Query: detect Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored jus in logs
Matching passage: Sigma rule: Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored jus. Logsource: antivirus. Rule: title: Antivirus - Password Dumper Signature id: 78cc2dd2-7d20-4d32-93ff-057084c38b93 status: stable description: 'Detects a highly relevant Antivirus alert that reports password dumpers and stealers. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset. ' references: - https://www.nextron-systems.com/?s=antivirus - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619 - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448 author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-15 tags: - attack.credential-access - attack.t1003 - attack.t1558 - attack.t1003.001 - attack.t1003.002 logsource: category: antivirus detection: selection: - Signature|startswith: PWS - Signature|contains: - Certify - DCSync - Creddump - DumpCreds - DumpLsass - DumpPert - FormBook - HTool/WCE - Kekeo - Lazagne - LsassDump - Lummast - Mimikatz - MultiDump - Multiverze - Nanodump - NativeDump - Outflank - PShlSpy - PSWTool - PWCrack - PWDump - PWS. - PWSX - pypykatz - Rubeus - SafetyKatz - SecurityTool - SharpChrome - SharpDPAPI - SharpDump - SharpKatz - SharpS. - ShpKatz - Steal - TrickDump - wsass condition: selection falsepositives: - Unlikely level: critical
Near-miss passage: Sigma rule: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands. Logsource: linux / auditd. Rule: title: Unix Shell Configuration Modification id: a94cdd87-6c54-4678-a6cc-2814ffe5a13d related: - id: e74e15cc-c4b6-4c80-b7eb-dfe49feb7fe9 type: obsolete status: test description: Detect unix shell configuration modification. Adversaries may establish persistence through executing malicious commands triggered when a new shell is opened. references: - https://objective-see.org/blog/blog_0x68.html - https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack - https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat author: Peter Matkovski, IAI date: 2023-03-06 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.004 logsource: product: linux service: auditd detection: selection: type: PATH name: - /etc/shells - /etc/profile - /etc/profile.d/* - /etc/bash.bashrc - /etc/bashrc - /etc/zsh/zprofile - /etc/zsh/zshrc - /etc/zsh/zlogin - /etc/zsh/zlogout - /etc/csh.cshrc - /etc/csh.login - /root/.bashrc - /root/.bash_profile - /root/.profile - /root/.zshrc - /root/.zprofile - /home/*/.bashrc - /home/*/.zshrc - /home/*/.bash_profile - /home/*/.zprofile - /home/*/.profile - /home/*/.bash_login - /home/*/.bash_logout - /home/*/.zlogin - /home/*/.zlogout condition: selection falsepositives: - Admin or User activity are expected to generate some false positives level: medium