Query: detect Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dum in logs
Matching passage: Sigma rule: Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dum. Logsource: windows / process_creation. Rule: title: Potential Adplus.EXE Abuse id: 2f869d59-7f6a-4931-992c-cce556ff2d53 status: test description: Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/ - https://twitter.com/nas_bench/status/1534916659676422152 - https://twitter.com/nas_bench/status/1534915321856917506 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-09 modified: 2023-06-23 tags: - attack.execution - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \adplus.exe - OriginalFileName: Adplus.exe selection_cli: CommandLine|contains: - ' -hang ' - ' -pn ' - ' -pmn ' - ' -p ' - ' -po ' - ' -c ' - ' -sc ' condition: all of selection_* falsepositives: - Legitimate usage of Adplus for debugging purposes level: high
Near-miss passage: Sigma rule: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disab. Logsource: windows / process_creation. Rule: title: Suspicious Manipulation Of Default Accounts Via Net.EXE id: 5b768e71-86f2-4879-b448-81061cbae951 status: test description: Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc references: - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/ - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_user_option: CommandLine|contains: ' user ' selection_username: CommandLine|contains: - ' Järjestelmänvalvoja ' - ' Rendszergazda ' - ' Администратор ' - ' Administrateur ' - ' Administrador ' - ' Administratör ' - ' Administrator ' - ' guest ' - ' DefaultAccount ' - ' "Järjestelmänvalvoja" ' - ' "Rendszergazda" ' - ' "Администратор" ' - ' "Administrateur" ' - ' "Administrador" ' - ' "Administratör" ' - ' "Administrator" ' - ' "guest" ' - ' "DefaultAccount" ' - ' ''Järjestelmänvalvoja'' ' - ' ''Rendszergazda'' ' - ' ''Администратор'' ' - ' ''Administrateur'' ' - ' ''Administrador'' ' - ' ''Administratör'' ' - ' ''Administrator'' ' - ' ''guest'' ' - ' ''DefaultAccount'' ' filter: CommandLine|contains|all: - guest - /active no condition: all of selection_* and not filter falsepositives: - Some false positives could occur with the admin or guest account. It depends on the scripts being used by the admins in your env. If you experience a lot of FP you could reduce the level to medium level: high