Query: write Sigma for Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommo
Matching passage: Sigma rule: Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommo. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Potentially Suspicious Child Process id: b6676963-0353-4f88-90f5-36c20d443c6a status: test description: 'Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32. Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others. ' references: - Internal Research - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86') date: 2023-05-15 modified: 2024-01-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \wscript.exe - \cscript.exe selection_cli_script_main: Image|endswith: - \cmd.exe - \powershell.exe - \pwsh.exe selection_cli_script_option_mshta: CommandLine|contains|all: - mshta - http selection_cli_script_option_other: CommandLine|contains: - rundll32 - regsvr32 - msiexec selection_cli_standalone: Image|endswith: \rundll32.exe filter_main_rundll32_known_exports: Image|endswith: \rundll32.exe CommandLine|contains: - UpdatePerUserSystemParameters - PrintUIEntry - ClearMyTracksByProcess condition: selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_* falsepositives: - Some false positives might occur with admin or third party software scripts. Investigate and apply additional filters accordingly. level: medium
Near-miss passage: Sigma rule: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this func. Logsource: windows / process_creation. Rule: title: Visual Studio Code Tunnel Shell Execution id: f4a623c2-4ef5-4c33-b811-0642f702c9f1 status: test description: Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system. references: - https://ipfyx.fr/post/visual-studio-code-tunnel/ - https://badoption.eu/blog/2023/01/31/code_c2.html - https://code.visualstudio.com/docs/remote/tunnels author: Nasreddine Bencherchali (Nextron Systems) date: 2023-10-25 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: \servers\Stable- ParentImage|endswith: \server\node.exe ParentCommandLine|contains: .vscode-server selection_child_1: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: \terminal\browser\media\shellIntegration.ps1 selection_child_2: Image|endswith: - \wsl.exe - \bash.exe condition: selection_parent and 1 of selection_child_* falsepositives: - Legitimate use of Visual Studio Code tunnel and running code from there level: medium