Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects file downloads directly from IP address URL using curl.exe. Logsource: windows / process_creation. Rule: title: File Download From IP URL Via Curl.EXE id: 9cc85849-3b02-4cb5-b371-3a1ff54f2218 related: - id: 5cb299fc-5fb1-4d07-b989-0644c68b6043 type: similar status: test description: Detects file downloads directly from IP address URL using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-18 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output filter_main_ext: CommandLine|endswith: - .bat - .bat" - .dat - .dat" - .dll - .dll" - .exe - .exe" - .gif - .gif" - .hta - .hta" - .jpeg - .jpeg" - .log - .log" - .msi - .msi" - .png - .png" - .ps1 - .ps1" - .psm1 - .psm1" - .vbe - .vbe" - .vbs - .vbs" - .bat' - .dat' - .dll' - .exe' - .gif' - .hta' - .jpeg' - .log' - .msi' - .png' - .ps1' - .psm1' - .vbe' - .vbs' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/info.yml
Near-miss passage: Sigma rule: Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as. Logsource: windows / process_creation. Rule: title: PUA - Memory Dump Mount Via MemProcFS id: 8a1b2c3d-4e5f-6789-abcd-ef1234567890 status: experimental description: 'Detects execution of MemProcFS a memory forensics tool with the ''-device'' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation. ' references: - https://github.com/ufrisk/MemProcFS - https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html# - https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.credential-access - attack.t1003 - attack.t1003.001 - attack.t1003.004 - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MemProcFS.exe - OriginalFileName: MemProcFS.exe - Description: MemProcFS selection_cli: CommandLine|contains: -device condition: all of selection_* falsepositives: - Legitimate use during memory forensics; if not part of authorized analysis, warrants urgent investigation level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_memprocfs/info.yml