Query: alert when Shadow Copies deletion using operating systems utilities
Matching passage: Sigma rule: Shadow Copies deletion using operating systems utilities. Logsource: windows / process_creation. Rule: title: Shadow Copies Deletion Using Operating Systems Utilities id: c947b146-0abc-4c87-9c64-b17e9d7274a2 status: stable description: Shadow Copies deletion using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://blog.talosintelligence.com/2017/05/wannacry.html - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/ - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 - https://github.com/Neo23x0/Raccine#the-process - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-10-22 modified: 2022-11-03 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1490 logsource: category: process_creation product: windows detection: selection1_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - \diskshadow.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE - diskshadow.exe selection1_cli: CommandLine|contains|all: - shadow - delete selection2_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection2_cli: CommandLine|contains|all: - delete - catalog - quiet selection3_img: - Image|endswith: \vssadmin.exe - OriginalFileName: VSSADMIN.EXE selection3_cli: CommandLine|contains|all: - resize - shadowstorage CommandLine|contains: - unbounded - /MaxSize= condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
Near-miss passage: Sigma rule: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any. Logsource: windows / process_creation. Rule: title: MpiExec Lolbin id: 729ce0ea-5d8f-4769-9762-e35de441586d status: test description: Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1465058133303246867 - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps author: Florian Roth (Nextron Systems) date: 2022-01-11 modified: 2024-11-23 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_binary: - Image|endswith: \mpiexec.exe - Hashes|contains: IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217 selection_flags: CommandLine|contains: - ' /n 1 ' - ' -n 1 ' condition: all of selection* falsepositives: - Unknown level: high