Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware. Logsource: windows / process_creation. Rule: title: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE id: 81325ce1-be01-4250-944f-b4789644556f related: - id: 43f487f0-755f-4c2a-bce7-d6d2eec2fcf8 type: derived status: test description: Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware references: - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/ - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04 - https://blog.talosintelligence.com/gophish-powerrat-dcrat/ author: Florian Roth (Nextron Systems) date: 2022-02-21 modified: 2025-10-07 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_1_create: Image|endswith: \schtasks.exe CommandLine|contains|windash: ' /create ' selection_1_all_folders: CommandLine|contains: - :\Perflogs - :\Users\All Users\ - :\Users\Default\ - :\Users\Public - :\Windows\Temp - \AppData\Local\ - \AppData\Roaming\ - '%AppData%' - '%Public%' selection_2_parent: ParentCommandLine|endswith: \svchost.exe -k netsvcs -p -s Schedule selection_2_some_folders: CommandLine|contains: - :\Perflogs - :\Windows\Temp - \Users\Public - '%Public%' filter_optional_other: - ParentCommandLine|contains: unattended.ini - CommandLine|contains: update_task.xml filter_optional_team_viewer: CommandLine|contains: /Create /TN TVInstallRestore /TR filter_optional_avira_install: CommandLine|contains|all: - '/Create /Xml ' - \Temp\.CR. - \Avira_Security_Installation.xml filter_optional_avira_other: CommandLine|contains|all: - /Create /F /TN - '/Xml ' - \Temp\ - Avira_ CommandLine|contains: - .tmp\UpdateFallbackTask.xml - .tmp\WatchdogServiceControlManagerTimeout.xml - .tmp\SystrayAutostart.xml - .tmp\MaintenanceTask.xml filter_optional_klite_codec: CommandLine|contains|all: - \Temp\ - '/Create /TN "klcp_update" /XML ' - \klcp_update_task.xml condition: ( all of selection_1_* or all of selection_2_* ) and not 1 of filter_optional_* falsepositives: - Benign scheduled tasks creations or executions that happen often during software installations - Software that uses the AppData folder and scheduled tasks to update the software in the AppData folders level: medium
Near-miss passage: Sigma rule: Detects specific combinations of encoding methods in PowerShell via the commandline. Logsource: windows / process_creation. Rule: title: Potential Encoded PowerShell Patterns In CommandLine id: cdf05894-89e7-4ead-b2b0-0a5f97a90f2f related: - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6 type: similar status: test description: Detects specific combinations of encoding methods in PowerShell via the commandline references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-01-26 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_to_1: CommandLine|contains: - ToInt - ToDecimal - ToByte - ToUint - ToSingle - ToSByte selection_to_2: CommandLine|contains: - ToChar - ToString - String selection_gen_1: CommandLine|contains|all: - char - join selection_gen_2: CommandLine|contains|all: - split - join condition: selection_img and (all of selection_to_* or 1 of selection_gen_*) falsepositives: - Unknown level: low