Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch. Logsource: windows / process_creation. Rule: title: Suspicious ShellExec_RunDLL Call Via Ordinal id: 8823e85d-31d8-473e-b7f4-92da070f0fc6 related: - id: d87bd452-6da1-456e-8155-7dc988157b7d type: derived status: test description: 'Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands. Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine. ' references: - https://redcanary.com/blog/raspberry-robin/ - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - https://github.com/SigmaHQ/sigma/issues/1009 - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html author: Swachchhanda Shrawan Poudel date: 2024-12-01 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_parent_img: ParentCommandLine|contains: SHELL32.DLL selection_parent_ordinal: ParentCommandLine|contains: - '#568' - '#570' - '#572' - '#576' selection_susp_cli_parent: - ParentCommandLine|contains: - comspec - iex - Invoke- - msiexec - odbcconf - regsvr32 - ParentCommandLine|contains: - \Desktop\ - \ProgramData\ - \Temp\ - \Users\Public\ selection_susp_child_img: Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \cscript.exe - \curl.exe - \mshta.exe - \msiexec.exe - \msxsl.exe - \odbcconf.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \schtasks.exe - \wmic.exe - \wscript.exe condition: all of selection_parent_* and 1 of selection_susp_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata c. Logsource: windows / process_creation. Rule: title: HackTool - Certipy Execution id: 6938366d-8954-4ddc-baff-c830b3ba8fcd status: test description: 'Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments. ' references: - https://github.com/ly4k/Certipy - https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7 author: pH-T (Nextron Systems), Sittikorn Sangrattanapitak date: 2023-04-17 modified: 2024-10-08 tags: - attack.discovery - attack.credential-access - attack.t1649 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Certipy.exe - OriginalFileName: Certipy.exe - Description|contains: Certipy selection_cli_commands: CommandLine|contains: - ' account ' - ' auth ' - ' cert ' - ' find ' - ' forge ' - ' ptt ' - ' relay ' - ' req ' - ' shadow ' - ' template ' selection_cli_flags: CommandLine|contains: - ' -bloodhound' - ' -ca-pfx ' - ' -dc-ip ' - ' -kirbi' - ' -old-bloodhound' - ' -pfx ' - ' -target' - ' -template' - ' -username ' - ' -vulnerable' - auth -pfx - shadow auto - shadow list condition: selection_img or all of selection_cli_* falsepositives: - Unlikely level: high