Query: write Sigma for Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Wi
Matching passage: Sigma rule: Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Wi. Logsource: windows / process_creation. Rule: title: Renamed AutoIt Execution id: f4264e47-f522-4c38-a420-04525d5b880f status: test description: 'Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious. ' references: - https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w - https://www.autoitscript.com/site/ author: Florian Roth (Nextron Systems) date: 2023-06-04 modified: 2024-11-23 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: - ' /AutoIt3ExecuteScript' - ' /ErrorStdOut' selection_2: Hashes|contains: - IMPHASH=FDC554B3A8683918D731685855683DDF - IMPHASH=CD30A61B60B3D60CECDB034C8C83C290 - IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000 selection_3: OriginalFileName: - AutoIt3.exe - AutoIt2.exe - AutoIt.exe filter_main_legit_name: Image|endswith: - \AutoIt.exe - \AutoIt2.exe - \AutoIt3_x64.exe - \AutoIt3.exe condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Invocations - Specific - ProcessCreation id: 536e2947-3729-478c-9903-745aaffe60d2 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 type: similar - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-05 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_convert_b64: CommandLine|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex: CommandLine|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc: CommandLine|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg: CommandLine|contains|all: - powershell - reg - add - \software\ selection_webclient: CommandLine|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: CommandLine|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: CommandLine|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium