Query: detection rule: Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate mal
Matching passage: Sigma rule: Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate mal. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Processes Spawned by ConHost id: dfa03a09-8b92-4d83-8e74-f72839b1c407 related: - id: 7dc2dedd-7603-461a-bc13-15803d132355 type: similar status: experimental description: Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.stealth - attack.t1202 - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \conhost.exe selection_child: - Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \wscript.exe - OriginalFileName: - cmd.exe - cscript.exe - mshta.exe - powershell_ise.exe - powershell.exe - pwsh.dll - regsvr32.exe - wscript.exe condition: all of selection_* falsepositives: - Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`. level: high
Near-miss passage: Sigma rule: Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators cr. Logsource: windows / registry_set. Rule: title: Directory Service Restore Mode(DSRM) Registry Value Tampering id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 related: - id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 type: similar status: test description: 'Detects changes to "DsrmAdminLogonBehavior" registry value. During a Domain Controller (DC) promotion, administrators create a Directory Services Restore Mode (DSRM) local administrator account with a password that rarely changes. The DSRM account is an “Administrator” account that logs in with the DSRM mode when the server is booting up to restore AD backups or recover the server from a failure. Attackers could abuse DSRM account to maintain their persistence and access to the organization''s Active Directory. If the "DsrmAdminLogonBehavior" value is set to "0", the administrator account can only be used if the DC starts in DSRM. If the "DsrmAdminLogonBehavior" value is set to "1", the administrator account can only be used if the local AD DS service is stopped. If the "DsrmAdminLogonBehavior" value is set to "2", the administrator account can always be used. ' references: - https://adsecurity.org/?p=1785 - https://www.sentinelone.com/blog/detecting-dsrm-account-misconfigurations/ - https://book.hacktricks.xyz/windows-hardening/active-directory-methodology/dsrm-credentials author: Nischal Khadgi date: 2024-07-11 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Lsa\DsrmAdminLogonBehavior filter_main_default_value: Details: DWORD (0x00000000) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high