Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects execution of "dsquery.exe" for domain trust discovery. Logsource: windows / process_creation. Rule: title: Domain Trust Discovery Via Dsquery id: 3bad990e-4848-4a78-9530-b427d854aac0 related: - id: b23fcb74-b1cb-4ff7-a31d-bfe2a7ba453b type: similar - id: 77815820-246c-47b8-9741-e0def3f57308 type: obsolete status: test description: Detects execution of "dsquery.exe" for domain trust discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843 author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72 date: 2019-10-24 modified: 2023-02-02 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsquery.exe - OriginalFileName: dsquery.exe selection_cli: CommandLine|contains: trustedDomain condition: all of selection_* falsepositives: - Legitimate use of the utilities by legitimate user for legitimate reason level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/info.yml simulation: - type: atomic-red-team name: Windows - Discover domain trusts with dsquery technique: T1482 atomic_guid: 4700a710-c821-4e17-a3ec-9e4c81d6845f
Near-miss passage: Sigma rule: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the w. Logsource: windows / registry_set. Rule: title: Suspicious Execution Of Renamed Sysinternals Tools - Registry id: f50f3c09-557d-492d-81db-9064a8d4e211 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: 8023f872-3f1d-4301-a384-801889917ab4 type: similar status: test description: Detects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool) references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \Active Directory Explorer - \Handle - \LiveKd - \ProcDump - \Process Explorer - \PsExec - \PsLoggedon - \PsLoglist - \PsPasswd - \PsPing - \PsService - \SDelete TargetObject|endswith: \EulaAccepted filter: Image|endswith: - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \PsLoggedon.exe - \PsLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \PsPing.exe - \PsPing64.exe - \PsPing64a.exe - \PsService.exe - \PsService64.exe - \PsService64a.exe - \sdelete.exe condition: selection and not filter falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_pua_sysinternals_renamed_execution_via_eula/info.yml