Query: rule covering Shadow Copies deletion using operating systems utilities
Matching passage: Sigma rule: Shadow Copies deletion using operating systems utilities. Logsource: windows / process_creation. Rule: title: Shadow Copies Deletion Using Operating Systems Utilities id: c947b146-0abc-4c87-9c64-b17e9d7274a2 status: stable description: Shadow Copies deletion using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://blog.talosintelligence.com/2017/05/wannacry.html - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/ - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 - https://github.com/Neo23x0/Raccine#the-process - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-10-22 modified: 2022-11-03 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1490 logsource: category: process_creation product: windows detection: selection1_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - \diskshadow.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE - diskshadow.exe selection1_cli: CommandLine|contains|all: - shadow - delete selection2_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection2_cli: CommandLine|contains|all: - delete - catalog - quiet selection3_img: - Image|endswith: \vssadmin.exe - OriginalFileName: VSSADMIN.EXE selection3_cli: CommandLine|contains|all: - resize - shadowstorage CommandLine|contains: - unbounded - /MaxSize= condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
Near-miss passage: Sigma rule: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accou. Logsource: windows / ps_script. Rule: title: Get-ADUser Enumeration Using UserAccountControl Flags id: 96c982fe-3d08-4df4-bed2-eb14e02f21c8 status: test description: Detects AS-REP roasting is an attack that is often-overlooked. It is not very common as you have to explicitly set accounts that do not require pre-authentication. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting - https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/ author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADUser - -Filter - useraccountcontrol - -band - '4194304' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium