Query: write Sigma for Detects potential calls to NtOpenProcess directly from NTDLL.
Matching passage: Sigma rule: Detects potential calls to NtOpenProcess directly from NTDLL.. Logsource: windows / process_access. Rule: title: Potential Direct Syscall of NtOpenProcess id: 3f3f3506-1895-401b-9cc3-e86b16e630d0 status: test description: Detects potential calls to NtOpenProcess directly from NTDLL. references: - https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6 author: Christian Burkard (Nextron Systems), Tim Shelton (FP) date: 2021-07-28 modified: 2023-12-13 tags: - attack.execution - attack.t1106 logsource: category: process_access product: windows detection: selection: CallTrace|startswith: UNKNOWN filter_main_vcredist: TargetImage|endswith: vcredist_x64.exe SourceImage|endswith: vcredist_x64.exe filter_main_generic: SourceImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ TargetImage|contains: - :\Program Files (x86)\ - :\Program Files\ - :\Windows\System32\ - :\Windows\SysWOW64\ - :\Windows\WinSxS\ filter_main_kerneltrace_edge: Provider_Name: Microsoft-Windows-Kernel-Audit-API-Calls filter_optional_vmware: TargetImage|endswith: :\Windows\system32\systeminfo.exe SourceImage|endswith: setup64.exe filter_optional_cylance: SourceImage|endswith: :\Windows\Explorer.EXE TargetImage|endswith: :\Program Files\Cylance\Desktop\CylanceUI.exe filter_optional_amazon: SourceImage|endswith: AmazonSSMAgentSetup.exe TargetImage|endswith: AmazonSSMAgentSetup.exe filter_optional_vscode: SourceImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe TargetImage|endswith: \AppData\Local\Programs\Microsoft VS Code\Code.exe filter_optional_teams: TargetImage|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe SourceImage|endswith: \AppData\Local\Microsoft\Teams\current\Teams.exe filter_optional_discord: TargetImage|contains: \AppData\Local\Discord\ TargetImage|endswith: \Discord.exe filter_optional_yammer: SourceImage|contains: \AppData\Local\yammerdesktop\app- SourceImage|endswith: \Yammer.exe TargetImage|contains: \AppData\Local\yammerdesktop\app- TargetImage|endswith: \Yammer.exe GrantedAccess: '0x1000' filter_optional_evernote: TargetImage|endswith: \Evernote\Evernote.exe filter_optional_adobe_acrobat: SourceImage|contains: :\Program Files\Adobe\Acrobat DC\Acrobat\ SourceImage|endswith: \AcroCEF.exe TargetImage|contains: :\Program Files\Adobe\Acrobat DC\Acrobat\ TargetImage|endswith: \AcroCEF.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects the presence and execution of Inveigh via dropped artefacts. Logsource: windows / file_event. Rule: title: HackTool - Inveigh Execution Artefacts id: bb09dd3e-2b78-4819-8e35-a7c1b874e449 status: test description: Detects the presence and execution of Inveigh via dropped artefacts references: - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Inveigh-Log.txt - \Inveigh-Cleartext.txt - \Inveigh-NTLMv1Users.txt - \Inveigh-NTLMv2Users.txt - \Inveigh-NTLMv1.txt - \Inveigh-NTLMv2.txt - \Inveigh-FormInput.txt - \Inveigh.dll - \Inveigh.exe - \Inveigh.ps1 - \Inveigh-Relay.ps1 condition: selection falsepositives: - Unlikely level: critical