Query: alert when Detects execution of different log query utilities and commands to search and dump the content of specific event logs or
Matching passage: Sigma rule: Detects execution of different log query utilities and commands to search and dump the content of specific event logs or. Logsource: windows / process_creation. Rule: title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf related: - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f type: derived status: test description: 'Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc. ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://www.group-ib.com/blog/apt41-world-tour-2021/ - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today - https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ - https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-09-09 modified: 2025-12-02 tags: - attack.credential-access - attack.discovery - attack.t1552 - attack.t1087 logsource: category: process_creation product: windows detection: selection_wmi: CommandLine|contains|all: - Select - Win32_NTLogEvent selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cli: CommandLine|contains: - ' qe ' - ' query-events ' selection_wmic_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains: ' ntevent' selection_cmdlet: CommandLine|contains: - 'Get-WinEvent ' - 'get-eventlog ' selection_logs_name: CommandLine|contains: - Microsoft-Windows-PowerShell - Microsoft-Windows-Security-Auditing - Microsoft-Windows-TerminalServices-LocalSessionManager - Microsof
Near-miss passage: Sigma rule: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of a. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting id: 396ae3eb-4174-4b9b-880e-dc0364d78a19 status: test description: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53 - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/ author: Nasreddine Bencherchali (Nextron Systems) date: 2021-04-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Outlook\LoadMacroProviderOnBoot Details|contains: '0x00000001' condition: selection falsepositives: - Unknown level: high