Query: Sigma YAML for windows / security
Matching passage: Sigma rule: Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986. Logsource: windows / security. Rule: title: Remote PowerShell Sessions Network Connections (WinRM) id: 13acf386-b8c6-4fe0-9a6e-c4756b974698 status: test description: Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986 references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-09-12 modified: 2022-10-09 tags: - attack.execution - attack.t1059.001 logsource: product: windows service: security detection: selection: EventID: 5156 DestPort: - 5985 - 5986 LayerRTID: 44 condition: selection falsepositives: - Legitimate use of remote PowerShell execution level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.. Logsource: windows / process_creation. Rule: title: Csc.EXE Execution Form Potentially Suspicious Parent id: b730a276-6b63-41b8-bcf8-55930c8fc6ee status: test description: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery. references: - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing - https://reaqta.com/2017/11/short-journey-darkvnc/ - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2019-02-11 modified: 2026-03-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 - attack.t1027.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csc.exe - OriginalFileName: csc.exe selection_parent_generic: ParentImage|endswith: - \cscript.exe - \excel.exe - \mshta.exe - \onenote.exe - \outlook.exe - \powerpnt.exe - \winword.exe - \wscript.exe selection_parent_powershell: ParentImage|endswith: - \powershell.exe - \pwsh.exe ParentCommandLine|contains: - '-Encoded ' - FromBase64String selection_parent_susp_location: - ParentCommandLine|re: (?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$ - ParentCommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Temporary Internet - ParentCommandLine|contains|all: - :\Users\ - \Favorites\ - ParentCommandLine|contains|all: - :\Users\ - \Favourites\ - ParentCommandLine|contains|all: - :\Users\ - \Contacts\ - ParentCommandLine|contains|all: - :\Users\ - \Pictures\ filter_main_programfiles: ParentImage|startswith: - C:\Program Files (x86)\ - C:\Program Files\ filter_main_sdiagnhost: ParentImage: C:\Windows\System32\sdiagnhost.exe filter_main_w3p: ParentImage: C:\Windows\System32\inetsrv\w3wp.exe filter_optional_chocolatey: ParentImage: C:\ProgramData\chocolatey\choco.exe filter_optional_defender: ParentCommandLine|contains: \ProgramData\Microsoft\Windows Defender Advanced Threat Protection filter_optional_ansible: ParentCommandLine|contains: - JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw - cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzAC