Query: rule covering Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable ex
Matching passage: Sigma rule: Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable ex. Logsource: windows / process_creation. Rule: title: Execution of Suspicious File Type Extension id: c09dad97-1c78-4f71-b127-7edb2b8e491a status: test description: 'Detects whether the image specified in a process creation event doesn''t refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process. This rule might require some initial baselining to align with some third party tooling in the user environment. ' references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ author: Max Altgelt (Nextron Systems) date: 2021-12-09 modified: 2023-11-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: known_image_extension: Image|endswith: - .bin - .cgi - .com - .exe - .scr - .tmp filter_main_image: Image: - System - Registry - MemCompression - vmmem filter_main_msi_installers: Image|contains: :\Windows\Installer\MSI filter_main_driver_store: Image|contains: :\Windows\System32\DriverStore\FileRepository\ filter_main_msi_rollbackfiles: Image|contains: :\Config.Msi\ Image|endswith: - .rbf - .rbs filter_main_windows_temp: - ParentImage|contains: :\Windows\Temp\ - Image|contains: :\Windows\Temp\ filter_main_deleted: Image|contains: :\$Extend\$Deleted\ filter_main_empty: Image: - '-' - '' filter_main_null: Image: null filter_optional_avira: ParentImage|contains: :\ProgramData\Avira\ filter_optional_nvidia: Image|contains: NVIDIA\NvBackend\ Image|endswith: .dat filter_optional_winpakpro: Image|contains: - :\Program Files (x86)\WINPAKPRO\ - :\Program Files\WINPAKPRO\ Image|endswith: .ngn filter_optional_myq_server: Image|endswith: - :\Program Files (x86)\MyQ\Server\pcltool.dll - :\Program Files\MyQ\Server\pcltool.dll filter_optional_wsl: Image|contains|all: - \AppData\Local\Packages\ - \LocalState\rootfs\ filter_optional_lzma_exe: Image|endswith: \LZMA_EXE filter_optional_firefox: Image|contains: :\Program Files\Mozilla Firefox\ filter_optional_docker: ParentImage: C:\Windows\System32\services.exe Image|endswith: com.docker.service condition: not known_image_extension and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to d. Logsource: windows / registry_set. Rule: title: Windows Hypervisor Enforced Code Integrity Disabled id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a related: - id: 6225c53a-a96e-4235-b28f-8d7997cd96eb type: similar status: test description: 'Detects changes to the HypervisorEnforcedCodeIntegrity registry key and the "Enabled" value being set to 0 in order to disable the Hypervisor Enforced Code Integrity feature. This allows an attacker to load unsigned and untrusted code to be run in the kernel ' references: - https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ - https://github.com/redcanaryco/atomic-red-team/blob/04e487c1828d76df3e834621f4f893ea756d5232/atomics/T1562.001/T1562.001.md#atomic-test-43---disable-hypervisor-enforced-code-integrity-hvci author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati date: 2023-03-14 modified: 2024-07-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: - \Control\DeviceGuard\HypervisorEnforcedCodeIntegrity - \Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity\Enabled - \Microsoft\Windows\DeviceGuard\HypervisorEnforcedCodeIntegrity Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it. level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_deviceguard_hypervisorenforcedcodeintegrity_disabled/info.yml simulation: - type: atomic-red-team name: Disable Hypervisor-Enforced Code Integrity (HVCI) technique: T1562.001 atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020