Query: Sigma rule for Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential
Matching passage: Sigma rule: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential. Logsource: windows / image_load. Rule: title: CredUI.DLL Loaded By Uncommon Process id: 9ae01559-cf7e-4f8e-8e14-4c290a1b4784 status: test description: Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW". references: - https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password - https://learn.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa - https://github.com/S12cybersecurity/RDPCredentialStealer author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2026-06-29 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: category: image_load product: windows detection: selection: - ImageLoaded|endswith: - \credui.dll - \wincredui.dll - OriginalFileName: - credui.dll - wincredui.dll filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\SystemApps\ filter_main_full: Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - C:\Windows\regedit.exe filter_optional_opera: Image|endswith: \opera_autoupdate.exe filter_optional_process_explorer: Image|endswith: - \procexp64.exe - \procexp64a.exe - \procexp.exe filter_optional_teams: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\Teams\ Image|endswith: \Teams.exe filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other legitimate processes loading those DLLs in your environment. level: medium
Near-miss passage: Sigma rule: Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network sha. Logsource: linux / process_creation. Rule: title: File and Directory Discovery - Linux id: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72 status: test description: 'Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad date: 2020-10-19 modified: 2024-12-01 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_file_with_asterisk: Image|endswith: /file CommandLine|re: (.){200,} selection_recursive_ls: Image|endswith: /ls CommandLine|contains: -R selection_find_execution: Image|endswith: /find selection_tree_execution: Image|endswith: /tree selection_findmnt_execution: Image|endswith: /findmnt selection_locate_execution: Image|endswith: /mlocate condition: 1 of selection_* falsepositives: - Legitimate activities level: informational