Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.. Logsource: windows / process_creation. Rule: title: PUA - PingCastle Execution id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c related: - id: b37998de-a70b-4f33-b219-ec36bf433dc0 type: derived status: test description: Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level. references: - https://github.com/vletoux/pingcastle - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450 - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680 - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699 - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8 - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-01-11 tags: - attack.reconnaissance - attack.t1595 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: - MD5=f741f25ac909ee434e50812d436c73ff - MD5=d40acbfc29ee24388262e3d8be16f622 - MD5=01bb2c16fadb992fa66228cd02d45c60 - MD5=9e1b18e62e42b5444fc55b51e640355b - MD5=b7f8fe33ac471b074ca9e630ba0c7e79 - MD5=324579d717c9b9b8e71d0269d13f811f - MD5=63257a1ddaf83cfa43fe24a3bc06c207 - MD5=049e85963826b059c9bac273bb9c82ab - MD5=ecb98b7b4d4427eb8221381154ff4cb2 - MD5=faf87749ac790ec3a10dd069d10f9d63 - MD5=f296dba5d21ad18e6990b1992aea8f83 - MD5=93ba94355e794b6c6f98204cf39f7a11 - MD5=a258ef593ac63155523a461ecc73bdba - MD5=97000eb5d1653f1140ee3f47186463c4 - MD5=95eb317fbbe14a82bd9fdf31c48b8d93 - MD5=32fe9f0d2630ac40ea29023920f20f49 - MD5=a05930dde939cfd02677fc18bb2b7df5 - MD5=124283924e86933ff9054a549d3a268b - MD5=ceda6909b8573fdeb0351c6920225686 - MD5=60ce120040f2cd311c810ae6f6bbc182 - MD5=2f10cdc5b09100a260703a28eadd0ceb - MD5=011d967028e797a4c16d547f7ba1463f - MD5=2da9152c0970500c697c1c9b4a9e0360 - MD5=b5ba72034b8f44d431f55275bace9f8b - MD5=d6ed9101df0f24e27ff92ddab42dacca - MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d - MD5=5e083cd0143ae95a6cb79b68c07ca573 - MD5=28caff93748cb84be70486e79f04c2df - MD5=9d4f12c30f9b500f896efd1800e4dd11 - MD5=4586f7dd14271ad65a5fb696b393f4c0 - MD5=86ba9dddbdf49215145b5bcd081d4011 - MD5=9dce0a481343874ef9a36
Near-miss passage: Sigma rule: Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API an. Logsource: windows / process_creation. Rule: title: Disabling Windows Defender WMI Autologger Session via Reg.exe id: a1b2c3d4-e5f6-a7b8-c9d0-e1f2a3b4c5d6 related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events. By setting the ''Start'' value to ''0'' for the ''DefenderApiLogger'' or ''DefenderAuditLogger'' session, an attacker can prevent these critical security events from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique. ' references: - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/ - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions author: Matt Anderson (Huntress) date: 2025-07-09 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_path: CommandLine|contains: - \Control\WMI\Autologger\DefenderApiLogger\Start - \Control\WMI\Autologger\DefenderAuditLogger\Start selection_reg_add: CommandLine|contains|all: - add - '0' filter_main_enable: CommandLine|contains: '0x00000001' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Highly unlikely level: high