Query: write Sigma for Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution proc
Matching passage: Sigma rule: Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution proc. Logsource: windows / ps_script. Rule: title: Security Software Discovery Via Powershell Script id: 904e8e61-8edf-4350-b59c-b905fc8e810c status: test description: 'Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-16 modified: 2023-10-24 tags: - attack.discovery - attack.t1518.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: - get-process | \? - get-process | where - gps | \? - gps | where selection_field: ScriptBlockText|contains: - Company -like - Description -like - Name -like - Path -like - Product -like selection_keywords: ScriptBlockText|contains: - \*avira\* - \*carbonblack\* - \*cylance\* - \*defender\* - \*kaspersky\* - \*malware\* - \*sentinel\* - \*symantec\* - \*virus\* condition: all of selection_* falsepositives: - False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required. - As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced level: medium
Near-miss passage: Sigma rule: Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected lo. Logsource: windows / file_event. Rule: title: Files With System DLL Name In Unsuspected Locations id: 13c02350-4177-4e45-ac17-cf7ca628ff5e status: test description: 'Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.). It is highly recommended to perform an initial baseline before using this rule in production. ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.stealth - attack.t1036.005 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \secur32.dll - \tdh.dll filter_main_generic: TargetFilename|contains: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ - C:\Windows\uus\ condition: selection and not 1 of filter_main_* falsepositives: - Third party software might bundle specific versions of system DLLs. level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_creation_system_dll_files/info.yml