Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects when a program changes the default file association of any extension to an executable. When a file is opened, th. Logsource: windows / process_creation. Rule: title: Change Default File Association To Executable Via Assoc id: ae6f14e6-14de-45b0-9f44-c0986f50dc89 related: - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061 type: derived status: test description: 'Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - 'assoc ' - exefile filter: CommandLine|contains: .exe=exefile condition: all of selection_* and not filter falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects file downloads directly from IP address URL using curl.exe. Logsource: windows / process_creation. Rule: title: File Download From IP URL Via Curl.EXE id: 9cc85849-3b02-4cb5-b371-3a1ff54f2218 related: - id: 5cb299fc-5fb1-4d07-b989-0644c68b6043 type: similar status: test description: Detects file downloads directly from IP address URL using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-18 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_ip: CommandLine|re: ://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3} selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output filter_main_ext: CommandLine|endswith: - .bat - .bat" - .dat - .dat" - .dll - .dll" - .exe - .exe" - .gif - .gif" - .hta - .hta" - .jpeg - .jpeg" - .log - .log" - .msi - .msi" - .png - .png" - .ps1 - .ps1" - .psm1 - .psm1" - .vbe - .vbe" - .vbs - .vbs" - .bat' - .dat' - .dll' - .exe' - .gif' - .hta' - .jpeg' - .log' - .msi' - .png' - .ps1' - .psm1' - .vbe' - .vbs' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip_exec/info.yml