Query: rule covering Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)
Matching passage: Sigma rule: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation). Logsource: windows / process_creation. Rule: title: Shell Process Spawned by Java.EXE id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 related: - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d type: similar status: test description: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \bash.exe - \cmd.exe - \powershell.exe - \pwsh.exe filter_main_build: ParentImage|contains: build CommandLine|contains: build condition: selection and not 1 of filter_main_* falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: medium
Near-miss passage: Sigma rule: Detects a suspicious curl process start on Windows and outputs the requested document to a local file. Logsource: windows / process_creation. Rule: title: Suspicious Curl.EXE Download id: e218595b-bbe7-4ee5-8a96-f32a24ad3468 related: - id: bbeaed61-1990-4773-bf57-b81dbad7db2d type: derived - id: 9a517fca-4ba3-4629-9278-a68694697b81 type: similar status: test description: Detects a suspicious curl process start on Windows and outputs the requested document to a local file references: - https://twitter.com/max_mal_/status/1542461200797163522 - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464 - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/ - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-07-03 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_curl: - Image|endswith: \curl.exe - Product: The curl executable selection_susp_locations: CommandLine|contains: - '%AppData%' - '%Public%' - '%Temp%' - '%tmp%' - \AppData\ - \Desktop\ - \Temp\ - \Users\Public\ - C:\PerfLogs\ - C:\ProgramData\ - C:\Windows\Temp\ selection_susp_extensions: CommandLine|endswith: - .dll - .gif - .jpeg - .jpg - .png - .temp - .tmp - .txt - .vbe - .vbs filter_optional_git_windows: ParentImage: C:\Program Files\Git\usr\bin\sh.exe Image: C:\Program Files\Git\mingw64\bin\curl.exe CommandLine|contains|all: - '--silent --show-error --output ' - gfw-httpget- - AppData condition: selection_curl and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml simulation: - type: atomic-red-team name: Curl Download File technique: T1105 atomic_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a