Query: Sigma YAML for windows / system
Matching passage: Sigma rule: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report. Logsource: windows / system. Rule: title: Moriya Rootkit - System id: 25b9c01c-350d-4b95-bed1-836d04a4f324 status: test description: Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report references: - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831 author: Bhabesh Raj date: 2021-05-06 modified: 2022-11-29 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName: ZzNetSvc condition: selection falsepositives: - Unknown level: critical
Near-miss passage: Sigma rule: Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains. These services (. Logsource: dns. Rule: title: DNS Query to External Service Interaction Domains id: aff715fa-4dd5-497a-8db3-910bea555566 status: test description: "Detects DNS queries to well-known out-of-band application security testing (OAST) and callback domains.\nThese\ \ services (e.g. Burp Collaborator, interactsh, canarytokens, dnslog.cn) are used by security\nresearchers and attackers\ \ alike to confirm blind vulnerabilities such as SSRF, XXE, blind RCE, and\nLog4Shell-style injections, where the exploit\ \ payload triggers an external DNS lookup to a controlled domain.\n\nA detection indicates that a host on your network resolved\ \ one of these domains, which may mean:\n (1) an attacker is actively probing or exploiting a vulnerable service and\ \ using the callback to\n confirm code execution or data exfiltration,\n (2) a security scanner (e.g. Nuclei, Gobies)\ \ is running against internal targets.\n\nInvestigate the source host, the full DNS query string (the unique subdomain prefix\ \ encodes the callback session),\nand any concurrent outbound connections or process activity to determine intent.\n" references: - https://twitter.com/breakersall/status/1533493587828260866 - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287 - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234 - https://hunt.io/blog/open-directory-nginx-rift-ghost-cms-multi-cve author: Florian Roth (Nextron Systems), Matt Kelly (list of domains) date: 2022-06-07 modified: 2026-07-23 tags: - attack.initial-access - attack.t1190 - attack.reconnaissance - attack.t1595.002 logsource: category: dns detection: selection: query|endswith: - .burpcollaborator.net - .canarytokens.com - .ceye.io - .ddns.1443.eu.org - .ddns.bypass.eu.org - .ddns.xn--gg8h.eu.org - .digimg.store - .dns.su18.org - .dnshook.site - .dnslog.cn - .dnslog.ink - .gobygo.net - .instances.httpworkbench.com - .interact.sh - .log.dnslog.pp.ua - .log.dnslog.qzz.io - .log.dnslogs.dpdns.org - .log.javaweb.org - .log.nat.cloudns.ph - .oast.fun - .oast.live - .oast.me - .oast.online - .oast.pro - .oast.site - .oastify.com - .p8.lol - .requestbin.net filter_main_polling: query|contains: polling.oastify.com condition: selection and not 1 of filter_main_* falsepositives: - Legitimate security scanning. level: high