Query: alert when Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the
Matching passage: Sigma rule: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the. Logsource: windows / process_creation. Rule: title: Potential Persistence Via Powershell Search Order Hijacking - Task id: b66474aa-bd92-4333-a16c-298155b120df related: - id: 6e8811ee-90ba-441e-8486-5653e68b2299 type: similar status: test description: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader references: - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/ author: pH-T (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-04-08 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.005 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: ParentImage: C:\WINDOWS\System32\svchost.exe ParentCommandLine|contains|all: - -k netsvcs - -s Schedule CommandLine|endswith: - ' -windowstyle hidden' - ' -w hidden' - ' -ep bypass' - ' -noni' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup. Logsource: windows / process_creation. Rule: title: VMToolsd Suspicious Child Process id: 5687f942-867b-4578-ade7-1e341c46e99a status: test description: Detects suspicious child process creations of VMware Tools process which may indicate persistence setup references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png - https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf author: bohops, Bhabesh Raj date: 2021-10-08 modified: 2023-07-25 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \vmtoolsd.exe selection_img: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - Cmd.Exe - cscript.exe - MSHTA.EXE - PowerShell.EXE - pwsh.dll - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_vmwaretools_script: Image|endswith: \cmd.exe CommandLine|contains: - \VMware\VMware Tools\poweron-vm-default.bat - \VMware\VMware Tools\poweroff-vm-default.bat - \VMware\VMware Tools\resume-vm-default.bat - \VMware\VMware Tools\suspend-vm-default.bat filter_main_empty: Image|endswith: \cmd.exe CommandLine: '' filter_main_null: Image|endswith: \cmd.exe CommandLine: null condition: all of selection* and not 1 of filter_main_* falsepositives: - Legitimate use by VM administrator level: high