Query: alert when Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides
Matching passage: Sigma rule: Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides. Logsource: macos / process_creation. Rule: title: System Information Discovery Via Sysctl - MacOS id: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c status: test description: 'Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments. ' references: - https://www.loobins.io/binaries/sysctl/# - https://evasions.checkpoint.com/techniques/macos.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://objective-see.org/blog/blog_0x1E.html - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior author: Pratinav Chandra date: 2024-05-27 tags: - attack.stealth - attack.t1497.001 - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /sysctl - CommandLine|contains: sysctl selection_cmd: CommandLine|contains: - hw. - kern. - machdep. condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Near-miss passage: Sigma rule: Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server. Logsource: windows / process_creation. Rule: title: HackTool - SharpWSUS/WSUSpendu Execution id: b0ce780f-10bd-496d-9067-066d23dc3aa5 status: test description: 'Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS. Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations. ' references: - https://labs.nettitude.com/blog/introducing-sharpwsus/ - https://github.com/nettitude/SharpWSUS - https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1 author: '@Kostastsale, Nasreddine Bencherchali (Nextron Systems)' date: 2022-10-07 modified: 2024-08-23 tags: - attack.execution - attack.lateral-movement - attack.t1210 logsource: product: windows category: process_creation detection: selection_wsuspendu_inject: CommandLine|contains: ' -Inject ' selection_wsuspendu_payload: CommandLine|contains: - ' -PayloadArgs ' - ' -PayloadFile ' selection_sharpwsus_commands: CommandLine|contains: - ' approve ' - ' create ' - ' check ' - ' delete ' selection_sharpwsus_flags: CommandLine|contains: - ' /payload:' - ' /payload=' - ' /updateid:' - ' /updateid=' condition: all of selection_wsuspendu_* or all of selection_sharpwsus_* falsepositives: - Unknown level: high