Query: detection rule: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt
Matching passage: Sigma rule: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of VsCode id: 5a3164f2-b373-4152-93cf-090b13c12d27 status: test description: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. references: - https://twitter.com/nas_bench/status/1618021838407495681 - https://twitter.com/nas_bench/status/1618021415852335105 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-26 modified: 2023-10-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \code.exe selection_children_images: Image|endswith: - \calc.exe - \regsvr32.exe - \rundll32.exe - \cscript.exe - \wscript.exe selection_children_cli: Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - Invoke-Expressions - IEX - Invoke-Command - ICM - DownloadString - rundll32 - regsvr32 - wscript - cscript selection_children_paths: Image|contains: - :\Users\Public\ - :\Windows\Temp\ - :\Temp\ condition: selection_parent and 1 of selection_children_* falsepositives: - In development environment where VsCode is used heavily. False positives may occur when developers use task to compile or execute different types of code. Remove or add processes accordingly level: medium
Near-miss passage: Sigma rule: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h. Logsource: windows / ps_script. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet - PS id: 22d80745-6f2c-46da-826b-77adaededd74 related: - id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac type: similar status: test description: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7) references: - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_sddl_flag: ScriptBlockText|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: ScriptBlockText|contains|all: - 'Set-Service ' - D;; ScriptBlockText|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Rare intended use of hidden services - Rare FP could occur due to the non linearity of the ScriptBlockText log level: high