Query: Sigma rule for Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation
Matching passage: Sigma rule: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. Logsource: macos / process_creation. Rule: title: Suspicious Browser Child Process - MacOS id: 0250638a-2b28-4541-86fc-ea4c558fa0c6 status: test description: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. references: - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml author: Sohan G (D4rkCiph3r) date: 2023-04-05 tags: - attack.initial-access - attack.execution - attack.t1189 - attack.t1203 - attack.t1059 logsource: category: process_creation product: macos detection: selection: ParentImage|contains: - com.apple.WebKit.WebContent - firefox - Google Chrome Helper - Google Chrome - Microsoft Edge - Opera - Safari - Tor Browser Image|endswith: - /bash - /curl - /dash - /ksh - /osascript - /perl - /php - /pwsh - /python - /sh - /tcsh - /wget - /zsh filter_main_generic: CommandLine|contains: --defaults-torrc filter_main_ms_autoupdate: CommandLine|contains: /Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate filter_main_chrome: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains: - /Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh filter_main_ms_edge: ParentImage|contains: Microsoft Edge CommandLine|contains: - IOPlatformExpertDevice - hw.model filter_main_chromerecovery: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains|all: - /Users/ - /Library/Application Support/Google/Chrome/recovery/ - /ChromeRecovery filter_optional_null: CommandLine: null filter_optional_empty: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate browser install, update and recovery scripts level: medium
Near-miss passage: Sigma rule: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This d. Logsource: m365 / threat_management. Rule: title: PST Export Alert Using New-ComplianceSearchAction id: 6897cd82-6664-11ed-9022-0242ac120002 related: - id: 18b88d08-d73e-4f21-bc25-4b9892a4fdd0 type: similar status: test description: Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365.This rule will apply to ExchangePowerShell usage and from the cloud. references: - https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps author: Nikita Khalimonenkov date: 2022-11-17 tags: - attack.collection - attack.t1114 logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter Payload|contains|all: - New-ComplianceSearchAction - Export - pst condition: selection falsepositives: - Exporting a PST can be done for legitimate purposes by legitimate sources, but due to the sensitive nature of PST content, it must be monitored. level: medium