Query: Sigma rule for Detects the addition of a new Federated Domain.
Matching passage: Sigma rule: Detects the addition of a new Federated Domain.. Logsource: m365 / exchange. Rule: title: New Federated Domain Added - Exchange id: 42127bdd-9133-474f-a6f1-97b6c08a4339 related: - id: 58f88172-a73d-442b-94c9-95eaed3cbb36 type: similar status: test description: Detects the addition of a new Federated Domain. references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ author: Splunk Threat Research Team (original rule), '@ionsor (rule)' date: 2022-02-08 tags: - attack.persistence - attack.t1136.003 logsource: service: exchange product: m365 detection: selection: eventSource: Exchange eventName: Add-FederatedDomain status: success condition: selection falsepositives: - The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. level: medium
Near-miss passage: Sigma rule: Detects a suspicious curl process start on Windows and outputs the requested document to a local file. Logsource: windows / process_creation. Rule: title: Suspicious Curl.EXE Download id: e218595b-bbe7-4ee5-8a96-f32a24ad3468 related: - id: bbeaed61-1990-4773-bf57-b81dbad7db2d type: derived - id: 9a517fca-4ba3-4629-9278-a68694697b81 type: similar status: test description: Detects a suspicious curl process start on Windows and outputs the requested document to a local file references: - https://twitter.com/max_mal_/status/1542461200797163522 - https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464 - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/ - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-07-03 modified: 2023-02-21 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_curl: - Image|endswith: \curl.exe - Product: The curl executable selection_susp_locations: CommandLine|contains: - '%AppData%' - '%Public%' - '%Temp%' - '%tmp%' - \AppData\ - \Desktop\ - \Temp\ - \Users\Public\ - C:\PerfLogs\ - C:\ProgramData\ - C:\Windows\Temp\ selection_susp_extensions: CommandLine|endswith: - .dll - .gif - .jpeg - .jpg - .png - .temp - .tmp - .txt - .vbe - .vbs filter_optional_git_windows: ParentImage: C:\Program Files\Git\usr\bin\sh.exe Image: C:\Program Files\Git\mingw64\bin\curl.exe CommandLine|contains|all: - '--silent --show-error --output ' - gfw-httpget- - AppData condition: selection_curl and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_susp_download/info.yml simulation: - type: atomic-red-team name: Curl Download File technique: T1105 atomic_guid: 2b080b99-0deb-4d51-af0f-833d37c4ca6a