Query: detect Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping in logs
Matching passage: Sigma rule: Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping. Logsource: windows / process_creation. Rule: title: Webshell Hacking Activity Patterns id: 4ebc877f-4612-45cb-b3a5-8e3834db36c9 status: test description: 'Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system ' references: - https://youtu.be/7aemGhaE9ds?t=641 author: Florian Roth (Nextron Systems) date: 2022-03-17 modified: 2023-11-09 tags: - attack.persistence - attack.discovery - attack.t1505.003 - attack.t1018 - attack.t1033 - attack.t1087 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \w3wp.exe - \ws_tomcatservice.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe CommandLine|contains: - catalina.jar - CATALINA_HOME selection_child_1: CommandLine|contains|all: - rundll32 - comsvcs selection_child_2: CommandLine|contains|all: - ' -hp' - ' a ' - ' -m' selection_child_3: CommandLine|contains|all: - net - ' user ' - ' /add' selection_child_4: CommandLine|contains|all: - net - ' localgroup ' - ' administrators ' - /add selection_child_5: Image|endswith: - \ntdsutil.exe - \ldifde.exe - \adfind.exe - \procdump.exe - \Nanodump.exe - \vssadmin.exe - \fsutil.exe selection_child_6: CommandLine|contains: - ' -decode ' - ' -NoP ' - ' -W Hidden ' - ' /decode ' - ' /ticket:' - ' sekurlsa' - .dmp full - .downloadfile( - .downloadstring( - FromBase64String - process call create - 'reg save ' - whoami /priv condition: 1 of selection_webserver_* and 1 of selection_child_* falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing. Logsource: windows / process_creation. Rule: title: Windows EventLog Autologger Session Registry Modification Via CommandLine id: d7b81144-b866-48a4-9bcc-275dc69d870e related: - id: f37b4bce-49d0-4087-9f5b-58bffda77316 type: similar status: experimental description: 'Detects attempts to disable Windows EventLog autologger sessions via registry modification. The AutoLogger event tracing session records events that occur early in the operating system boot process. Applications and device drivers can use the AutoLogger session to capture traces before the user logs in. Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events. ' references: - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session - https://ptylu.github.io/content/report/report.html?report=25 - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \reg.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - reg.exe - PowerShell.EXE - pwsh.dll selection_cli_action: CommandLine|contains: - 'add ' - Set-ItemProperty - New-ItemProperty - 'si ' selection_cli_base: CommandLine|contains: \Control\WMI\Autologger\ selection_cli_key: CommandLine|contains: - Start - Enabled condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_autologger_session_registry_modification/info.yml simulation: - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - Cmd technique: T1562.001 atomic_guid: 653c6e17-14a2-4849-851d-f1c0cc8ea9ab - type: atomic-red-team name: Disable EventLog-Application Auto Logger Session Via Registry - PowerShell technique: T1562.001 atomic_guid: da86f239-9bd3-4e85-92ed-4a94ef111a1c - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - Cmd technique: T1562.001 atomic_guid: 1cac9b54-810e-495c-8aac-989e0076583b - type: atomic-red-team name: Disable EventLog-Application ETW Provider Via Registry - PowerShell technique: T1562.001 atomic_guid: 8f907648-1ebf-4276-b0f0-e2678ca474f0