Query: write Sigma for Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Matching passage: Sigma rule: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID. Logsource: windows / process_creation. Rule: title: Potential COM Objects Download Cradles Usage - Process Creation id: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf related: - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe type: similar status: test description: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID references: - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0 - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57 author: frack113 date: 2022-12-25 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_1: CommandLine|contains: '[Type]::GetTypeFromCLSID(' selection_2: CommandLine|contains: - 0002DF01-0000-0000-C000-000000000046 - F6D90F16-9C73-11D3-B32E-00C04F990BB4 - F5078F35-C551-11D3-89B9-0000F81FE221 - 88d96a0a-f192-11d4-a65f-0040963251e5 - AFBA6B42-5692-48EA-8141-DC517DCF0EF1 - AFB40FFD-B609-40A3-9828-F88BBE11E4E3 - 88d96a0b-f192-11d4-a65f-0040963251e5 - 2087c2f4-2cef-4953-a8ab-66779b670495 - 000209FF-0000-0000-C000-000000000046 - 00024500-0000-0000-C000-000000000046 condition: all of selection_* falsepositives: - Legitimate use of the library level: medium
Near-miss passage: Sigma rule: Detects when a rule has been added to the Windows Firewall exception list. Logsource: windows / firewall-as. Rule: title: Uncommon New Firewall Rule Added In Windows Firewall Exception List id: cde0a575-7d3d-4a49-9817-b8004a7bf105 status: test description: Detects when a rule has been added to the Windows Firewall exception list references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2025-10-08 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: - 2004 - 2071 - 2097 filter_main_block: Action: 2 filter_main_generic: ApplicationPath|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_covered_paths: ApplicationPath|contains: - C:\PerfLogs\ - C:\Temp\ - C:\Tmp\ - C:\Users\Public\ - C:\Windows\Tasks\ - C:\Windows\Temp\ - \AppData\Local\Temp\ filter_main_system_dllhost: ApplicationPath: System ModifyingApplication: C:\Windows\System32\dllhost.exe filter_main_tiworker: ModifyingApplication|startswith: C:\Windows\WinSxS\ ModifyingApplication|endswith: \TiWorker.exe filter_main_null: ApplicationPath: null filter_optional_no_path: ModifyingApplication: - C:\Windows\System32\svchost.exe - C:\Windows\System32\dllhost.exe ApplicationPath: '' filter_optional_msmpeng: - ModifyingApplication|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ModifyingApplication|endswith: \MsMpEng.exe - ApplicationPath|startswith: - C:\ProgramData\Microsoft\Windows Defender\Platform\ - C:\Program Files\Windows Defender\ ApplicationPath|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* level: medium