Query: detection rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat
Matching passage: Sigma rule: Adversaries may look for details about the network configuration and settings of systems they access or through informat. Logsource: windows / process_creation. Rule: title: HackTool - SharpView Execution id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d related: - id: dcd74b95-3f36-4ed9-9598-0490951643aa type: similar status: test description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems references: - https://github.com/tevora-threat/SharpView/ - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview author: frack113 date: 2021-12-10 modified: 2023-02-14 tags: - attack.discovery - attack.t1049 - attack.t1069.002 - attack.t1482 - attack.t1135 - attack.t1033 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: SharpView.exe - Image|endswith: \SharpView.exe - CommandLine|contains: - Add-RemoteConnection - Convert-ADName - ConvertFrom-SID - ConvertFrom-UACValue - Convert-SidToName - Export-PowerViewCSV - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-Interesting - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainComputer - Get-DomainController - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainFileServer - Get-DomainForeign - Get-DomainGPO - Get-DomainGroup - Get-DomainGUIDMap - Get-DomainManagedSecurityGroup - Get-DomainObject - Get-DomainOU - Get-DomainPolicy - Get-DomainSID - Get-DomainSite - Get-DomainSPNTicket - Get-DomainSubnet - Get-DomainTrust - Get-DomainUserEvent - Get-ForestDomain - Get-ForestGlobalCatalog - Get-ForestTrust - Get-GptTmpl - Get-GroupsXML - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetComputer - Get-NetDomain - Get-NetFileServer - Get-NetForest - Get-NetGPO - Get-NetGroupMember - Get-NetLocalGroup - Get-NetLoggedon - Get-NetOU - Get-NetProcess - Get-NetRDPSession - Get-NetSession - Get-NetShare - Get-NetSite - Get-NetSubnet - Get-NetUser - Get-PathAcl - Get-PrincipalContext - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke
Near-miss passage: Sigma rule: Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or secur. Logsource: aws / cloudtrail. Rule: title: AWS SAML Provider Deletion Activity id: ccd6a6c8-bb4e-4a91-9d2a-07e632819374 status: experimental description: 'Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access. An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it. ' references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html author: Ivan Saakov date: 2024-12-19 tags: - attack.stealth - attack.t1078.004 - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.t1531 - attack.impact logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: DeleteSAMLProvider status: success condition: selection falsepositives: - Automated processes using tools like Terraform may trigger this alert. - Legitimate administrative actions by authorized system administrators could cause this alert. Verify the user identity, user agent, and hostname to ensure they are expected. - Deletions by unfamiliar users should be investigated. If the behavior is known and expected, it can be exempted from the rule. level: medium