Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection. Logsource: windows / process_creation. Rule: title: Use Short Name Path in Image id: a96970af-f126-420d-90e1-d37bf25e50e1 related: - id: 349d891d-fef0-4fe4-bc53-eee623a15969 type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/frack113/status/1555830623633375232 author: frack113, Nasreddine Bencherchali date: 2022-08-07 modified: 2025-10-20 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: Image|contains: - ~1\ - ~2\ filter_main_system_process: ParentImage: - C:\Windows\System32\Dism.exe - C:\Windows\System32\cleanmgr.exe filter_main_installers: - Image|contains|all: - \AppData\ - \Temp\ - Image|endswith: - ~1\unzip.exe - ~1\7zG.exe filter_optional_webex: ParentImage|endswith: \WebEx\WebexHost.exe filter_optional_thor: ParentImage|endswith: \thor\thor64.exe filter_optional_installshield: - Product: InstallShield (R) - Description: InstallShield (R) Setup Engine - Company: InstallShield Software Corporation condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Applications could use this notation occasionally which might generate some false positives. In that case Investigate the parent and child process. level: medium
Near-miss passage: Sigma rule: Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage. Logsource: windows / network_connection. Rule: title: Uncommon Outbound Kerberos Connection id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74 related: - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 type: similar status: test description: 'Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. ' references: - https://github.com/GhostPack/Rubeus author: Ilyas Ochkov, oscd.community date: 2019-10-24 modified: 2024-03-15 tags: - attack.credential-access - attack.t1558 - attack.lateral-movement - attack.t1550.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: 88 Initiated: 'true' filter_main_lsass: Image: C:\Windows\System32\lsass.exe filter_optional_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tomcat: Image|endswith: \tomcat\bin\tomcat8.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Web Browsers and third party application might generate similar activity. An initial baseline is required. level: medium