Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects base64 encoded strings used in hidden malicious PowerShell command lines. Logsource: windows / process_creation. Rule: title: Malicious Base64 Encoded PowerShell Keywords in Command Lines id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0 status: test description: Detects base64 encoded strings used in hidden malicious PowerShell command lines references: - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/ author: John Lambert (rule) date: 2019-01-16 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_hidden: CommandLine|contains: ' hidden ' selection_encoded: CommandLine|contains: - AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA - aXRzYWRtaW4gL3RyYW5zZmVy - IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA - JpdHNhZG1pbiAvdHJhbnNmZX - YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg - Yml0c2FkbWluIC90cmFuc2Zlc - AGMAaAB1AG4AawBfAHMAaQB6AGUA - JABjAGgAdQBuAGsAXwBzAGkAegBlA - JGNodW5rX3Npem - QAYwBoAHUAbgBrAF8AcwBpAHoAZQ - RjaHVua19zaXpl - Y2h1bmtfc2l6Z - AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A - kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg - lPLkNvbXByZXNzaW9u - SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA - SU8uQ29tcHJlc3Npb2 - Ty5Db21wcmVzc2lvb - AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ - kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA - lPLk1lbW9yeVN0cmVhb - SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A - SU8uTWVtb3J5U3RyZWFt - Ty5NZW1vcnlTdHJlYW - 4ARwBlAHQAQwBoAHUAbgBrA - 5HZXRDaHVua - AEcAZQB0AEMAaAB1AG4Aaw - LgBHAGUAdABDAGgAdQBuAGsA - LkdldENodW5r - R2V0Q2h1bm - AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A - QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA - RIUkVBRF9JTkZPNj - SFJFQURfSU5GTzY0 - VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA - VEhSRUFEX0lORk82N - AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA - cmVhdGVSZW1vdGVUaHJlYW - MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA - NyZWF0ZVJlbW90ZVRocmVhZ - Q3JlYXRlUmVtb3RlVGhyZWFk - QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA - 0AZQBtAG0AbwB2AGUA - 1lbW1vdm - AGUAbQBtAG8AdgBlA - bQBlAG0AbQBvAHYAZQ - bWVtbW92Z - ZW1tb3Zl condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both cre. Logsource: windows / process_creation. Rule: title: PUA - Mouse Lock Execution id: c9192ad9-75e5-43eb-8647-82a0a5b493e3 status: test description: In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents. references: - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf - https://sourceforge.net/projects/mouselock/ author: Cian Heasley date: 2020-08-13 modified: 2023-02-21 tags: - attack.credential-access - attack.collection - attack.t1056.002 logsource: product: windows category: process_creation detection: selection: - Product|contains: Mouse Lock - Company|contains: Misc314 - CommandLine|contains: Mouse Lock_ condition: selection falsepositives: - Legitimate uses of Mouse Lock software level: medium