Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools. Logsource: windows / process_creation. Rule: title: Sticky Key Like Backdoor Execution id: 2fdefcb3-dbda-401e-ae23-f0db027628bc related: - id: baca5663-583c-45f9-b5dc-ea96a22ce542 type: derived status: test description: Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen references: - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community date: 2018-03-15 modified: 2023-03-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.008 - car.2014-11-003 - car.2014-11-008 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \winlogon.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - \wt.exe CommandLine|contains: - sethc.exe - utilman.exe - osk.exe - Magnify.exe - Narrator.exe - DisplaySwitch.exe condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute liv. Logsource: windows / process_creation. Rule: title: Python Inline Command Execution id: 899133d5-4d7c-4a7f-94ee-27355c879d90 status: test description: Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code. references: - https://docs.python.org/3/using/cmdline.html#cmdoption-c - https://www.revshells.com/ - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 modified: 2025-10-07 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: python.exe - Image|endswith: - python.exe - python3.exe - python2.exe selection_cli: CommandLine|contains: ' -c' filter_main_python_1: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python ParentImage|endswith: \python.exe ParentCommandLine|contains: -E -s -m ensurepip -U --default-pip filter_main_python_trace: ParentImage|startswith: - C:\Program Files\Python - C:\Program Files (x86)\Python CommandLine|contains|all: - -W ignore::DeprecationWarning - '[''install'', ''--no-cache-dir'', ''--no-index'', ''--find-links'',' - '''--upgrade'', ''pip''' filter_optional_vscode: - ParentImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe - ParentImage: - C:\Program Files\Microsoft VS Code\Code.exe - C:\Program Files (x86)\Microsoft VS Code\Code.exe filter_optional_pip: CommandLine|contains|all: - <pip-setuptools-caller> - exec(compile( condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Python libraries that use a flag starting with "-c". Filter according to your environment level: medium