Query: alert when Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
Matching passage: Sigma rule: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale. Logsource: windows / security. Rule: title: Persistence and Execution at Scale via GPO Scheduled Task id: a8f29a7b-b137-4446-80a0-b804272f3da2 status: test description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale references: - https://twitter.com/menasec1/status/1106899890377052160 - https://www.secureworks.com/blog/ransomware-as-a-distraction - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-09-04 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.lateral-movement - attack.t1053.005 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection_5136: EventID: 5136 AttributeLDAPDisplayName: - gPCMachineExtensionNames - gPCUserExtensionNames AttributeValue|contains: - CAB54552-DEEA-4691-817E-ED4A4D1AFC72 - AADCED64-746C-4633-A97C-D61349046527 selection_5145: EventID: 5145 ShareName|endswith: \SYSVOL RelativeTargetName|endswith: ScheduledTasks.xml AccessList|contains: - WriteData - '%%4417' condition: 1 of selection_* falsepositives: - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks. level: high
Near-miss passage: Sigma rule: Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access a. Logsource: windows / file_access. Rule: title: Suspicious File Access to Browser Credential Storage id: a1dfd976-4852-41d4-9507-dc6590a3ccd0 status: experimental description: 'Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts. Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies. This behavior is often commonly observed in credential stealing malware. ' references: - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore date: 2025-05-22 tags: - attack.credential-access - attack.t1555.003 - attack.discovery - attack.t1217 logsource: category: file_access product: windows detection: selection_browser_paths: FileName|contains: - \Sputnik\Sputnik - \MapleStudio\ChromePlus - \QIP Surf - \BlackHawk - \7Star\7Star - \CatalinaGroup\Citrio - \Google\Chrome - \Coowon\Coowon - \CocCoc\Browser - \uCozMedia\Uran - \Tencent\QQBrowser - \Orbitum - \Slimjet - \Iridium - \Vivaldi - \Chromium - \GhostBrowser - \CentBrowser - \Xvast - \Chedot - \SuperBird - \360Browser\Browser - \360Chrome\Chrome - \Comodo\Dragon - \BraveSoftware\Brave-Browser - \Torch - \UCBrowser\ - \Blisk - \Epic Privacy Browser - \Nichrome - \Amigo - \Kometa - \Xpom - \Microsoft\Edge - \Liebao7Default\EncryptedStorage - \AVAST Software\Browser - \Kinza - \Mozilla\SeaMonkey\ - \Comodo\IceDragon\ - \8pecxstudios\Cyberfox\ - \FlashPeak\SlimBrowser\ - \Moonchild Productions\Pale Moon\ selection_browser_subpaths: FileName|contains: - \Profiles\ - \User Data selection_cred_files: - FileName|contains: - \Login Data - \Cookies - \EncryptedStorage - \WebCache\ - FileName|endswith: - cert9.db - cookies.sqlite - formhistory.sqlite - key3.db - key4.db - Login Data.sqlite - logins.json - places.sqlite filter_main_img: Image|endswith: - \Sputnik.exe - \ChromePlus.exe - \QIP Surf.exe - \BlackHawk.exe - \7Star.exe - \Sleipnir5.exe - \Citrio.exe - \Chrome SxS.exe - \Chrome.exe - \Coowon.exe - \CocCocBrowser.exe - \Uran.exe - \QQBrowser.exe - \Orbitum.exe - \Slimjet.exe - \Iridium.exe - \Vivaldi.exe - \Chromium.exe - \GhostBrowser.exe - \CentBrowser.exe - \Xvast.exe - \Chedot.exe - \SuperBird.exe - \360Browser.exe - \360Chrome.exe - \dragon.exe - \brave.e