Query: detection rule: Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of
Matching passage: Sigma rule: Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of. Logsource: windows / registry_set. Rule: title: DNS-over-HTTPS Enabled by Registry id: 04b45a8a-d11d-49e4-9acc-4a1b524407a5 status: test description: 'Detects when a user enables DNS-over-HTTPS. This can be used to hide internet activity or be used to hide the process of exfiltrating data. With this enabled organization will lose visibility into data such as query type, response and originating IP that are used to determine bad actors. ' references: - https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html - https://github.com/elastic/detection-rules/issues/1371 - https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode - https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS author: Austin Songer date: 2021-07-22 modified: 2023-08-17 tags: - attack.persistence - attack.stealth - attack.defense-impairment - attack.t1140 - attack.t1112 logsource: product: windows category: registry_set detection: selection_edge: TargetObject|endswith: \SOFTWARE\Policies\Microsoft\Edge\BuiltInDnsClientEnabled Details: DWORD (0x00000001) selection_chrome: TargetObject|endswith: \SOFTWARE\Google\Chrome\DnsOverHttpsMode Details: secure selection_firefox: TargetObject|endswith: \SOFTWARE\Policies\Mozilla\Firefox\DNSOverHTTPS\Enabled Details: DWORD (0x00000001) condition: 1 of selection_* falsepositives: - Unlikely level: medium
Near-miss passage: Sigma rule: Detects suspicious print spool service (spoolsv.exe) child processes.. Logsource: windows / process_creation. Rule: title: Suspicious Spool Service Child Process id: dcdbc940-0bff-46b2-95f3-2d73f848e33b status: test description: Detects suspicious print spool service (spoolsv.exe) child processes. references: - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule) date: 2021-07-11 modified: 2024-12-01 tags: - attack.execution - attack.t1203 - attack.privilege-escalation - attack.t1068 logsource: category: process_creation product: windows detection: spoolsv: ParentImage|endswith: \spoolsv.exe IntegrityLevel: - System - S-1-16-16384 suspicious_unrestricted: Image|endswith: - \gpupdate.exe - \whoami.exe - \nltest.exe - \taskkill.exe - \wmic.exe - \taskmgr.exe - \sc.exe - \findstr.exe - \curl.exe - \wget.exe - \certutil.exe - \bitsadmin.exe - \accesschk.exe - \wevtutil.exe - \bcdedit.exe - \fsutil.exe - \cipher.exe - \schtasks.exe - \write.exe - \wuauclt.exe - \systeminfo.exe - \reg.exe - \query.exe suspicious_net: Image|endswith: - \net.exe - \net1.exe suspicious_net_filter: CommandLine|contains: start suspicious_cmd: Image|endswith: \cmd.exe suspicious_cmd_filter: CommandLine|contains: - .spl - route add - program files suspicious_netsh: Image|endswith: \netsh.exe suspicious_netsh_filter: CommandLine|contains: - add portopening - rule name suspicious_powershell: Image|endswith: - \powershell.exe - \pwsh.exe suspicious_powershell_filter: CommandLine|contains: .spl suspicious_rundll32_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE suspicious_rundll32_cli: CommandLine|endswith: rundll32.exe condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* ) falsepositives: - Unknown level: high