Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local pr. Logsource: windows / process_creation. Rule: title: PUA - Ngrok Execution id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31 status: test description: 'Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections. ' references: - https://ngrok.com/docs - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/ - https://twitter.com/xorJosh/status/1598646907802451969 - https://www.softwaretestinghelp.com/how-to-use-ngrok/ author: Florian Roth (Nextron Systems) date: 2021-05-14 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - ' tcp 139' - ' tcp 445' - ' tcp 3389' - ' tcp 5985' - ' tcp 5986' selection2: CommandLine|contains|all: - ' start ' - --all - --config - .yml selection3: Image|endswith: ngrok.exe CommandLine|contains: - ' tcp ' - ' http ' - ' authtoken ' selection4: CommandLine|contains: - '.exe authtoken ' - .exe start --all condition: 1 of selection* falsepositives: - Another tool that uses the command line switches of Ngrok - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0) level: high
Near-miss passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / pipe_created. Rule: title: Alternate PowerShell Hosts Pipe id: 58cb02d5-78ce-4692-b3e1-dce850aae41a related: - id: ac7102b4-9e1e-4802-9b4f-17c5524c015c type: derived status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-09-12 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PSHost filter_main_generic: - Image|contains: - :\Program Files\PowerShell\7-preview\pwsh.exe - :\Program Files\PowerShell\7\pwsh.exe - :\Windows\system32\dsac.exe - :\Windows\system32\inetsrv\w3wp.exe - :\Windows\System32\sdiagnhost.exe - :\Windows\system32\ServerManager.exe - :\Windows\system32\wbem\wmiprvse.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe - Image|contains|all: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe - Image|contains|all: - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe filter_optional_sqlserver: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ Image|contains: \Microsoft SQL Server\ Image|endswith: \Tools\Binn\SQLPS.exe filter_optional_azure_connected_machine_agent: Image|startswith: C:\Program Files\AzureConnectedMachineAgent\GCArcService Image|endswith: \GC\gc_worker.exe filter_optional_citrix: Image|startswith: C:\Program Files\Citrix\ filter_optional_exchange: Image|startswith: C:\Program Files\Microsoft\Exchange Se