Query: detection rule: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-
Matching passage: Sigma rule: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-. Logsource: windows / process_creation. Rule: title: MMC Executing Files with Reversed Extensions Using RTLO Abuse id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 status: experimental description: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats. references: - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf - https://en.wikipedia.org/wiki/Right-to-left_override - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1204.002 - attack.t1218.014 - attack.t1036.002 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \mmc.exe - OriginalFileName: MMC.exe selection_commandline: CommandLine|contains: - cod.msc - fdp.msc - ftr.msc - lmth.msc - slx.msc - tdo.msc - xcod.msc - xslx.msc - xtpp.msc condition: all of selection_* falsepositives: - Legitimate administrative actions using MMC to execute misnamed `.msc` files. - Unconventional but non-malicious usage of RLO or reversed extensions. level: high
Near-miss passage: Sigma rule: Detects suspicious and uncommon child processes of WmiPrvSE. Logsource: windows / process_creation. Rule: title: Suspicious WmiPrvSE Child Process id: 8a582fe2-0882-4b89-a82a-da6b2dc32937 related: - id: 692f0bec-83ba-4d04-af7e-e884a96059b6 type: similar - id: d21374ff-f574-44a7-9998-4a8c8bf33d7d type: similar - id: 18cf6cf0-39b0-4c22-9593-e244bdc9a2d4 type: obsolete status: test description: Detects suspicious and uncommon child processes of WmiPrvSE references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/ForensicITGuy/status/1334734244120309760 author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems) date: 2021-08-23 modified: 2023-11-10 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: product: windows category: process_creation detection: selection_parent: ParentImage|endswith: \wbem\WmiPrvSE.exe selection_children_1: Image|endswith: - \certutil.exe - \cscript.exe - \mshta.exe - \msiexec.exe - \regsvr32.exe - \rundll32.exe - \verclsid.exe - \wscript.exe selection_children_2: Image|endswith: \cmd.exe CommandLine|contains: - cscript - mshta - powershell - pwsh - regsvr32 - rundll32 - wscript filter_main_werfault: Image|endswith: \WerFault.exe filter_main_wmiprvse: Image|endswith: \WmiPrvSE.exe filter_main_msiexec: Image|endswith: \msiexec.exe CommandLine|contains: '/i ' condition: selection_parent and 1 of selection_children_* and not 1 of filter_main_* falsepositives: - Unknown level: high