Query: Sigma rule for Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)
Matching passage: Sigma rule: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato). Logsource: windows / process_creation. Rule: title: WhoAmI as Parameter id: e9142d84-fbe0-401d-ac50-3e519fb00c89 status: test description: Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato) references: - https://twitter.com/blackarrowsec/status/1463805700602224645?s=12 author: Florian Roth (Nextron Systems) date: 2021-11-29 modified: 2022-12-25 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: .exe whoami condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli. Logsource: windows / process_creation. Rule: title: Net WebClient Casing Anomalies id: c86133ad-4725-4bd0-8170-210788e0a7ba status: test description: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_encoded: CommandLine|contains: - TgBlAFQALgB3AEUAQg - 4AZQBUAC4AdwBFAEIA - OAGUAVAAuAHcARQBCA - bgBFAHQALgB3AGUAYg - 4ARQB0AC4AdwBlAGIA - uAEUAdAAuAHcAZQBiA - TgBFAHQALgB3AGUAYg - OAEUAdAAuAHcAZQBiA - bgBlAFQALgB3AGUAYg - 4AZQBUAC4AdwBlAGIA - uAGUAVAAuAHcAZQBiA - TgBlAFQALgB3AGUAYg - OAGUAVAAuAHcAZQBiA - bgBFAFQALgB3AGUAYg - 4ARQBUAC4AdwBlAGIA - uAEUAVAAuAHcAZQBiA - bgBlAHQALgBXAGUAYg - 4AZQB0AC4AVwBlAGIA - uAGUAdAAuAFcAZQBiA - bgBFAHQALgBXAGUAYg - 4ARQB0AC4AVwBlAGIA - uAEUAdAAuAFcAZQBiA - TgBFAHQALgBXAGUAYg - OAEUAdAAuAFcAZQBiA - bgBlAFQALgBXAGUAYg - 4AZQBUAC4AVwBlAGIA - uAGUAVAAuAFcAZQBiA - TgBlAFQALgBXAGUAYg - OAGUAVAAuAFcAZQBiA - bgBFAFQALgBXAGUAYg - 4ARQBUAC4AVwBlAGIA - uAEUAVAAuAFcAZQBiA - bgBlAHQALgB3AEUAYg - 4AZQB0AC4AdwBFAGIA - uAGUAdAAuAHcARQBiA - TgBlAHQALgB3AEUAYg - OAGUAdAAuAHcARQBiA - bgBFAHQALgB3AEUAYg - 4ARQB0AC4AdwBFAGIA - uAEUAdAAuAHcARQBiA - TgBFAHQALgB3AEUAYg - OAEUAdAAuAHcARQBiA - bgBlAFQALgB3AEUAYg - 4AZQBUAC4AdwBFAGIA - uAGUAVAAuAHcARQBiA - TgBlAFQALgB3AEUAYg - OAGUAVAAuAHcARQBiA - bgBFAFQALgB3AEUAYg - 4ARQBUAC4AdwBFAGIA - uAEUAVAAuAHcARQBiA - TgBFAFQALgB3AEUAYg - OAEUAVAAuAHcARQBiA - bgBlAHQALgBXAEUAYg - 4AZQB0AC4AVwBFAGIA - uAGUAdAAuAFcARQBiA - TgBlAHQALgBXAEUAYg - OAGUAdAAuAFcARQBiA - bgBFAHQALgBXAEUAYg - 4ARQB0AC4AVwBFAGIA - uAEUAdAAuAFcARQBiA - TgBFAHQALgBXAEUAYg - OAEUAdAAuAFcARQBiA - bgBlAFQALgBXAEUAYg - 4AZQBUAC4AVwBFAGIA - uAGUAVAAuAFcARQBiA - TgBlAFQALgBXAEUAYg - OAGUAVAAuAFcARQBiA - bgBFAFQALgBXAEUAYg - 4ARQBUAC4AVwBFAGIA - uAEUAVAAuAFcARQBiA - TgBFAFQALgBXAEUAYg - OAEUAVAAuAFcARQBiA - bgBlAHQALgB3AGUAQg - 4AZQB0AC4AdwBlAEIA - uAGUAdAAuAHcAZQBCA - TgBlAHQALgB3AGUAQg - OAGUAdAAuAHcAZQBCA - bgBFAHQALgB3AGUAQg - 4ARQB0AC4AdwBlAEIA - uAEUAdAAuAHcAZQBCA - TgBFAHQALgB3AGUAQg - OAEUAdAAuAHcAZQBCA - bgBlAFQALgB3AGUAQg - 4AZQBUAC4AdwBlAEIA - uAGUAVAAuAHcAZQBCA - TgBlAFQALgB3AGUAQg - OAGU