Query: detection rule: Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p
Matching passage: Sigma rule: Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution From Parent Process In Public Folder id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a status: test description: 'Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines. ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-25 modified: 2024-07-12 tags: - attack.execution - attack.stealth - attack.t1564 - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: :\Users\Public\ selection_child: - Image|endswith: - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - CommandLine|contains: - bitsadmin - certutil - cscript - mshta - powershell - regsvr32 - rundll32 - wscript condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects execution of different log query utilities and commands to search and dump the content of specific event logs or. Logsource: windows / process_creation. Rule: title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf related: - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f type: derived status: test description: 'Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc. ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://www.group-ib.com/blog/apt41-world-tour-2021/ - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today - https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ - https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-09-09 modified: 2025-12-02 tags: - attack.credential-access - attack.discovery - attack.t1552 - attack.t1087 logsource: category: process_creation product: windows detection: selection_wmi: CommandLine|contains|all: - Select - Win32_NTLogEvent selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cli: CommandLine|contains: - ' qe ' - ' query-events ' selection_wmic_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains: ' ntevent' selection_cmdlet: CommandLine|contains: - 'Get-WinEvent ' - 'get-eventlog ' selection_logs_name: CommandLine|contains: - Microsoft-Windows-PowerShell - Microsoft-Windows-Security-Auditing - Microsoft-Windows-TerminalServices-LocalSessionManager - Microsof