Query: Sigma rule for Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been r
Matching passage: Sigma rule: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been r. Logsource: windows / process_creation. Rule: title: Hacktool Execution - Imphash id: 24e3e58a-646b-4b50-adef-02ef935b9fc8 status: test description: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-04 modified: 2024-11-23 tags: - attack.credential-access - attack.resource-development - attack.t1588.002 - attack.t1003 logsource: category: process_creation product: windows detection: selection: Hashes|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F4
Near-miss passage: Sigma rule: Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and. Logsource: windows / process_creation. Rule: title: Suspicious Process Masquerading As SvcHost.EXE id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd related: - id: 01d2e2a1-5f09-44f7-9fc1-24faa7479b6d type: similar - id: e4a6b256-3e47-40fc-89d2-7a477edd6915 type: similar status: test description: 'Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location. Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection. ' references: - https://tria.ge/240731-jh4crsycnb/behavioral2 - https://redcanary.com/blog/threat-detection/process-masquerading/ author: Swachchhanda Shrawan Poudel date: 2024-08-07 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: Image|endswith: \svchost.exe filter_main_img_location: Image: - C:\Windows\System32\svchost.exe - C:\Windows\SysWOW64\svchost.exe filter_main_ofn: OriginalFileName: svchost.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_svchost_masqueraded_execution/info.yml