Query: detect Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co in logs
Matching passage: Sigma rule: Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Today Page id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 related: - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 type: similar status: test description: 'Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl". ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-10 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains|all: - Software\Microsoft\Office\ - \Outlook\Today\ selection_value_stamp: TargetObject|endswith: \Stamp Details: DWORD (0x00000001) selection_value_url: TargetObject|endswith: - \URL - \UserDefinedUrl filter_main_office: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ Image|endswith: \OfficeClickToRun.exe condition: selection_main and 1 of selection_value_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is. Logsource: windows / process_creation. Rule: title: Potentially Suspicious CMD Shell Output Redirect id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892 related: - id: aa2efee7-34dd-446e-8a37-40790a66efd7 type: derived - id: 4f4eaa9f-5ad4-410c-a4be-bc6132b0175a type: similar status: test description: 'Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location. This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration. ' references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 modified: 2024-03-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli_1: CommandLine|contains: - '>?%APPDATA%\' - '>?%TEMP%\' - '>?%TMP%\' - '>?%USERPROFILE%\' - '>?C:\ProgramData\' - '>?C:\Temp\' - '>?C:\Users\Public\' - '>?C:\Windows\Temp\' selection_cli_2: CommandLine|contains: - ' >' - '">' - '''>' CommandLine|contains|all: - C:\Users\ - \AppData\Local\ condition: selection_img and 1 of selection_cli_* falsepositives: - Legitimate admin or third party scripts used for diagnostic collection might generate some false positives level: medium