Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker. Logsource: windows / process_creation. Rule: title: PUA - Process Hacker Execution id: 811e0002-b13b-4a15-9d00-a613fce66e42 related: - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a type: similar status: test description: 'Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes. ' references: - https://processhacker.sourceforge.io/ - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/ author: Florian Roth (Nextron Systems) date: 2022-10-10 modified: 2024-11-23 tags: - attack.discovery - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1622 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|contains: \ProcessHacker_ - Image|endswith: \ProcessHacker.exe - OriginalFileName: - ProcessHacker.exe - Process Hacker - Description: Process Hacker - Product: Process Hacker - Hashes|contains: - MD5=68F9B52895F4D34E74112F3129B3B00D - MD5=B365AF317AE730A67C936F21432B9C71 - SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D - SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E - SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F - SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4 - IMPHASH=3695333C60DEDECDCAFF1590409AA462 - IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF condition: selection falsepositives: - While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis level: medium
Near-miss passage: Sigma rule: Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their mal. Logsource: windows / process_creation. Rule: title: Data Export From MSSQL Table Via BCP.EXE id: c615d676-f655-46b9-b913-78729021e5d7 status: test description: 'Detects the execution of the BCP utility in order to export data from the database. Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file. ' references: - https://docs.microsoft.com/en-us/sql/tools/bcp-utility - https://asec.ahnlab.com/en/61000/ - https://asec.ahnlab.com/en/78944/ - https://www.huntress.com/blog/attacking-mssql-servers - https://www.huntress.com/blog/attacking-mssql-servers-pt-ii - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/ - https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems) date: 2024-08-20 tags: - attack.execution - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcp.exe - OriginalFileName: BCP.exe selection_cli: CommandLine|contains: - ' out ' - ' queryout ' condition: all of selection_* falsepositives: - Legitimate data export operations. level: medium