Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: Suspicious AgentExecutor PowerShell Execution id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab related: - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_pwsh: CommandLine|contains: - C:\Windows\System32\WindowsPowerShell\v1.0\ - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local pr. Logsource: windows / process_creation. Rule: title: PUA - Ngrok Execution id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31 status: test description: 'Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available. Involved domains are bin.equinox.io for download and *.ngrok.io for connections. ' references: - https://ngrok.com/docs - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/ - https://twitter.com/xorJosh/status/1598646907802451969 - https://www.softwaretestinghelp.com/how-to-use-ngrok/ author: Florian Roth (Nextron Systems) date: 2021-05-14 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains: - ' tcp 139' - ' tcp 445' - ' tcp 3389' - ' tcp 5985' - ' tcp 5986' selection2: CommandLine|contains|all: - ' start ' - --all - --config - .yml selection3: Image|endswith: ngrok.exe CommandLine|contains: - ' tcp ' - ' http ' - ' authtoken ' selection4: CommandLine|contains: - '.exe authtoken ' - .exe start --all condition: 1 of selection* falsepositives: - Another tool that uses the command line switches of Ngrok - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0) level: high