Query: detect Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con in logs
Matching passage: Sigma rule: Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can con. Logsource: windows / process_creation. Rule: title: Setup16.EXE Execution With Custom .Lst File id: 99c8be4f-3087-4f9f-9c24-8c7e257b442e status: test description: 'Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file. These ".lst" file can contain references to external program that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a living of the land utility. ' references: - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ author: frack113 date: 2024-12-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.005 logsource: category: process_creation product: windows detection: selection: ParentImage: C:\Windows\SysWOW64\setup16.exe ParentCommandLine|contains: ' -m ' filter_optional_valid_path: Image|startswith: C:\~MSSETUP.T\ condition: selection and not 1 of filter_optional_* falsepositives: - On modern Windows system, the "Setup16" utility is practically never used, hence false positive should be very rare. level: medium
Near-miss passage: Sigma rule: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.. Logsource: windows / ps_script. Rule: title: PowerView PowerShell Cmdlets - ScriptBlock id: dcd74b95-3f36-4ed9-9598-0490951643aa related: - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d type: similar status: test description: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework. references: - https://powersploit.readthedocs.io/en/stable/Recon/README - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon - https://thedfirreport.com/2020/10/08/ryuks-return - https://adsecurity.org/?p=2277 author: Bhabesh Raj date: 2021-05-18 modified: 2023-11-22 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PowerViewCSV - Find-DomainLocalGroupMember - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-InterestingDomain - Find-InterestingFile - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainDNSZone - Get-DomainFileServer - Get-DomainGPOComputerLocalGroupMapping - Get-DomainGPOLocalGroup - Get-DomainGPOUserLocalGroupMapping - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetFileServer - Get-NetForest - Get-NetGPOGroup - Get-NetProcess - Get-NetRDPSession - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-EnumerateLocalAdmin - Invoke-EventHunter - Invoke-FileFinder - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke-ProcessHunter - Invoke-RevertToSelf - Invoke-ShareFinder - Invoke-UserHunter - Invoke-UserImpersonation - Remove-RemoteConnection - Request-SPNTicket - Resolve-IPAddress condition: selection falsepositives: - Unknown level: high