Query: Sigma rule for Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.
Matching passage: Sigma rule: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.. Logsource: windows / process_creation. Rule: title: DLL Loaded via CertOC.EXE id: 242301bc-f92f-4476-8718-78004a6efd9f related: - id: 84232095-ecca-4015-b0d7-7726507ee793 type: similar status: test description: Detects when a user installs certificates by using CertOC.exe to loads the target DLL file. references: - https://twitter.com/sblmsrsn/status/1445758411803480072?s=20 - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2 - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Austin Songer @austinsonger date: 2021-10-23 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|windash: ' -LoadDLL ' condition: all of selection_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: HackTool - SharpView Execution id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d related: - id: dcd74b95-3f36-4ed9-9598-0490951643aa type: similar status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/tevora-threat/SharpView/ - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview author: frack113 date: 2021-12-10 modified: 2023-02-14 tags: - attack.discovery - attack.t1049 - attack.t1069.002 - attack.t1482 - attack.t1135 - attack.t1033 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: SharpView.exe - Image|endswith: \SharpView.exe - CommandLine|contains: - Add-RemoteConnection - Convert-ADName - ConvertFrom-SID - ConvertFrom-UACValue - Convert-SidToName - Export-PowerViewCSV - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-Interesting - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainComputer - Get-DomainController - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainFileServer - Get-DomainForeign - Get-DomainGPO - Get-DomainGroup - Get-DomainGUIDMap - Get-DomainManagedSecurityGroup - Get-DomainObject - Get-DomainOU - Get-DomainPolicy - Get-DomainSID - Get-DomainSite - Get-DomainSPNTicket - Get-DomainSubnet - Get-DomainTrust - Get-DomainUserEvent - Get-ForestDomain - Get-ForestGlobalCatalog - Get-ForestTrust - Get-GptTmpl - Get-GroupsXML - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetComputer - Get-NetDomain - Get-NetFileServer - Get-NetForest - Get-NetGPO - Get-NetGroupMember - Get-NetLocalGroup - Get-NetLoggedon - Get-NetOU - Get-NetProcess - Get-NetRDPSession - Get-NetSession - Get-NetShare - Get-NetSite - Get-NetSubnet - Get-NetUser - Get-PathAcl - Get-PrincipalContext - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke