Query: write Sigma for Detects port forwarding activity via SSH.exe
Matching passage: Sigma rule: Detects port forwarding activity via SSH.exe. Logsource: windows / process_creation. Rule: title: Port Forwarding Activity Via SSH.EXE id: 327f48c1-a6db-4eb8-875a-f6981f1b0183 status: test description: Detects port forwarding activity via SSH.exe references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2024-03-05 tags: - attack.command-and-control - attack.lateral-movement - attack.t1572 - attack.t1021.001 - attack.t1021.004 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains|windash: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: medium
Near-miss passage: Sigma rule: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publishe. Logsource: windows / process_creation. Rule: title: Suspicious Microsoft Office Child Process id: 438025f9-5856-4663-83f7-52f878a70a50 related: - id: c27515df-97a9-4162-8a60-dc0eeb51b775 type: derived - id: e1693bc8-7168-4eab-8718-cdcaa68a1738 type: derived - id: 23daeb52-e6eb-493c-8607-c4f0246cb7d8 type: obsolete - id: 518643ba-7d9c-4fa5-9f37-baed36059f6a type: obsolete - id: 04f5363a-6bca-42ff-be70-0d28bf629ead type: obsolete status: test description: Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.) references: - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100 - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml - https://github.com/splunk/security_content/blob/300af51b88ad5d5b27ce4f5f54e4d6e6a3a2c06d/detections/endpoint/office_spawning_control.yml - https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A - https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml - https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html - https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/ author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io date: 2018-04-06 modified: 2023-04-24 tags: - attack.execution - attack.stealth - attack.t1047 - attack.t1204.002 - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \EQNEDT32.EXE - \EXCEL.EXE - \MSACCESS.EXE - \MSPUB.exe - \ONENOTE.EXE - \POWERPNT.exe - \VISIO.exe - \WINWORD.EXE - \wordpad.exe - \wordview.exe selection_child_processes: - OriginalFileName: - bitsadmin.exe - CertOC.exe - CertUtil.exe - Cmd.Exe - CMSTP.EXE - cscript.exe - curl.exe - HH.exe - IEExec.exe - InstallUtil.exe - javaw.exe - Microsoft.Workflow.Compiler.exe - msdt.exe -