Query: write Sigma for Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro
Matching passage: Sigma rule: Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse pro. Logsource: windows / network_connection. Rule: title: Communication To LocaltoNet Tunneling Service Initiated id: 3ab65069-d82a-4d44-a759-466661a082d1 status: test description: 'Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls. ' references: - https://localtonet.com/documents/supported-tunnels - https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications author: Andreas Braathen (mnemonic.io) date: 2024-06-17 tags: - attack.command-and-control - attack.t1572 - attack.t1090 - attack.t1102 logsource: category: network_connection product: windows detection: selection: DestinationHostname|endswith: - .localto.net - .localtonet.com Initiated: 'true' condition: selection falsepositives: - Legitimate use of the LocaltoNet service. level: high
Near-miss passage: Sigma rule: Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abus. Logsource: windows / file_event. Rule: title: Suspicious LNK Double Extension File Created id: 3215aa19-f060-4332-86d5-5602511f3ca8 related: - id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e type: derived status: test description: 'Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default. ' references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-11-07 modified: 2023-10-18 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: .lnk TargetFilename|contains: - .doc. - .docx. - .jpg. - .pdf. - .ppt. - .pptx. - .xls. - .xlsx. filter_main_recent: TargetFilename|contains: \AppData\Roaming\Microsoft\Windows\Recent\ filter_optional_office_recent: Image|endswith: - \excel.exe - \powerpnt.exe - \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Office\Recent\ filter_optional_office_excel: Image|endswith: \excel.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Excel filter_optional_office_powerpoint: Image|endswith: \powerpnt.exe TargetFilename|contains: \AppData\Roaming\Microsoft\PowerPoint filter_optional_office_word: Image|endswith: \winword.exe TargetFilename|contains: \AppData\Roaming\Microsoft\Word condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Some tuning is required for other general purpose directories of third party apps level: medium regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension/info.yml