Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / process_creation. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet id: 435e10e4-992a-4281-96f3-38b11106adde related: - id: db885529-903f-4c5d-9864-28fe199e6370 type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-10 modified: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - 'Get-ADComputer ' - ' -Filter \*' CommandLine|contains: - ' > ' - ' | Select ' - Out-File - Set-Content - Add-Content condition: all of selection_* falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Near-miss passage: Sigma rule: Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process inj. Logsource: windows / ps_script. Rule: title: Potential WinAPI Calls Via PowerShell Scripts id: 03d83090-8cba-44a0-b02f-0b756a050306 related: - id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702 type: similar status: test description: 'Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory. ' references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse - https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1 - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community date: 2020-10-06 modified: 2026-04-29 tags: - attack.execution - attack.t1059.001 - attack.t1106 - attack.stealth - attack.t1620 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_injection: ScriptBlockText|contains|all: - VirtualAlloc - OpenProcess - WriteProcessMemory - CreateRemoteThread selection_token_steal: ScriptBlockText|contains|all: - OpenProcessToken - LookupPrivilegeValue - AdjustTokenPrivileges selection_duplicate_token: ScriptBlockText|contains|all: - OpenProcessToken - DuplicateTokenEx - CloseHandle selection_process_write_read: ScriptBlockText|contains|all: - WriteProcessMemory - VirtualAlloc - ReadProcessMemory - VirtualFree selection_local_shellcode_injection: ScriptBlockText|contains|all: - VirtualAlloc - GetDelegateForFunctionPointer - Marshal.Copy condition: 1 of selection_* falsepositives: - Unknown level: high