Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Repor. Logsource: windows / process_creation. Rule: title: HackTool - WSASS Execution id: 589ac73f-8e12-409c-964e-31a2f5775ae2 status: experimental description: 'Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER''s (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections. ' references: - https://github.com/TwoSevenOneT/WSASS - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-23 modified: 2026-01-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wsass.exe selection_hash: Hashes|contains: IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42 selection_cli: CommandLine|re: (?i)\.exe[\"\']?\s+[^\"]{0,64}werfaultsecure\.exe[\"\']?\s+\d{2,10} condition: 1 of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml
Near-miss passage: Sigma rule: Detects when attackers or tools disable Windows Defender functionalities via the Windows registry. Logsource: windows / registry_set. Rule: title: Disable Windows Defender Functionalities Via Registry Keys id: 0eb46774-f1ab-4a74-8238-1155855f2263 related: - id: a64e4198-c1c8-46a5-bc9c-324c86455fd4 type: obsolete - id: fd115e64-97c7-491f-951c-fc8da7e042fa type: obsolete status: test description: Detects when attackers or tools disable Windows Defender functionalities via the Windows registry references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105 - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html - https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/ author: AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel date: 2022-08-01 modified: 2024-10-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains: - \SOFTWARE\Microsoft\Windows Defender\ - \SOFTWARE\Policies\Microsoft\Windows Defender Security Center\ - \SOFTWARE\Policies\Microsoft\Windows Defender\ selection_dword_1: TargetObject|endswith: - \DisableAntiSpyware - \DisableAntiVirus - \DisableBehaviorMonitoring - \DisableBlockAtFirstSeen - \DisableEnhancedNotifications - \DisableIntrusionPreventionSystem - \DisableIOAVProtection - \DisableOnAccessProtection - \DisableRealtimeMonitoring - \DisableScanOnRealtimeEnable - \DisableScriptScanning Details: DWORD (0x00000001) selection_dword_0: TargetObject|endswith: - \DisallowExploitProtectionOverride - \Features\TamperProtection - \MpEngine\MpEnablePus - \PUAProtection - \Signature Update\ForceUpdateFromMU - \SpyNet\SpynetReporting - \SpyNet\SubmitSamplesConsent - \Windows Defender Exploit Guard\Controlled Folder Access\EnableControlledFolderAccess Details: DWORD (0x00000000) filter_optional_symantec: Image|startswith: C:\Program Files\Symantec\Symantec Endpoint Protection\ Image|endswith: \sepWscSvc64.exe condition: selection_main and 1 of selection_dword_*