Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.. Logsource: windows / process_creation. Rule: title: Potential Cookies Session Hijacking id: 5a6e1e16-07de-48d8-8aae-faa766c05e88 status: test description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-c\s - CommandLine|contains: --cookie-jar condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
Near-miss passage: Sigma rule: Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection. Logsource: aws / cloudtrail. Rule: title: AWS GuardDuty Detector Deleted Or Updated id: d2656e78-c069-4571-8220-9e0ab5913f19 status: experimental description: 'Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. Upon deletion, GuardDuty stops monitoring the environment and all existing findings are lost. Verify with the user identity that this activity is legitimate. ' references: - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html - https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html - https://docs.datadoghq.com/security/default_rules/719-39f-9cd/ - https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled - https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html - https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml - https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml - https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm - https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/ - https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/ - https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion author: suktech24 date: 2025-11-27 tags: - attack.defense-impairment - attack.t1685 - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection_event_source: eventSource: guardduty.amazonaws.com selection_action_delete: eventName: DeleteDetector selection_action_update: eventName: UpdateDetector requestParameters.enable: 'false' selection_status_success: errorCode: Success selection_status_null: errorCode: null condition: selection_event_source and 1 of selection_action_* and 1 of selection_status_* falsepositives: - Legitimate detector deletion by an admin (e.g., during account decommissioning). - Temporary disablement for troubleshooting (verify via change management tickets). - Automated deployment tools (e.g. Terraform) managing GuardDuty state. level: high