Query: alert when Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat
Matching passage: Sigma rule: Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat. Logsource: windows / process_creation. Rule: title: Deleted Data Overwritten Via Cipher.EXE id: 4b046706-5789-4673-b111-66f25fe99534 status: test description: 'Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive author: frack113 date: 2021-12-26 modified: 2023-02-21 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: CIPHER.EXE - Image|endswith: \cipher.exe selection_cli: CommandLine|contains: ' /w:' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml simulation: - type: atomic-red-team name: Overwrite deleted data on C drive technique: T1485 atomic_guid: 321fd25e-0007-417f-adec-33232252be19
Near-miss passage: Sigma rule: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights. Logsource: windows / process_creation. Rule: title: PsExec/PAExec Escalation to LOCAL SYSTEM id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 related: - id: 207b0396-3689-42d9-8399-4222658efc99 type: similar status: test description: Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights references: - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec - https://www.poweradmin.com/paexec/ - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-11-23 modified: 2024-03-05 tags: - attack.resource-development - attack.t1587.001 logsource: category: process_creation product: windows detection: selection_sys: CommandLine|contains|windash: - ' -s cmd' - ' -s -i cmd' - ' -i -s cmd' - ' -s pwsh' - ' -s -i pwsh' - ' -i -s pwsh' - ' -s powershell' - ' -s -i powershell' - ' -i -s powershell' selection_other: CommandLine|contains: - psexec - paexec - accepteula condition: all of selection_* falsepositives: - Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare) - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension level: high