Sigma rules for CVE-2014-8162
10 rules · scoped to cve · back to CVE-2014-8162
Direct rules mention this entity in their title or description. Related rules cover the techniques this entity is known to use.
title: Potential Malicious Usage of CloudTrail System Manager
id: 38e7f511-3f74-41d4-836e-f57dfa18eead
status: test
description: |
Detect when System Manager successfully executes commands against an instance.
references:
- https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
author: jamesc-grafana
date: 2024-07-11
modified: 2025-12-08
tags:
- attack.privilege-escalation
- attack.initial-access
- attack.t1566
- attack.t1566.002
logsource:
product: aws
service: cloudtrail
detection:
selection_event:
eventName: 'SendCommand'
eventSource: 'ssm.amazonaws.com'
selection_status_success:
errorCode: 'Success'
selection_status_null:
errorCode: null
condition: selection_event and 1 of selection_status_*
falsepositives:
- There are legitimate uses of SSM to send commands to EC2 instances
- Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them
level: high
title: Suspicious Key Manager Access
id: a4694263-59a8-4608-a3a0-6f8d3a51664c
status: test
description: Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)
references:
- https://twitter.com/NinjaParanoid/status/1516442028963659777
author: Florian Roth (Nextron Systems)
date: 2022-04-21
modified: 2023-02-09
tags:
- attack.credential-access
- attack.t1555.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\rundll32.exe'
- OriginalFileName: 'RUNDLL32.EXE'
selection_cli:
CommandLine|contains|all:
- 'keymgr'
- 'KRShowKeyMgr'
condition: all of selection_*
falsepositives:
- Administrative activity
level: high
title: Potential Attachment Manager Settings Associations Tamper
id: a9b6c011-ab69-4ddb-bc0a-c4f21c80ec47
status: test
description: Detects tampering with attachment manager settings policies associations to lower the default file type risks (See reference for more information)
references:
- https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
- https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-01
modified: 2023-08-17
tags:
- attack.defense-impairment
logsource:
category: registry_set
product: windows
detection:
selection_main:
TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\'
selection_value_default_file_type_rsik:
TargetObject|endswith: '\DefaultFileTypeRisk'
Details: 'DWORD (0x00006152)'
selection_value_low_risk_filetypes:
TargetObject|endswith: '\LowRiskFileTypes'
Details|contains: # Add more as you see fit
- '.zip;'
- '.rar;'
- '.exe;'
- '.bat;'
- '.com;'
- '.cmd;'
- '.reg;'
- '.msi;'
- '.htm;'
- '.html;'
condition: selection_main and 1 of selection_value_*
falsepositives:
- Unlikely
level: high
title: Potential Attachment Manager Settings Attachments Tamper
id: ee77a5db-b0f3-4be2-bfd4-b58be1c6b15a
status: test
description: Detects tampering with attachment manager settings policies attachments (See reference for more information)
references:
- https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738
- https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-01
modified: 2023-08-17
tags:
- attack.defense-impairment
logsource:
category: registry_set
product: windows
detection:
selection_main:
TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments\'
selection_value_hide_zone_info:
TargetObject|endswith: '\HideZoneInfoOnProperties'
Details: 'DWORD (0x00000001)' # On
selection_value_save_zone_info:
TargetObject|endswith: '\SaveZoneInformation'
Details: 'DWORD (0x00000002)' # Off
selection_value_scan_with_av:
TargetObject|endswith: '\ScanWithAntiVirus'
Details: 'DWORD (0x00000001)' # Disabled
condition: selection_main and 1 of selection_value_*
falsepositives:
- Unlikely
level: high
title: Dump Credentials from Windows Credential Manager With PowerShell
id: 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc
status: test
description: |
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md
author: frack113
date: 2021-12-20
modified: 2022-12-25
tags:
- attack.credential-access
- attack.t1555
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection_kiddie:
ScriptBlockText|contains:
- 'Get-PasswordVaultCredentials'
- 'Get-CredManCreds'
selection_rename_Password:
ScriptBlockText|contains|all:
- 'New-Object'
- 'Windows.Security.Credentials.PasswordVault'
selection_rename_credman:
ScriptBlockText|contains|all:
- 'New-Object'
- 'Microsoft.CSharp.CSharpCodeProvider'
- '[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())'
- 'Collections.ArrayList'
- 'System.CodeDom.Compiler.CompilerParameters'
condition: 1 of selection_*
falsepositives:
- Unknown
level: medium
title: Enumerate Credentials from Windows Credential Manager With PowerShell
id: 603c6630-5225-49c1-8047-26c964553e0e
status: test
description: |
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md
author: frack113
date: 2021-12-20
modified: 2022-12-25
tags:
- attack.credential-access
- attack.t1555
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection_cmd:
ScriptBlockText|contains|all:
- vaultcmd
- '/listcreds:'
selection_option:
ScriptBlockText|contains:
- 'Windows Credentials'
- 'Web Credentials'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
title: Credential Manager Access By Uncommon Applications
id: 407aecb1-e762-4acf-8c7b-d087bcff3bb6
status: test
description: |
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function
references:
- https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
- https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-11
modified: 2024-07-29
tags:
- attack.t1003
- attack.credential-access
logsource:
category: file_access
product: windows
definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider'
detection:
selection:
FileName|contains:
- '\AppData\Local\Microsoft\Credentials\'
- '\AppData\Roaming\Microsoft\Credentials\'
- '\AppData\Local\Microsoft\Vault\'
- '\ProgramData\Microsoft\Vault\'
filter_system_folders:
Image|startswith:
- 'C:\Program Files\'
- 'C:\Program Files (x86)\'
- 'C:\Windows\system32\'
- 'C:\Windows\SysWOW64\'
condition: selection and not 1 of filter_*
falsepositives:
- Legitimate software installed by the users for example in the "AppData" directory may access these files (for any reason).
# Increase level after false positives filters are good enough
level: medium
title: Windows Credential Manager Access via VaultCmd
id: 58f50261-c53b-4c88-bd12-1d71f12eda4c
status: test
description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd
author: frack113
date: 2022-04-08
modified: 2022-05-13
tags:
- attack.credential-access
- attack.t1555.004
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\VaultCmd.exe'
- OriginalFileName: 'VAULTCMD.EXE'
selection_cli:
CommandLine|contains: '/listcreds:'
condition: all of selection*
falsepositives:
- Unknown
level: medium
title: NetSupport Manager Service Install
id: 2d510d8d-912b-45c5-b1df-36faa3d8c3f4
status: test
description: Detects NetSupport Manager service installation on the target system.
references:
- http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-31
tags:
- attack.persistence
logsource:
product: windows
service: system
detection:
# Example:
# <EventData>
# <Data Name="ServiceName">Client32</Data>
# <Data Name="ImagePath">"C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *</Data>
# <Data Name="ServiceType">user mode service</Data>
# <Data Name="StartType">auto start</Data>
# <Data Name="AccountName">LocalSystem</Data>
# </EventData>
selection_root:
Provider_Name: 'Service Control Manager'
EventID: 7045
selection_service:
- ImagePath|contains: '\NetSupport Manager\client32.exe'
- ServiceName: 'Client32'
condition: all of selection_*
falsepositives:
- Legitimate use of the tool
level: medium
title: Session Manager Autorun Keys Modification
id: 046218bd-e0d8-4113-a3c3-895a12b2b298
related:
- id: 17f878b8-9968-4578-b814-c4217fc5768c
type: obsolete
status: test
description: Detects modification of autostart extensibility point (ASEP) in registry.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
- https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d # a list with registry keys
author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)
date: 2019-10-25
modified: 2023-08-17
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1547.001
- attack.t1546.009
logsource:
category: registry_set
product: windows
detection:
session_manager_base:
TargetObject|contains: '\System\CurrentControlSet\Control\Session Manager'
session_manager:
TargetObject|contains:
- '\SetupExecute'
- '\S0InitialCommand'
- '\KnownDlls'
- '\Execute'
- '\BootExecute'
- '\AppCertDlls'
filter:
Details: '(Empty)'
condition: session_manager_base and session_manager and not filter
falsepositives:
- Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason
- Legitimate administrator sets up autorun keys for legitimate reason
level: medium