Query: detection rule: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica
Matching passage: Sigma rule: Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an applica. Logsource: windows / process_creation. Rule: title: Potential DLL Injection Via AccCheckConsole id: 0f6da907-5854-4be6-859a-e9958747b0aa status: test description: 'Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application''s UI. One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc. The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility. ' references: - https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340 - https://twitter.com/bohops/status/1477717351017680899?s=12 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/ author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2024-08-29 tags: - attack.execution - detection.threat-hunting logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AccCheckConsole.exe - OriginalFileName: AccCheckConsole.exe selection_cli: CommandLine|contains: - ' -hwnd' - ' -process ' - ' -window ' condition: all of selection_* falsepositives: - Legitimate use of the UI Accessibility Checker level: medium
Near-miss passage: Sigma rule: Detects the creation of a named pipe as used by CobaltStrike. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 related: - id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 type: similar - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar status: test description: Detects the creation of a named pipe as used by CobaltStrike references: - https://twitter.com/d4rksystem/status/1357010969264873472 - https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/ - https://github.com/SigmaHQ/sigma/issues/253 - https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/ - https://redcanary.com/threat-detection-report/threats/cobalt-strike/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-25 modified: 2022-10-31 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_MSSE: PipeName|contains|all: - \MSSE- - -server selection_postex: PipeName|startswith: \postex_ selection_status: PipeName|startswith: \status_ selection_msagent: PipeName|startswith: \msagent_ selection_mojo: PipeName|startswith: \mojo_ selection_interprocess: PipeName|startswith: \interprocess_ selection_samr: PipeName|startswith: \samr_ selection_netlogon: PipeName|startswith: \netlogon_ selection_srvsvc: PipeName|startswith: \srvsvc_ selection_lsarpc: PipeName|startswith: \lsarpc_ selection_wkssvc: PipeName|startswith: \wkssvc_ condition: 1 of selection* falsepositives: - Unknown level: critical