Query: detect Detects the enumeration of other remote systems. in logs
Matching passage: Sigma rule: Detects the enumeration of other remote systems.. Logsource: linux / process_creation. Rule: title: Linux Remote System Discovery id: 11063ec2-de63-4153-935e-b1a8b9e616f1 status: test description: Detects the enumeration of other remote systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md author: Alejandro Ortuno, oscd.community date: 2020-10-22 modified: 2021-11-27 tags: - attack.discovery - attack.t1018 logsource: category: process_creation product: linux detection: selection_1: Image|endswith: /arp CommandLine|contains: -a selection_2: Image|endswith: /ping CommandLine|contains: - ' 10.' - ' 192.168.' - ' 172.16.' - ' 172.17.' - ' 172.18.' - ' 172.19.' - ' 172.20.' - ' 172.21.' - ' 172.22.' - ' 172.23.' - ' 172.24.' - ' 172.25.' - ' 172.26.' - ' 172.27.' - ' 172.28.' - ' 172.29.' - ' 172.30.' - ' 172.31.' - ' 127.' - ' 169.254.' condition: 1 of selection* falsepositives: - Legitimate administration activities level: low
Near-miss passage: Sigma rule: Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Defi. Logsource: windows / registry_set. Rule: title: Windows Event Log Access Tampering Via Registry id: ba226dcf-d390-4642-b9af-b534872f1156 status: experimental description: 'Detects changes to the Windows EventLog channel permission values. It focuses on changes to the Security Descriptor Definition Language (SDDL) string, as modifications to these values can restrict access to specific users or groups, potentially aiding in defense evasion by controlling who can view or modify a event log channel. Upon execution, the user shouldn''t be able to access the event log channel via the event viewer or via utilities such as "Get-EventLog" or "wevtutil". ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell - https://www.youtube.com/watch?v=uSYvHUVU8xY - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language author: X__Junior date: 2025-01-16 modified: 2025-08-16 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1547.001 - attack.t1112 logsource: category: registry_set product: windows detection: selection_key_1: TargetObject|contains: \SYSTEM\CurrentControlSet\Services\EventLog\ TargetObject|endswith: \CustomSD selection_key_2: TargetObject|contains: - \Policies\Microsoft\Windows\EventLog\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels TargetObject|endswith: \ChannelAccess selection_details: - Details|contains: D:(D; - Details|contains|all: - D:( - )(D; filter_main_trustedinstaller: Image: C:\Windows\servicing\TrustedInstaller.exe filter_main_tiworker: Image|startswith: C:\Windows\WinSxS\ Image|endswith: \TiWorker.exe filter_optional_empty: Image: '' filter_optional_null: Image: null condition: 1 of selection_key_* and selection_details and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Administrative activity, still unlikely level: high