Query: alert when Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or
Matching passage: Sigma rule: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or. Logsource: windows / process_creation. Rule: title: Potential Persistence Attempt Via Existing Service Tampering id: 38879043-7e1e-47a9-8d46-6bec88e201df status: test description: Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence. references: - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/ author: Sreeman date: 2020-09-29 modified: 2023-02-04 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1543.003 - attack.t1574.011 logsource: category: process_creation product: windows detection: selection_sc: - CommandLine|contains|all: - 'sc ' - 'config ' - binpath= - CommandLine|contains|all: - 'sc ' - failure - command= selection_reg_img: - CommandLine|contains|all: - 'reg ' - 'add ' - FailureCommand - CommandLine|contains|all: - 'reg ' - 'add ' - ImagePath selection_reg_ext: CommandLine|contains: - .sh - .exe - .dll - .bin$ - .bat - .cmd - .js - .msh$ - .reg$ - .scr - .ps - .vb - .jar - .pl condition: selection_sc or all of selection_reg_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDriv. Logsource: windows / file_event. Rule: title: Potential Initial Access via DLL Search Order Hijacking id: dbbd9f66-2ed3-4ca2-98a4-6ea985dd1a1c status: test description: Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0 author: Tim Rauch (rule), Elastic (idea) date: 2022-10-21 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1566 - attack.t1566.001 - attack.initial-access - attack.t1574 - attack.t1574.001 logsource: product: windows category: file_event detection: selection: Image|endswith: - \winword.exe - \excel.exe - \powerpnt.exe - \MSACCESS.EXE - \MSPUB.EXE - \fltldr.exe - \cmd.exe - \certutil.exe - \mshta.exe - \cscript.exe - \wscript.exe - \curl.exe - \powershell.exe - \pwsh.exe TargetFilename|endswith: .dll TargetFilename|contains|all: - \Users\ - \AppData\ TargetFilename|contains: - \Microsoft\OneDrive\ - \Microsoft OneDrive\ - \Microsoft\Teams\ - \Local\slack\app- - \Local\Programs\Microsoft VS Code\ filter: Image|endswith: \cmd.exe TargetFilename|contains|all: - \Users\ - \AppData\ - \Microsoft\OneDrive\ - \api-ms-win-core- condition: selection and not filter falsepositives: - Unknown level: medium