Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still pres. Logsource: windows / process_creation. Rule: title: Finger.EXE Execution id: af491bca-e752-4b44-9c86-df5680533dbc related: - id: c082c2b0-525b-4dbc-9a26-a57dc4692074 type: similar - id: 2fdaf50b-9fd5-449f-ba69-f17248119af6 type: similar status: test description: 'Detects execution of the "finger.exe" utility. Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating. ' references: - https://twitter.com/bigmacjpg/status/1349727699863011328?s=12 - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/ - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt author: Florian Roth (Nextron Systems), omkar72, oscd.community date: 2021-02-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: finger.exe - Image|endswith: \finger.exe condition: selection falsepositives: - Admin activity (unclear what they do nowadays with finger.exe) level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_finger_execution/info.yml
Near-miss passage: Sigma rule: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe Patterns id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 related: - id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a type: similar - id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 type: similar status: test description: Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles references: - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 author: Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems) date: 2021-07-30 modified: 2024-01-26 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - stp.1k logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection_malleable_profile_generic: - PipeName|startswith: - \DserNamePipe - \f4c3 - \f53f - \fullduplex_ - \mojo.5688.8052.183894939787088877 - \mojo.5688.8052.35780273329370473 - \MsFteWds - \msrpc_ - \mypipe-f - \mypipe-h - \ntsvcs - \PGMessagePipe - \rpc_ - \scerpc - \SearchTextHarvester - \spoolss - \win_svc - \win\msrpc_ - \windows.update.manager - \wkssvc - PipeName: - \demoagent_11 - \demoagent_22 selection_malleable_profile_catalog_change_listener: PipeName|startswith: \Winsock2\CatalogChangeListener- PipeName|endswith: -0, filter_main_generic: PipeName: - \wkssvc - \spoolss - \scerpc - \ntsvcs - \SearchTextHarvester - \PGMessagePipe - \MsFteWds filter_optional_websense: Image|contains: - :\Program Files\Websense\ - :\Program Files (x86)\Websense\ PipeName|startswith: - \DserNamePipeR - \DserNamePipeW condition: 1 of selection_malleable_profile_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Chrome instances using the exact same pipe name "mojo.xxx" - Websense Endpoint usin