Query: alert when Identifies when the Secrets are Modified or Deleted.
Matching passage: Sigma rule: Identifies when the Secrets are Modified or Deleted.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud Kubernetes Secrets Modified or Deleted id: 2f0bae2d-bf20-4465-be86-1311addebaa3 status: test description: Identifies when the Secrets are Modified or Deleted. references: - https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging author: Austin Songer @austinsonger date: 2021-08-09 modified: 2022-10-09 tags: - attack.credential-access logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - io.k8s.core.v*.secrets.create - io.k8s.core.v*.secrets.update - io.k8s.core.v*.secrets.patch - io.k8s.core.v*.secrets.delete condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Near-miss passage: Sigma rule: Detects execution of different log query utilities and commands to search and dump the content of specific event logs or. Logsource: windows / process_creation. Rule: title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf related: - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f type: derived status: test description: 'Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc. ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://www.group-ib.com/blog/apt41-world-tour-2021/ - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today - https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ - https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-09-09 modified: 2025-12-02 tags: - attack.credential-access - attack.discovery - attack.t1552 - attack.t1087 logsource: category: process_creation product: windows detection: selection_wmi: CommandLine|contains|all: - Select - Win32_NTLogEvent selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cli: CommandLine|contains: - ' qe ' - ' query-events ' selection_wmic_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains: ' ntevent' selection_cmdlet: CommandLine|contains: - 'Get-WinEvent ' - 'get-eventlog ' selection_logs_name: CommandLine|contains: - Microsoft-Windows-PowerShell - Microsoft-Windows-Security-Auditing - Microsoft-Windows-TerminalServices-LocalSessionManager - Microsof