Query: detection rule: Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume
Matching passage: Sigma rule: Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume. Logsource: windows / process_creation. Rule: title: Wlrmdr.EXE Uncommon Argument Or Child Process id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb status: experimental description: 'Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry. ' references: - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/ author: frack113, manasmbellani date: 2022-02-16 modified: 2025-10-31 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \wlrmdr.exe selection_child_img: - Image|endswith: \wlrmdr.exe - OriginalFileName: WLRMNDR.EXE selection_child_cli_flags_s: CommandLine|contains|windash: '-s ' selection_child_cli_flags_f: CommandLine|contains|windash: '-f ' selection_child_cli_flags_t: CommandLine|contains|windash: '-t ' selection_child_cli_flags_m: CommandLine|contains|windash: '-m ' selection_child_cli_flags_a: CommandLine|contains|windash: '-a ' selection_child_cli_flags_u: CommandLine|contains|windash: '-u ' filter_main_winlogon: ParentImage: C:\Windows\System32\winlogon.exe filter_main_empty: ParentImage: - '' - '-' filter_main_null: ParentImage: null condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*) falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects DNS resolution of an .onion address related to Tor routing networks. Logsource: windows / dns-client. Rule: title: Query Tor Onion Address - DNS Client id: 8384bd26-bde6-4da9-8e5d-4174a7a47ca2 related: - id: b55ca2a3-7cff-4dda-8bdd-c7bfa63bf544 type: similar - id: a8322756-015c-42e7-afb1-436e85ed3ff5 type: similar status: test description: Detects DNS resolution of an .onion address related to Tor routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml author: Nasreddine Bencherchali (Nextron Systems) date: 2022-02-20 modified: 2025-09-12 tags: - attack.command-and-control - attack.t1090.003 logsource: product: windows service: dns-client definition: 'Requirements: Microsoft-Windows-DNS Client Events/Operational Event Log must be enabled/collected in order to receive the events.' detection: selection: EventID: 3008 QueryName|endswith: - .hiddenservice.net - .onion.ca - .onion.cab - .onion.casa - .onion.city - .onion.direct - .onion.dog - .onion.glass - .onion.gq - .onion.guide - .onion.in.net - .onion.ink - .onion.it - .onion.link - .onion.lt - .onion.lu - .onion.ly - .onion.mn - .onion.network - .onion.nu - .onion.pet - .onion.plus - .onion.pt - .onion.pw - .onion.rip - .onion.sh - .onion.si - .onion.to - .onion.top - .onion.ws - .onion - .s1.tor-gateways.de - .s2.tor-gateways.de - .s3.tor-gateways.de - .s4.tor-gateways.de - .s5.tor-gateways.de - .t2w.pw - .tor2web.ae.org - .tor2web.blutmagie.de - .tor2web.com - .tor2web.fi - .tor2web.io - .tor2web.org - .tor2web.xyz - .torlink.co condition: selection falsepositives: - Unlikely level: high