VMware Carbon Black detection rules

high Strong High FP

HackTool - Typical HiveNightmare SAM File Export

Detects files written by the different tools that exploit HiveNightmare

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 6ea858a8-ba71-4a12-b2cc-5d83312404c7

carbon_black query

(TargetFilename:\\hive_sam_* OR TargetFilename:\\SAM\-2021\-* OR TargetFilename:\\SAM\-2022\-* OR TargetFilename:\\SAM\-2023\-* OR TargetFilename:\\SAM\-haxx* OR TargetFilename:\\Sam.save*) OR TargetFilename:C\:\\windows\\temp\\sam

view Sigma YAML

title: HackTool - Typical HiveNightmare SAM File Export
id: 6ea858a8-ba71-4a12-b2cc-5d83312404c7
status: test
description: Detects files written by the different tools that exploit HiveNightmare
references:
    - https://github.com/GossiTheDog/HiveNightmare
    - https://github.com/FireFart/hivenightmare/
    - https://github.com/WiredPulse/Invoke-HiveNightmare
    - https://twitter.com/cube0x0/status/1418920190759378944
author: Florian Roth (Nextron Systems)
date: 2021-07-23
modified: 2024-06-27
tags:
    - attack.credential-access
    - attack.t1552.001
    - cve.2021-36934
logsource:
    product: windows
    category: file_event
detection:
    selection:
        - TargetFilename|contains:
              - '\hive_sam_'  # Go version
              - '\SAM-2021-'  # C++ version
              - '\SAM-2022-'  # C++ version
              - '\SAM-2023-'  # C++ version
              - '\SAM-haxx'   # Early C++ versions
              - '\Sam.save'   # PowerShell version
        - TargetFilename: 'C:\windows\temp\sam'  # C# version of HiveNightmare
    condition: selection
falsepositives:
    - Files that accidentally contain these strings
level: high

Convert to SIEM query

high Moderate Medium FP

HackTool - UACMe Akagi Execution

Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

status test author Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) ATT&CK sub-technique id d38d2fa4-98e6-4a24-aff1-410b0c9ad177

carbon_black query

(Product:UACMe OR (Company:REvol\ Corp OR Company:APT\ 92 OR Company:UG\ North OR Company:Hazardous\ Environments OR Company:CD\ Project\ Rekt) OR (Description:UACMe\ main\ module OR Description:Pentesting\ utility) OR (OriginalFileName:Akagi.exe OR OriginalFileName:Akagi64.exe)) OR (Image:\\Akagi64.exe OR Image:\\Akagi.exe) OR (Hashes:IMPHASH=767637C23BB42CD5D7397CF58B0BE688* OR Hashes:IMPHASH=14C4E4C72BA075E9069EE67F39188AD8* OR Hashes:IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC* OR Hashes:IMPHASH=7D010C6BB6A3726F327F7E239166D127* OR Hashes:IMPHASH=89159BA4DD04E4CE5559F132A9964EB3* OR Hashes:IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F* OR Hashes:IMPHASH=5834ED4291BDEB928270428EBBAF7604* OR Hashes:IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38* OR Hashes:IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894* OR Hashes:IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74* OR Hashes:IMPHASH=3DE09703C8E79ED2CA3F01074719906B*)

view Sigma YAML

title: HackTool - UACMe Akagi Execution
id: d38d2fa4-98e6-4a24-aff1-410b0c9ad177
status: test
description: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
date: 2021-08-30
modified: 2024-11-23
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_pe:
        - Product: 'UACMe'
        - Company:
              - 'REvol Corp'
              - 'APT 92'
              - 'UG North'
              - 'Hazardous Environments'
              - 'CD Project Rekt'
        - Description:
              - 'UACMe main module'
              - 'Pentesting utility'
        - OriginalFileName:
              - 'Akagi.exe'
              - 'Akagi64.exe'
    selection_img:
        Image|endswith:
            - '\Akagi64.exe'
            - '\Akagi.exe'
    selection_hashes_sysmon:
        Hashes|contains:
            - 'IMPHASH=767637C23BB42CD5D7397CF58B0BE688'
            - 'IMPHASH=14C4E4C72BA075E9069EE67F39188AD8'
            - 'IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC'
            - 'IMPHASH=7D010C6BB6A3726F327F7E239166D127'
            - 'IMPHASH=89159BA4DD04E4CE5559F132A9964EB3'
            - 'IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F'
            - 'IMPHASH=5834ED4291BDEB928270428EBBAF7604'
            - 'IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38'
            - 'IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894'
            - 'IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74'
            - 'IMPHASH=3DE09703C8E79ED2CA3F01074719906B'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

HackTool - WSASS Execution

Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.

status experimental author Swachchhanda Shrawan Poudel (Nextron Systems) ATT&CK sub-technique id 589ac73f-8e12-409c-964e-31a2f5775ae2

carbon_black query

Image:\\wsass.exe OR Hashes:IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42* OR CommandLine:(?i)\\.exe[\\"\\']?\\s+[^\\"]{0,64}werfaultsecure\\.exe[\\"\\']?\\s+\\d{2,10}

view Sigma YAML

title: HackTool - WSASS Execution
id: 589ac73f-8e12-409c-964e-31a2f5775ae2
status: experimental
description: |
    Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's
    (Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.
references:
    - https://github.com/TwoSevenOneT/WSASS
    - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-11-23
modified: 2026-01-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\wsass.exe'
    selection_hash:
        Hashes|contains: 'IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42'
    selection_cli:
        # change to |re|i after Sigma v2.0 release
        # plain string without quotation marks as it has to match for both ' and "
        CommandLine|re: (?i)\.exe[\"\']?\s+[^\"]{0,64}werfaultsecure\.exe[\"\']?\s+\d{2,10} # wsass.exe "path to werfaultsecure" lsass_pid
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml

Convert to SIEM query

high Moderate High FP

HackTool - WinPwn Execution

Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

status test author Swachchhanda Shrawan Poudel ATT&CK sub-technique id d557dc06-62e8-4468-a8e8-7984124908ce

carbon_black query

CommandLine:Offline_Winpwn* OR CommandLine:WinPwn\ * OR CommandLine:WinPwn.exe* OR CommandLine:WinPwn.ps1*

view Sigma YAML

title: HackTool - WinPwn Execution
id: d557dc06-62e8-4468-a8e8-7984124908ce
related:
    - id: 851fd622-b675-4d26-b803-14bc7baa517a
      type: similar
status: test
description: |
    Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
author: Swachchhanda Shrawan Poudel
date: 2023-12-04
references:
    - https://github.com/S3cur3Th1sSh1t/WinPwn
    - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
    - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
    - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
    - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
tags:
    - attack.credential-access
    - attack.discovery
    - attack.execution
    - attack.privilege-escalation
    - attack.t1046
    - attack.t1082
    - attack.t1106
    - attack.t1518
    - attack.t1548.002
    - attack.t1552.001
    - attack.t1555
    - attack.t1555.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'Offline_Winpwn'
            - 'WinPwn '
            - 'WinPwn.exe'
            - 'WinPwn.ps1'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong High FP

HackTool - WinPwn Execution - ScriptBlock

Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.

status test author Swachchhanda Shrawan Poudel ATT&CK sub-technique id 851fd622-b675-4d26-b803-14bc7baa517a

carbon_black query

ScriptBlockText:Offline_Winpwn* OR ScriptBlockText:WinPwn\ * OR ScriptBlockText:WinPwn.exe* OR ScriptBlockText:WinPwn.ps1*

view Sigma YAML

title: HackTool - WinPwn Execution - ScriptBlock
id: 851fd622-b675-4d26-b803-14bc7baa517a
related:
    - id: d557dc06-62e8-4468-a8e8-7984124908ce
      type: similar
status: test
description: |
    Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.
author: Swachchhanda Shrawan Poudel
date: 2023-12-04
references:
    - https://github.com/S3cur3Th1sSh1t/WinPwn
    - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
    - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
    - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
    - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
tags:
    - attack.credential-access
    - attack.discovery
    - attack.execution
    - attack.privilege-escalation
    - attack.t1046
    - attack.t1082
    - attack.t1106
    - attack.t1518
    - attack.t1548.002
    - attack.t1552.001
    - attack.t1555
    - attack.t1555.003
logsource:
    category: ps_script
    product: windows
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Offline_Winpwn'
            - 'WinPwn '
            - 'WinPwn.exe'
            - 'WinPwn.ps1'
    condition: selection
falsepositives:
    - As the script block is a blob of text. False positive may occur with scripts that contain the keyword as a reference or simply use it for detection.
level: high

Convert to SIEM query

high Moderate High FP

HackTool - Wmiexec Default Powershell Command

Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0

carbon_black query

CommandLine:\-NoP\ \-NoL\ \-sta\ \-NonI\ \-W\ Hidden\ \-Exec\ Bypass\ \-Enc*

view Sigma YAML

title: HackTool - Wmiexec Default Powershell Command
id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0
status: test
description: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script
references:
    - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-08
tags:
    - attack.lateral-movement
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: '-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc'
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate High FP

HackTool - XORDump Execution

Detects suspicious use of XORDump process memory dumping utility

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 66e563f9-1cbd-4a22-a957-d8b7c0f44372

carbon_black query

Image:\\xordump.exe OR (CommandLine:\ \-process\ lsass.exe\ * OR CommandLine:\ \-m\ comsvcs\ * OR CommandLine:\ \-m\ dbghelp\ * OR CommandLine:\ \-m\ dbgcore\ *)

view Sigma YAML

title: HackTool - XORDump Execution
id: 66e563f9-1cbd-4a22-a957-d8b7c0f44372
status: test
description: Detects suspicious use of XORDump process memory dumping utility
references:
    - https://github.com/audibleblink/xordump
author: Florian Roth (Nextron Systems)
date: 2022-01-28
modified: 2023-02-08
tags:
    - attack.stealth
    - attack.t1036
    - attack.t1003.001
    - attack.credential-access
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\xordump.exe'
        - CommandLine|contains:
              - ' -process lsass.exe '
              - ' -m comsvcs '
              - ' -m dbghelp '
              - ' -m dbgcore '
    condition: selection
falsepositives:
    - Another tool that uses the command line switches of XORdump
level: high

Convert to SIEM query

high Strong Medium FP

HackTool - winPEAS Execution

WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

status test author Georg Lauenstein (sure[secure]) ATT&CK technique id 98b53e78-ebaf-46f8-be06-421aafd176d9

carbon_black query

(OriginalFileName:winPEAS.exe OR (Image:\\winPEASany_ofs.exe OR Image:\\winPEASany.exe OR Image:\\winPEASx64_ofs.exe OR Image:\\winPEASx64.exe OR Image:\\winPEASx86_ofs.exe OR Image:\\winPEASx86.exe)) OR (CommandLine:\ applicationsinfo* OR CommandLine:\ browserinfo* OR CommandLine:\ eventsinfo* OR CommandLine:\ fileanalysis* OR CommandLine:\ filesinfo* OR CommandLine:\ processinfo* OR CommandLine:\ servicesinfo* OR CommandLine:\ windowscreds*) OR CommandLine:https\:\/\/github.com\/carlospolop\/PEASS\-ng\/releases\/latest\/download\/* OR (ParentCommandLine:\ \-linpeas OR CommandLine:\ \-linpeas)

view Sigma YAML

title: HackTool - winPEAS Execution
id: 98b53e78-ebaf-46f8-be06-421aafd176d9
status: test
description: WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz
references:
    - https://github.com/carlospolop/PEASS-ng
    - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
author: Georg Lauenstein (sure[secure])
date: 2022-09-19
modified: 2023-03-23
tags:
    - attack.privilege-escalation
    - attack.discovery
    - attack.t1082
    - attack.t1087
    - attack.t1046
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - OriginalFileName: 'winPEAS.exe'
        - Image|endswith:
              - '\winPEASany_ofs.exe'
              - '\winPEASany.exe'
              - '\winPEASx64_ofs.exe'
              - '\winPEASx64.exe'
              - '\winPEASx86_ofs.exe'
              - '\winPEASx86.exe'
    selection_cli_option:
        CommandLine|contains:
            - ' applicationsinfo' # Search installed applications information
            - ' browserinfo' # Search browser information
            - ' eventsinfo' # Display interesting events information
            - ' fileanalysis' # Search specific files that can contains credentials and for regexes inside files
            - ' filesinfo' # Search generic files that can contains credentials
            - ' processinfo' # Search processes information
            - ' servicesinfo' # Search services information
            - ' windowscreds' # Search windows credentials
    selection_cli_dl:
        CommandLine|contains: 'https://github.com/carlospolop/PEASS-ng/releases/latest/download/'
    selection_cli_specific:
        - ParentCommandLine|endswith: ' -linpeas'
        - CommandLine|endswith: ' -linpeas'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate Medium FP

HackTool Named File Stream Created

Detects the creation of a named file stream with the imphash of a well-known hack tool

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 19b041f6-e583-40dc-b842-d6fa8011493f

carbon_black query

Hash:IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932* OR Hash:IMPHASH=3A19059BD7688CB88E70005F18EFC439* OR Hash:IMPHASH=bf6223a49e45d99094406777eb6004ba* OR Hash:IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6* OR Hash:IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3* OR Hash:IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF* OR Hash:IMPHASH=4C1B52A19748428E51B14C278D0F58E3* OR Hash:IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F* OR Hash:IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A* OR Hash:IMPHASH=672B13F4A0B6F27D29065123FE882DFC* OR Hash:IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F* OR Hash:IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D* OR Hash:IMPHASH=9528A0E91E28FBB88AD433FEABCA2456* OR Hash:IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3* OR Hash:IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88* OR Hash:IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4* OR Hash:IMPHASH=D21BBC50DCC169D7B4D0F01962793154* OR Hash:IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6* OR Hash:IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1* OR Hash:IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC* OR Hash:IMPHASH=F9A28C458284584A93B14216308D31BD* OR Hash:IMPHASH=6118619783FC175BC7EBECFF0769B46E* OR Hash:IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA* OR Hash:IMPHASH=563233BFA169ACC7892451F71AD5850A* OR Hash:IMPHASH=87575CB7A0E0700EB37F2E3668671A08* OR Hash:IMPHASH=13F08707F759AF6003837A150A371BA1* OR Hash:IMPHASH=1781F06048A7E58B323F0B9259BE798B* OR Hash:IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5* OR Hash:IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D* OR Hash:IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2* OR Hash:IMPHASH=713C29B396B907ED71A72482759ED757* OR Hash:IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F* OR Hash:IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E* OR Hash:IMPHASH=8B114550386E31895DFAB371E741123D* OR Hash:IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793* OR Hash:IMPHASH=9D68781980370E00E0BD939EE5E6C141* OR Hash:IMPHASH=B18A1401FF8F444056D29450FBC0A6CE* OR Hash:IMPHASH=CB567F9498452721D77A451374955F5F* OR Hash:IMPHASH=730073214094CD328547BF1F72289752* OR Hash:IMPHASH=17B461A082950FC6332228572138B80C* OR Hash:IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9* OR Hash:IMPHASH=819B19D53CA6736448F9325A85736792* OR Hash:IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E* OR Hash:IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74* OR Hash:IMPHASH=0588081AB0E63BA785938467E1B10CCA* OR Hash:IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C* OR Hash:IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29* OR Hash:IMPHASH=4DA924CF622D039D58BCE71CDF05D242* OR Hash:IMPHASH=E7A3A5C377E2D29324093377D7DB1C66* OR Hash:IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF* OR Hash:IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE* OR Hash:IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4* OR Hash:IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338* OR Hash:IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E* OR Hash:IMPHASH=E6F9D5152DA699934B30DAAB206471F6* OR Hash:IMPHASH=3AD59991CCF1D67339B319B15A41B35D* OR Hash:IMPHASH=FFDD59E0318B85A3E480874D9796D872* OR Hash:IMPHASH=0CF479628D7CC1EA25EC7998A92F5051* OR Hash:IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51* OR Hash:IMPHASH=D6D0F80386E1380D05CB78E871BC72B1* OR Hash:IMPHASH=38D9E015591BBFD4929E0D0F47FA0055* OR Hash:IMPHASH=0E2216679CA6E1094D63322E3412D650* OR Hash:IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB* OR Hash:IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798* OR Hash:IMPHASH=11083E75553BAAE21DC89CE8F9A195E4* OR Hash:IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80* OR Hash:IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F* OR Hash:IMPHASH=767637C23BB42CD5D7397CF58B0BE688* OR Hash:IMPHASH=14C4E4C72BA075E9069EE67F39188AD8* OR Hash:IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC* OR Hash:IMPHASH=7D010C6BB6A3726F327F7E239166D127* OR Hash:IMPHASH=89159BA4DD04E4CE5559F132A9964EB3* OR Hash:IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F* OR Hash:IMPHASH=5834ED4291BDEB928270428EBBAF7604* OR Hash:IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38* OR Hash:IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894* OR Hash:IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74* OR Hash:IMPHASH=3DE09703C8E79ED2CA3F01074719906B* OR Hash:IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F* OR Hash:IMPHASH=E96A73C7BF33A464C510EDE582318BF2* OR Hash:IMPHASH=32089B8851BBF8BC2D014E9F37288C83* OR Hash:IMPHASH=09D278F9DE118EF09163C6140255C690* OR Hash:IMPHASH=03866661686829d806989e2fc5a72606* OR Hash:IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d* OR Hash:IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE* OR Hash:IMPHASH=19584675D94829987952432E018D5056* OR Hash:IMPHASH=330768A4F172E10ACB6287B87289D83B* OR Hash:IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313* OR Hash:IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC* OR Hash:IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28* OR Hash:IMPHASH=96DF3A3731912449521F6F8D183279B1* OR Hash:IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46* OR Hash:IMPHASH=51791678F351C03A0EB4E2A7B05C6E17* OR Hash:IMPHASH=25CE42B079282632708FC846129E98A5* OR Hash:IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20* OR Hash:IMPHASH=59223B5F52D8799D38E0754855CBDF42* OR Hash:IMPHASH=81E75D8F1D276C156653D3D8813E4A43* OR Hash:IMPHASH=17244E8B6B8227E57FE709CCAD421420* OR Hash:IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4* OR Hash:IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C* OR Hash:IMPHASH=40445337761D80CF465136FAFB1F63E6* OR Hash:IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6*

view Sigma YAML

title: HackTool Named File Stream Created
id: 19b041f6-e583-40dc-b842-d6fa8011493f
status: test
description: Detects the creation of a named file stream with the imphash of a well-known hack tool
references:
    - https://github.com/gentilkiwi/mimikatz
    - https://github.com/topotam/PetitPotam
    - https://github.com/ohpe/juicy-potato
    - https://github.com/antonioCoco/RoguePotato
    - https://www.tarasco.org/security/pwdump_7/
    - https://github.com/fortra/nanodump
    - https://github.com/codewhitesec/HandleKatz
    - https://github.com/xuanxuan0/DripLoader
    - https://github.com/hfiref0x/UACME
    - https://github.com/outflanknl/Dumpert
    - https://github.com/wavestone-cdt/EDRSandblast
author: Florian Roth (Nextron Systems)
date: 2022-08-24
modified: 2024-11-23
tags:
    - attack.stealth
    - attack.s0139
    - attack.t1564.004
logsource:
    product: windows
    category: create_stream_hash
    definition: 'Requirements: Sysmon config with Imphash logging activated'
detection:
    selection:
        Hash|contains: # Sysmon field hashes contains all types
            - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 # PetitPotam
            - IMPHASH=3A19059BD7688CB88E70005F18EFC439 # PetitPotam
            - IMPHASH=bf6223a49e45d99094406777eb6004ba # PetitPotam
            - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 # Mimikatz
            - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 # Mimikatz
            - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF # Mimikatz
            - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 # Mimikatz
            - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F # Mimikatz
            - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A # Mimikatz
            - IMPHASH=672B13F4A0B6F27D29065123FE882DFC # Mimikatz
            - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F # Mimikatz
            - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D # Mimikatz
            - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 # Mimikatz
            - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 # Mimikatz
            - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 # Mimikatz
            - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 # Mimikatz
            - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 # Mimikatz
            - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 # Mimikatz
            - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 # JuicyPotato
            - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC # JuicyPotato
            - IMPHASH=F9A28C458284584A93B14216308D31BD # JuicyPotatoNG
            - IMPHASH=6118619783FC175BC7EBECFF0769B46E # RoguePotato
            - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA # RoguePotato
            - IMPHASH=563233BFA169ACC7892451F71AD5850A # RoguePotato
            - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 # RoguePotato
            - IMPHASH=13F08707F759AF6003837A150A371BA1 # Pwdump
            - IMPHASH=1781F06048A7E58B323F0B9259BE798B # Pwdump
            - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 # Pwdump
            - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D # Pwdump
            - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 # Pwdump
            - IMPHASH=713C29B396B907ED71A72482759ED757 # Pwdump
            - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F # Pwdump
            - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E # Pwdump
            - IMPHASH=8B114550386E31895DFAB371E741123D # Pwdump
            - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 # PwDumpX
            - IMPHASH=9D68781980370E00E0BD939EE5E6C141 # Pwdump
            - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE # Pwdump
            - IMPHASH=CB567F9498452721D77A451374955F5F # Pwdump
            - IMPHASH=730073214094CD328547BF1F72289752 # Htran
            - IMPHASH=17B461A082950FC6332228572138B80C # Cobalt Strike beacons
            - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 # Cobalt Strike beacons
            - IMPHASH=819B19D53CA6736448F9325A85736792 # Cobalt Strike beacons
            - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E # Cobalt Strike beacons
            - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 # PPLDump
            - IMPHASH=0588081AB0E63BA785938467E1B10CCA # PPLDump
            - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C # NanoDump
            - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 # NanoDump
            - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 # NanoDump
            - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 # NanoDump
            - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF # NanoDump
            - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE # NanoDump
            - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 # NanoDump
            - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 # NanoDump
            - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E # NanoDump
            - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 # NanoDump
            - IMPHASH=3AD59991CCF1D67339B319B15A41B35D # NanoDump
            - IMPHASH=FFDD59E0318B85A3E480874D9796D872 # NanoDump
            - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 # NanoDump
            - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 # NanoDump
            - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 # NanoDump
            - IMPHASH=38D9E015591BBFD4929E0D0F47FA0055 # HandleKatz
            - IMPHASH=0E2216679CA6E1094D63322E3412D650 # HandleKatz
            - IMPHASH=ADA161BF41B8E5E9132858CB54CAB5FB # DripLoader
            - IMPHASH=2A1BC4913CD5ECB0434DF07CB675B798 # DripLoader
            - IMPHASH=11083E75553BAAE21DC89CE8F9A195E4 # DripLoader
            - IMPHASH=A23D29C9E566F2FA8FFBB79267F5DF80 # DripLoader
            - IMPHASH=4A07F944A83E8A7C2525EFA35DD30E2F # CreateMiniDump
            - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 # UACMe Akagi
            - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 # UACMe Akagi
            - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC # UACMe Akagi
            - IMPHASH=7D010C6BB6A3726F327F7E239166D127 # UACMe Akagi
            - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 # UACMe Akagi
            - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F # UACMe Akagi
            - IMPHASH=5834ED4291BDEB928270428EBBAF7604 # UACMe Akagi
            - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 # UACMe Akagi
            - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 # UACMe Akagi
            - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 # UACMe Akagi
            - IMPHASH=3DE09703C8E79ED2CA3F01074719906B # UACMe Akagi
            - IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F # WCE
            - IMPHASH=E96A73C7BF33A464C510EDE582318BF2 # WCE
            - IMPHASH=32089B8851BBF8BC2D014E9F37288C83 # Sliver Stagers
            - IMPHASH=09D278F9DE118EF09163C6140255C690 # Dumpert
            - IMPHASH=03866661686829d806989e2fc5a72606 # Dumpert
            - IMPHASH=e57401fbdadcd4571ff385ab82bd5d6d # Dumpert
            - IMPHASH=84B763C45C0E4A3E7CA5548C710DB4EE # SysmonEnte
            - IMPHASH=19584675D94829987952432E018D5056 # SysmonQuiet
            - IMPHASH=330768A4F172E10ACB6287B87289D83B # ShaprEvtMute Hook
            - IMPHASH=885C99CCFBE77D1CBFCB9C4E7C1A3313 # Forkatz
            - IMPHASH=22A22BC9E4E0D2F189F1EA01748816AC # PPLKiller
            - IMPHASH=7FA30E6BB7E8E8A69155636E50BF1B28 # PPLKiller
            - IMPHASH=96DF3A3731912449521F6F8D183279B1 # Backstab
            - IMPHASH=7E6CF3FF4576581271AC8A313B2AAB46 # Backstab
            - IMPHASH=51791678F351C03A0EB4E2A7B05C6E17 # Backstab
            - IMPHASH=25CE42B079282632708FC846129E98A5 # Forensia
            - IMPHASH=021BCCA20BA3381B11BDDE26B4E62F20 # EDRSandBlast
            - IMPHASH=59223B5F52D8799D38E0754855CBDF42 # EDRSandBlast
            - IMPHASH=81E75D8F1D276C156653D3D8813E4A43 # EDRSandBlast
            - IMPHASH=17244E8B6B8227E57FE709CCAD421420 # EDRSandBlast
            - IMPHASH=5B76DA3ACDEDC8A5CDF23A798B5936B4 # EDRSandBlast
            - IMPHASH=CB2B65BB77D995CC1C0E5DF1C860133C # EDRSandBlast
            - IMPHASH=40445337761D80CF465136FAFB1F63E6 # EDRSandBlast
            - IMPHASH=8A790F401B29FA87BC1E56F7272B3AA6 # EDRSilencer
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

HackTool Service Registration or Execution

Detects installation or execution of services

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id d26ce60c-2151-403c-9a42-49420d87b5e4

carbon_black query

(Provider_Name:Service\ Control\ Manager (EventID:7045 OR EventID:7036)) ((ServiceName:cachedump* OR ServiceName:DumpSvc* OR ServiceName:gsecdump* OR ServiceName:pwdump* OR ServiceName:UACBypassedService* OR ServiceName:WCE\ SERVICE* OR ServiceName:WCESERVICE* OR ServiceName:winexesvc*) OR ImagePath:bypass*)

view Sigma YAML

title: HackTool Service Registration or Execution
id: d26ce60c-2151-403c-9a42-49420d87b5e4
status: test
description: Detects installation or execution of services
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2022-03-21
modified: 2023-08-07
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID:
            - 7045
            - 7036
    selection_service_name:
        ServiceName|contains:
            - 'cachedump'
            - 'DumpSvc'
            - 'gsecdump'
            - 'pwdump'
            - 'UACBypassedService'
            - 'WCE SERVICE'
            - 'WCESERVICE'
            - 'winexesvc'
    selection_service_image:
        ImagePath|contains: 'bypass' # https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82#file-scmuacbypass-cpp-L159
    condition: selection_eid and 1 of selection_service_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Hacktool - EDR-Freeze Execution

Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows. EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process. This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.

status experimental author Swachchhanda Shrawan Poudel (Nextron Systems) ATT&CK technique id c598cc0c-9e70-4852-b9eb-8921af79f598

carbon_black query

((Image:\\EDR\-Freeze* OR Image:\\EDRFreeze*) Image:.exe) OR (Hashes:IMPHASH=1195F7935954A2CD09157390C33F8E8C* OR Hashes:IMPHASH=129F58DE3D687FB7F012BF6C3D679997* OR Hashes:IMPHASH=2C617A175D0086251642C6619F7CC8BA* OR Hashes:IMPHASH=8828F0B906F7844358FB92A899E9520F* OR Hashes:IMPHASH=AF76D95157EC554DC1EF178E4E66D447* OR Hashes:IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5* OR Hashes:IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0* OR Hashes:IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7*)

view Sigma YAML

title: Hacktool - EDR-Freeze Execution
id: c598cc0c-9e70-4852-b9eb-8921af79f598
status: experimental
description: |
    Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows.
    EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process.
    This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.
references:
    - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
    - https://github.com/TwoSevenOneT/EDR-Freeze
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-09-24
modified: 2025-11-27
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains:
            - '\EDR-Freeze'
            - '\EDRFreeze'
        Image|endswith: '.exe'
    selection_imphash:
        Hashes|contains:
            - 'IMPHASH=1195F7935954A2CD09157390C33F8E8C'
            - 'IMPHASH=129F58DE3D687FB7F012BF6C3D679997'
            - 'IMPHASH=2C617A175D0086251642C6619F7CC8BA'
            - 'IMPHASH=8828F0B906F7844358FB92A899E9520F'
            - 'IMPHASH=AF76D95157EC554DC1EF178E4E66D447'
            - 'IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5'
            - 'IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0'
            - 'IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_edr_freeze/info.yml

Convert to SIEM query

high Moderate Medium FP

Hacktool Execution - PE Metadata

Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 37c1333a-a0db-48be-b64b-7393b2386e3b

carbon_black query

Company:Cube0x0

view Sigma YAML

title: Hacktool Execution - PE Metadata
id: 37c1333a-a0db-48be-b64b-7393b2386e3b
status: test
description: Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
references:
    - https://github.com/cube0x0
    - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files
author: Florian Roth (Nextron Systems)
date: 2022-04-27
modified: 2024-01-15
tags:
    - attack.credential-access
    - attack.resource-development
    - attack.t1588.002
    - attack.t1003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Company: 'Cube0x0' # Detects the use of tools created by a well-known hacktool producer named "Cube0x0", which includes his handle in all binaries as company information in the PE headers (SharpPrintNightmare, KrbRelay, SharpMapExec, etc.)
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong Low FP

Hacktool Ruler

This events that are generated when using the hacktool Ruler by Sensepost

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 24549159-ac1b-479c-8175-d42aea947cae

carbon_black query

(EventID:4776 Workstation:RULER) OR ((EventID:4624 OR EventID:4625) WorkstationName:RULER)

view Sigma YAML

title: Hacktool Ruler
id: 24549159-ac1b-479c-8175-d42aea947cae
status: test
description: This events that are generated when using the hacktool Ruler by Sensepost
references:
    - https://github.com/sensepost/ruler
    - https://github.com/sensepost/ruler/issues/47
    - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
author: Florian Roth (Nextron Systems)
date: 2017-05-31
modified: 2022-10-09
tags:
    - attack.discovery
    - attack.execution
    - attack.collection
    - attack.lateral-movement
    - attack.t1087
    - attack.t1114
    - attack.t1059
    - attack.t1550.002
logsource:
    product: windows
    service: security
detection:
    selection1:
        EventID: 4776
        Workstation: 'RULER'
    selection2:
        EventID:
            - 4624
            - 4625
        WorkstationName: 'RULER'
    condition: (1 of selection*)
falsepositives:
    - Go utilities that use staaldraad awesome NTLM library
level: high

Convert to SIEM query

high Moderate High FP

Hermetic Wiper TG Process Patterns

Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 2f974656-6d83-4059-bbdf-68ac5403422f

carbon_black query

Image:\\policydefinitions\\postgresql.exe OR ((CommandLine:CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp* OR CommandLine:\ 1>\ \\\\127.0.0.1\\ADMIN$\\__16*) OR (CommandLine:powershell\ \-c\ * CommandLine:\\comsvcs.dll\ MiniDump\ * CommandLine:\\winupd.log\ full*))

view Sigma YAML

title: Hermetic Wiper TG Process Patterns
id: 2f974656-6d83-4059-bbdf-68ac5403422f
status: test
description: Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022
references:
    - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia
author: Florian Roth (Nextron Systems)
date: 2022-02-25
modified: 2022-09-09
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1021.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        Image|endswith: '\policydefinitions\postgresql.exe'
    selection2:
        - CommandLine|contains:
              - 'CSIDL_SYSTEM_DRIVE\temp\sys.tmp'
              - ' 1> \\\\127.0.0.1\ADMIN$\__16'
        - CommandLine|contains|all:
              - 'powershell -c '
              - '\comsvcs.dll MiniDump '
              - '\winupd.log full'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Low FP

Hidden Local User Creation

Detects the creation of a local hidden user account which should not happen for event ID 4720.

status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 7b449a5e-1db5-4dd0-a2dc-4e3a67282538

carbon_black query

(EventID:4720 TargetUserName:$) (-TargetUserName:HomeGroupUser$)

view Sigma YAML

title: Hidden Local User Creation
id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
status: test
description: Detects the creation of a local hidden user account which should not happen for event ID 4720.
references:
    - https://twitter.com/SBousseaden/status/1387743867663958021
author: Christian Burkard (Nextron Systems)
date: 2021-05-03
modified: 2024-01-16
tags:
    - attack.persistence
    - attack.t1136.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4720
        TargetUserName|endswith: '$'
    filter_main_homegroup:
        TargetUserName: 'HomeGroupUser$'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Hide Schedule Task Via Index Value Tamper

Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 5b16df71-8615-4f7f-ac9b-6c43c0509e61

carbon_black query

(TargetObject:\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\* TargetObject:Index*) Details:DWORD\ \(0x00000000\)

view Sigma YAML

title: Hide Schedule Task Via Index Value Tamper
id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61
related:
    - id: acd74772-5f88-45c7-956b-6a7b36c294d2
      type: similar
    - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec
      type: similar
status: test
description: |
  Detects when the "index" value of a scheduled task is modified from the registry
  Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique)
references:
    - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-26
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\'
            - 'Index'
        Details: DWORD (0x00000000)
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong Medium FP

Hiding User Account Via SpecialAccounts Registry Key

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

status test author Nasreddine Bencherchali (Nextron Systems), frack113 ATT&CK sub-technique id f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd

carbon_black query

TargetObject:\\SOFTWARE\\Microsoft\\Windows\ NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList* Details:DWORD\ \(0x00000000\)

view Sigma YAML

title: Hiding User Account Via SpecialAccounts Registry Key
id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd
related:
    - id: 8a58209c-7ae6-4027-afb0-307a78e4589a
      type: obsolete
    - id: 9ec9fb1b-e059-4489-9642-f270c207923d
      type: similar
status: test
description: Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
references:
    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
    - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
author: Nasreddine Bencherchali (Nextron Systems), frack113
date: 2022-07-12
modified: 2023-01-26
tags:
    - attack.stealth
    - attack.t1564.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
        Details: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml
simulation:
    - type: atomic-red-team
      name: Create Hidden User in Registry
      technique: T1564.002
      atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c

Convert to SIEM query

high Moderate Medium FP

Hijack Legit RDP Session to Move Laterally

Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

status test author Samir Bousseaden ATT&CK sub-technique id 52753ea4-b3a0-4365-910d-36cff487b789

carbon_black query

Image:\\mstsc.exe TargetFilename:\\Microsoft\\Windows\\Start\ Menu\\Programs\\Startup\\*

view Sigma YAML

title: Hijack Legit RDP Session to Move Laterally
id: 52753ea4-b3a0-4365-910d-36cff487b789
status: test
description: Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
author: Samir Bousseaden
references:
    - Internal Research
date: 2019-02-21
modified: 2021-11-27
tags:
    - attack.command-and-control
    - attack.t1219.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\mstsc.exe'
        TargetFilename|contains: '\Microsoft\Windows\Start Menu\Programs\Startup\'
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong High FP

History File Deletion

Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 1182f3b3-e716-4efa-99ab-d2685d04360f

carbon_black query

(Image:\/rm OR Image:\/unlink OR Image:\/shred) ((CommandLine:\/.bash_history* OR CommandLine:\/.zsh_history*) OR (CommandLine:_history OR CommandLine:.history OR CommandLine:zhistory))

view Sigma YAML

title: History File Deletion
id: 1182f3b3-e716-4efa-99ab-d2685d04360f
status: test
description: Detects events in which a history file gets deleted, e.g. the ~/bash_history to remove traces of malicious activity
references:
    - https://github.com/sleventyeleven/linuxprivchecker/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md
author: Florian Roth (Nextron Systems)
date: 2022-06-20
modified: 2022-09-15
tags:
    - attack.impact
    - attack.t1565.001
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/rm'
            - '/unlink'
            - '/shred'
    selection_history:
        - CommandLine|contains:
              - '/.bash_history'
              - '/.zsh_history'
        - CommandLine|endswith:
              - '_history'
              - '.history'
              - 'zhistory'
    condition: all of selection*
falsepositives:
    - Legitimate administration activities
level: high

Convert to SIEM query

high Strong Medium FP

HybridConnectionManager Service Installation

Rule to detect the Hybrid Connection Manager service installation.

status test author Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) ATT&CK technique id 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2

carbon_black query

EventID:4697 ServiceName:HybridConnectionManager ServiceFileName:HybridConnectionManager*

view Sigma YAML

title: HybridConnectionManager Service Installation
id: 0ee4d8a5-4e67-4faf-acfa-62a78457d1f2
status: test
description: Rule to detect the Hybrid Connection Manager service installation.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2022-10-09
tags:
    - attack.persistence
    - attack.t1554
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceName: HybridConnectionManager
        ServiceFileName|contains: HybridConnectionManager
    condition: selection
falsepositives:
    - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high

Convert to SIEM query

high Moderate Medium FP

HybridConnectionManager Service Installation - Registry

Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.

status test author Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) ATT&CK technique id ac8866c7-ce44-46fd-8c17-b24acff96ca8

carbon_black query

TargetObject:\\Services\\HybridConnectionManager* OR (EventType:SetValue Details:Microsoft.HybridConnectionManager.Listener.exe*)

view Sigma YAML

title: HybridConnectionManager Service Installation - Registry
id: ac8866c7-ce44-46fd-8c17-b24acff96ca8
status: test
description: Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2022-11-27
tags:
    - attack.resource-development
    - attack.t1608
logsource:
    category: registry_event
    product: windows
detection:
    selection1:
        TargetObject|contains: '\Services\HybridConnectionManager'
    selection2:
        EventType: SetValue
        Details|contains: 'Microsoft.HybridConnectionManager.Listener.exe'
    condition: selection1 or selection2
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong Low FP

HybridConnectionManager Service Running

Rule to detect the Hybrid Connection Manager service running on an endpoint.

status test author Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) ATT&CK technique id b55d23e5-6821-44ff-8a6e-67218891e49f

carbon_black query

(EventID:40300 OR EventID:40301 OR EventID:40302) ("HybridConnection" OR "sb\:\/\/" OR "servicebus.windows.net" OR "HybridConnectionManage")

view Sigma YAML

title: HybridConnectionManager Service Running
id: b55d23e5-6821-44ff-8a6e-67218891e49f
status: test
description: Rule to detect the Hybrid Connection Manager service running on an endpoint.
references:
    - https://twitter.com/Cyb3rWard0g/status/1381642789369286662
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
date: 2021-04-12
modified: 2024-08-05
tags:
    - attack.persistence
    - attack.t1554
logsource:
    product: windows
    service: microsoft-servicebus-client # Change to servicebus-client once validators are up to date
detection:
    selection:
        EventID:
            - 40300
            - 40301
            - 40302
    keywords:
        - 'HybridConnection'
        - 'sb://'
        - 'servicebus.windows.net'
        - 'HybridConnectionManage'
    condition: selection and keywords
falsepositives:
    - Legitimate use of Hybrid Connection Manager via Azure function apps.
level: high

Convert to SIEM query

high Moderate Medium FP

Hypervisor Enforced Paging Translation Disabled

Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 7f2954d2-99c2-4d42-a065-ca36740f187b

carbon_black query

TargetObject:\\DisableHypervisorEnforcedPagingTranslation Details:DWORD\ \(0x00000001\)

view Sigma YAML

title: Hypervisor Enforced Paging Translation Disabled
id: 7f2954d2-99c2-4d42-a065-ca36740f187b
status: test
description: |
    Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature.
references:
    - https://twitter.com/standa_t/status/1808868985678803222
    - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-05
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\DisableHypervisorEnforcedPagingTranslation'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine

Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.

status experimental author Swachchhanda Shrawan Poudel (Nextron Systems) ATT&CK technique id 6225c53a-a96e-4235-b28f-8d7997cd96eb

carbon_black query

((Image:\\powershell.exe OR Image:\\pwsh.exe OR Image:\\reg.exe) OR (OriginalFileName:PowerShell.EXE OR OriginalFileName:pwsh.dll OR OriginalFileName:reg.exe)) (CommandLine:add\ * OR CommandLine:New\-ItemProperty\ * OR CommandLine:Set\-ItemProperty\ * OR CommandLine:si\ *) CommandLine:\\DeviceGuard* (CommandLine:EnableVirtualizationBasedSecurity* OR CommandLine:HypervisorEnforcedCodeIntegrity*)

view Sigma YAML

title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
id: 6225c53a-a96e-4235-b28f-8d7997cd96eb
related:
    - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a
      type: similar
status: experimental
description: |
    Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe.
    HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.
    Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.
references:
    - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
    - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-01-26
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\reg.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
              - 'reg.exe'
    selection_cli:
        CommandLine|contains:
            - 'add '
            - 'New-ItemProperty '
            - 'Set-ItemProperty '
            - 'si '  # SetItem Alias
    selection_cli_base:
        CommandLine|contains: '\DeviceGuard'
    selection_cli_key:
        CommandLine|contains:
            - 'EnableVirtualizationBasedSecurity'
            - 'HypervisorEnforcedCodeIntegrity'
    condition: all of selection_*
falsepositives:
    - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml
simulation:
    - type: atomic-red-team
      name: Disable Hypervisor-Enforced Code Integrity (HVCI)
      technique: T1562.001
      atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020

Convert to SIEM query

high Moderate High FP

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

status test author Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea) ATT&CK tactic-only id 3fd4c8d7-8362-4557-a8e6-83b29cc0d724

carbon_black query

TargetObject:\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\ZoneMap\\ProtocolDefaults* (TargetObject:\\http OR TargetObject:\\https) Details:DWORD\ \(0x00000000\)*

view Sigma YAML

title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols
id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
related:
    - id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
      type: similar
status: test
description: |
    Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
references:
    - https://twitter.com/M_haggis/status/1699056847154725107
    - https://twitter.com/JAMESWT_MHT/status/1699042827261391247
    - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
    - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (idea)
date: 2023-09-05
tags:
    - attack.stealth
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults'
        TargetObject|endswith:
            - '\http'
            - '\https'
        Details|contains: 'DWORD (0x00000000)'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI

Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 10344bb3-7f65-46c2-b915-2d00d47be5b0

carbon_black query

CommandLine:\\Microsoft\\Windows\\CurrentVersion\\Internet\ Settings\\ZoneMap\\ProtocolDefaults* CommandLine:http* CommandLine:\ 0*

view Sigma YAML

title: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
id: 10344bb3-7f65-46c2-b915-2d00d47be5b0
related:
    - id: 3fd4c8d7-8362-4557-a8e6-83b29cc0d724
      type: similar
status: test
description: |
    Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.
references:
    - https://twitter.com/M_haggis/status/1699056847154725107
    - https://twitter.com/JAMESWT_MHT/status/1699042827261391247
    - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
    - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-09-05
tags:
    - attack.execution
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - '\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults'
            - 'http'
            - ' 0'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong Medium FP

ISO File Created Within Temp Folders

Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

status test author @sam0x90 ATT&CK sub-technique id 2f9356ae-bf43-41b8-b858-4496d83b2acb

carbon_black query

((TargetFilename:\\AppData\\Local\\Temp\\* TargetFilename:.zip\\*) TargetFilename:.iso) OR (TargetFilename:\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\* TargetFilename:.iso)

view Sigma YAML

title: ISO File Created Within Temp Folders
id: 2f9356ae-bf43-41b8-b858-4496d83b2acb
status: test
description: Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
references:
    - https://twitter.com/Sam0x90/status/1552011547974696960
    - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
    - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
author: '@sam0x90'
date: 2022-07-30
tags:
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: file_event
    product: windows
detection:
    selection_1:
        TargetFilename|contains|all:
            - '\AppData\Local\Temp\'
            - '.zip\'
        TargetFilename|endswith: '.iso'
    selection_2:
        TargetFilename|contains: '\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\'
        TargetFilename|endswith: '.iso'
    condition: 1 of selection*
falsepositives:
    - Potential FP by sysadmin opening a zip file containing a legitimate ISO file
level: high

Convert to SIEM query

high Moderate Medium FP

IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32

Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 2bd8e100-5b3b-4b6a-bbb5-b129d3ddddc5

carbon_black query

Image:\\rundll32.exe (CommandLine:\\1.dll,\ DllRegisterServer OR CommandLine:\ 1.dll,\ DllRegisterServer)

view Sigma YAML

title: IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32
id: 2bd8e100-5b3b-4b6a-bbb5-b129d3ddddc5
status: test
description: Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID
references:
    - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
    - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-31
tags:
    - attack.stealth
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith:
            - '\1.dll, DllRegisterServer' # In case of full path exec
            - ' 1.dll, DllRegisterServer' # In case of direct exec
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

ImagingDevices Unusual Parent/Child Processes

Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id f11f2808-adb4-46c0-802a-8660db50fa99

carbon_black query

((ParentImage:\\WmiPrvSE.exe OR ParentImage:\\svchost.exe OR ParentImage:\\dllhost.exe) Image:\\ImagingDevices.exe) OR ParentImage:\\ImagingDevices.exe

view Sigma YAML

title: ImagingDevices Unusual Parent/Child Processes
id: f11f2808-adb4-46c0-802a-8660db50fa99
status: test
description: Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity
references:
    - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-27
modified: 2022-12-29
tags:
    - attack.execution
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            # Add more if known
            - \WmiPrvSE.exe
            - \svchost.exe
            - \dllhost.exe
        Image|endswith: '\ImagingDevices.exe'
    selection_child:
        # You can add specific suspicious child processes (such as cmd, powershell...) to increase the accuracy
        ParentImage|endswith: '\ImagingDevices.exe'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Impacket PsExec Execution

Detects execution of Impacket's psexec.py.

status test author Bhabesh Raj ATT&CK sub-technique id 32d56ea1-417f-44ff-822b-882873f5f43b

carbon_black query

EventID:5145 ShareName:\\\\\*\\IPC$ (RelativeTargetName:RemCom_stdin* OR RelativeTargetName:RemCom_stdout* OR RelativeTargetName:RemCom_stderr*)

view Sigma YAML

title: Impacket PsExec Execution
id: 32d56ea1-417f-44ff-822b-882873f5f43b
status: test
description: Detects execution of Impacket's psexec.py.
references:
    - https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
author: Bhabesh Raj
date: 2020-12-14
modified: 2022-09-22
tags:
    - attack.lateral-movement
    - attack.t1021.002
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
    selection1:
        EventID: 5145
        ShareName: '\\\\\*\\IPC$' # looking for the string \\*\IPC$
        RelativeTargetName|contains:
            - 'RemCom_stdin'
            - 'RemCom_stdout'
            - 'RemCom_stderr'
    condition: selection1
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong Medium FP

Important Scheduled Task Deleted or Disabled

Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

status test author frack113 ATT&CK technique id 9e3cb244-bdb8-4632-8c90-6079c8f4f16d

carbon_black query

((EventID:141 OR EventID:142) (TaskName:\\Windows\\SystemRestore\\SR* OR TaskName:\\Windows\\Windows\ Defender\\* OR TaskName:\\Windows\\BitLocker* OR TaskName:\\Windows\\WindowsBackup\\* OR TaskName:\\Windows\\WindowsUpdate\\* OR TaskName:\\Windows\\UpdateOrchestrator\\* OR TaskName:\\Windows\\ExploitGuard*)) (-(UserName:AUTHORI* OR UserName:AUTORI*))

view Sigma YAML

title: Important Scheduled Task Deleted or Disabled
id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d
related:
    - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 # ProcCreation schtasks delete
      type: similar
    - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad # Security-Audting Eventlog
      type: similar
    - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 # ProcCreation schtasks disable
      type: similar
status: test
description: |
    Detects when adversaries try to stop system services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
references:
    - https://www.socinvestigation.com/most-common-windows-event-ids-to-hunt-mind-map/
author: frack113
date: 2023-01-13
modified: 2026-03-11
tags:
    - attack.impact
    - attack.t1489
logsource:
    product: windows
    service: taskscheduler
    definition: 'Requirements: The "Microsoft-Windows-TaskScheduler/Operational" is disabled by default and needs to be enabled in order for this detection to trigger'
detection:
    selection:
        EventID:
            - 141 # Task Deleted
            - 142 # Task Disabled
        TaskName|contains:
            - '\Windows\SystemRestore\SR'
            - '\Windows\Windows Defender\'
            - '\Windows\BitLocker'
            - '\Windows\WindowsBackup\'
            - '\Windows\WindowsUpdate\'
            - '\Windows\UpdateOrchestrator\'
            - '\Windows\ExploitGuard'
    filter_main_user:
        UserName|contains:
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/builtin/taskscheduler/win_taskscheduler_susp_schtasks_delete_or_disable/info.yml
simulation:
    - type: atomic-red-team
      name: Windows - Disable the SR scheduled task
      technique: T1490
      atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034

Convert to SIEM query

high Strong Medium FP

Important Scheduled Task Deleted/Disabled

Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 7595ba94-cf3b-4471-aa03-4f6baa9e5fad

carbon_black query

((EventID:4699 OR EventID:4701) (TaskName:\\Windows\\SystemRestore\\SR* OR TaskName:\\Windows\\Windows\ Defender\\* OR TaskName:\\Windows\\BitLocker* OR TaskName:\\Windows\\WindowsBackup\\* OR TaskName:\\Windows\\WindowsUpdate\\* OR TaskName:\\Windows\\UpdateOrchestrator\\Schedule* OR TaskName:\\Windows\\ExploitGuard*)) (-(EventID:4699 SubjectUserName:$ TaskName:\\Windows\\Windows\ Defender\\*))

view Sigma YAML

title: Important Scheduled Task Deleted/Disabled
id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad
related:
    - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 # ProcCreation schtasks delete
      type: similar
    - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 # ProcCreation schtasks disable
      type: similar
    - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d # TaskScheduler EventLog
      type: similar
status: test
description: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-05
modified: 2023-03-13
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1053.005
logsource:
    product: windows
    service: security
    definition: 'The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data.'
detection:
    selection:
        EventID:
            - 4699 # Task Deleted Event
            - 4701 # Task Disabled Event
        TaskName|contains:
            # Add more important tasks
            - '\Windows\SystemRestore\SR'
            - '\Windows\Windows Defender\'
            - '\Windows\BitLocker'
            - '\Windows\WindowsBackup\'
            - '\Windows\WindowsUpdate\'
            - '\Windows\UpdateOrchestrator\Schedule'
            - '\Windows\ExploitGuard'
    filter_main_defender_update:
        EventID: 4699
        SubjectUserName|endswith: '$'  # False positives during upgrades of Defender, where its tasks get removed and added
        TaskName|contains: '\Windows\Windows Defender\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml
simulation:
    - type: atomic-red-team
      name: Windows - Disable the SR scheduled task
      technique: T1490
      atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034

Convert to SIEM query

high Strong Medium FP

Important Windows Event Auditing Disabled

Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1

carbon_black query

(EventID:4719 (SubcategoryGuid:\{0CCE9210\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9211\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9212\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9215\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE921B\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE922B\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE922F\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9230\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9235\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9236\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9237\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE923F\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9240\-69AE\-11D9\-BED3\-505054503030\} OR SubcategoryGuid:\{0CCE9242\-69AE\-11D9\-BED3\-505054503030\}) (AuditPolicyChanges:%%8448* OR AuditPolicyChanges:%%8450*)) OR (EventID:4719 SubcategoryGuid:\{0CCE9217\-69AE\-11D9\-BED3\-505054503030\} AuditPolicyChanges:%%8448*)

view Sigma YAML

title: Important Windows Event Auditing Disabled
id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1
related:
    - id: 69aeb277-f15f-4d2d-b32a-55e883609563
      type: derived
status: test
description: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.
references:
    - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
    - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-20
modified: 2023-11-17
tags:
    - attack.defense-impairment
    - attack.t1685.001
logsource:
    product: windows
    service: security
    definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64
detection:
    selection_state_success_and_failure:
        EventID: 4719
        SubcategoryGuid:
            # Note: Add or remove GUID as you see fit in your env
            - '{0CCE9210-69AE-11D9-BED3-505054503030}' # Audit Security State Change
            - '{0CCE9211-69AE-11D9-BED3-505054503030}' # Audit Security System Extension
            - '{0CCE9212-69AE-11D9-BED3-505054503030}' # Audit System Integrity
            - '{0CCE9215-69AE-11D9-BED3-505054503030}' # Audit Logon
            - '{0CCE921B-69AE-11D9-BED3-505054503030}' # Audit Special Logon
            - '{0CCE922B-69AE-11D9-BED3-505054503030}' # Audit Process Creation
            - '{0CCE922F-69AE-11D9-BED3-505054503030}' # Audit Audit Policy Change
            - '{0CCE9230-69AE-11D9-BED3-505054503030}' # Audit Authentication Policy Change
            - '{0CCE9235-69AE-11D9-BED3-505054503030}' # Audit User Account Management
            - '{0CCE9236-69AE-11D9-BED3-505054503030}' # Audit Computer Account Management
            - '{0CCE9237-69AE-11D9-BED3-505054503030}' # Audit Security Group Management
            - '{0CCE923F-69AE-11D9-BED3-505054503030}' # Audit Credential Validation
            - '{0CCE9240-69AE-11D9-BED3-505054503030}' # Audit Kerberos Service Ticket Operations
            - '{0CCE9242-69AE-11D9-BED3-505054503030}' # Audit Kerberos Authentication Service
        AuditPolicyChanges|contains:
            - '%%8448' # This is "Success removed"
            - '%%8450' # This is "Failure removed"
    selection_state_success_only:
        EventID: 4719
        SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' # Audit Account Lockout
        AuditPolicyChanges|contains: '%%8448'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong Low FP

Important Windows Eventlog Cleared

Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

status test author Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 100ef69e-3327-481c-8e5c-6d80d9507556

carbon_black query

EventID:104 Provider_Name:Microsoft\-Windows\-Eventlog (Channel:Microsoft\-Windows\-PowerShell\/Operational OR Channel:Microsoft\-Windows\-Sysmon\/Operational OR Channel:PowerShellCore\/Operational OR Channel:Security OR Channel:System OR Channel:Windows\ PowerShell)

view Sigma YAML

title: Important Windows Eventlog Cleared
id: 100ef69e-3327-481c-8e5c-6d80d9507556
related:
    - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b
      type: derived
status: test
description: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution
references:
    - https://twitter.com/deviouspolack/status/832535435960209408
    - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
date: 2022-05-17
modified: 2023-11-15
tags:
    - attack.defense-impairment
    - attack.t1685.005
    - car.2016-04-002
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 104
        Provider_Name: 'Microsoft-Windows-Eventlog'
        Channel:
            - 'Microsoft-Windows-PowerShell/Operational'
            - 'Microsoft-Windows-Sysmon/Operational'
            - 'PowerShellCore/Operational'
            - 'Security'
            - 'System'
            - 'Windows PowerShell'
    condition: selection
falsepositives:
    - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog)
    - System provisioning (system reset before the golden image creation)
level: high

Convert to SIEM query

high Strong Medium FP

Important Windows Service Terminated Unexpectedly

Detects important or interesting Windows services that got terminated unexpectedly.

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 56abae0c-6212-4b97-adc0-0b559bb950c3

carbon_black query

(Provider_Name:Service\ Control\ Manager EventID:7034) (param1:Message\ Queuing* OR (Binary:4d0053004d005100* OR Binary:6d0073006d007100*))

view Sigma YAML

title: Important Windows Service Terminated Unexpectedly
id: 56abae0c-6212-4b97-adc0-0b559bb950c3
status: test
description: Detects important or interesting Windows services that got terminated unexpectedly.
references:
    - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-14
tags:
    - attack.stealth
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7034 # The X service terminated unexpectedly. It has done this Y time(s).
    selection_name:
        # Note that these names contained in "param1" are "Display Names" and are language specific. If you're using a non-english system these can and will be different
        - param1|contains: 'Message Queuing'
        # Use this If you collect the binary value provided from this event, which is the wide hex encoded value of the service name.
        - Binary|contains:
              - '4d0053004d005100' # MSMQ (Microsoft Message Queuing). Encoded in upper case just in case
              - '6d0073006d007100' # msmq
    condition: all of selection_*
falsepositives:
    - Rare false positives could occur since service termination could happen due to multiple reasons
level: high

Convert to SIEM query

high Strong Medium FP

Important Windows Service Terminated With Error

Detects important or interesting Windows services that got terminated for whatever reason

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id d6b5520d-3934-48b4-928c-2aa3f92d6963

carbon_black query

(Provider_Name:Service\ Control\ Manager EventID:7023) ((param1:\ Antivirus* OR param1:\ Firewall* OR param1:Application\ Guard* OR param1:BitLocker\ Drive\ Encryption\ Service* OR param1:Encrypting\ File\ System* OR param1:Microsoft\ Defender* OR param1:Threat\ Protection* OR param1:Windows\ Event\ Log*) OR (Binary:770069006e0064006500660065006e006400* OR Binary:4500760065006e0074004c006f006700* OR Binary:6d0070007300730076006300* OR Binary:530065006e0073006500* OR Binary:450046005300* OR Binary:420044004500530056004300*))

view Sigma YAML

title: Important Windows Service Terminated With Error
id: d6b5520d-3934-48b4-928c-2aa3f92d6963
related:
    - id: acfa2210-0d71-4eeb-b477-afab494d596c
      type: similar
status: test
description: Detects important or interesting Windows services that got terminated for whatever reason
references:
    - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-14
tags:
    - attack.stealth
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7023 # The X Service service terminated with the following error
    selection_name:
        - param1|contains:
              # Note that these names are "Display Names" and are language specific. If you're using a non-english system these can and will be different
              - ' Antivirus'
              - ' Firewall'
              - 'Application Guard'
              - 'BitLocker Drive Encryption Service'
              - 'Encrypting File System'
              - 'Microsoft Defender'
              - 'Threat Protection'
              - 'Windows Event Log'
        # Use this If you collect the binary value provided from this event, which is the wide hex encoded value of the service name.
        - Binary|contains:
              - '770069006e0064006500660065006e006400' # windefend (Microsoft Defender Antivirus Service)
              - '4500760065006e0074004c006f006700' # EventLog
              - '6d0070007300730076006300' # mpssvc (Windows Defender Firewall)
              - '530065006e0073006500' # Sense (Windows Defender Advanced Threat Protection Service)
              - '450046005300' # EFS (Encrypting File System)
              - '420044004500530056004300' # BDESVC (BitLocker Drive Encryption Service)
    condition: all of selection_*
falsepositives:
    - Rare false positives could occur since service termination could happen due to multiple reasons
level: high

Convert to SIEM query

high Moderate Medium FP

Imports Registry Key From an ADS

Detects the import of a alternate datastream to the registry with regedit.exe.

status test author Oddvar Moe, Sander Wiebing, oscd.community ATT&CK technique id 0b80ade5-6997-4b1d-99a1-71701778ea61

carbon_black query

((Image:\\regedit.exe OR OriginalFileName:REGEDIT.EXE) ((CommandLine:\ \/i\ * OR CommandLine:.reg*) CommandLine::[^ \\\\])) (-(CommandLine:\ \-e\ * OR CommandLine:\ \/e\ * OR CommandLine:\ –e\ * OR CommandLine:\ —e\ * OR CommandLine:\ ―e\ * OR CommandLine:\ \-a\ * OR CommandLine:\ \/a\ * OR CommandLine:\ –a\ * OR CommandLine:\ —a\ * OR CommandLine:\ ―a\ * OR CommandLine:\ \-c\ * OR CommandLine:\ \/c\ * OR CommandLine:\ –c\ * OR CommandLine:\ —c\ * OR CommandLine:\ ―c\ *))

view Sigma YAML

title: Imports Registry Key From an ADS
id: 0b80ade5-6997-4b1d-99a1-71701778ea61
related:
    - id: 73bba97f-a82d-42ce-b315-9182e76c57b1
      type: similar
status: test
description: Detects the import of a alternate datastream to the registry with regedit.exe.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
    - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
author: Oddvar Moe, Sander Wiebing, oscd.community
date: 2020-10-12
modified: 2024-03-13
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\regedit.exe'
        - OriginalFileName: 'REGEDIT.EXE'
    selection_cli:
        CommandLine|contains:
            - ' /i '
            - '.reg'
        CommandLine|re: ':[^ \\]'
    filter:
        CommandLine|contains|windash:
            - ' -e '
            - ' -a '
            - ' -c '
    condition: all of selection_* and not filter
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Impossible Travel

Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.

status test author Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' ATT&CK technique id b2572bf9-e20a-4594-b528-40bde666525a

carbon_black query

riskEventType:impossibleTravel

view Sigma YAML

title: Impossible Travel
id: b2572bf9-e20a-4594-b528-40bde666525a
status: test
description: Identifies user activities originating from geographically distant locations within a time period shorter than the time it takes to travel from the first location to the second.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
    - attack.initial-access
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'impossibleTravel'
    condition: selection
falsepositives:
    - Connecting to a VPN, performing activity and then dropping and performing additional activity.
level: high

Convert to SIEM query

high Moderate High FP

Injected Browser Process Spawning Rundll32 - GuLoader Activity

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

status test author @kostastsale ATT&CK technique id 89e1490f-1a3e-452a-bbb8-b68a5f58072f

carbon_black query

(ParentImage:\\chrome.exe OR ParentImage:\\firefox.exe OR ParentImage:\\msedge.exe) Image:\\rundll32.exe CommandLine:\\rundll32.exe

view Sigma YAML

title: Injected Browser Process Spawning Rundll32 - GuLoader Activity
id: 89e1490f-1a3e-452a-bbb8-b68a5f58072f
status: test
description: |
    Detects the execution of installed GuLoader malware on the host.
    GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.
references:
    - Internal Research
author: '@kostastsale'
date: 2023-08-07
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|endswith: '\rundll32.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate High FP

Inline Python Execution - Spawn Shell Via OS System Library

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

status test author Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) ATT&CK technique id 2d2f44ff-4611-4778-a8fc-323a0e9850cc

carbon_black query

((Image:\/python OR Image:\/python2 OR Image:\/python3) OR (Image:\/python2.* OR Image:\/python3.*)) ((CommandLine:\ \-c\ * CommandLine:os.system\(*) (CommandLine:\/bin\/bash* OR CommandLine:\/bin\/dash* OR CommandLine:\/bin\/fish* OR CommandLine:\/bin\/sh* OR CommandLine:\/bin\/zsh*))

view Sigma YAML

title: Inline Python Execution - Spawn Shell Via OS System Library
id: 2d2f44ff-4611-4778-a8fc-323a0e9850cc
status: test
description: |
    Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.
references:
    - https://gtfobins.github.io/gtfobins/python/#shell
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
date: 2024-09-02
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        - Image|endswith:
              - '/python'
              - '/python2'
              - '/python3'
        - Image|contains:
              - '/python2.'  # python image is always of the form ../python3.10; ../python is just a symlink
              - '/python3.'
    selection_cli:
        CommandLine|contains|all:
            - ' -c '
            - 'os.system('
        CommandLine|contains:
            - '/bin/bash'
            - '/bin/dash'
            - '/bin/fish'
            - '/bin/sh'
            - '/bin/zsh'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Installation of WSL Kali-Linux

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

status experimental author Swachchhanda Shrawan Poudel (Nextron Systems) ATT&CK technique id eca8ae39-5c3c-4321-b538-9e64fe25822e

carbon_black query

(Image:\\wsl.exe OR OriginalFileName:wsl) (CommandLine:\ \-\-install\ * OR CommandLine:\ \-i\ *) CommandLine:kali*

view Sigma YAML

title: Installation of WSL Kali-Linux
id: eca8ae39-5c3c-4321-b538-9e64fe25822e
status: experimental
description: |
    Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
    Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.
references:
    - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
    - https://learn.microsoft.com/en-us/windows/wsl/install
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-10
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_wsl_img:
        - Image|endswith: '\wsl.exe'
        - OriginalFileName: 'wsl'
    selection_wsl_install:
        CommandLine|contains:
            - ' --install '
            - ' -i '
    selection_wsl_kali:
        CommandLine|contains: 'kali'
    condition: all of selection_wsl_*
falsepositives:
    - Legitimate installation or usage of Kali Linux WSL by administrators or security teams
level: high

Convert to SIEM query

high Strong Medium FP

Interactive AT Job

Detects an interactive AT job, which may be used as a form of privilege escalation.

status test author E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community ATT&CK sub-technique id 60fc936d-2eb0-4543-8a13-911c750a1dfc

carbon_black query

Image:\\at.exe CommandLine:interactive*

view Sigma YAML

title: Interactive AT Job
id: 60fc936d-2eb0-4543-8a13-911c750a1dfc
status: test
description: Detects an interactive AT job, which may be used as a form of privilege escalation.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md
    - https://eqllib.readthedocs.io/en/latest/analytics/d8db43cf-ed52-4f5c-9fb3-c9a4b95a0b56.html
author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
date: 2019-10-24
modified: 2021-11-27
tags:
    - attack.persistence
    - attack.execution
    - attack.privilege-escalation
    - attack.t1053.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\at.exe'
        CommandLine|contains: 'interactive'
    condition: selection
falsepositives:
    - Unlikely (at.exe deprecated as of Windows 8)
level: high
simulation:
    - type: atomic-red-team
      name: At.exe Scheduled task
      technique: T1053.002
      atomic_guid: 4a6c0dc4-0f2a-4203-9298-a5a9bdc21ed8

Convert to SIEM query

high Moderate Medium FP

Invalid PIM License

Identifies when an organization doesn't have the proper license for PIM and is out of compliance.

status test author Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' ATT&CK technique id 58af08eb-f9e1-43c8-9805-3ad9b0482bd8

carbon_black query

riskEventType:invalidLicenseAlertIncident

view Sigma YAML

title: Invalid PIM License
id: 58af08eb-f9e1-43c8-9805-3ad9b0482bd8
status: test
description: Identifies when an organization doesn't have the proper license for PIM and is out of compliance.
references:
    - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#the-organization-doesnt-have-microsoft-entra-premium-p2-or-microsoft-entra-id-governance
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-14
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1078
    - attack.persistence
    - attack.privilege-escalation
logsource:
    product: azure
    service: pim
detection:
    selection:
        riskEventType: 'invalidLicenseAlertIncident'
    condition: selection
falsepositives:
    - Investigate if licenses have expired.
level: high

Convert to SIEM query

high Moderate High FP

Invoke-Obfuscation CLIP+ Launcher

Detects Obfuscated use of Clip.exe to execute PowerShell

status test author Jonathan Cheong, oscd.community ATT&CK sub-technique id b222df08-0e07-11eb-adc1-0242ac120002

carbon_black query

(CommandLine:cmd* CommandLine:&&* CommandLine:clipboard\]\:\:* CommandLine:\-f*) (CommandLine:\/c* OR CommandLine:\/r*)

view Sigma YAML

title: Invoke-Obfuscation CLIP+ Launcher
id: b222df08-0e07-11eb-adc1-0242ac120002
status: test
description: Detects Obfuscated use of Clip.exe to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
author: Jonathan Cheong, oscd.community
date: 2020-10-13
modified: 2022-11-17
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # CommandLine|re: 'cmd.{0,5}(?:\/c|\/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\\"\{\d\}.+\-f.+\"'
        # Example 1: Cmd /c" echo/Invoke-Expression (New-Object Net.WebClient).DownloadString |cLiP&& POWerSheLl -Nolog -sT . (\"{1}{2}{0}\"-f'pe','Ad',(\"{1}{0}\" -f'Ty','d-' ) ) -Assemb ( \"{5}{1}{3}{0}{2}{4}\" -f'ows','y','.F',(\"{0}{1}{2}\" -f'stem.W','i','nd'),( \"{0}{1}\"-f 'o','rms' ),'S' ) ; ([SySTEM.wiNDows.FoRmS.CLiPbOArd]::( \"{1}{0}\" -f (\"{1}{0}\" -f'T','TTeX' ),'gE' ).\"invO`Ke\"( ) ) ^| ^&( \"{5}{1}{2}{4}{3}{0}\" -f 'n',( \"{1}{0}\"-f'KE-','o' ),(\"{2}{1}{0}\"-f 'pRESS','x','e' ),'o','i','iNV') ; [System.Windows.Forms.Clipboard]::(\"{0}{1}\" -f( \"{1}{0}\"-f'e','SetT' ),'xt').\"InV`oKe\"( ' ')"
        # Example 2: CMD/c " ECho Invoke-Expression (New-Object Net.WebClient).DownloadString|c:\WiNDowS\SySteM32\cLip && powershElL -noPRO -sTa ^& (\"{2}{0}{1}\" -f 'dd',(\"{1}{0}\"-f 'ype','-T' ),'A' ) -AssemblyN (\"{0}{3}{2}{1}{4}\"-f'Pr','nCo',(\"{0}{1}\"-f'e','ntatio'),'es','re' ) ; ^& ( ( [StRinG]${ve`RB`OSE`pr`e`FeReNCE} )[1,3] + 'x'-JoiN'') ( ( [sySTem.WInDOWs.ClipbOaRD]::( \"{1}{0}\" -f(\"{0}{1}\" -f'tTe','xt' ),'ge' ).\"IN`Vo`Ke\"( ) ) ) ; [System.Windows.Clipboard]::( \"{2}{1}{0}\" -f't',( \"{0}{1}\" -f 'tT','ex' ),'Se' ).\"In`V`oKe\"( ' ' )"
        CommandLine|contains|all:
            - 'cmd'
            - '&&'
            - 'clipboard]::'
            - '-f'
        CommandLine|contains:
            - '/c'
            - '/r'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Invoke-Obfuscation CLIP+ Launcher - PowerShell

Detects Obfuscated use of Clip.exe to execute PowerShell

status test author Jonathan Cheong, oscd.community ATT&CK sub-technique id 73e67340-0d25-11eb-adc1-0242ac120002

carbon_black query

ScriptBlockText:cmd.{0,5}(?:/c|/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\"\\{\\d\\}.+-f.+"

view Sigma YAML

title: Invoke-Obfuscation CLIP+ Launcher - PowerShell
id: 73e67340-0d25-11eb-adc1-0242ac120002
status: test
description: Detects Obfuscated use of Clip.exe to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
author: Jonathan Cheong, oscd.community
date: 2020-10-13
modified: 2024-04-05
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_4104:
        ScriptBlockText|re: 'cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"'
    condition: selection_4104
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Detects Obfuscated use of Clip.exe to execute PowerShell

status test author Jonathan Cheong, oscd.community ATT&CK sub-technique id a136cde0-61ad-4a61-9b82-8dc490e60dd2

carbon_black query

Payload:cmd.{0,5}(?:/c|/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\"\\{\\d\\}.+-f.+"

view Sigma YAML

title: Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
id: a136cde0-61ad-4a61-9b82-8dc490e60dd2
related:
    - id: 73e67340-0d25-11eb-adc1-0242ac120002
      type: derived
status: test
description: Detects Obfuscated use of Clip.exe to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
author: Jonathan Cheong, oscd.community
date: 2020-10-13
modified: 2024-04-05
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_module
    definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
    selection_4103:
        Payload|re: 'cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"'
    condition: selection_4103
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Invoke-Obfuscation CLIP+ Launcher - Security

Detects Obfuscated use of Clip.exe to execute PowerShell

status test author Jonathan Cheong, oscd.community ATT&CK sub-technique id 4edf51e1-cb83-4e1a-bc39-800e396068e3

carbon_black query

EventID:4697 (ServiceFileName:cmd* ServiceFileName:&&* ServiceFileName:clipboard\]\:\:*)

view Sigma YAML

title: Invoke-Obfuscation CLIP+ Launcher - Security
id: 4edf51e1-cb83-4e1a-bc39-800e396068e3
related:
    - id: f7385ee2-0e0c-11eb-adc1-0242ac120002
      type: derived
status: test
description: Detects Obfuscated use of Clip.exe to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
author: Jonathan Cheong, oscd.community
date: 2020-10-13
modified: 2022-11-27
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: security
    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
    selection:
        EventID: 4697
        ServiceFileName|contains|all:
            - 'cmd'
            - '&&'
            - 'clipboard]::'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Invoke-Obfuscation CLIP+ Launcher - System

Detects Obfuscated use of Clip.exe to execute PowerShell

status test author Jonathan Cheong, oscd.community ATT&CK sub-technique id f7385ee2-0e0c-11eb-adc1-0242ac120002

carbon_black query

Provider_Name:Service\ Control\ Manager EventID:7045 (ImagePath:cmd* ImagePath:&&* ImagePath:clipboard\]\:\:*)

view Sigma YAML

title: Invoke-Obfuscation CLIP+ Launcher - System
id: f7385ee2-0e0c-11eb-adc1-0242ac120002
status: test
description: Detects Obfuscated use of Clip.exe to execute PowerShell
references:
    - https://github.com/SigmaHQ/sigma/issues/1009  # (Task 26)
author: Jonathan Cheong, oscd.community
date: 2020-10-13
modified: 2023-02-20
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: system
detection:
    selection:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
        ImagePath|contains|all:
            - 'cmd'
            - '&&'
            - 'clipboard]::'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Invoke-Obfuscation Obfuscated IEX Invocation

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

status test author Daniel Bohannon (@Mandiant/@FireEye), oscd.community ATT&CK sub-technique id 4bf943c6-5146-4273-98dd-e958fd1e3abf

carbon_black query

CommandLine:\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[ OR CommandLine:\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[ OR CommandLine:\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[ OR CommandLine:\\$env:ComSpec\\[(?:\\s*\\d{1,3}\\s*,){2} OR CommandLine:\\*mdr\\*\\W\\s*\\)\\.Name OR CommandLine:\\$VerbosePreference\\.ToString\\( OR CommandLine:\\[String\\]\\s*\\$VerbosePreference

view Sigma YAML

title: Invoke-Obfuscation Obfuscated IEX Invocation
id: 4bf943c6-5146-4273-98dd-e958fd1e3abf
status: test
description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block
references:
    - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
author: 'Daniel Bohannon (@Mandiant/@FireEye), oscd.community'
date: 2019-11-08
modified: 2026-03-16
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\['
        - CommandLine|re: '\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\['
        - CommandLine|re: '\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\['
        - CommandLine|re: '\$env:ComSpec\[(?:\s*\d{1,3}\s*,){2}'
        - CommandLine|re: '\*mdr\*\W\s*\)\.Name'
        - CommandLine|re: '\$VerbosePreference\.ToString\('
        - CommandLine|re: '\[String\]\s*\$VerbosePreference'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

status test author Daniel Bohannon (@Mandiant/@FireEye), oscd.community ATT&CK sub-technique id 1b9dc62e-6e9e-42a3-8990-94d7a10007f7

carbon_black query

ScriptBlockText:\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\[ OR ScriptBlockText:\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\[ OR ScriptBlockText:\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\[ OR ScriptBlockText:\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2} OR ScriptBlockText:\\*mdr\\*\\W\\s*\\)\\.Name OR ScriptBlockText:\\$VerbosePreference\\.ToString\\(

view Sigma YAML

title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7
status: test
description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014
references:
    - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
author: 'Daniel Bohannon (@Mandiant/@FireEye), oscd.community'
date: 2019-11-08
modified: 2022-12-31
tags:
    - attack.stealth
    - attack.t1027
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_iex:
        - ScriptBlockText|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\['
        - ScriptBlockText|re: '\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\['
        - ScriptBlockText|re: '\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\['
        - ScriptBlockText|re: '\$env:ComSpec\[(\s*\d{1,3}\s*,){2}'
        - ScriptBlockText|re: '\*mdr\*\W\s*\)\.Name'
        - ScriptBlockText|re: '\$VerbosePreference\.ToString\('
    condition: selection_iex
falsepositives:
    - Unknown
level: high

Convert to SIEM query

VMware Carbon Black

Detection rules