Query: write Sigma for Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for
Matching passage: Sigma rule: Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for. Logsource: windows / process_creation. Rule: title: PUA - NimScan Execution id: 4fd6b1c7-19b8-4488-97f6-00f0924991a3 status: test description: 'Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool. ' references: - https://x.com/cyberfeeddigest/status/1887041526397587859 - https://github.com/elddy/NimScan author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \NimScan.exe - Hashes|contains: - IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C - IMPHASH=B1B6ADACB172795480179EFD18A29549 - IMPHASH=0D1F896DC7642AD8384F9042F30279C2 condition: selection falsepositives: - Legitimate administrator activity level: medium
Near-miss passage: Sigma rule: Detects process handle on LSASS process with certain access mask. Logsource: windows / security. Rule: title: Potentially Suspicious AccessMask Requested From LSASS id: 4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76 status: test description: Detects process handle on LSASS process with certain access mask references: - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update) date: 2019-11-01 modified: 2026-06-29 tags: - attack.credential-access - car.2019-04-004 - attack.t1003.001 logsource: product: windows service: security detection: selection_1: EventID: 4656 ObjectName|endswith: \lsass.exe AccessMask|contains: - '0x40' - '0x1400' - '0x100000' - '0x1410' - '0x1010' - '0x1438' - '0x143a' - '0x1418' - '0x1f0fff' - '0x1f1fff' - '0x1f2fff' - '0x1f3fff' selection_2: EventID: 4663 ObjectName|endswith: \lsass.exe AccessList|contains: - '4484' - '4416' filter_main_specific: ProcessName|endswith: - \csrss.exe - \GamingServices.exe - \lsm.exe - \MicrosoftEdgeUpdate.exe - \minionhost.exe - \MRT.exe - \MsMpEng.exe - \perfmon.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \svchost.exe - \taskmgr.exe - \thor.exe - \thor64.exe - \vmtoolsd.exe - \VsTskMgr.exe - \wininit.exe - \wmiprvse.exe - RtkAudUService64 ProcessName|contains: - :\Program Files (x86)\ - :\Program Files\ - :\ProgramData\Microsoft\Windows Defender\Platform\ - :\Windows\SysNative\ - :\Windows\System32\ - :\Windows\SysWow64\ - :\Windows\Temp\asgard2-agent\ filter_main_generic: ProcessName|contains: :\Program Files filter_main_exact: ProcessName|endswith: - :\Windows\System32\taskhostw.exe - :\Windows\System32\msiexec.exe - :\Windows\CCM\CcmExec.exe filter_main_sysmon: ProcessName|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe AccessList|contains: '%%4484' filter_main_aurora: ProcessName|contains: :\Windows\Temp\asgard2-agent-sc\aurora\ ProcessName|endswith: \aurora-agent-64.exe AccessList|contains: '%%4484' filter_main_scenarioengine: ProcessName|endswith: \x64\SCENARIOENGINE.EXE AccessList|contains: '%%4484' filter_main_avira1: ProcessName|contains|all: - :\Users\ - \AppData\Local\Temp\is- ProcessName|endswith: \avira_system_speedup.tmp AccessList|contains: '%%4484' filter_main_avira2: ProcessName|contains: :\Windows\Temp\ ProcessName|endswith: \avira_speedup_setup_update.tmp AccessList|contains: