Query: detect Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable ex in logs
Matching passage: Sigma rule: Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable ex. Logsource: windows / process_creation. Rule: title: Execution of Suspicious File Type Extension id: c09dad97-1c78-4f71-b127-7edb2b8e491a status: test description: 'Detects whether the image specified in a process creation event doesn''t refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment. ' references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ author: Max Altgelt (Nextron Systems) date: 2021-12-09 modified: 2023-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: known_image_extension: Image|endswith: - .bin - .cgi - .com - .exe - .scr - .tmp filter_main_image: Image: - System - Registry - MemCompression - vmmem filter_main_msi_installers: Image|contains: :\Windows\Installer\MSI filter_main_driver_store: Image|contains: :\Windows\System32\DriverStore\FileRepository\ filter_main_msi_rollbackfiles: Image|contains: :\Config.Msi\ Image|endswith: - .rbf - .rbs filter_main_windows_temp: - ParentImage|contains: :\Windows\Temp\ - Image|contains: :\Windows\Temp\ filter_main_deleted: Image|contains: :\$Extend\$Deleted\ filter_main_empty: Image: - '-' - '' filter_main_null: Image: null filter_optional_avira: ParentImage|contains: :\ProgramData\Avira\ filter_optional_nvidia: Image|contains: NVIDIA\NvBackend\ Image|endswith: .dat filter_optional_winpakpro: Image|contains: - :\Program Files (x86)\WINPAKPRO\ - :\Program Files\WINPAKPRO\ Image|endswith: .ngn filter_optional_myq_server: Image|endswith: - :\Program Files (x86)\MyQ\Server\pcltool.dll - :\Program Files\MyQ\Server\pcltool.dll filter_optional_wsl: Image|contains|all: - \AppData\Local\Packages\ - \LocalState\rootfs\ filter_optional_lzma_exe: Image|endswith: \LZMA_EXE filter_optional_firefox: Image|contains: :\Program Files\Mozilla Firefox\ filter_optional_docker: ParentImage: C:\Windows\System32\services.exe Image|endswith: com.docker.service condition: not known_image_extension and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance. Logsource: windows / ps_module. Rule: title: Malicious PowerShell Scripts - PoshModule id: 41025fd7-0466-4650-a813-574aaacbe7f4 related: - id: f331aa1f-8c53-4fc3-b083-cc159bc971cb type: similar - id: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2 type: obsolete status: test description: Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance references: - https://github.com/PowerShellMafia/PowerSploit - https://github.com/NetSPI/PowerUpSQL - https://github.com/CsEnox/EventViewer-UACBypass - https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu - https://github.com/nettitude/Invoke-PowerThIEf - https://github.com/S3cur3Th1sSh1t/WinPwn - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1 - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-23 modified: 2025-12-10 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_generic: ContextInfo|contains: - Add-ConstrainedDelegationBackdoor.ps1 - Add-Exfiltration.ps1 - Add-Persistence.ps1 - Add-RegBackdoor.ps1 - Add-RemoteRegBackdoor.ps1 - Add-ScrnSaveBackdoor.ps1 - BadSuccessor.ps1 - Check-VM.ps1 - ConvertTo-ROT13.ps1 - Copy-VSS.ps1 - Create-MultipleSessions.ps1 - DNS_TXT_Pwnage.ps1 - dnscat2.ps1 - Do-Exfiltration.ps1 - DomainPasswordSpray.ps1 - Download_Execute.ps1 - Download-Execute-PS.ps1 - Enabled-DuplicateToken.ps1 - Enable-DuplicateToken.ps1 -