Query: write Sigma for Detects execution of different log query utilities and commands to search and dump the content of specific event logs or
Matching passage: Sigma rule: Detects execution of different log query utilities and commands to search and dump the content of specific event logs or. Logsource: windows / process_creation. Rule: title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf related: - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f type: derived status: test description: 'Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc. ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://www.group-ib.com/blog/apt41-world-tour-2021/ - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today - https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ - https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-09-09 modified: 2025-12-02 tags: - attack.credential-access - attack.discovery - attack.t1552 - attack.t1087 logsource: category: process_creation product: windows detection: selection_wmi: CommandLine|contains|all: - Select - Win32_NTLogEvent selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cli: CommandLine|contains: - ' qe ' - ' query-events ' selection_wmic_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains: ' ntevent' selection_cmdlet: CommandLine|contains: - 'Get-WinEvent ' - 'get-eventlog ' selection_logs_name: CommandLine|contains: - Microsoft-Windows-PowerShell - Microsoft-Windows-Security-Auditing - Microsoft-Windows-TerminalServices-LocalSessionManager - Microsof
Near-miss passage: Sigma rule: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use. Logsource: windows / process_creation. Rule: title: Query Usage To Exfil Data id: 53ef0cef-fa24-4f25-a34a-6c72dfa2e6e2 status: test description: Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use references: - https://twitter.com/MichalKoczwara/status/1553634816016498688 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-01 modified: 2023-01-19 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: Image|endswith: :\Windows\System32\query.exe CommandLine|contains: - session > - process > condition: selection falsepositives: - Unknown level: medium