Query: detect Detects the creation of a named file stream with the imphash of a well-known hack tool in logs
Matching passage: Sigma rule: Detects the creation of a named file stream with the imphash of a well-known hack tool. Logsource: windows / create_stream_hash. Rule: title: HackTool Named File Stream Created id: 19b041f6-e583-40dc-b842-d6fa8011493f status: test description: Detects the creation of a named file stream with the imphash of a well-known hack tool references: - https://github.com/gentilkiwi/mimikatz - https://github.com/topotam/PetitPotam - https://github.com/ohpe/juicy-potato - https://github.com/antonioCoco/RoguePotato - https://www.tarasco.org/security/pwdump_7/ - https://github.com/fortra/nanodump - https://github.com/codewhitesec/HandleKatz - https://github.com/xuanxuan0/DripLoader - https://github.com/hfiref0x/UACME - https://github.com/outflanknl/Dumpert - https://github.com/wavestone-cdt/EDRSandblast author: Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2024-11-23 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon config with Imphash logging activated' detection: selection: Hash|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0
Near-miss passage: Sigma rule: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permi. Logsource: windows / process_creation. Rule: title: Suspicious Recursive Takeown id: 554601fb-9b71-4bcc-abf4-21a611be4fde status: test description: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility author: frack113 date: 2022-01-30 modified: 2022-11-21 tags: - attack.defense-impairment - attack.t1222.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \takeown.exe CommandLine|contains|all: - '/f ' - /r condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium