Query: detection rule: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, P
Matching passage: Sigma rule: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, P. Logsource: windows / process_creation. Rule: title: Suspicious Binary In User Directory Spawned From Office Application id: aa3a6f94-890e-4e22-b634-ffdfd54792cc status: test description: Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio) references: - https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign - https://www.virustotal.com/gui/file/23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57 author: Jason Lynch date: 2019-04-02 modified: 2023-02-04 tags: - attack.execution - attack.t1204.002 - attack.g0046 - car.2013-05-002 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \WINWORD.EXE - \EXCEL.EXE - \POWERPNT.exe - \MSPUB.exe - \VISIO.exe - \MSACCESS.exe - \EQNEDT32.exe Image|startswith: C:\users\ Image|endswith: .exe filter: Image|endswith: \Teams.exe condition: selection and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the creation of a named pipe seen used by known APTs or malware.. Logsource: windows / pipe_created. Rule: title: Malicious Named Pipe Created id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a status: test description: Detects the creation of a named pipe seen used by known APTs or malware. references: - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/ - https://securelist.com/faq-the-projectsauron-apt/75533/ - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://www.us-cert.gov/ncas/alerts/TA17-117A - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://github.com/RiccardoAncarani/LiquidSnake - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Florian Roth (Nextron Systems), blueteam0ps, elhoim date: 2017-11-06 modified: 2023-08-07 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: - \46a676ab7f179e511e30dd2dc41bd388 - \583da945-62af-10e8-4902-a8f205c72b2e - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7 - \9f81f59bc58452127884ce513865ed20 - \adschemerpc - \ahexec - \AnonymousPipe - \bc31a7 - \bc367 - \bizkaz - \csexecsvc - \dce_3d - \e710f28d59aa529d6792ca6ff0ca1b34 - \gruntsvc - \isapi_dg - \isapi_dg2 - \isapi_http - \jaccdpqnvbrrxlaf - \lsassw - \NamePipe_MoreWindows - \pcheap_reuse - \Posh* - \rpchlp_3 - \sdlrpc - \svcctl - \testPipe -