Query: rule covering Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain t
Matching passage: Sigma rule: Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain t. Logsource: windows / process_creation. Rule: title: Renamed AdFind Execution id: df55196f-f105-44d3-a675-e9dfb6cc2f2b status: test description: Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain. references: - https://www.joeware.net/freetools/tools/adfind/ - https://thedfirreport.com/2020/05/08/adfind-recon/ - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/ - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx - https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md author: Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2025-02-26 tags: - attack.discovery - attack.t1018 - attack.t1087.002 - attack.t1482 - attack.t1069.002 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - domainlist - trustdmp - dcmodes - adinfo - ' dclist ' - computer_pwdnotreqd - objectcategory= - -subnets -f - name="Domain Admins" - '-sc u:' - domainncs - dompol - ' oudmp ' - subnetdmp - gpodmp - fspdmp - users_noexpire - computers_active - computers_pwdnotreqd selection_2: Hashes|contains: - IMPHASH=BCA5675746D13A1F246E2DA3C2217492 - IMPHASH=53E117A96057EAF19C41380D0E87F1C2 - IMPHASH=d144de8117df2beceaba2201ad304764 - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 - IMPHASH=4fbf3f084fbbb2470b80b2013134df35 - IMPHASH=49b639b4acbecc49d72a01f357aa4930 - IMPHASH=680dad9e300346e05a85023965867201 - IMPHASH=21aa085d54992511b9f115355e468782 selection_3: OriginalFileName: AdFind.exe filter: Image|endswith: \AdFind.exe condition: 1 of selection* and not filter falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_renamed_adfind/info.yml
Near-miss passage: Sigma rule: Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) dev. Logsource: windows / process_creation. Rule: title: Devcon Execution Disabling VMware VMCI Device id: 85f520e7-6f5e-43ca-874c-222e5bf9c0de status: experimental description: 'Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device. This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host. ' references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon - https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060 - https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV - https://huntress.com/blog/esxi-vm-escape-exploit author: Matt Anderson, Dray Agha, Anna Pham (Huntress) date: 2026-01-02 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1543.003 - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \devcon.exe - OriginalFileName: DevCon.exe selection_action: CommandLine|contains: ' disable ' selection_vmci_pci: CommandLine|contains: - 15AD&DEV_0740 - VMWVMCIHOSTDEV condition: all of selection_* falsepositives: - Legitimate VMware administration, Tools installation/uninstallation, or troubleshooting driver conflicts. - Automated scripts in virtualized environments for device cleanup. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_devcon_disable_vmci_driver/info.yml