Query: detection rule: Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat a
Matching passage: Sigma rule: Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat a. Logsource: windows / dns_query. Rule: title: DNS Query To AzureWebsites.NET By Non-Browser Process id: e043f529-8514-4205-8ab0-7f7d2927b400 related: - id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 type: derived status: test description: 'Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: dns_query detection: selection: QueryName|endswith: azurewebsites.net filter_optional_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_optional_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_defender: Image|endswith: - \MsMpEng.exe - \MsSense.exe filter_optional_brave: Image|endswith: \brave.exe Image|startswith: C:\Program Files\BraveSoftware\ filter_optional_maxthon: Image|contains: \AppData\Local\Maxthon\ Image|endswith: \maxthon.exe filter_optional_opera: Image|contains: \AppData\Local\Programs\Opera\ Image|endswith: \opera.exe filter_optional_seamonkey: Image|startswith: - C:\Program Files\SeaMonkey\ - C:\Program Files (x86)\SeaMonkey\ Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|contains: \AppD
Near-miss passage: Sigma rule: Detects when the macOS Script Editor utility spawns an unusual child process.. Logsource: macos / process_creation. Rule: title: Suspicious Execution via macOS Script Editor id: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 status: test description: Detects when the macOS Script Editor utility spawns an unusual child process. author: Tim Rauch (rule), Elastic (idea) references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685 - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/ date: 2022-10-21 modified: 2022-12-28 logsource: category: process_creation product: macos tags: - attack.defense-impairment - attack.t1566 - attack.t1566.002 - attack.initial-access - attack.t1059 - attack.t1059.002 - attack.t1204 - attack.t1204.001 - attack.execution - attack.persistence - attack.t1553 detection: selection_parent: ParentImage|endswith: /Script Editor selection_img: - Image|endswith: - /curl - /bash - /sh - /zsh - /dash - /fish - /osascript - /mktemp - /chmod - /php - /nohup - /openssl - /plutil - /PlistBuddy - /xattr - /sqlite - /funzip - /popen - Image|contains: - python - perl condition: all of selection_* falsepositives: - Unknown level: medium