Query: write Sigma for Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation
Matching passage: Sigma rule: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. Logsource: macos / process_creation. Rule: title: Suspicious Browser Child Process - MacOS id: 0250638a-2b28-4541-86fc-ea4c558fa0c6 status: test description: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. references: - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml author: Sohan G (D4rkCiph3r) date: 2023-04-05 tags: - attack.initial-access - attack.execution - attack.t1189 - attack.t1203 - attack.t1059 logsource: category: process_creation product: macos detection: selection: ParentImage|contains: - com.apple.WebKit.WebContent - firefox - Google Chrome Helper - Google Chrome - Microsoft Edge - Opera - Safari - Tor Browser Image|endswith: - /bash - /curl - /dash - /ksh - /osascript - /perl - /php - /pwsh - /python - /sh - /tcsh - /wget - /zsh filter_main_generic: CommandLine|contains: --defaults-torrc filter_main_ms_autoupdate: CommandLine|contains: /Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate filter_main_chrome: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains: - /Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh filter_main_ms_edge: ParentImage|contains: Microsoft Edge CommandLine|contains: - IOPlatformExpertDevice - hw.model filter_main_chromerecovery: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains|all: - /Users/ - /Library/Application Support/Google/Chrome/recovery/ - /ChromeRecovery filter_optional_null: CommandLine: null filter_optional_empty: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate browser install, update and recovery scripts level: medium
Near-miss passage: Sigma rule: Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.. Logsource: windows / ps_module. Rule: title: HackTool - Evil-WinRm Execution - PowerShell Module id: 9fe55ea2-4cd6-4491-8a54-dd6871651b51 status: test description: 'Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility. ' references: - https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb - https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-25 tags: - attack.lateral-movement logsource: product: windows category: ps_module detection: selection_wsm: ContextInfo|contains: - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\wsmprovhost.exe selection_payload_1: Payload|contains: - value="(get-location).path - value="(get-item*).length - 'Invoke-Binary ' - Donut-Loader -process_id*-donutfile - Bypass-4MSI - IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','') selection_payload_2: Payload|contains|all: - $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\" - Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath selection_payload_3: Payload|contains|all: - $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" } - $a=@();$ condition: selection_wsm and 1 of selection_payload_* falsepositives: - Unknown level: high