Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.. Logsource: windows / process_creation. Rule: title: Scheduled Task Executing Payload from Registry id: 86588b36-c6d3-465f-9cee-8f9093e07798 related: - id: c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78 type: derived status: test description: Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell. references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-07-18 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_create: CommandLine|contains: /Create selection_cli_get: CommandLine|contains: - Get-ItemProperty - ' gp ' selection_cli_hive: CommandLine|contains: - 'HKCU:' - 'HKLM:' - 'registry::' - HKEY_ filter_main_encoding: CommandLine|contains: - FromBase64String - encodedcommand condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious process patterns used in NTDS.DIT exfiltration. Logsource: windows / process_creation. Rule: title: Suspicious Process Patterns NTDS.DIT Exfil id: 8bc64091-6875-4881-aaf9-7bd25b5dda08 status: test description: Detects suspicious process patterns used in NTDS.DIT exfiltration references: - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/ - https://pentestlab.blog/tag/ntds-dit/ - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1 - https://github.com/zcgonvh/NTDSDumpEx - https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1 - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2022-11-10 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: process_creation detection: selection_tool: - Image|endswith: - \NTDSDump.exe - \NTDSDumpEx.exe - CommandLine|contains|all: - ntds.dit - system.hiv - CommandLine|contains: NTDSgrab.ps1 selection_oneliner_1: CommandLine|contains|all: - ac i ntds - create full selection_onliner_2: CommandLine|contains|all: - '/c copy ' - \windows\ntds\ntds.dit selection_onliner_3: CommandLine|contains|all: - activate instance ntds - create full selection_powershell: CommandLine|contains|all: - powershell - ntds.dit set1_selection_ntds_dit: CommandLine|contains: ntds.dit set1_selection_image_folder: - ParentImage|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ - Image|contains: - \apache - \tomcat - \AppData\ - \Temp\ - \Public\ - \PerfLogs\ condition: 1 of selection* or all of set1* falsepositives: - Unknown level: high