Query: detect Detect scenarios where a potentially unauthorized application or user is modifying the system time. in logs
Matching passage: Sigma rule: Detect scenarios where a potentially unauthorized application or user is modifying the system time.. Logsource: windows / security. Rule: title: Unauthorized System Time Modification id: faa031b5-21ed-4e02-8881-2591f98d82ed status: test description: Detect scenarios where a potentially unauthorized application or user is modifying the system time. references: - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well) - Live environment caused by malware - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616 author: '@neu5ron' date: 2019-02-05 modified: 2025-12-03 tags: - attack.stealth - attack.t1070.006 logsource: product: windows service: security definition: 'Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change' detection: selection: EventID: 4616 filter_main_svchost: ProcessName: C:\Windows\System32\svchost.exe SubjectUserSid: S-1-5-19 filter_optional_vmtools: ProcessName: - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Windows\System32\VBoxService.exe - C:\Windows\System32\oobe\msoobe.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - HyperV or other virtualization technologies with binary not listed in filter portion of detection level: low
Near-miss passage: Sigma rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is. Logsource: windows / process_access. Rule: title: Potential Credential Dumping Activity Via LSASS id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da status: test description: 'Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. ' references: - https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md - https://research.splunk.com/endpoint/windows_possible_credential_dumping/ author: Samir Bousseaden, Michael Haag date: 2019-04-03 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess|contains: - '0x1038' - '0x1438' - '0x143a' - '0x1fffff' CallTrace|contains: - dbgcore.dll - dbghelp.dll - kernel32.dll - kernelbase.dll - ntdll.dll filter_main_system_user: SourceUser|contains: - AUTHORI - AUTORI filter_optional_thor: CallTrace|contains|all: - :\Windows\Temp\asgard2-agent\ - \thor\thor64.exe+ - '|UNKNOWN(' GrantedAccess: '0x103800' filter_optional_sysmon: SourceImage|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium