Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.. Logsource: windows / process_creation. Rule: title: System File Execution Location Anomaly id: e4a6b256-3e47-40fc-89d2-7a477edd6915 related: - id: be58d2e2-06c8-4f58-b666-b99f6dc3b6cd type: derived status: test description: 'Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. ' references: - https://twitter.com/GelosSnake/status/934900723426439170 - https://asec.ahnlab.com/en/39828/ - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2017-11-27 modified: 2026-07-28 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \atbroker.exe - \audiodg.exe - \bcdedit.exe - \bitsadmin.exe - \certreq.exe - \certutil.exe - \cmstp.exe - \conhost.exe - \consent.exe - \cscript.exe - \csrss.exe - \dashost.exe - \defrag.exe - \dfrgui.exe - \dism.exe - \dllhost.exe - \dllhst3g.exe - \dwm.exe - \eventvwr.exe - \fsquirt.exe - \finger.exe - \logonui.exe - \LsaIso.exe - \lsass.exe - \lsm.exe - \msiexec.exe - \ntoskrnl.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \runonce.exe - \RuntimeBroker.exe - \schtasks.exe - \services.exe - \sihost.exe - \smartscreen.exe - \smss.exe - \spoolsv.exe - \svchost.exe - \taskhost.exe - \taskhostw.exe - \Taskmgr.exe - \userinit.exe - \werfault.exe - \werfaultsecure.exe - \wininit.exe - \winlogon.exe - \winver.exe - \wlanext.exe - \wmic.exe - \wscript.exe - \wsl.exe - \wsmprovhost.exe filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\$WinREAgent\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_optional_system32: Image|contains: \SystemRoot\System32\ filter_main_powershell: Image|contains: - C:\Program Files\PowerShell\7\ - C:\Program Files\PowerShell\7-preview\ - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_wsl_programfiles: Image|startswith: - C:\Program Files\WindowsApps\MicrosoftCorporationII.WindowsSubsystemForLinux - C:\Program Files\WSL\ Image|endswith: \wsl.exe filter_main_wsl_appdata: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\WindowsApps\ Image|endswith: \wsl.exe c
Near-miss passage: Sigma rule: Detects when a Azure Kubernetes Cluster is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Cluster Created or Deleted id: 9541f321-7cba-4b43-80fc-fbd1fb922808 status: test description: Detects when a Azure Kubernetes Cluster is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/DELETE condition: selection falsepositives: - Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low