Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli. Logsource: windows / process_creation. Rule: title: Net WebClient Casing Anomalies id: c86133ad-4725-4bd0-8170-210788e0a7ba status: test description: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_encoded: CommandLine|contains: - TgBlAFQALgB3AEUAQg - 4AZQBUAC4AdwBFAEIA - OAGUAVAAuAHcARQBCA - bgBFAHQALgB3AGUAYg - 4ARQB0AC4AdwBlAGIA - uAEUAdAAuAHcAZQBiA - TgBFAHQALgB3AGUAYg - OAEUAdAAuAHcAZQBiA - bgBlAFQALgB3AGUAYg - 4AZQBUAC4AdwBlAGIA - uAGUAVAAuAHcAZQBiA - TgBlAFQALgB3AGUAYg - OAGUAVAAuAHcAZQBiA - bgBFAFQALgB3AGUAYg - 4ARQBUAC4AdwBlAGIA - uAEUAVAAuAHcAZQBiA - bgBlAHQALgBXAGUAYg - 4AZQB0AC4AVwBlAGIA - uAGUAdAAuAFcAZQBiA - bgBFAHQALgBXAGUAYg - 4ARQB0AC4AVwBlAGIA - uAEUAdAAuAFcAZQBiA - TgBFAHQALgBXAGUAYg - OAEUAdAAuAFcAZQBiA - bgBlAFQALgBXAGUAYg - 4AZQBUAC4AVwBlAGIA - uAGUAVAAuAFcAZQBiA - TgBlAFQALgBXAGUAYg - OAGUAVAAuAFcAZQBiA - bgBFAFQALgBXAGUAYg - 4ARQBUAC4AVwBlAGIA - uAEUAVAAuAFcAZQBiA - bgBlAHQALgB3AEUAYg - 4AZQB0AC4AdwBFAGIA - uAGUAdAAuAHcARQBiA - TgBlAHQALgB3AEUAYg - OAGUAdAAuAHcARQBiA - bgBFAHQALgB3AEUAYg - 4ARQB0AC4AdwBFAGIA - uAEUAdAAuAHcARQBiA - TgBFAHQALgB3AEUAYg - OAEUAdAAuAHcARQBiA - bgBlAFQALgB3AEUAYg - 4AZQBUAC4AdwBFAGIA - uAGUAVAAuAHcARQBiA - TgBlAFQALgB3AEUAYg - OAGUAVAAuAHcARQBiA - bgBFAFQALgB3AEUAYg - 4ARQBUAC4AdwBFAGIA - uAEUAVAAuAHcARQBiA - TgBFAFQALgB3AEUAYg - OAEUAVAAuAHcARQBiA - bgBlAHQALgBXAEUAYg - 4AZQB0AC4AVwBFAGIA - uAGUAdAAuAFcARQBiA - TgBlAHQALgBXAEUAYg - OAGUAdAAuAFcARQBiA - bgBFAHQALgBXAEUAYg - 4ARQB0AC4AVwBFAGIA - uAEUAdAAuAFcARQBiA - TgBFAHQALgBXAEUAYg - OAEUAdAAuAFcARQBiA - bgBlAFQALgBXAEUAYg - 4AZQBUAC4AVwBFAGIA - uAGUAVAAuAFcARQBiA - TgBlAFQALgBXAEUAYg - OAGUAVAAuAFcARQBiA - bgBFAFQALgBXAEUAYg - 4ARQBUAC4AVwBFAGIA - uAEUAVAAuAFcARQBiA - TgBFAFQALgBXAEUAYg - OAEUAVAAuAFcARQBiA - bgBlAHQALgB3AGUAQg - 4AZQB0AC4AdwBlAEIA - uAGUAdAAuAHcAZQBCA - TgBlAHQALgB3AGUAQg - OAGUAdAAuAHcAZQBCA - bgBFAHQALgB3AGUAQg - 4ARQB0AC4AdwBlAEIA - uAEUAdAAuAHcAZQBCA - TgBFAHQALgB3AGUAQg - OAEUAdAAuAHcAZQBCA - bgBlAFQALgB3AGUAQg - 4AZQBUAC4AdwBlAEIA - uAGUAVAAuAHcAZQBCA - TgBlAFQALgB3AGUAQg - OAGU
Near-miss passage: Sigma rule: Detects Obfuscated Powershell via RUNDLL LAUNCHER. Logsource: windows / system. Rule: title: Invoke-Obfuscation RUNDLL LAUNCHER - System id: 11b52f18-aaec-4d60-9143-5dd8cc4706b9 status: test description: Detects Obfuscated Powershell via RUNDLL LAUNCHER references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains|all: - rundll32.exe - shell32.dll - shellexec_rundll - powershell condition: selection falsepositives: - Unknown level: medium