Query: write Sigma for Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli
Matching passage: Sigma rule: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli. Logsource: windows / process_creation. Rule: title: Net WebClient Casing Anomalies id: c86133ad-4725-4bd0-8170-210788e0a7ba status: test description: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_encoded: CommandLine|contains: - TgBlAFQALgB3AEUAQg - 4AZQBUAC4AdwBFAEIA - OAGUAVAAuAHcARQBCA - bgBFAHQALgB3AGUAYg - 4ARQB0AC4AdwBlAGIA - uAEUAdAAuAHcAZQBiA - TgBFAHQALgB3AGUAYg - OAEUAdAAuAHcAZQBiA - bgBlAFQALgB3AGUAYg - 4AZQBUAC4AdwBlAGIA - uAGUAVAAuAHcAZQBiA - TgBlAFQALgB3AGUAYg - OAGUAVAAuAHcAZQBiA - bgBFAFQALgB3AGUAYg - 4ARQBUAC4AdwBlAGIA - uAEUAVAAuAHcAZQBiA - bgBlAHQALgBXAGUAYg - 4AZQB0AC4AVwBlAGIA - uAGUAdAAuAFcAZQBiA - bgBFAHQALgBXAGUAYg - 4ARQB0AC4AVwBlAGIA - uAEUAdAAuAFcAZQBiA - TgBFAHQALgBXAGUAYg - OAEUAdAAuAFcAZQBiA - bgBlAFQALgBXAGUAYg - 4AZQBUAC4AVwBlAGIA - uAGUAVAAuAFcAZQBiA - TgBlAFQALgBXAGUAYg - OAGUAVAAuAFcAZQBiA - bgBFAFQALgBXAGUAYg - 4ARQBUAC4AVwBlAGIA - uAEUAVAAuAFcAZQBiA - bgBlAHQALgB3AEUAYg - 4AZQB0AC4AdwBFAGIA - uAGUAdAAuAHcARQBiA - TgBlAHQALgB3AEUAYg - OAGUAdAAuAHcARQBiA - bgBFAHQALgB3AEUAYg - 4ARQB0AC4AdwBFAGIA - uAEUAdAAuAHcARQBiA - TgBFAHQALgB3AEUAYg - OAEUAdAAuAHcARQBiA - bgBlAFQALgB3AEUAYg - 4AZQBUAC4AdwBFAGIA - uAGUAVAAuAHcARQBiA - TgBlAFQALgB3AEUAYg - OAGUAVAAuAHcARQBiA - bgBFAFQALgB3AEUAYg - 4ARQBUAC4AdwBFAGIA - uAEUAVAAuAHcARQBiA - TgBFAFQALgB3AEUAYg - OAEUAVAAuAHcARQBiA - bgBlAHQALgBXAEUAYg - 4AZQB0AC4AVwBFAGIA - uAGUAdAAuAFcARQBiA - TgBlAHQALgBXAEUAYg - OAGUAdAAuAFcARQBiA - bgBFAHQALgBXAEUAYg - 4ARQB0AC4AVwBFAGIA - uAEUAdAAuAFcARQBiA - TgBFAHQALgBXAEUAYg - OAEUAdAAuAFcARQBiA - bgBlAFQALgBXAEUAYg - 4AZQBUAC4AVwBFAGIA - uAGUAVAAuAFcARQBiA - TgBlAFQALgBXAEUAYg - OAGUAVAAuAFcARQBiA - bgBFAFQALgBXAEUAYg - 4ARQBUAC4AVwBFAGIA - uAEUAVAAuAFcARQBiA - TgBFAFQALgBXAEUAYg - OAEUAVAAuAFcARQBiA - bgBlAHQALgB3AGUAQg - 4AZQB0AC4AdwBlAEIA - uAGUAdAAuAHcAZQBCA - TgBlAHQALgB3AGUAQg - OAGUAdAAuAHcAZQBCA - bgBFAHQALgB3AGUAQg - 4ARQB0AC4AdwBlAEIA - uAEUAdAAuAHcAZQBCA - TgBFAHQALgB3AGUAQg - OAEUAdAAuAHcAZQBCA - bgBlAFQALgB3AGUAQg - 4AZQBUAC4AdwBlAEIA - uAGUAVAAuAHcAZQBCA - TgBlAFQALgB3AGUAQg - OAGU
Near-miss passage: Sigma rule: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by. Logsource: windows / process_creation. Rule: title: Suspicious Rundll32 Invoking Inline VBScript id: 1cc50f3f-1fc8-4acf-b2e9-6f172e1fdebd status: test description: Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452 references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - Execute - RegRead - window.close condition: selection falsepositives: - Unknown level: high