Query: rule covering Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr
Matching passage: Sigma rule: Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScr. Logsource: windows / process_creation. Rule: title: HackTool - SharpMove Tool Execution id: 055fb54c-a8f4-4aee-bd44-f74cf30a0d9d status: test description: 'Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options. ' references: - https://github.com/0xthirteen/SharpMove/ - https://pentestlab.blog/tag/sharpmove/ author: Luca Di Bartolomeo (CrimpSec) date: 2024-01-29 tags: - attack.lateral-movement - attack.t1021.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \SharpMove.exe - OriginalFileName: SharpMove.exe selection_cli_computer: CommandLine|contains: computername= selection_cli_actions: CommandLine|contains: - action=create - action=dcom - action=executevbs - action=hijackdcom - action=modschtask - action=modsvc - action=query - action=scm - action=startservice - action=taskscheduler condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Invocations - Specific id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar - id: 536e2947-3729-478c-9903-745aaffe60d2 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2017-03-05 modified: 2025-02-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_convert_b64: ScriptBlockText|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg_selection: ScriptBlockText|contains|all: - powershell - reg - add ScriptBlockText|contains: - \software\microsoft\windows\currentversion\run - \software\wow6432node\microsoft\windows\currentversion\run - \software\microsoft\windows\currentversion\policies\explorer\run selection_webclient_selection: ScriptBlockText|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: ScriptBlockText|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: high