Query: detect Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persi in logs
Matching passage: Sigma rule: Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persi. Logsource: windows / dns_query. Rule: title: DNS Query To Devtunnels Domain id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b related: - id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 type: similar - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar status: test description: 'Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security - https://cydefops.com/devtunnels-unleashed author: citron_ninja date: 2023-10-25 modified: 2023-11-20 tags: - attack.command-and-control - attack.t1071.001 - attack.t1572 logsource: category: dns_query product: windows detection: selection: QueryName|endswith: .devtunnels.ms condition: selection falsepositives: - Legitimate use of Devtunnels will also trigger this. level: medium
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentControlSet Autorun Keys Modification id: f674e36a-4b91-431e-8aef-f8a96c2aca35 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: system_control_base: TargetObject|contains: \SYSTEM\CurrentControlSet\Control system_control_keys: TargetObject|contains: - \Terminal Server\WinStations\RDP-Tcp\InitialProgram - \Terminal Server\Wds\rdpwd\StartupPrograms - \SecurityProviders\SecurityProviders - \SafeBoot\AlternateShell - \Print\Providers - \Print\Monitors - \NetworkProvider\Order - \Lsa\Notification Packages - \Lsa\Authentication Packages - \BootVerificationProgram\ImagePath filter_empty: Details: (Empty) filter_cutepdf: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: \Print\Monitors\CutePDF Writer Monitor Details: - cpwmon64_v40.dll - CutePDF Writer filter_onenote: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: Print\Monitors\Appmon\Ports\Microsoft.Office.OneNote_ User|contains: - AUTHORI - AUTORI filter_poqexec: Image: C:\Windows\System32\poqexec.exe TargetObject|endswith: \NetworkProvider\Order\ProviderOrder filter_realvnc: Image: C:\Windows\System32\spoolsv.exe TargetObject|endswith: \Print\Monitors\MONVNC\Driver Details: VNCpm.dll condition: all of system_control_* and not 1 of filter_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium