Query: detection rule: Detects driver load of the System Informer tool
Matching passage: Sigma rule: Detects driver load of the System Informer tool. Logsource: windows / driver_load. Rule: title: PUA - System Informer Driver Load id: 10cb6535-b31d-4512-9962-513dcbc42cc1 related: - id: 67add051-9ee7-4ad3-93ba-42935615ae8d type: similar status: test description: Detects driver load of the System Informer tool references: - https://systeminformer.sourceforge.io/ - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|endswith: \SystemInformer.sys - Hashes|contains: - SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24 - SHA256=A41348BEC147CA4D9EA2869817527EB5CEA2E20202AF599D2B30625433BCF454 - SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D - SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B - SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D - SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34 - SHA256=047C42E9BBA28366868847C7DAFC1E043FB038C796422D37220493517D68EE89 - SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB - SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B - SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97 - SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656 - SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4 - SHA256=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Near-miss passage: Sigma rule: Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish p. Logsource: macos / file_event. Rule: title: Startup Item File Created - MacOS id: dfe8b941-4e54-4242-b674-6b613d521962 status: test description: 'Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2024-08-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1037.005 logsource: category: file_event product: macos detection: selection: TargetFilename|startswith: - /Library/StartupItems/ - /System/Library/StartupItems TargetFilename|endswith: .plist condition: selection falsepositives: - Legitimate administration activities level: low