sigma rule: Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie.. Logsource: windows / process_creation. Rule: title: Suspicious WebDav Client Execution Via Rundll32.EXE id: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555 status: test description: 'Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397 ' references: - https://twitter.com/aceresponder/status/1636116096506818562 - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/ - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/ - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/ author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-03-16 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1048.003 - cve.2023-23397 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe ParentCommandLine|contains: -s WebClient Image|endswith: \rundll32.exe CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} filter_local_ips: CommandLine|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. condition: selection and not 1 of filter_* falsepositives: - Unknown level: high