Query: detection rule: Detects a suspicious or uncommon parent processes of PowerShell
Matching passage: Sigma rule: Detects a suspicious or uncommon parent processes of PowerShell. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parent Process id: 754ed792-634f-40ae-b3bc-e0448d33f695 related: - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: derived status: test description: Detects a suspicious or uncommon parent processes of PowerShell references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26 author: Teymur Kheirkhabarov, Harish Segar date: 2020-03-20 modified: 2023-02-04 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_parent: - ParentImage|contains: tomcat - ParentImage|endswith: - \amigo.exe - \browser.exe - \chrome.exe - \firefox.exe - \httpd.exe - \iexplore.exe - \jbosssvc.exe - \microsoftedge.exe - \microsoftedgecp.exe - \MicrosoftEdgeSH.exe - \mshta.exe - \nginx.exe - \outlook.exe - \php-cgi.exe - \regsvr32.exe - \rundll32.exe - \safari.exe - \services.exe - \sqlagent.exe - \sqlserver.exe - \sqlservr.exe - \vivaldi.exe - \w3wp.exe selection_powershell: - Image|endswith: - \powershell.exe - \pwsh.exe - CommandLine|contains: - /c powershell - /c pwsh - Description: Windows PowerShell - Product: PowerShell Core 6 - OriginalFileName: - PowerShell.EXE - pwsh.dll condition: all of selection_* falsepositives: - Other scripts level: high
Near-miss passage: Sigma rule: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows. Logsource: windows / file_event. Rule: title: Suspicious Double Extension Files id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e related: - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 type: derived - id: 3215aa19-f060-4332-86d5-5602511f3ca8 type: similar status: test description: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default. references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-06-19 modified: 2026-03-31 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection_gen: TargetFilename|endswith: - .exe - .iso - .rar - .svg - .zip TargetFilename|contains: - .doc. - .docx. - .gif. - .jpeg. - .jpg. - .mp3. - .mp4. - .pdf. - .png. - .ppt. - .pptx. - .rtf. - .svg. - .txt. - .xls. - .xlsx. selection_exe: TargetFilename|endswith: - .rar.exe - .zip.exe filter_icons_linux: TargetFilename|startswith: /usr/share/icons/ condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unlikely level: high