Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publishe. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft Office Child Process id: 438025f9-5856-4663-83f7-52f878a70a50 related: - id: c27515df-97a9-4162-8a60-dc0eeb51b775 type: derived - id: e1693bc8-7168-4eab-8718-cdcaa68a1738 type: derived - id: 23daeb52-e6eb-493c-8607-c4f0246cb7d8 type: obsolete - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.) references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml - https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html - https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/ author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io date: 2018-04-06 modified: 2023-04-24 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \EQNEDT32.EXE - \EXCEL.EXE - \MSACCESS.EXE - \MSPUB.exe - \ONENOTE.EXE - \POWERPNT.exe - \VISIO.exe - \WINWORD.EXE - \wordpad.exe - \wordview.exe selection_child_processes: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe -
Near-miss passage: Sigma rule: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode. Logsource: windows / system. Rule: title: Local Privilege Escalation Indicator TabTip id: bc2e25ed-b92b-4daa-b074-b502bdd1982b status: test description: Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode references: - https://github.com/antonioCoco/JuicyPotatoNG author: Florian Roth (Nextron Systems) date: 2022-10-07 modified: 2023-04-14 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-DistributedCOM EventID: 10001 param1: C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe param2: 2147943140 param3: '{054AAE20-4BEA-4347-8A35-64A533254A9D}' condition: selection falsepositives: - Unknown level: high