Query: rule covering Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping
Matching passage: Sigma rule: Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping. Logsource: windows / process_creation. Rule: title: Webshell Hacking Activity Patterns id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9 status: test description: 'Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system ' references: - https://youtu.be/7aemGhaE9ds?t=641 author: Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2023-11-09 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \w3wp.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_child_1: CommandLine|contains|all: - rundll32 - comsvcs selection_child_2: CommandLine|contains|all: - ' -hp' - ' a ' - ' -m' selection_child_3: CommandLine|contains|all: - net - ' user ' - ' /add' selection_child_4: CommandLine|contains|all: - net - ' localgroup ' - ' administrators ' - /add selection_child_5: Image|endswith: - \ntdsutil.exe - \ldifde.exe - \adfind.exe - \procdump.exe - \Nanodump.exe - \vssadmin.exe - \fsutil.exe selection_child_6: CommandLine|contains: - ' -decode ' - ' -NoP ' - ' -W Hidden ' - ' /decode ' - ' /ticket:' - ' sekurlsa' - .dmp full - .downloadfile( - .downloadstring( - FromBase64String - process call create - 'reg save ' - whoami /priv condition: 1 of selection_webserver_* and 1 of selection_child_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Image/Driver Load For Policy Violation id: e4be5675-4a53-426a-8c81-a8bb2387e947 status: test description: Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy. references: - https://twitter.com/wdormann/status/1590434950335320065 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2023-06-07 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3077 condition: selection falsepositives: - Unknown level: high