Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been re. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Execution id: 42a993dd-bb3e-48c8-b372-4d6684c4106c status: test description: This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced. references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local - https://www.mandiant.com/resources/telegram-malware-iranian-espionage - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject author: Florian Roth (Nextron Systems) date: 2022-02-25 modified: 2023-03-08 tags: - attack.execution - attack.persistence - attack.privilege-escalation - attack.credential-access - attack.discovery - attack.t1047 - attack.t1053 - attack.t1059.003 - attack.t1059.001 - attack.t1110 - attack.t1201 logsource: category: process_creation product: windows detection: selection_binary: Image|endswith: \crackmapexec.exe selection_special: CommandLine|contains: ' -M pe_inject ' selection_execute: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -x ' selection_hash: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' - ' -H ''NTHASH''' selection_module_mssql: CommandLine|contains|all: - ' mssql ' - ' -u ' - ' -p ' - ' -M ' - ' -d ' selection_module_smb1: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -H ' - ' -M ' - ' -o ' selection_module_smb2: CommandLine|contains|all: - ' smb ' - ' -u ' - ' -p ' - ' --local-auth' part_localauth_1: CommandLine|contains|all: - ' --local-auth' - ' -u ' - ' -p ' part_localauth_2: CommandLine|contains|all: - ' 10.' - ' 192.168.' - '/24 ' condition: 1 of selection_* or all of part_localauth* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change m. Logsource: windows / registry_set. Rule: title: New Netsh Helper DLL Registered From A Suspicious Location id: e7b18879-676e-4a0e-ae18-27039185a8e7 related: - id: 56321594-9087-49d9-bf10-524fe8479452 type: similar - id: c90362e0-2df3-4e61-94fe-b37615814cb1 type: similar status: test description: 'Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper ' references: - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-11-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.007 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: \SOFTWARE\Microsoft\NetSh selection_folders_1: Details|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \Temporary Internet selection_folders_2: - Details|contains|all: - :\Users\ - \Favorites\ - Details|contains|all: - :\Users\ - \Favourites\ - Details|contains|all: - :\Users\ - \Contacts\ - Details|contains|all: - :\Users\ - \Pictures\ condition: selection_target and 1 of selection_folders_* falsepositives: - Unknown level: high