Query: Sigma YAML for proxy
Matching passage: Sigma rule: Detects suspicious malformed user agent strings in proxy logs. Logsource: proxy. Rule: title: Suspicious User Agent id: 7195a772-4b3f-43a4-a210-6a003d65caa1 status: test description: Detects suspicious malformed user agent strings in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-10-31 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection1: c-useragent|startswith: - user-agent - 'Mozilla/3.0 ' - 'Mozilla/2.0 ' - 'Mozilla/1.0 ' - 'Mozilla ' - ' Mozilla/' - Mozila/ - Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol selection2: c-useragent|contains: - ' (compatible;MSIE ' - '.0;Windows NT ' - loader selection3: c-useragent: - _ - CertUtil URL Agent - Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0) - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - HTTPS - Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a - x - xxx falsepositives: - c-useragent: Mozilla/3.0 * Acrobat * - cs-host|endswith: - .acrobat.com - .adobe.com - .adobe.io condition: 1 of selection* and not falsepositives falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a sys. Logsource: windows / registry_set. Rule: title: RDP Sensitive Settings Changed id: 3f6b7b62-61aa-45db-96bd-9c31b36b653c related: - id: 171b67e1-74b4-460e-8d55-b331f3e32d67 type: obsolete - id: 41904ebe-d56c-4904-b9ad-7a77bdf154b3 type: obsolete - id: a2863fbc-d5cb-48d5-83fb-d976d4b1743b type: similar status: test description: 'Detects tampering of RDP Terminal Service/Server sensitive settings. Such as allowing unauthorized users access to a system via the ''fAllowUnsolicited'' or enabling RDP via ''fDenyTSConnections'', etc. Below is a list of registry keys/values that are monitored by this rule: - Shadow: Used to enable Remote Desktop shadowing, which allows an administrator to view or control a user''s session. - DisableRemoteDesktopAntiAlias: Disables anti-aliasing for remote desktop sessions. - DisableSecuritySettings: Disables certain security settings for Remote Desktop connections. - fAllowUnsolicited: Allows unsolicited remote assistance offers. - fAllowUnsolicitedFullControl: Allows unsolicited remote assistance offers with full control. - InitialProgram: Specifies a program to run automatically when a user logs on to a remote computer. - ServiceDll: Used in RDP hijacking techniques to specify a custom DLL to be loaded by the Terminal Services service. - SecurityLayer: Specifies the security layer used for RDP connections. ' references: - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - https://blog.sekoia.io/darkgate-internals/ - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalser