Query: write Sigma for Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially su
Matching passage: Sigma rule: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially su. Logsource: windows / process_creation. Rule: title: Diskshadow Script Mode - Execution From Potential Suspicious Location id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 related: - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f type: similar - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 type: similar - id: 56b1dde8-b274-435f-a73a-fb75eb81262a type: similar - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 type: similar status: test description: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location. references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: diskshadow.exe - Image|endswith: \diskshadow.exe selection_cli: CommandLine|contains|windash: '-s ' selection_paths: CommandLine|contains: - :\Temp\ - :\Windows\Temp\ - \AppData\Local\ - \AppData\Roaming\ - \ProgramData\ - \Users\Public\ condition: all of selection_* falsepositives: - False positives may occur if you execute the script from one of the paths mentioned in the rule. Apply additional filters that fits your org needs. level: medium
Near-miss passage: Sigma rule: Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the. Logsource: windows / process_creation. Rule: title: Potential Arbitrary Command Execution Using Msdt.EXE id: 258fc8ce-8352-443a-9120-8a11e4857fa5 status: test description: Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://twitter.com/_JohnHammond/status/1531672601067675648 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-29 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd_inline: CommandLine|contains: IT_BrowseForFile= selection_cmd_answerfile_flag: CommandLine|contains: ' PCWDiagnostic' selection_cmd_answerfile_param: CommandLine|contains|windash: ' -af ' condition: selection_img and (selection_cmd_inline or all of selection_cmd_answerfile_*) falsepositives: - Unknown level: high