Query: Sigma rule for Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for pers
Matching passage: Sigma rule: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for pers. Logsource: windows / process_creation. Rule: title: Uncommon Userinit Child Process id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458 related: - id: 21d856f9-9281-4ded-9377-51a1a6e2a432 type: similar status: test description: Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence. references: - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core author: Tom Ueltschi (@c_APT_ure), Tim Shelton date: 2019-01-12 modified: 2023-11-14 tags: - attack.privilege-escalation - attack.t1037.001 - attack.persistence logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \userinit.exe filter_main_explorer: Image|endswith: :\WINDOWS\explorer.exe filter_optional_logonscripts: CommandLine|contains: - netlogon.bat - UsrLogon.cmd filter_optional_windows_core: CommandLine: PowerShell.exe filter_optional_proquota: Image|endswith: - :\Windows\System32\proquota.exe - :\Windows\SysWOW64\proquota.exe filter_optional_citrix: Image|endswith: - :\Program Files (x86)\Citrix\HDX\bin\cmstart.exe - :\Program Files (x86)\Citrix\HDX\bin\icast.exe - :\Program Files (x86)\Citrix\System32\icast.exe - :\Program Files\Citrix\HDX\bin\cmstart.exe - :\Program Files\Citrix\HDX\bin\icast.exe - :\Program Files\Citrix\System32\icast.exe filter_optional_image_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate logon scripts or custom shells may trigger false positives. Apply additional filters accordingly. level: high
Near-miss passage: Sigma rule: Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissio. Logsource: linux / process_creation. Rule: title: Chmod Targeting Sensitive Directories id: 6419afd1-3742-47a5-a7e6-b50386cd15f8 status: test description: 'Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations. ' references: - https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-03 modified: 2026-03-18 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: /chmod CommandLine|contains: - /tmp/ - /.Library/ - /etc/ - /opt/ filter_main_update_shells: CommandLine|contains: chmod --reference=/etc/shells ParentCommandLine|endswith: /update-shells filter_main_postinst: CommandLine|contains: /etc/ ParentCommandLine|contains|all: - /var/lib/dpkg/info/ - .postinst configure filter_main_apt_key: CommandLine|startswith: chmod 700 /tmp/apt-key-gpghome. filter_main_mkinitramfs: CommandLine|startswith: chmod 755 /var/tmp/mkinitramfs filter_main_landscape: CommandLine: chmod 0775 /etc/landscape/ filter_main_ubuntu_apparmor: CommandLine: chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu condition: selection and not 1 of filter_main_* falsepositives: - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium