Query: rule covering Detects potential malicious and unauthorized usage of bcdedit.exe
Matching passage: Sigma rule: Detects potential malicious and unauthorized usage of bcdedit.exe. Logsource: windows / process_creation. Rule: title: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE id: c9fbe8e9-119d-40a6-9b59-dd58a5d84429 status: test description: Detects potential malicious and unauthorized usage of bcdedit.exe references: - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set - https://twitter.com/malwrhunterteam/status/1372536434125512712/photo/2 author: '@neu5ron' date: 2019-02-07 modified: 2023-02-15 tags: - attack.stealth - attack.t1070 - attack.persistence - attack.t1542.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_cli: CommandLine|contains: - delete - deletevalue - import - safeboot - network condition: all of selection_* level: medium
Near-miss passage: Sigma rule: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe Patterns id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 related: - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar - id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 type: similar status: test description: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles references: - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 author: Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems) date: 2021-07-30 modified: 2024-01-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - stp.1k logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_malleable_profile_generic: - PipeName|startswith: - \DserNamePipe - \f4c3 - \f53f - \fullduplex_ - \mojo.5688.8052.183894939787088877 - \mojo.5688.8052.35780273329370473 - \MsFteWds - \msrpc_ - \mypipe-f - \mypipe-h - \ntsvcs - \PGMessagePipe - \rpc_ - \scerpc - \SearchTextHarvester - \spoolss - \win_svc - \win\msrpc_ - \windows.update.manager - \wkssvc - PipeName: - \demoagent_11 - \demoagent_22 selection_malleable_profile_catalog_change_listener: PipeName|startswith: \Winsock2\CatalogChangeListener- PipeName|endswith: -0, filter_main_generic: PipeName: - \wkssvc - \spoolss - \scerpc - \ntsvcs - \SearchTextHarvester - \PGMessagePipe - \MsFteWds filter_optional_websense: Image|contains: - :\Program Files\Websense\ - :\Program Files (x86)\Websense\ PipeName|startswith: - \DserNamePipeR - \DserNamePipeW condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Chrome instances using the exact same pipe name "mojo.xxx" - Websense Endpoint usin