Query: alert when Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accou
Matching passage: Sigma rule: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accou. Logsource: windows / ps_script. Rule: title: Get-ADUser Enumeration Using UserAccountControl Flags id: 96c982fe-3d08-4df4-bed2-eb14e02f21c8 status: test description: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting - https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/ author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADUser - -Filter - useraccountcontrol - -band - '4194304' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Near-miss passage: Sigma rule: Detects certain command line parameters often used during reconnaissance activity via web shells. Logsource: windows / process_creation. Rule: title: Webshell Detection With Command Line Keywords id: bed2a484-9348-4143-8a8a-b801c979301c status: test description: Detects certain command line parameters often used during reconnaissance activity via web shells references: - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html - https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/ - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson date: 2017-01-01 modified: 2026-07-14 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \w3wp.exe - \php-cgi.exe - \nginx.exe - \httpd.exe - \caddy.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_susp_net_utility: OriginalFileName: - net.exe - net1.exe CommandLine|contains: - ' user ' - ' use ' - ' group ' selection_susp_ping_utility: OriginalFileName: ping.exe CommandLine|contains: ' -n ' selection_susp_change_dir: CommandLine|contains: - '&cd&echo' - 'cd /d ' selection_susp_wmic_utility: OriginalFileName: wmic.exe CommandLine|contains: ' /node:' selection_susp_powershell_cli: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -enc ' - ' -EncodedCommand ' - ' -w hidden ' - ' -windowstyle hidden' - .WebClient).Download selection_susp_misc_discovery_binaries: - Image|endswith: - \dsquery.exe - \find.exe - \findstr.exe - \ipconfig.exe - \netstat.exe - \nslookup.exe - \pathping.exe - \quser.exe - \schtasks.exe - \systeminfo.exe - \tasklist.exe - \tracert.exe - \wevtutil.exe - \whoami.exe - OriginalFileName: - dsquery.exe - find.exe - findstr.exe - ipconfig.exe - netstat.exe - nslookup.exe - pathping.exe - quser.exe - schtasks.exe - sysinfo.exe - tasklist.exe - tracert.exe - VSSADMIN.EXE - wevtutil.exe - whoami.exe selection_susp_misc_discovery_commands: CommandLine|contains: - ' Test-NetConnection ' - dir \ condition: 1 of selection_webserver_* and 1 of selectio