Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for pers. Logsource: windows / process_creation. Rule: title: Uncommon Userinit Child Process id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 related: - id: 21d856f9-9281-4ded-9377-51a1a6e2a432 type: similar status: test description: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence. references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core author: Tom Ueltschi (@c_APT_ure), Tim Shelton date: 2019-01-12 modified: 2023-11-14 tags: - attack.privilege-escalation - attack.t1037.001 - attack.persistence logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_explorer: Image|endswith: :\WINDOWS\explorer.exe filter_optional_logonscripts: CommandLine|contains: - netlogon.bat - UsrLogon.cmd filter_optional_windows_core: CommandLine: PowerShell.exe filter_optional_proquota: Image|endswith: - :\Windows\System32\proquota.exe - :\Windows\SysWOW64\proquota.exe filter_optional_citrix: Image|endswith: - :\Program Files (x86)\Citrix\HDX\bin\cmstart.exe - :\Program Files (x86)\Citrix\HDX\bin\icast.exe - :\Program Files (x86)\Citrix\System32\icast.exe - :\Program Files\Citrix\HDX\bin\cmstart.exe - :\Program Files\Citrix\HDX\bin\icast.exe - :\Program Files\Citrix\System32\icast.exe filter_optional_image_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly. level: high
Near-miss passage: Sigma rule: Detects when a user performs data exfiltration by using DataSvcUtil.exe. Logsource: windows / process_creation. Rule: title: LOLBAS Data Exfiltration by DataSvcUtil.exe id: e290b10b-1023-4452-a4a9-eb31a9013b3a status: test description: Detects when a user performs data exfiltration by using DataSvcUtil.exe references: - https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6 - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services - https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/ author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger date: 2021-09-30 modified: 2022-05-16 tags: - attack.exfiltration - attack.t1567 logsource: category: process_creation product: windows detection: selection_cli: CommandLine|contains: - '/in:' - '/out:' - '/uri:' selection_img: - Image|endswith: \DataSvcUtil.exe - OriginalFileName: DataSvcUtil.exe condition: all of selection* falsepositives: - DataSvcUtil.exe being used may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - DataSvcUtil.exe being executed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium