Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often u. Logsource: windows / process_creation. Rule: title: Suspicious Greedy Compression Using Rar.EXE id: afe52666-401e-4a02-b4ff-5d128990b8cb status: test description: Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes references: - https://decoded.avast.io/martinchlumecky/png-steganography author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems) date: 2022-12-15 modified: 2024-01-02 tags: - attack.execution - attack.t1059 logsource: product: windows category: process_creation detection: selection_opt_1: - Image|endswith: \rar.exe - Description: Command line RAR selection_opt_2: CommandLine|contains: - '.exe a ' - ' a -m' selection_cli_flags: CommandLine|contains|all: - ' -hp' - ' -r ' selection_cli_folders: CommandLine|contains: - ' ?:\\\*.' - ' ?:\\\\\*.' - ' ?:\$Recycle.bin\' - ' ?:\PerfLogs\' - ' ?:\Temp' - ' ?:\Users\Public\' - ' ?:\Windows\' - ' %public%' condition: 1 of selection_opt_* and all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious print spool service (spoolsv.exe) child processes.. Logsource: windows / process_creation. Rule: title: Suspicious Spool Service Child Process id: dcdbc940-0bff-46b2-95f3-2d73f848e33b status: test description: Detects suspicious print spool service (spoolsv.exe) child processes. references: - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule) date: 2021-07-11 modified: 2024-12-01 tags: - attack.execution - attack.t1203 - attack.privilege-escalation - attack.t1068 logsource: category: process_creation product: windows detection: spoolsv: ParentImage|endswith: \spoolsv.exe IntegrityLevel: - System - S-1-16-16384 suspicious_unrestricted: Image|endswith: - \gpupdate.exe - \whoami.exe - \nltest.exe - \taskkill.exe - \wmic.exe - \taskmgr.exe - \sc.exe - \findstr.exe - \curl.exe - \wget.exe - \certutil.exe - \bitsadmin.exe - \accesschk.exe - \wevtutil.exe - \bcdedit.exe - \fsutil.exe - \cipher.exe - \schtasks.exe - \write.exe - \wuauclt.exe - \systeminfo.exe - \reg.exe - \query.exe suspicious_net: Image|endswith: - \net.exe - \net1.exe suspicious_net_filter: CommandLine|contains: start suspicious_cmd: Image|endswith: \cmd.exe suspicious_cmd_filter: CommandLine|contains: - .spl - route add - program files suspicious_netsh: Image|endswith: \netsh.exe suspicious_netsh_filter: CommandLine|contains: - add portopening - rule name suspicious_powershell: Image|endswith: - \powershell.exe - \pwsh.exe suspicious_powershell_filter: CommandLine|contains: .spl suspicious_rundll32_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE suspicious_rundll32_cli: CommandLine|endswith: rundll32.exe condition: spoolsv and ( suspicious_unrestricted or (suspicious_net and not suspicious_net_filter) or (suspicious_cmd and not suspicious_cmd_filter) or (suspicious_netsh and not suspicious_netsh_filter) or (suspicious_powershell and not suspicious_powershell_filter) or all of suspicious_rundll32_* ) falsepositives: - Unknown level: high