Query: Sigma YAML for windows / process_access
Matching passage: Sigma rule: Detects potential calls to NtOpenProcess directly from NTDLL.. Logsource: windows / process_access. Rule: title: Potential Direct Syscall of NtOpenProcess id: 3f3f3506-1895-401b-9cc3-e86b16e630d0 status: test description: Detects potential calls to NtOpenProcess directly from NTDLL. references: - https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 author: Christian Burkard (Nextron Systems), Tim Shelton (FP) date: 2021-07-28 modified: 2023-12-13 tags: - attack.execution - attack.t1106 logsource: category: process_access product: windows detection: selection: CallTrace|startswith: UNKNOWN filter_main_vcredist: TargetImage|endswith: vcredist_x64.exe SourceImage|endswith: vcredist_x64.exe filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ TargetImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ filter_main_kerneltrace_edge: Provider_Name: Microsoft-Windows-Kernel-Audit-API-Calls filter_optional_vmware: TargetImage|endswith: :\Windows\system32\systeminfo.exe SourceImage|endswith: setup64.exe filter_optional_cylance: SourceImage|endswith: :\Windows\Explorer.EXE TargetImage|endswith: :\Program Files\Cylance\Desktop\CylanceUI.exe filter_optional_amazon: SourceImage|endswith: AmazonSSMAgentSetup.exe TargetImage|endswith: AmazonSSMAgentSetup.exe filter_optional_vscode: SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe TargetImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe filter_optional_teams: TargetImage|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe SourceImage|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe filter_optional_discord: TargetImage|contains: \AppData\Local\Discord\ TargetImage|endswith: \Discord.exe filter_optional_yammer: SourceImage|contains: \AppData\Local\yammerdesktop\app- SourceImage|endswith: \Yammer.exe TargetImage|contains: \AppData\Local\yammerdesktop\app- TargetImage|endswith: \Yammer.exe GrantedAccess: '0x1000' filter_optional_evernote: TargetImage|endswith: \Evernote\Evernote.exe filter_optional_adobe_acrobat: SourceImage|contains: :\Program Files\Adobe\Acrobat DC\Acrobat\ SourceImage|endswith: \AcroCEF.exe TargetImage|contains: :\Program Files\Adobe\Acrobat DC\Acrobat\ TargetImage|endswith: \AcroCEF.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto. Logsource: windows / file_access. Rule: title: Access To Crypto Currency Wallets By Uncommon Applications id: f41b0311-44f9-44f0-816d-dd45e39d4bc8 status: test description: 'Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2024-07-29 tags: - attack.t1003 - attack.credential-access logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: - FileName|contains: - \AppData\Roaming\Ethereum\keystore\ - \AppData\Roaming\EthereumClassic\keystore\ - \AppData\Roaming\monero\wallets\ - FileName|endswith: - \AppData\Roaming\Bitcoin\wallet.dat - \AppData\Roaming\BitcoinABC\wallet.dat - \AppData\Roaming\BitcoinSV\wallet.dat - \AppData\Roaming\DashCore\wallet.dat - \AppData\Roaming\DogeCoin\wallet.dat - \AppData\Roaming\Litecoin\wallet.dat - \AppData\Roaming\Ripple\wallet.dat - \AppData\Roaming\Zcash\wallet.dat filter_main_system: Image: System filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_optional_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\ Image|endswith: - \MpCopyAccelerator.exe - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Antivirus, Anti-Spyware, Anti-Malware Software - Backup software - Legitimate software installed on partitions other than "C:\" - Searching software such as "everything.exe" level: medium