Query: Sigma rule for Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh
Matching passage: Sigma rule: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, msh. Logsource: windows / process_creation. Rule: title: Windows Shell/Scripting Processes Spawning Suspicious Programs id: 3a6586ad-127a-4d3b-a677-1e6eacdf8fde status: test description: Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc. references: - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html author: Florian Roth (Nextron Systems), Tim Shelton date: 2018-04-06 modified: 2023-05-23 tags: - attack.execution - attack.stealth - attack.t1059.005 - attack.t1059.001 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \mshta.exe - \powershell.exe - \pwsh.exe - \rundll32.exe - \cscript.exe - \wscript.exe - \wmiprvse.exe - \regsvr32.exe Image|endswith: - \schtasks.exe - \nslookup.exe - \certutil.exe - \bitsadmin.exe - \mshta.exe filter_ccmcache: CurrentDirectory|contains: \ccmcache\ filter_amazon: ParentCommandLine|contains: - \Program Files\Amazon\WorkSpacesConfig\Scripts\setup-scheduledtask.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\set-selfhealing.ps1 - \Program Files\Amazon\WorkSpacesConfig\Scripts\check-workspacehealth.ps1 - \nessus_ filter_nessus: CommandLine|contains: \nessus_ filter_sccm_install: ParentImage|endswith: \mshta.exe Image|endswith: \mshta.exe ParentCommandLine|contains|all: - C:\MEM_Configmgr_ - \splash.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' CommandLine|contains|all: - C:\MEM_Configmgr_ - \SMSSETUP\BIN\ - \autorun.hta - '{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}' condition: selection and not 1 of filter_* falsepositives: - Administrative scripts - Microsoft SCCM level: high
Near-miss passage: Sigma rule: Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child p. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution From Parent Process In Public Folder id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a status: test description: 'Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines. ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-25 modified: 2024-07-12 tags: - attack.execution - attack.stealth - attack.t1564 - attack.t1059 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: :\Users\Public\ selection_child: - Image|endswith: - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - CommandLine|contains: - bitsadmin - certutil - cscript - mshta - powershell - regsvr32 - rundll32 - wscript condition: all of selection_* falsepositives: - Unknown level: high