Query: detect Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into in logs
Matching passage: Sigma rule: Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into. Logsource: windows / process_creation. Rule: title: Bad Opsec Defaults Sacrificial Processes With Improper Arguments id: a7c3d773-caef-227e-a7e7-c2f13c622329 related: - id: f5647edc-a7bf-4737-ab50-ef8c60dc3add type: obsolete status: test description: 'Detects attackers using tooling with bad opsec defaults. E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run. One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples. ' references: - https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/ - https://www.cobaltstrike.com/help-opsec - https://twitter.com/CyberRaiju/status/1251492025678983169 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32 - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool - https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems) date: 2020-10-23 modified: 2024-08-15 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_werfault: Image|endswith: \WerFault.exe CommandLine|endswith: WerFault.exe selection_rundll32: Image|endswith: \rundll32.exe CommandLine|endswith: rundll32.exe selection_regsvcs: Image|endswith: \regsvcs.exe CommandLine|endswith: regsvcs.exe selection_regasm: Image|endswith: \regasm.exe CommandLine|endswith: regasm.exe selection_regsvr32: Image|endswith: \regsvr32.exe CommandLine|endswith: regsvr32.exe filter_optional_edge_update: ParentImage|contains: \AppData\Local\Microsoft\EdgeUpdate\Install\{ Image|endswith: \rundll32.exe CommandLine|endswith: rundll32.exe filter_optional_chromium_installer: ParentImage|contains: - \AppData\Local\BraveSoftware\Brave-Browser\Application\ - \AppData\Local\Google\Chrome\Application\ ParentImage|endswith: \Installer\setup.exe ParentCommandLine|contains: '--uninstall ' Image|endswith: \rundll32.exe CommandLine|endswith: rundll32.exe condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / system. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - System id: 175997c5-803c-4b08-8bb0-70b099f47595 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - new-object - text.encoding]::ascii - readtoend ImagePath|contains: - :system.io.compression.deflatestream - system.io.streamreader condition: selection falsepositives: - Unknown level: medium