Query: Sigma rule for Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Matching passage: Sigma rule: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded WMI Classes id: 1816994b-42e1-4fb1-afd2-134d88184f71 related: - id: 47688f1b-9f51-4656-b013-3cc49a166a36 type: obsolete status: test description: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc. references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_shadowcopy: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ - cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA - XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A - V2luMzJfU2hhZG93Y29we - dpbjMyX1NoYWRvd2NvcH - XaW4zMl9TaGFkb3djb3B5 selection_cli_scheduledJob: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA - cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA - XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg - V2luMzJfU2NoZWR1bGVkSm9i - dpbjMyX1NjaGVkdWxlZEpvY - XaW4zMl9TY2hlZHVsZWRKb2 selection_cli_process: CommandLine|contains: - VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw - cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA - XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA - V2luMzJfUHJvY2Vzc - dpbjMyX1Byb2Nlc3 - XaW4zMl9Qcm9jZXNz selection_cli_useraccount: CommandLine|contains: - VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A - cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA - XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA - V2luMzJfVXNlckFjY291bn - dpbjMyX1VzZXJBY2NvdW50 - XaW4zMl9Vc2VyQWNjb3Vud selection_cli_loggedonuser: CommandLine|contains: - VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA - cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA - XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg - V2luMzJfTG9nZ2VkT25Vc2Vy - dpbjMyX0xvZ2dlZE9uVXNlc - XaW4zMl9Mb2dnZWRPblVzZX condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. Th. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Executable id: f0540f7e-2db3-4432-b9e0-3965486744bc status: test description: 'Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk. This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .com - .dll - .exe - .jar - .ocx - .pyc condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe/info.yml