Query: detection rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR
Matching passage: Sigma rule: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. Logsource: rpc_firewall / application. Rule: title: Remote Encrypting File System Abuse id: 5f92fff9-82e2-48eb-8fc1-8b133556a551 status: test description: Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR references: - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.lateral-movement logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:df1941c5-fe89-4e79-bf10-463657acf44d or c681d488-d850-11d0-8c52-00c04fd90f7e' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: - df1941c5-fe89-4e79-bf10-463657acf44d - c681d488-d850-11d0-8c52-00c04fd90f7e condition: selection falsepositives: - Legitimate usage of remote file encryption level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".a. Logsource: windows / process_creation. Rule: title: Suspicious Electron Application Child Processes id: f26eb764-fd89-464b-85e2-dc4a8e6e77b8 related: - id: 378a05d8-963c-46c9-bcce-13c7657eac99 type: similar status: test description: 'Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule) ' references: - https://taggart-tech.com/quasar-electron/ - https://github.com/mttaggart/quasar - https://positive.security/blog/ms-officecmd-rce - https://lolbas-project.github.io/lolbas/Binaries/Msedge/ - https://lolbas-project.github.io/lolbas/Binaries/Teams/ - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/ - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-21 modified: 2024-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \chrome.exe - \discord.exe - \GitHubDesktop.exe - \keybase.exe - \msedge.exe - \msedgewebview2.exe - \msteams.exe - \slack.exe - \teams.exe selection_child_image: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \whoami.exe - \wscript.exe selection_child_paths: Image|contains: - :\ProgramData\ - :\Temp\ - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ filter_optional_discord: ParentImage|endswith: \Discord.exe Image|endswith: \cmd.exe CommandLine|contains: \NVSMI\nvidia-smi.exe condition: selection_parent and 1 of selection_child_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium