Query: Sigma rule for Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h
Matching passage: Sigma rule: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be h. Logsource: windows / ps_script. Rule: title: Suspicious Service DACL Modification Via Set-Service Cmdlet - PS id: 22d80745-6f2c-46da-826b-77adaededd74 related: - id: a95b9b42-1308-4735-a1af-abb1c5e6f5ac type: similar status: test description: Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7) references: - https://twitter.com/Alh4zr3d/status/1580925761996828672 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_sddl_flag: ScriptBlockText|contains: - '-SecurityDescriptorSddl ' - '-sd ' selection_set_service: ScriptBlockText|contains|all: - 'Set-Service ' - D;; ScriptBlockText|contains: - ;;;IU - ;;;SU - ;;;BA - ;;;SY - ;;;WD condition: all of selection_* falsepositives: - Rare intended use of hidden services - Rare FP could occur due to the non linearity of the ScriptBlockText log level: high
Near-miss passage: Sigma rule: Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 related: - id: e043f529-8514-4205-8ab0-7f7d2927b400 type: derived status: test description: 'Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 modified: 2024-07-16 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: azurewebsites.net filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_chrome_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_firefox_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_safari: Image|contains: - C:\Program Files (x86)\Safari\ - C:\Program Files\Safari\ Image|endswith: \safari.exe filter_main_defender: Image|contains: - C:\Program Files\Windows Defender Advanced Threat Protection\ - C:\Program Files\Windows Defender\ - C:\Pro