Query: write Sigma for Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature
Matching passage: Sigma rule: Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation id: f8931561-97f5-4c46-907f-0a4a592e47a7 status: experimental description: 'Detects attempted file load events that did not meet the signing level requirements. It often means the file''s signature is revoked or a signature with the Lifetime Signing EKU has expired. This event is best correlated with EID 3089 to determine the error of the validation. ' references: - https://twitter.com/SBousseaden/status/1483810148602814466 - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-20 modified: 2025-02-28 tags: - attack.execution logsource: product: windows service: codeintegrity-operational detection: selection: EventID: - 3033 - 3034 filter_optional_dtrace: FileNameBuffer|endswith: \Program Files\DTrace\dtrace.dll ProcessNameBuffer|endswith: \Windows\System32\svchost.exe RequestedPolicy: 12 filter_optional_av_generic: FileNameBuffer|contains: \Windows\System32\DriverStore\FileRepository\ FileNameBuffer|endswith: \igd10iumd64.dll RequestedPolicy: 7 filter_optional_electron_based_app: FileNameBuffer|endswith: \Windows\System32\nvspcap64.dll ProcessNameBuffer|endswith: - \AppData\Local\Keybase\Gui\Keybase.exe - \Microsoft\Teams\stage\Teams.exe RequestedPolicy: 8 filter_optional_bonjour: FileNameBuffer|endswith: \Program Files\Bonjour\mdnsNSP.dll ProcessNameBuffer|endswith: - \Windows\System32\svchost.exe - \Windows\System32\SIHClient.exe RequestedPolicy: - 8 - 12 filter_optional_msoffice_1: FileNameBuffer|contains: \Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE FileNameBuffer|endswith: \MSOXMLMF.DLL RequestedPolicy: 7 filter_optional_msoffice_2: ProcessNameBuffer|contains: \Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office FileNameBuffer|contains: \Windows\System32\ RequestedPolicy: 8 filter_optional_slack: FileNameBuffer|endsw
Near-miss passage: Sigma rule: Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass). Logsource: windows / process_creation. Rule: title: HackTool - Htran/NATBypass Execution id: f5e3b62f-e577-4e59-931e-0a15b2b94e1e status: test description: Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass) references: - https://github.com/HiwinCN/HTran - https://github.com/cw1997/NATBypass author: Florian Roth (Nextron Systems) date: 2022-12-27 modified: 2023-02-04 tags: - attack.command-and-control - attack.t1090 - attack.s0040 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \htran.exe - \lcx.exe selection_cli: CommandLine|contains: - '.exe -tran ' - '.exe -slave ' condition: 1 of selection_* falsepositives: - Unknown level: high