Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for o. Logsource: windows / process_creation. Rule: title: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4 status: test description: 'Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder. ' author: '@Kostastsale' references: - https://ss64.com/nt/shell.html date: 2022-12-22 modified: 2024-08-23 tags: - attack.discovery - attack.t1135 logsource: product: windows category: process_creation detection: selection: ParentImage|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe Image|endswith: \explorer.exe CommandLine|contains: shell:mycomputerfolder condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml
Near-miss passage: Sigma rule: Running Chrome VPN Extensions via the Registry install 2 vpn extension. Logsource: windows / registry_set. Rule: title: Running Chrome VPN Extensions via the Registry 2 VPN Extension id: b64a026b-8deb-4c1d-92fd-98893209dff1 status: test description: Running Chrome VPN Extensions via the Registry install 2 vpn extension references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1133/T1133.md#atomic-test-1---running-chrome-vpn-extensions-via-the-registry-2-vpn-extension author: frack113 date: 2021-12-28 modified: 2023-08-17 tags: - attack.initial-access - attack.persistence - attack.t1133 logsource: category: registry_set product: windows detection: chrome_ext: TargetObject|contains: Software\Wow6432Node\Google\Chrome\Extensions TargetObject|endswith: update_url chrome_vpn: TargetObject|contains: - fdcgdnkidjaadafnichfpabhfomcebme - fcfhplploccackoneaefokcmbjfbkenj - bihmplhobchoageeokmgbdihknkjbknd - gkojfkhlekighikafcpjkiklfbnlmeio - jajilbjjinjmgcibalaakngmkilboobh - gjknjjomckknofjidppipffbpoekiipm - nabbmpekekjknlbkgpodfndbodhijjem - kpiecbcckbofpmkkkdibbllpinceiihk - nlbejmccbhkncgokjcmghpfloaajcffj - omghfjlpggmjjaagoclmmobgdodcjboh - bibjcjfmgapbfoljiojpipaooddpkpai - mpcaainmfjjigeicjnlkdfajbioopjko - jljopmgdobloagejpohpldgkiellmfnc - lochiccbgeohimldjooaakjllnafhaid - nhnfcgpcbfclhfafjlooihdfghaeinfc - ookhnhpkphagefgdiemllfajmkdkcaim - namfblliamklmeodpcelkokjbffgmeoo - nbcojefnccbanplpoffopkoepjmhgdgh - majdfhpaihoncoakbjgbdhglocklcgno - lnfdmdhmfbimhhpaeocncdlhiodoblbd - eppiocemhmnlbhjplcgkofciiegomcon - cocfojppfigjeefejbpfmedgjbpchcng - foiopecknacmiihiocgdjgbjokkpkohc - hhdobjgopfphlmjbmnpglhfcgppchgje - jgbaghohigdbgbolncodkdlpenhcmcge - inligpkjkhbpifecbdjhmdpcfhnlelja - higioemojdadgdbhbbbkfbebbdlfjbip - hipncndjamdcmphkgngojegjblibadbe - iolonopooapdagdemdoaihahlfkncfgg - nhfjkakglbnnpkpldhjmpmmfefifedcj - jpgljfpmoofbmlieejglhonfofmahini - fgddmllnllkalaagkghckoinaemmogpe - ejkaocphofnobjdedneohbbiilggdlbi - keodbianoliadkoelloecbhllnpiocoi - hoapmlpnmpaehilehggglehfdlnoegck - poeojclicodamonabcabmapamjkkmnnk - dfkdflfgjdajbhocmfjolpjbebdkcjog - kcdahmgmaagjhocpipbodaokikjkampi - klnkiajpmpkkkgpgbogmcgfjhdoljacg - lneaocagcijjdpkcabeanfpdbmapcjjg - pgfpignfckbloagkfnamnolkeaecfgfh - jplnlifepflhkbkgonidnobkakhmpnmh - jliodmnojccaloajphkingdnpljdhdok - hnmpcagpplmpfojmgmnngilcnanddlhb - ffbkglfijbcbgblgflchnbphjdllaogb - kcndmbbelllkmioekdagahekgimemejo - jdgilggpfmjpbodmhndmhojklgfdlhob - bihhflimonbpcfagfadcnbbdngpopnjb - ppajinakbfocjfnijggfndbdmjggcmde - oofgbpoabipfcfjapgnbbjjaenockbdp