Query: rule covering Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar
Matching passage: Sigma rule: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar. Logsource: windows / ps_script. Rule: title: Execute Invoke-command on Remote Host id: 7b836d7f-179c-4ba4-90a7-a7e60afb48e6 status: test description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-2---invoke-command - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.4 author: frack113 date: 2022-01-07 tags: - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains|all: - 'invoke-command ' - ' -ComputerName ' condition: selection_cmdlet falsepositives: - Legitimate script level: medium
Near-miss passage: Sigma rule: Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing. Logsource: windows / process_creation. Rule: title: Windows EventLog Autologger Session Registry Modification Via CommandLine id: d7b81144-b866-48a4-9bcc-275dc69d870e related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://ptylu.github.io/content/report/report.html?report=25 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - PowerShell.EXE - pwsh.dll selection_cli_action: CommandLine|contains: - 'add ' - Set-ItemProperty - New-ItemProperty - 'si ' selection_cli_base: CommandLine|contains: \Control\WMI\Autologger\ selection_cli_key: CommandLine|contains: - Start - Enabled condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - Cmd technique: T1562.001 atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - PowerShell technique: T1562.001 atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0