Query: rule covering Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass dete
Matching passage: Sigma rule: Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass dete. Logsource: windows / ps_classic_start. Rule: title: Renamed Powershell Under Powershell Channel id: 30a8cb77-8eb3-4cfb-8e79-ad457c5a4592 status: test description: 'Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that''s dependent on process names and process paths. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse author: Harish Segar, frack113 date: 2020-06-29 modified: 2025-01-20 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1036.003 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: HostName=ConsoleHost filter_main_ps: Data|contains: - HostApplication=powershell - HostApplication=C:\Windows\System32\WindowsPowerShell\v1.0\powershell - HostApplication=C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell - HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell - HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell - HostApplication=C:\\\\WINDOWS\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe - HostApplication=C:\\\\WINDOWS\\\\SysWOW64\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe filter_main_host_application_null: Data|re: HostId=[a-zA-Z0-9-]{36}\s+EngineVersion= condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP IP Pattern id: 2dd2c217-bf68-437a-b57c-fe9fd01d5de8 status: test description: Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2023-05-24 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_ip: CommandLine|contains: - ' /i:http://1' - ' /i:http://2' - ' /i:http://3' - ' /i:http://4' - ' /i:http://5' - ' /i:http://6' - ' /i:http://7' - ' /i:http://8' - ' /i:http://9' - ' /i:https://1' - ' /i:https://2' - ' /i:https://3' - ' /i:https://4' - ' /i:https://5' - ' /i:https://6' - ' /i:https://7' - ' /i:https://8' - ' /i:https://9' - ' -i:http://1' - ' -i:http://2' - ' -i:http://3' - ' -i:http://4' - ' -i:http://5' - ' -i:http://6' - ' -i:http://7' - ' -i:http://8' - ' -i:http://9' - ' -i:https://1' - ' -i:https://2' - ' -i:https://3' - ' -i:https://4' - ' -i:https://5' - ' -i:https://6' - ' -i:https://7' - ' -i:https://8' - ' -i:https://9' condition: all of selection_* falsepositives: - FQDNs that start with a number such as "7-Zip" level: high