Query: rule covering Detects the creation of a named file stream with the imphash of a well-known hack tool
Matching passage: Sigma rule: Detects the creation of a named file stream with the imphash of a well-known hack tool. Logsource: windows / create_stream_hash. Rule: title: HackTool Named File Stream Created id: 19b041f6-e583-40dc-b842-d6fa8011493f status: test description: Detects the creation of a named file stream with the imphash of a well-known hack tool references: - https://github.com/gentilkiwi/mimikatz - https://github.com/topotam/PetitPotam - https://github.com/ohpe/juicy-potato - https://github.com/antonioCoco/RoguePotato - https://www.tarasco.org/security/pwdump_7/ - https://github.com/fortra/nanodump - https://github.com/codewhitesec/HandleKatz - https://github.com/xuanxuan0/DripLoader - https://github.com/hfiref0x/UACME - https://github.com/outflanknl/Dumpert - https://github.com/wavestone-cdt/EDRSandblast author: Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2024-11-23 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon config with Imphash logging activated' detection: selection: Hash|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0
Near-miss passage: Sigma rule: Detects potential malicious and unauthorized usage of bcdedit.exe. Logsource: windows / process_creation. Rule: title: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE id: c9fbe8e9-119d-40a6-9b59-dd58a5d84429 status: test description: Detects potential malicious and unauthorized usage of bcdedit.exe references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set - https://twitter.com/malwrhunterteam/status/1372536434125512712/photo/2 author: '@neu5ron' date: 2019-02-07 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 - attack.persistence - attack.t1542.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_cli: CommandLine|contains: - delete - deletevalue - import - safeboot - network condition: all of selection_* level: medium