Query: rule covering Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in poten
Matching passage: Sigma rule: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in poten. Logsource: windows / process_creation. Rule: title: File In Suspicious Location Encoded To Base64 Via Certutil.EXE id: 82a6714f-4899-4f16-9c1e-9a333544d4c3 related: - id: e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a type: derived status: test description: Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations references: - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|windash: -encode selection_extension: CommandLine|contains: - \AppData\Roaming\ - \Desktop\ - \Local\Temp\ - \PerfLogs\ - \Users\Public\ - \Windows\Temp\ - $Recycle.Bin condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location/info.yml
Near-miss passage: Sigma rule: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lat. Logsource: windows / security. Rule: title: CobaltStrike Service Installations - Security id: d7a95147-145f-4678-b85d-d1ff4a3bb3f6 related: - id: 5a105d34-05fc-401e-8553-272b45c1522d type: derived status: test description: Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement references: - https://www.sans.org/webcasts/119395 - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/ - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Florian Roth (Nextron Systems), Wojciech Lesicki date: 2021-05-26 modified: 2022-11-27 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.lateral-movement - attack.t1021.002 - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: event_id: EventID: 4697 selection1: ServiceFileName|contains|all: - ADMIN$ - .exe selection2: ServiceFileName|contains|all: - '%COMSPEC%' - start - powershell selection3: ServiceFileName|contains: powershell -nop -w hidden -encodedcommand selection4: ServiceFileName|base64offset|contains: 'IEX (New-Object Net.Webclient).DownloadString(''http://127.0.0.1:' condition: event_id and 1 of selection* falsepositives: - Unknown level: high