Query: alert when Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Matching passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection. Logsource: windows / process_creation. Rule: title: Use NTFS Short Name in Command Line id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 related: - id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/jonasLyk/status/1555914501802921984 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2022-09-21 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ~1.exe - ~1.bat - ~1.msi - ~1.vbe - ~1.vbs - ~1.dll - ~1.ps1 - ~1.js - ~1.hta - ~2.exe - ~2.bat - ~2.msi - ~2.vbe - ~2.vbs - ~2.dll - ~2.ps1 - ~2.js - ~2.hta filter: - ParentImage|endswith: - \WebEx\WebexHost.exe - \thor\thor64.exe - CommandLine|contains: C:\xampp\vcredist\VCREDI~1.EXE condition: selection and not filter falsepositives: - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process. level: medium
Near-miss passage: Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: Suspicious AgentExecutor PowerShell Execution id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab related: - id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_pwsh: CommandLine|contains: - C:\Windows\System32\WindowsPowerShell\v1.0\ - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high