Query: alert when Detect scenarios where a potentially unauthorized application or user is modifying the system time.
Matching passage: Sigma rule: Detect scenarios where a potentially unauthorized application or user is modifying the system time.. Logsource: windows / security. Rule: title: Unauthorized System Time Modification id: faa031b5-21ed-4e02-8881-2591f98d82ed status: test description: Detect scenarios where a potentially unauthorized application or user is modifying the system time. references: - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well) - Live environment caused by malware - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616 author: '@neu5ron' date: 2019-02-05 modified: 2025-12-03 tags: - attack.stealth - attack.t1070.006 logsource: product: windows service: security definition: 'Requirements: Audit Policy : System > Audit Security State Change, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\System\Audit Security State Change' detection: selection: EventID: 4616 filter_main_svchost: ProcessName: C:\Windows\System32\svchost.exe SubjectUserSid: S-1-5-19 filter_optional_vmtools: ProcessName: - C:\Program Files\VMware\VMware Tools\vmtoolsd.exe - C:\Program Files (x86)\VMware\VMware Tools\vmtoolsd.exe - C:\Windows\System32\VBoxService.exe - C:\Windows\System32\oobe\msoobe.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - HyperV or other virtualization technologies with binary not listed in filter portion of detection level: low
Near-miss passage: Sigma rule: Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial basel. Logsource: windows / network_connection. Rule: title: Outbound RDP Connections Over Non-Standard Tools id: ed74fe75-7594-4b4b-ae38-e38e3fd2eb23 status: test description: 'Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement. An initial baseline is required before using this utility to exclude third party RDP tooling that you might use. ' references: - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708 author: Markus Neis date: 2019-05-15 modified: 2024-02-09 tags: - attack.lateral-movement - attack.t1021.001 - car.2013-07-002 logsource: category: network_connection product: windows detection: selection: DestinationPort: 3389 Initiated: 'true' filter_main_mstsc: Image: - C:\Windows\System32\mstsc.exe - C:\Windows\SysWOW64\mstsc.exe filter_optional_dns: Image: C:\Windows\System32\dns.exe SourcePort: 53 Protocol: udp filter_optional_avast: Image|endswith: - \Avast Software\Avast\AvastSvc.exe - \Avast\AvastSvc.exe filter_optional_sysinternals_rdcman: Image|endswith: \RDCMan.exe filter_optional_chrome: Image: C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_third_party: Image|endswith: - \FSAssessment.exe - \FSDiscovery.exe - \MobaRTE.exe - \mRemote.exe - \mRemoteNG.exe - \Passwordstate.exe - \RemoteDesktopManager.exe - \RemoteDesktopManager64.exe - \RemoteDesktopManagerFree.exe - \RSSensor.exe - \RTS2App.exe - \RTSApp.exe - \spiceworks-finder.exe - \Terminals.exe - \ws_TunnelService.exe filter_optional_thor: Image|endswith: - \thor.exe - \thor64.exe filter_optional_splunk: Image|startswith: C:\Program Files\SplunkUniversalForwarder\bin\ filter_optional_sentinel_one: Image|endswith: \Ranger\SentinelRanger.exe filter_optional_firefox: Image: C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tsplus: Image: - C:\Program Files\TSplus\Java\bin\HTML5service.exe - C:\Program Files (x86)\TSplus\Java\bin\HTML5service.exe filter_optional_null: Image: null filter_optional_empty: Image: '' filter_optional_unknown: Image: <unknown process> condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Third party RDP tools level: high