Query: detection rule: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can
Matching passage: Sigma rule: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can. Logsource: windows / process_creation. Rule: title: Suspicious Csi.exe Usage id: 40b95d31-1afc-469e-8d34-9a3a667d058e status: test description: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/ - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/ - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/ - https://twitter.com/Z3Jpa29z/status/1317545798981324801 author: Konstantin Grishchenko, oscd.community date: 2020-10-17 modified: 2022-07-11 tags: - attack.lateral-movement - attack.execution - attack.stealth - attack.t1072 - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \csi.exe - \rcsi.exe - OriginalFileName: - csi.exe - rcsi.exe selection_cli: Company: Microsoft Corporation condition: all of selection* falsepositives: - Legitimate usage by software developers level: medium
Near-miss passage: Sigma rule: Detects suspicious user agent strings used by malware in proxy logs. Logsource: proxy. Rule: title: Malware User Agent id: 5c84856b-55a5-45f1-826f-13f37250cf4e status: test description: Detects suspicious user agent strings used by malware in proxy logs references: - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules - http://www.botopedia.org/search?searchword=scan&searchphrase=all - https://networkraptor.blogspot.com/2015/01/user-agent-strings.html - https://perishablepress.com/blacklist/ua-2013.txt - https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents - https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q - https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large - https://twitter.com/crep1x/status/1635034100213112833 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-07-08 modified: 2024-04-14 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Mozilla/5.0 (Windows NT 6.1; WOW64; rv:53.0) Gecko/20100101 Chrome /53.0 - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322) - HttpBrowser/1.0 - '*<|>*' - nsis_inetc (mozilla) - Wget/1.9+cvs-stable (Red Hat modified) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) - '*zeroup*' - Mozilla/5.0 (Windows NT 5.1 ; v.* - '* adlib/*' - '* tiny' - '* BGroom *' - '* changhuatong' - '* CholTBAgent' - Mozilla/5.0 WinInet - RookIE/1.0 - M - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) - Mozilla/4.0 (compatible;MSIE 7.0;Windows NT 6.0) - backdoorbot - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30731) - Opera/8.81 (Windows NT 6.0; U; en) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.1 (.NET CLR 3.5.30729) - Opera - Mozilla/4.0 (compatible; MSIE 5.0; Windows 98) - Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0) - MSIE - '*(Charon; Inferno)' - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/5.0 (Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64) - Mozilla/4.0