Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard s. Logsource: windows / process_creation. Rule: title: SQL Client Tools PowerShell Session Detection id: a746c9b8-a2fb-4ee5-a428-92bee9e99060 status: test description: 'This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs. ' references: - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml - https://twitter.com/pabraeken/status/993298228840992768 author: Agro (@agro_sev) oscd.communitly date: 2020-10-13 modified: 2022-02-25 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \sqltoolsps.exe - ParentImage|endswith: \sqltoolsps.exe - OriginalFileName: \sqltoolsps.exe filter: ParentImage|endswith: \smss.exe condition: selection and not filter falsepositives: - Direct PS command execution through SQLToolsPS.exe is uncommon, childprocess sqltoolsps.exe spawned by smss.exe is a legitimate action. level: medium
Near-miss passage: Sigma rule: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands. Logsource: windows / process_creation. Rule: title: PUA - Rclone Execution id: e37db05d-d1f9-49c8-b464-cee1a4b11638 related: - id: a0d63692-a531-4912-ad39-4393325b2a9c type: obsolete - id: cb7286ba-f207-44ab-b9e6-760d82b84253 type: obsolete status: test description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-10 modified: 2023-03-05 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific_options: CommandLine|contains|all: - '--config ' - '--no-check-certificate ' - ' copy ' selection_rclone_img: - Image|endswith: \rclone.exe - Description: Rsync for cloud storage selection_rclone_cli: CommandLine|contains: - pass - user - copy - sync - config - lsd - remote - ls - mega - pcloud - ftp - ignore-existing - auto-confirm - transfers - multi-thread-streams - 'no-check-certificate ' condition: selection_specific_options or all of selection_rclone_* falsepositives: - Unknown level: high