Query: rule covering Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory re
Matching passage: Sigma rule: Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory re. Logsource: windows / process_creation. Rule: title: HackTool - WinPwn Execution id: d557dc06-62e8-4468-a8e8-7984124908ce related: - id: 851fd622-b675-4d26-b803-14bc7baa517a type: similar status: test description: 'Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation. ' author: Swachchhanda Shrawan Poudel date: 2023-12-04 references: - https://github.com/S3cur3Th1sSh1t/WinPwn - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841 - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/ - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team tags: - attack.credential-access - attack.discovery - attack.execution - attack.privilege-escalation - attack.t1046 - attack.t1082 - attack.t1106 - attack.t1518 - attack.t1548.002 - attack.t1552.001 - attack.t1555 - attack.t1555.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Offline_Winpwn - 'WinPwn ' - WinPwn.exe - WinPwn.ps1 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being esta. Logsource: linux / file_event. Rule: title: New Cron File Created id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05 status: experimental description: 'Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment. ' references: - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/ - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2026-04-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux category: file_event detection: selection_cron_dirs: TargetFilename|startswith: - /etc/cron.d/ - /etc/cron.daily/ - /etc/cron.hourly/ - /etc/cron.monthly/ - /etc/cron.weekly/ - /var/spool/cron/crontabs/ - /var/spool/cron/root selection_cron_special_files: TargetFilename|contains: - /etc/cron.allow - /etc/cron.deny - /etc/crontab filter_optional_legit_cron: TargetFilename: - /etc/cron.daily/apt - /etc/cron.daily/dpkg - /etc/cron.daily/passwd - /etc/crontabs/root condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment. level: low