Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the usage of the "net.exe" command to start a service using the "start" flag. Logsource: windows / process_creation. Rule: title: Start Windows Service Via Net.EXE id: 2a072a96-a086-49fa-bcb5-15cc5a619093 status: test description: Detects the usage of the "net.exe" command to start a service using the "start" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.002/T1569.002.md author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community date: 2019-10-21 modified: 2023-03-05 tags: - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains: ' start ' condition: all of selection_* falsepositives: - Legitimate administrator or user executes a service for legitimate reasons. level: low
Near-miss passage: Sigma rule: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications.. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Visual Studio Tools for Office id: 9d15044a-7cfe-4d23-8085-6ebc11df7685 status: test description: Detects persistence via Visual Studio Tools for Office (VSTO) add-ins in Office applications. references: - https://twitter.com/_vivami/status/1347925307643355138 - https://vanmieghem.io/stealth-outlook-persistence/ author: Bhabesh Raj date: 2021-01-10 modified: 2026-01-09 tags: - attack.t1137.006 - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\Office\Outlook\Addins\ - \Software\Microsoft\Office\Word\Addins\ - \Software\Microsoft\Office\Excel\Addins\ - \Software\Microsoft\Office\Powerpoint\Addins\ - \Software\Microsoft\VSTO\Security\Inclusion\ filter_main_system: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe - C:\Windows\System32\regsvr32.exe - C:\Windows\SysWOW64\regsvr32.exe filter_main_office_click_to_run: Image|startswith: - C:\Program Files\Common Files (x86)\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ Image|endswith: \OfficeClickToRun.exe filter_main_integrator: Image: - C:\Program Files (x86)\Microsoft Office\root\integration\integrator.exe - C:\Program Files\Microsoft Office\root\integration\integrator.exe filter_main_office_apps: Image|startswith: - C:\Program Files\Microsoft Office\OFFICE - C:\Program Files (x86)\Microsoft Office\OFFICE - C:\Program Files\Microsoft Office\Root\OFFICE - C:\Program Files (x86)\Microsoft Office\Root\OFFICE - C:\PROGRA~2\MICROS~2\Office Image|endswith: - \excel.exe - \Integrator.exe - \OneNote.exe - \outlook.exe - \powerpnt.exe - \Teams.exe - \visio.exe - \winword.exe filter_main_vsto: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\VSTO\ - C:\Program Files (x86)\Microsoft Shared\VSTO\ Image|endswith: \VSTOInstaller.exe filter_optional_avg: Image: - C:\Program Files\AVG\Antivirus\RegSvr.exe - C:\Program Files (x86)\AVG\Antivirus\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Antivirus.AsOutExt\ filter_optional_avast: Image: - C:\Program Files\Avast Software\Avast\RegSvr.exe - C:\Program Files (x86)\Avast Software\Avast\RegSvr.exe TargetObject|contains: \Microsoft\Office\Outlook\Addins\Avast.AsOutExt\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Addin Installation level: medium