Query: rule covering Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use
Matching passage: Sigma rule: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use. Logsource: windows / process_creation. Rule: title: Query Usage To Exfil Data id: 53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2 status: test description: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-01-19 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: :\Windows\System32\query.exe CommandLine|contains: - session > - process > condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.. Logsource: windows / image_load. Rule: title: Suspicious WSMAN Provider Image Loads id: ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94 status: test description: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. references: - https://twitter.com/chadtilbury/status/1275851297770610688 - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/ - https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture - https://github.com/bohops/WSMan-WinRM author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-24 modified: 2026-07-28 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: request_client: - ImageLoaded|endswith: - \WsmSvc.dll - \WsmAuto.dll - \Microsoft.WSMan.Management.ni.dll - OriginalFileName: - WsmSvc.dll - WSMANAUTOMATION.DLL - Microsoft.WSMan.Management.dll respond_server: Image|endswith: \svchost.exe OriginalFileName: WsmWmiPl.dll filter_general: Image: - C:\Program Files (x86)\PowerShell\6\pwsh.exe - C:\Program Files (x86)\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\6\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\services.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe filter_svchost: CommandLine|contains: - svchost.exe -k netsvcs -p -s BITS - svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc - svchost.exe -k NetworkService -p -s Wecsvc - svchost.exe -k netsvcs filter_mscorsvw: Image|startswith: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \mscorsvw.exe filter_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_svr_2019: Image: - C:\Windows\System32\Configure-SMRemoting.exe - C:\Windows\System32\ServerManager.exe filter_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ filter_citrix: Image|startswith: C:\Program Files\Citrix\ filter_upgrade: Image|startswith: C:\$WINDOWS.~BT\Sources\ filter_mmc: Image|endswith: \mmc.exe svchost: Image|endswith: \svchost.exe commandline_null: CommandLine: null condition: ( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null ) f