Query: write Sigma for Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
Matching passage: Sigma rule: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.. Logsource: windows / image_load. Rule: title: Suspicious WSMAN Provider Image Loads id: ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94 status: test description: Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution. references: - https://twitter.com/chadtilbury/status/1275851297770610688 - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/ - https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture - https://github.com/bohops/WSMan-WinRM author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-24 modified: 2026-07-28 tags: - attack.execution - attack.t1059.001 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: request_client: - ImageLoaded|endswith: - \WsmSvc.dll - \WsmAuto.dll - \Microsoft.WSMan.Management.ni.dll - OriginalFileName: - WsmSvc.dll - WSMANAUTOMATION.DLL - Microsoft.WSMan.Management.dll respond_server: Image|endswith: \svchost.exe OriginalFileName: WsmWmiPl.dll filter_general: Image: - C:\Program Files (x86)\PowerShell\6\pwsh.exe - C:\Program Files (x86)\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\6\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\sdiagnhost.exe - C:\Windows\System32\services.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe filter_svchost: CommandLine|contains: - svchost.exe -k netsvcs -p -s BITS - svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc - svchost.exe -k NetworkService -p -s Wecsvc - svchost.exe -k netsvcs filter_mscorsvw: Image|startswith: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \mscorsvw.exe filter_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_svr_2019: Image: - C:\Windows\System32\Configure-SMRemoting.exe - C:\Windows\System32\ServerManager.exe filter_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ filter_citrix: Image|startswith: C:\Program Files\Citrix\ filter_upgrade: Image|startswith: C:\$WINDOWS.~BT\Sources\ filter_mmc: Image|endswith: \mmc.exe svchost: Image|endswith: \svchost.exe commandline_null: CommandLine: null condition: ( request_client or respond_server ) and not 1 of filter* and not ( svchost and commandline_null ) f
Near-miss passage: Sigma rule: Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being esta. Logsource: linux / file_event. Rule: title: New Cron File Created id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05 status: experimental description: 'Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment. ' references: - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/ - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2026-04-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux category: file_event detection: selection_cron_dirs: TargetFilename|startswith: - /etc/cron.d/ - /etc/cron.daily/ - /etc/cron.hourly/ - /etc/cron.monthly/ - /etc/cron.weekly/ - /var/spool/cron/crontabs/ - /var/spool/cron/root selection_cron_special_files: TargetFilename|contains: - /etc/cron.allow - /etc/cron.deny - /etc/crontab filter_optional_legit_cron: TargetFilename: - /etc/cron.daily/apt - /etc/cron.daily/dpkg - /etc/cron.daily/passwd - /etc/crontabs/root condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment. level: low