Query: write Sigma for Adversaries may look for details about the network configuration and settings of systems they access or through informat
Matching passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: Firewall Configuration Discovery Via Netsh.EXE id: 0e4164da-94bc-450d-a7be-a4b176179f1f status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules - https://ss64.com/nt/netsh.html author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io' date: 2021-12-07 modified: 2025-10-18 tags: - attack.discovery - attack.t1016 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - netsh - 'show ' - 'firewall ' CommandLine|contains: - 'config ' - 'state ' - 'rule ' - name=all condition: all of selection_* falsepositives: - Administrative activity level: low
Near-miss passage: Sigma rule: Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). U. Logsource: windows / pipe_created. Rule: title: ADFS Database Named Pipe Connection By Uncommon Tool id: 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 status: test description: 'Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens. ' references: - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml - https://o365blog.com/post/adfs/ - https://github.com/Azure/SimuLand author: Roberto Rodriguez @Cyb3rWard0g date: 2021-10-08 modified: 2023-11-30 tags: - attack.collection - attack.t1005 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \MICROSOFT##WID\tsql\query filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\system32\svchost.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\mmc.exe - :\Windows\SysWOW64\wsmprovhost.exe - :\Windows\WID\Binn\sqlwriter.exe - \AzureADConnect.exe - \Microsoft.Identity.Health.Adfs.PshSurrogate.exe - \Microsoft.IdentityServer.ServiceHost.exe - \Microsoft.Tri.Sensor.exe - \sqlservr.exe - \tssdis.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium