Query: detection rule: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli
Matching passage: Sigma rule: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli. Logsource: windows / process_creation. Rule: title: Net WebClient Casing Anomalies id: c86133ad-4725-4bd0-8170-210788e0a7ba status: test description: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_encoded: CommandLine|contains: - TgBlAFQALgB3AEUAQg - 4AZQBUAC4AdwBFAEIA - OAGUAVAAuAHcARQBCA - bgBFAHQALgB3AGUAYg - 4ARQB0AC4AdwBlAGIA - uAEUAdAAuAHcAZQBiA - TgBFAHQALgB3AGUAYg - OAEUAdAAuAHcAZQBiA - bgBlAFQALgB3AGUAYg - 4AZQBUAC4AdwBlAGIA - uAGUAVAAuAHcAZQBiA - TgBlAFQALgB3AGUAYg - OAGUAVAAuAHcAZQBiA - bgBFAFQALgB3AGUAYg - 4ARQBUAC4AdwBlAGIA - uAEUAVAAuAHcAZQBiA - bgBlAHQALgBXAGUAYg - 4AZQB0AC4AVwBlAGIA - uAGUAdAAuAFcAZQBiA - bgBFAHQALgBXAGUAYg - 4ARQB0AC4AVwBlAGIA - uAEUAdAAuAFcAZQBiA - TgBFAHQALgBXAGUAYg - OAEUAdAAuAFcAZQBiA - bgBlAFQALgBXAGUAYg - 4AZQBUAC4AVwBlAGIA - uAGUAVAAuAFcAZQBiA - TgBlAFQALgBXAGUAYg - OAGUAVAAuAFcAZQBiA - bgBFAFQALgBXAGUAYg - 4ARQBUAC4AVwBlAGIA - uAEUAVAAuAFcAZQBiA - bgBlAHQALgB3AEUAYg - 4AZQB0AC4AdwBFAGIA - uAGUAdAAuAHcARQBiA - TgBlAHQALgB3AEUAYg - OAGUAdAAuAHcARQBiA - bgBFAHQALgB3AEUAYg - 4ARQB0AC4AdwBFAGIA - uAEUAdAAuAHcARQBiA - TgBFAHQALgB3AEUAYg - OAEUAdAAuAHcARQBiA - bgBlAFQALgB3AEUAYg - 4AZQBUAC4AdwBFAGIA - uAGUAVAAuAHcARQBiA - TgBlAFQALgB3AEUAYg - OAGUAVAAuAHcARQBiA - bgBFAFQALgB3AEUAYg - 4ARQBUAC4AdwBFAGIA - uAEUAVAAuAHcARQBiA - TgBFAFQALgB3AEUAYg - OAEUAVAAuAHcARQBiA - bgBlAHQALgBXAEUAYg - 4AZQB0AC4AVwBFAGIA - uAGUAdAAuAFcARQBiA - TgBlAHQALgBXAEUAYg - OAGUAdAAuAFcARQBiA - bgBFAHQALgBXAEUAYg - 4ARQB0AC4AVwBFAGIA - uAEUAdAAuAFcARQBiA - TgBFAHQALgBXAEUAYg - OAEUAdAAuAFcARQBiA - bgBlAFQALgBXAEUAYg - 4AZQBUAC4AVwBFAGIA - uAGUAVAAuAFcARQBiA - TgBlAFQALgBXAEUAYg - OAGUAVAAuAFcARQBiA - bgBFAFQALgBXAEUAYg - 4ARQBUAC4AVwBFAGIA - uAEUAVAAuAFcARQBiA - TgBFAFQALgBXAEUAYg - OAEUAVAAuAFcARQBiA - bgBlAHQALgB3AGUAQg - 4AZQB0AC4AdwBlAEIA - uAGUAdAAuAHcAZQBCA - TgBlAHQALgB3AGUAQg - OAGUAdAAuAHcAZQBCA - bgBFAHQALgB3AGUAQg - 4ARQB0AC4AdwBlAEIA - uAEUAdAAuAHcAZQBCA - TgBFAHQALgB3AGUAQg - OAEUAdAAuAHcAZQBCA - bgBlAFQALgB3AGUAQg - 4AZQBUAC4AdwBlAEIA - uAGUAVAAuAHcAZQBCA - TgBlAFQALgB3AGUAQg - OAGU
Near-miss passage: Sigma rule: Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused b. Logsource: macos / process_creation. Rule: title: JAMF MDM Execution id: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49 status: test description: 'Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices. ' references: - https://github.com/MythicAgents/typhon/ - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html author: Jay Pandit date: 2023-08-22 tags: - attack.execution logsource: category: process_creation product: macos detection: selection: Image|endswith: /jamf CommandLine|contains: - createAccount - manage - removeFramework - removeMdmProfile - resetPassword - setComputerName condition: selection falsepositives: - Legitimate use of the JAMF CLI tool by IT support and administrators level: low