Query: detection rule: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially su
Matching passage: Sigma rule: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially su. Logsource: windows / process_creation. Rule: title: Diskshadow Script Mode - Execution From Potential Suspicious Location id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 related: - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f type: similar - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 type: similar - id: 56b1dde8-b274-435f-a73a-fb75eb81262a type: similar - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 type: similar status: test description: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location. references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: diskshadow.exe - Image|endswith: \diskshadow.exe selection_cli: CommandLine|contains|windash: '-s ' selection_paths: CommandLine|contains: - :\Temp\ - :\Windows\Temp\ - \AppData\Local\ - \AppData\Roaming\ - \ProgramData\ - \Users\Public\ condition: all of selection_* falsepositives: - False positives may occur if you execute the script from one of the paths mentioned in the rule. Apply additional filters that fits your org needs. level: medium
Near-miss passage: Sigma rule: Detects suspicious malformed user agent strings in proxy logs. Logsource: proxy. Rule: title: Suspicious User Agent id: 7195a772-4b3f-43a4-a210-6a003d65caa1 status: test description: Detects suspicious malformed user agent strings in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-10-31 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection1: c-useragent|startswith: - user-agent - 'Mozilla/3.0 ' - 'Mozilla/2.0 ' - 'Mozilla/1.0 ' - 'Mozilla ' - ' Mozilla/' - Mozila/ - Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol selection2: c-useragent|contains: - ' (compatible;MSIE ' - '.0;Windows NT ' - loader selection3: c-useragent: - _ - CertUtil URL Agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - HTTPS - Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a - x - xxx falsepositives: - c-useragent: Mozilla/3.0 * Acrobat * - cs-host|endswith: - .acrobat.com - .adobe.com - .adobe.io condition: 1 of selection* and not falsepositives falsepositives: - Unknown level: high