Query: detection rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Matching passage: Sigma rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons. Logsource: windows / create_remote_thread. Rule: title: HackTool - Potential CobaltStrike Process Injection id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42 status: test description: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons references: - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/ author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community date: 2018-11-30 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: product: windows category: create_remote_thread detection: selection: StartAddress|endswith: - 0B80 - 0C7C - 0C88 condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentControlSet Autorun Keys Modification id: f674e36a-4b91-431e-8aef-f8a96c2aca35 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: system_control_base: TargetObject|contains: \SYSTEM\CurrentControlSet\Control system_control_keys: TargetObject|contains: - \Terminal Server\WinStations\RDP-Tcp\InitialProgram - \Terminal Server\Wds\rdpwd\StartupPrograms - \SecurityProviders\SecurityProviders - \SafeBoot\AlternateShell - \Print\Providers - \Print\Monitors - \NetworkProvider\Order - \Lsa\Notification Packages - \Lsa\Authentication Packages - \BootVerificationProgram\ImagePath filter_empty: Details: (Empty) filter_cutepdf: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: \Print\Monitors\CutePDF Writer Monitor Details: - cpwmon64_v40.dll - CutePDF Writer filter_onenote: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: Print\Monitors\Appmon\Ports\Microsoft.Office.OneNote_ User|contains: - AUTHORI - AUTORI filter_poqexec: Image: C:\Windows\System32\poqexec.exe TargetObject|endswith: \NetworkProvider\Order\ProviderOrder filter_realvnc: Image: C:\Windows\System32\spoolsv.exe TargetObject|endswith: \Print\Monitors\MONVNC\Driver Details: VNCpm.dll condition: all of system_control_* and not 1 of filter_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium