Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects potentially suspicious file download from file sharing domains using curl.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From File Sharing Domain Via Curl.EXE id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb related: - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects potentially suspicious file download from file sharing domains using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-03-29 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_websites: CommandLine|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output selection_ext: CommandLine|endswith: - .ps1 - .ps1' - .ps1" - .dat - .dat' - .dat" - .msi - .msi' - .msi" - .bat - .bat' - .bat" - .exe - .exe' - .exe" - .vbs - .vbs' - .vbs" - .vbe - .vbe' - .vbe" - .hta - .hta' - .hta" - .dll - .dll' - .dll" - .psm1 - .psm1' - .psm1" condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml
Near-miss passage: Sigma rule: Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey,. Logsource: windows / process_creation. Rule: title: Registry Enumeration via WMI Stdregprov id: a0e417e2-2fa1-40da-b6d2-e094cd5e1191 related: - id: c453ab7a-1f5c-4716-a3b4-dea8135fb43a type: similar status: experimental description: 'Detects the usage of wmic.exe to enumerate or read Windows registry via the WMI StdRegProv class read methods (EnumKey, EnumValues, GetStringValue, etc.). While registry reads are common, attackers may use this technique to perform reconnaissance and discover sensitive configuration values, credentials, or installed software. The use of WMI as an alternative to standard tools like reg.exe can indicate an attempt to evade detection focused on traditional registry query commands. ' references: - https://trustedsec.com/blog/command-line-underdog-wmic-in-action - https://trustedsec.com/blog/wmi-for-script-kiddies - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/regprov/stdregprov author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-30 modified: 2026-06-19 tags: - attack.execution - attack.t1047 - attack.discovery - attack.t1012 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - stdregprov - call CommandLine|contains: - CheckAccess - EnumKey - EnumValues - GetBinaryValue - GetDWORDValue - GetExpandedStringValue - GetMultiStringValue - GetQWORDValue - GetSecurityDescriptor - GetStringValue condition: all of selection_* falsepositives: - Legitimate administrative activity level: medium