Query: alert when Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli
Matching passage: Sigma rule: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCli. Logsource: windows / process_creation. Rule: title: Net WebClient Casing Anomalies id: c86133ad-4725-4bd0-8170-210788e0a7ba status: test description: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_encoded: CommandLine|contains: - TgBlAFQALgB3AEUAQg - 4AZQBUAC4AdwBFAEIA - OAGUAVAAuAHcARQBCA - bgBFAHQALgB3AGUAYg - 4ARQB0AC4AdwBlAGIA - uAEUAdAAuAHcAZQBiA - TgBFAHQALgB3AGUAYg - OAEUAdAAuAHcAZQBiA - bgBlAFQALgB3AGUAYg - 4AZQBUAC4AdwBlAGIA - uAGUAVAAuAHcAZQBiA - TgBlAFQALgB3AGUAYg - OAGUAVAAuAHcAZQBiA - bgBFAFQALgB3AGUAYg - 4ARQBUAC4AdwBlAGIA - uAEUAVAAuAHcAZQBiA - bgBlAHQALgBXAGUAYg - 4AZQB0AC4AVwBlAGIA - uAGUAdAAuAFcAZQBiA - bgBFAHQALgBXAGUAYg - 4ARQB0AC4AVwBlAGIA - uAEUAdAAuAFcAZQBiA - TgBFAHQALgBXAGUAYg - OAEUAdAAuAFcAZQBiA - bgBlAFQALgBXAGUAYg - 4AZQBUAC4AVwBlAGIA - uAGUAVAAuAFcAZQBiA - TgBlAFQALgBXAGUAYg - OAGUAVAAuAFcAZQBiA - bgBFAFQALgBXAGUAYg - 4ARQBUAC4AVwBlAGIA - uAEUAVAAuAFcAZQBiA - bgBlAHQALgB3AEUAYg - 4AZQB0AC4AdwBFAGIA - uAGUAdAAuAHcARQBiA - TgBlAHQALgB3AEUAYg - OAGUAdAAuAHcARQBiA - bgBFAHQALgB3AEUAYg - 4ARQB0AC4AdwBFAGIA - uAEUAdAAuAHcARQBiA - TgBFAHQALgB3AEUAYg - OAEUAdAAuAHcARQBiA - bgBlAFQALgB3AEUAYg - 4AZQBUAC4AdwBFAGIA - uAGUAVAAuAHcARQBiA - TgBlAFQALgB3AEUAYg - OAGUAVAAuAHcARQBiA - bgBFAFQALgB3AEUAYg - 4ARQBUAC4AdwBFAGIA - uAEUAVAAuAHcARQBiA - TgBFAFQALgB3AEUAYg - OAEUAVAAuAHcARQBiA - bgBlAHQALgBXAEUAYg - 4AZQB0AC4AVwBFAGIA - uAGUAdAAuAFcARQBiA - TgBlAHQALgBXAEUAYg - OAGUAdAAuAFcARQBiA - bgBFAHQALgBXAEUAYg - 4ARQB0AC4AVwBFAGIA - uAEUAdAAuAFcARQBiA - TgBFAHQALgBXAEUAYg - OAEUAdAAuAFcARQBiA - bgBlAFQALgBXAEUAYg - 4AZQBUAC4AVwBFAGIA - uAGUAVAAuAFcARQBiA - TgBlAFQALgBXAEUAYg - OAGUAVAAuAFcARQBiA - bgBFAFQALgBXAEUAYg - 4ARQBUAC4AVwBFAGIA - uAEUAVAAuAFcARQBiA - TgBFAFQALgBXAEUAYg - OAEUAVAAuAFcARQBiA - bgBlAHQALgB3AGUAQg - 4AZQB0AC4AdwBlAEIA - uAGUAdAAuAHcAZQBCA - TgBlAHQALgB3AGUAQg - OAGUAdAAuAHcAZQBCA - bgBFAHQALgB3AGUAQg - 4ARQB0AC4AdwBlAEIA - uAEUAdAAuAHcAZQBCA - TgBFAHQALgB3AGUAQg - OAEUAdAAuAHcAZQBCA - bgBlAFQALgB3AGUAQg - 4AZQBUAC4AdwBlAEIA - uAGUAVAAuAHcAZQBCA - TgBlAFQALgB3AGUAQg - OAGU
Near-miss passage: Sigma rule: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitra. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Renamed Execution id: 65c3ca2c-525f-4ced-968e-246a713d164f related: - id: a20391f8-76fb-437b-abc0-dba2df1952c6 type: similar status: test description: Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: OriginalFileName: Microsoft.NodejsTools.PressAnyKey.exe filter_main_legit_name: Image|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium