Query: Sigma YAML for windows / file_event
Matching passage: Sigma rule: Detects the creation of known offensive powershell scripts used for exploitation. Logsource: windows / file_event. Rule: title: Malicious PowerShell Scripts - FileCreation id: f331aa1f-8c53-4fc3-b083-cc159bc971cb related: - id: 41025fd7-0466-4650-a813-574aaacbe7f4 type: similar status: test description: Detects the creation of known offensive powershell scripts used for exploitation references: - https://github.com/PowerShellMafia/PowerSploit - https://github.com/NetSPI/PowerUpSQL - https://github.com/CsEnox/EventViewer-UACBypass - https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu - https://github.com/nettitude/Invoke-PowerThIEf - https://github.com/S3cur3Th1sSh1t/WinPwn - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/Kevin-Robertson/Powermad - https://github.com/adrecon/ADRecon - https://github.com/adrecon/AzureADRecon - https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1 - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein date: 2018-04-07 modified: 2025-12-10 tags: - attack.execution - attack.t1059.001 logsource: category: file_event product: windows detection: selection_generic: TargetFilename|endswith: - \Add-ConstrainedDelegationBackdoor.ps1 - \Add-Exfiltration.ps1 - \Add-Persistence.ps1 - \Add-RegBackdoor.ps1 - \Add-RemoteRegBackdoor.ps1 - \Add-ScrnSaveBackdoor.ps1 - \ADRecon.ps1 - \AzureADRecon.ps1 - \BadSuccessor.ps1 - \Check-VM.ps1 - \ConvertTo-ROT13.ps1 - \Copy-VSS.ps1 - \Create-MultipleSessions.ps1 - \DNS_TXT_Pwnage.ps1 - \dnscat2.ps1 - \Do-Exfiltration.ps1 - \DomainPasswordSpray.ps1 - \Download_
Near-miss passage: Sigma rule: Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is. Logsource: windows / network_connection. Rule: title: Outbound Network Connection Initiated By Microsoft Dialer id: 37e4024a-6c80-4d8f-b95d-2e7e94f3a8d1 status: test description: 'Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it''s usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys" ' references: - https://tria.ge/240301-rk34sagf5x/behavioral2 - https://app.any.run/tasks/6720b85b-9c53-4a12-b1dc-73052a78477d - https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ - https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html author: CertainlyP date: 2024-04-26 tags: - attack.execution - attack.command-and-control - attack.t1071.001 logsource: category: network_connection product: windows detection: selection: Image|endswith: :\Windows\System32\dialer.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - In Modern Windows systems, unable to see legitimate usage of this process, However, if an organization has legitimate purpose for this there can be false positives. level: high