Query: Sigma rule for Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system
Matching passage: Sigma rule: Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system. Logsource: windows / process_creation. Rule: title: Set Suspicious Files as System Files Using Attrib.EXE id: efec536f-72e8-4656-8960-5e85d091345b related: - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b type: derived status: test description: 'Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs ' references: - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4 - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0 - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +s' selection_paths: CommandLine|contains: - ' %' - \Users\Public\ - \AppData\Local\ - \ProgramData\ - \Downloads\ - \Windows\Temp\ selection_ext: CommandLine|contains: - .bat - .dll - .exe - .hta - .ps1 - .vbe - .vbs filter_optional_installer: CommandLine|contains|all: - \Windows\TEMP\ - .exe condition: all of selection* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule. Logsource: github / audit. Rule: title: Github Self Hosted Runner Changes Detected id: f8ed0e8f-7438-4b79-85eb-f358ef2fbebd status: test description: 'A self-hosted runner is a system that you deploy and manage to execute jobs from GitHub Actions on GitHub.com. This rule detects changes to self-hosted runners configurations in the environment. The self-hosted runner configuration changes once detected, it should be validated from GitHub UI because the log entry may not provide full context. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-27 references: - https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#search-based-on-operation tags: - attack.impact - attack.discovery - attack.collection - attack.persistence - attack.privilege-escalation - attack.initial-access - attack.stealth - attack.t1526 - attack.t1213.003 - attack.t1078.004 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - org.remove_self_hosted_runner - org.runner_group_created - org.runner_group_removed - org.runner_group_runner_removed - org.runner_group_runners_added - org.runner_group_runners_updated - org.runner_group_updated - repo.register_self_hosted_runner - repo.remove_self_hosted_runner condition: selection falsepositives: - Allowed self-hosted runners changes in the environment. - A self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 14 days. - An ephemeral self-hosted runner is automatically removed from GitHub if it has not connected to GitHub Actions for more than 1 day. level: low