title: Potential Pikabot Hollowing Activity
id: d8937fe7-42d5-4b4d-8178-e089c908f63f
status: test
description: |
    Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
    The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
references:
    - https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
    - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
    - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055.012
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith:
            # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
            - '\SearchFilterHost.exe'
            - '\SearchProtocolHost.exe'
            - '\sndvol.exe'
            - '\wermgr.exe'
            - '\wwahost.exe'
    filter_main_legit_sndvol:
        Image|endswith: '\sndvol.exe'
        ParentCommandLine|contains: 'mmsys.cpl'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential PlugX Activity
id: aeab5ec5-be14-471a-80e8-e344418305c2
status: test
description: Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
references:
    - http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
    - https://countuponsecurity.com/2017/06/07/threat-hunting-in-the-enterprise-with-appcompatprocessor/
author: Florian Roth (Nextron Systems)
date: 2017-06-12
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.s0013
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_cammute:
        Image|endswith: '\CamMute.exe'
    filter_cammute:
        Image|contains:
            - '\Lenovo\Communication Utility\'
            - '\Lenovo\Communications Utility\'
    selection_chrome_frame:
        Image|endswith: '\chrome_frame_helper.exe'
    filter_chrome_frame:
        Image|contains: '\Google\Chrome\application\'
    selection_devemu:
        Image|endswith: '\dvcemumanager.exe'
    filter_devemu:
        Image|contains: '\Microsoft Device Emulator\'
    selection_gadget:
        Image|endswith: '\Gadget.exe'
    filter_gadget:
        Image|contains: '\Windows Media Player\'
    selection_hcc:
        Image|endswith: '\hcc.exe'
    filter_hcc:
        Image|contains: '\HTML Help Workshop\'
    selection_hkcmd:
        Image|endswith: '\hkcmd.exe'
    filter_hkcmd:
        Image|contains:
            - '\System32\'
            - '\SysNative\'
            - '\SysWow64\'
    selection_mc:
        Image|endswith: '\Mc.exe'
    filter_mc:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
    selection_msmpeng:
        Image|endswith: '\MsMpEng.exe'
    filter_msmpeng:
        Image|contains:
            - '\Microsoft Security Client\'
            - '\Windows Defender\'
            - '\AntiMalware\'
    selection_msseces:
        Image|endswith: '\msseces.exe'
    filter_msseces:
        Image|contains:
            - '\Microsoft Security Center\'
            - '\Microsoft Security Client\'
            - '\Microsoft Security Essentials\'
    selection_oinfo:
        Image|endswith: '\OInfoP11.exe'
    filter_oinfo:
        Image|contains: '\Common Files\Microsoft Shared\'
    selection_oleview:
        Image|endswith: '\OleView.exe'
    filter_oleview:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
            - '\Windows Resource Kit\'
    selection_rc:
        Image|endswith: '\rc.exe'
    filter_rc:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
            - '\Windows Resource Kit\'
            - '\Microsoft.NET\'
    condition: ( selection_cammute and not filter_cammute ) or ( selection_chrome_frame and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc ) or ( selection_msmpeng and not filter_msmpeng ) or ( selection_msseces and not filter_msseces ) or ( selection_oinfo and not filter_oinfo ) or ( selection_oleview and not filter_oleview ) or ( selection_rc and not filter_rc )
falsepositives:
    - Unknown
level: high

title: Potential PowerShell Execution Policy Tampering - ProcCreation
id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
related:
    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 # ProcCreation Registry
      type: similar
    - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 # ProcCreation Cmdlet
      type: similar
    - id: 61d0475c-173f-4844-86f7-f3eebae1c66b # PowerShell ScriptBlock
      type: similar
status: test
description: Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine
references:
    - https://learn.microsoft.com/de-de/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-11
tags:
    - attack.defense-impairment
logsource:
    product: windows
    category: process_creation
detection:
    selection_path:
        CommandLine|contains:
            - '\ShellIds\Microsoft.PowerShell\ExecutionPolicy'
            - '\Policies\Microsoft\Windows\PowerShell\ExecutionPolicy'
    selection_values:
        CommandLine|contains:
            - 'Bypass'
            - 'RemoteSigned'
            - 'Unrestricted'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Potential PowerShell Obfuscation Via WCHAR/CHAR
id: e312efd0-35a1-407f-8439-b8d434b438a6
status: test
description: Detects suspicious encoded character syntax often used for defense evasion
references:
    - https://twitter.com/0gtweet/status/1281103918693482496
author: Florian Roth (Nextron Systems)
date: 2020-07-09
modified: 2025-03-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '[char]0x'
            - '(WCHAR)0x'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential PrintNightmare Exploitation Attempt
id: 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
status: test
description: Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
references:
    - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
    - https://github.com/cube0x0/CVE-2021-1675
author: Bhabesh Raj
date: 2021-07-01
modified: 2023-02-17
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574
    - cve.2021-1675
    - detection.emerging-threats
logsource:
    category: file_delete
    product: windows
detection:
    selection:
        Image|endswith: '\spoolsv.exe'
        TargetFilename|contains: 'C:\Windows\System32\spool\drivers\x64\3\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Privilege Escalation Attempt Via .Exe.Local Technique
id: 07a99744-56ac-40d2-97b7-2095967b0e03
status: test
description: Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"
references:
    - https://github.com/binderlabs/DirCreate2System
    - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
author: Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash)
date: 2022-12-16
modified: 2022-12-19
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith:
            - 'C:\Windows\System32\logonUI.exe.local'
            - 'C:\Windows\System32\werFault.exe.local'
            - 'C:\Windows\System32\consent.exe.local'
            - 'C:\Windows\System32\narrator.exe.local'
            - 'C:\Windows\System32\wermgr.exe.local'
        TargetFilename|endswith: '\comctl32.dll'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Privilege Escalation To LOCAL SYSTEM
id: 207b0396-3689-42d9-8399-4222658efc99
related:
    - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 # PsExec specific rule
      type: similar
status: test
description: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
    - https://www.poweradmin.com/paexec/
    - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-05-22
modified: 2024-03-05
tags:
    - attack.resource-development
    - attack.t1587.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Escalation to LOCAL_SYSTEM
        CommandLine|contains|windash:
            # Note that you don't need to add the ".exe" part when using psexec/paexec
            # The "-" can also be replaced with "/"
            # The order of args isn't important
            # "cmd" can be replaced by "powershell", "pwsh" or any other console like software
            - ' -s cmd'
            - ' -s -i cmd'
            - ' -i -s cmd'
            # Pwsh (For PowerShell 7)
            - ' -s pwsh'
            - ' -s -i pwsh'
            - ' -i -s pwsh'
            # PowerShell (For PowerShell 5)
            - ' -s powershell'
            - ' -s -i powershell'
            - ' -i -s powershell'
    filter_main_exclude_coverage:
        # This filter exclude strings covered by 8834e2f7-6b4b-4f09-8906-d2276470ee23
        CommandLine|contains:
            - 'paexec'
            - 'PsExec'
            - 'accepteula'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Weird admins that rename their tools
    - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing
level: high

title: Potential Privilege Escalation via Service Permissions Weakness
id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981
status: test
description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/
author: Teymur Kheirkhabarov
date: 2019-10-26
modified: 2024-12-01
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.011
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        IntegrityLevel:
            - 'Medium'
            - 'S-1-16-8192'
        CommandLine|contains|all:
            - 'ControlSet'
            - 'services'
        CommandLine|contains:
            - '\ImagePath'
            - '\FailureCommand'
            - '\ServiceDll'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Process Injection Via Msra.EXE
id: 744a188b-0415-4792-896f-11ddb0588dbc
status: test
description: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics
references:
    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
    - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf
author: Alexander McDonald
date: 2022-06-24
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\msra.exe'
        ParentCommandLine|endswith: 'msra.exe'
        Image|endswith:
            - '\arp.exe'
            - '\cmd.exe'
            - '\net.exe'
            - '\netstat.exe'
            - '\nslookup.exe'
            - '\route.exe'
            - '\schtasks.exe'
            - '\whoami.exe'
    condition: selection
falsepositives:
    - Legitimate use of Msra.exe
level: high

title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution
id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25
related:
    - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c # CLI Generic
      type: similar
    - id: f9999590-1f94-4a34-a91e-951e47bedefd # CLI Abuse
      type: similar
    - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 # Registry
      type: similar
status: test
description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
    - https://twitter.com/0gtweet/status/1674399582162153472
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
date: 2023-08-08
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'SOFTWARE\Microsoft\Provisioning\Commands\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
id: 7021255e-5db3-4946-a8b9-0ba7a4644a69
related:
    - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c # CLI Generic
      type: similar
    - id: f9999590-1f94-4a34-a91e-951e47bedefd # CLI Abuse
      type: similar
    - id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 # CLI Registry
      type: similar
status: test
description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
    - https://twitter.com/0gtweet/status/1674399582162153472
author: Swachchhanda Shrawan Poudel
date: 2023-08-02
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: registry_set
    product: windows
    definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored'
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Provisioning\Commands\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential PsExec Remote Execution
id: ea011323-7045-460b-b2d7-0f7442ea6b38
status: test
description: Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
    - https://www.poweradmin.com/paexec/
    - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-28
modified: 2025-09-01
tags:
    - attack.resource-development
    - attack.t1587.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Accepting EULA in commandline - often used in automated attacks
        CommandLine|contains|all:
            - 'accepteula'
            - ' -u '
            - ' -p '
            - ' \\\\'
    filter_main_localhost:
        CommandLine|contains:
            - '\\\\localhost'
            - '\\\\127.'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potential Qakbot Registry Activity
id: 1c8e96cd-2bed-487d-9de0-b46c90cade56
status: test
description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
references:
    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
author: Hieu Tran
date: 2023-03-13
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\firm\soft\Name'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Qakbot Rundll32 Execution
id: cf879ffb-793a-4753-9a14-bc8f37cc90df
status: test
description: Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.
references:
    - https://github.com/pr0xylife/Qakbot/
author: X__Junior (Nextron Systems)
date: 2023-05-24
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection_paths:
        ParentImage|endswith:
            # Note: Only add processes seen used by Qakbot to avoid collision with other strains of malware
            - '\cmd.exe'
            - '\cscript.exe'
            - '\curl.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            # Note: Only add paths seen used by Qakbot to avoid collision with other strains of malware
            - ':\ProgramData\'
            - ':\Users\Public\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    selection_extension:
        CommandLine|contains: '.dll'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential RDP Tunneling Via Plink
id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da
related:
    - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d # ssh.exe
      type: similar
status: test
description: Execution of plink to perform data exfiltration and tunneling
references:
    - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
author: Florian Roth (Nextron Systems)
date: 2022-08-04
modified: 2023-01-27
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_a:
        Image|endswith: '\plink.exe'
        CommandLine|contains: ':127.0.0.1:3389'
    selection_b1:
        Image|endswith: '\plink.exe'
        CommandLine|contains: ':3389'
    selection_b2:
        CommandLine|contains:
            - ' -P 443'
            - ' -P 22'
    condition: selection_a or all of selection_b*
falsepositives:
    - Unknown
level: high

title: Potential RDP Tunneling Via SSH
id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d
related:
    - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da # plink.exe
      type: similar
status: test
description: Execution of ssh.exe to perform data exfiltration and tunneling through RDP
references:
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-12
modified: 2023-01-25
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ssh.exe'
        CommandLine|contains: ':3389'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Ransomware Activity Using LegalNotice Message
id: 8b9606c9-28be-4a38-b146-0e313cc232c1
status: test
description: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md
author: frack113
date: 2022-12-11
modified: 2023-08-17
tags:
    - attack.impact
    - attack.t1491.001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains:
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption'
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText'
        Details|contains:
            - 'encrypted'
            - 'Unlock-Password'
            - 'paying'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Raspberry Robin Dot Ending File
id: a35c97c8-d9c4-4c89-a3e7-533dc0bcb73a
status: test
description: Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin
author: Nasreddine Bencherchali (Nextron Systems)
references:
    - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
date: 2022-10-28
modified: 2023-02-05
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Example 1: https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2022/10/fig-3f-raspberryrobin-runonce.png
        # Example 2: https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2022/10/fig-5f-odbcconf.png
        # Example 3: https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2022/10/fig-6f-fauppod-command-line.png
        CommandLine|re: \\[a-zA-Z0-9]{1,32}\.[a-zA-Z0-9]{1,6}\.[ "']{1}  # cannot match on end-of-line because of FPs with bind DNS notation
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Rcdll.DLL Sideloading
id: 6e78b74f-c762-4800-82ad-f66787f10c8a
status: test
description: Detects potential DLL sideloading of rcdll.dll
references:
    - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
author: X__Junior (Nextron Systems)
date: 2023-03-13
modified: 2023-03-15
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\rcdll.dll'
    filter:
        ImageLoaded|startswith:
            - 'C:\Program Files (x86)\Microsoft Visual Studio\'
            - 'C:\Program Files (x86)\Windows Kits\'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: Potential Registry Persistence Attempt Via Windows Telemetry
id: 73a883d0-0348-4be4-a8d8-51031c2564f8
related:
    - id: 4e8d5fd3-c959-441f-a941-f73d0cdcdca5
      type: obsolete
status: test
description: |
    Detects potential persistence behavior using the windows telemetry registry key.
    Windows telemetry makes use of the binary CompatTelRunner.exe to run a variety of commands and perform the actual telemetry collections.
    This binary was created to be easily extensible, and to that end, it relies on the registry to instruct on which commands to run.
    The problem is, it will run any arbitrary command without restriction of location or type.
references:
    - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
author: Lednyov Alexey, oscd.community, Sreeman
date: 2020-10-16
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
logsource:
    category: registry_set
    product: windows
    definition: 'Requirements: Sysmon config that monitors \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController subkey of the HKLM hives'
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\TelemetryController\'
        TargetObject|endswith: '\Command'
        Details|contains:
            - '.bat'
            - '.bin'
            - '.cmd'
            - '.dat'
            - '.dll'
            - '.exe'
            - '.hta'
            - '.jar'
            - '.js'
            - '.msi'
            - '.ps'
            - '.sh'
            - '.vb'
    filter_main_generic:
        Details|contains:
            - '\system32\CompatTelRunner.exe'
            - '\system32\DeviceCensus.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potential Renamed Rundll32 Execution
id: 2569ed8c-1147-498a-9b8c-2ad3656b10ed
related:
    - id: 0ba1da6d-b6ce-4366-828c-18826c9de23e
      type: derived
status: test
description: Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection
references:
    - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20
    - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-22
modified: 2023-02-03
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'DllRegisterServer'
    filter:
        Image|endswith: '\rundll32.exe'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

title: Potential RipZip Attack on Startup Folder
id: a6976974-ea6f-4e97-818e-ea08625c52cb
status: test
description: |
    Detects a phishing attack which expands a ZIP file containing a malicious shortcut.
    If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder.
    Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
references:
    - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19
author: Greg (rule)
date: 2022-07-21
modified: 2023-01-05
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547
logsource:
    category: file_event
    product: windows
detection:
    selection: # %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\target.lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}\target.lnk
        TargetFilename|contains|all:
            - '\Microsoft\Windows\Start Menu\Programs\Startup'
            - '.lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}'
        Image|endswith: '\explorer.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential RjvPlatform.DLL Sideloading From Non-Default Location
id: 0e0bc253-07ed-43f1-816d-e1b220fe8971
status: test
description: Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
references:
    - https://twitter.com/0gtweet/status/1666716511988330499
author: X__Junior (Nextron Systems)
date: 2023-06-09
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\RjvPlatform.dll'
        Image: '\SystemResetPlatform.exe'
    filter_main_legit_path:
        Image|startswith: 'C:\Windows\System32\SystemResetPlatform\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential Ryuk Ransomware Activity
id: c37510b8-2107-4b78-aa32-72f251e7a844
related:
    - id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
      type: similar
    - id: 0acaad27-9f02-4136-a243-c357202edd74
      type: obsolete
status: stable
description: Detects Ryuk ransomware activity
references:
    - https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
    - https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/
author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)
date: 2019-12-16
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_reg:
        CommandLine|contains|all:
            - 'Microsoft\Windows\CurrentVersion\Run'
            - 'C:\users\Public\'
    selection_del:
        CommandLine|contains|all:
            - 'del /s /f /q c:\'
            - '\*.bac'
            - '\*.bak'
            - '\*.bkf'
    selection_net:
        Image|endswith:
            - '\net.exe'
            - '\net1.exe'
        CommandLine|contains|all:
            - ' stop '
            - ' /y'
        CommandLine|contains:
            - 'samss'
            - 'audioendpointbuilder'
            - 'unistoresvc_'
            - 'AcrSch2Svc'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential SAM Database Dump
id: 4e87b8e2-2ee9-4b2a-a715-4727d297ece0
status: test
description: Detects the creation of files that look like exports of the local SAM (Security Account Manager)
references:
    - https://github.com/search?q=CVE-2021-36934
    - https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934
    - https://www.google.com/search?q=%22reg.exe+save%22+sam
    - https://github.com/HuskyHacks/ShadowSteal
    - https://github.com/FireFart/hivenightmare
author: Florian Roth (Nextron Systems)
date: 2022-02-11
modified: 2023-01-05
tags:
    - attack.credential-access
    - attack.t1003.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        - TargetFilename|endswith:
              - '\Temp\sam'
              - '\sam.sav'
              - '\Intel\sam'
              - '\sam.hive'
              - '\Perflogs\sam'
              - '\ProgramData\sam'
              - '\Users\Public\sam'
              - '\AppData\Local\sam'
              - '\AppData\Roaming\sam'
              - '_ShadowSteal.zip'       # https://github.com/HuskyHacks/ShadowSteal
              - '\Documents\SAM.export'  # https://github.com/n3tsurge/CVE-2021-36934/
              - ':\sam'
        - TargetFilename|contains:
              - '\hive_sam_'             # https://github.com/FireFart/hivenightmare
              - '\sam.save'
              - '\sam.export'
              - '\~reg_sam.save'
              - '\sam_backup'
              - '\sam.bck'
              - '\sam.backup'
    condition: selection
falsepositives:
    - Rare cases of administrative activity
level: high

title: Potential SNAKE Malware Installation CLI Arguments Indicator
id: 02cbc035-b390-49fe-a9ff-3bb402c826db
status: test
description: Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # This CLI regex is based on the following description from the report:
        #   The jpsetup.exe installer requires two arguments to be passed via the command line for execution
        #   The first argument is a wide character string hashed with SHA-256 twice -> We assume that the first argument is of length SHA256
        #   The AES initialization vector (IV) consists of the first 16 bytes of the second argument to jpsetup.exe -> We assume that the second argument is of at least 16 bytes (16 characters)
        CommandLine|re: '\s[a-fA-F0-9]{64}\s[a-fA-F0-9]{16}'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential SNAKE Malware Persistence Service Execution
id: f7536642-4a08-4dd9-b6d5-c3286d8975ed
status: test
description: Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\services.exe'
        Image|startswith: 'C:\Windows\WinSxS\'
        Image|endswith: '\WerFault.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators
id: 7477881c-ec3b-49d6-aced-7255944e5c59
status: experimental
description: |
    Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities.
    CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.
references:
    - https://research.eye.security/sharepoint-under-siege/
    - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-07-21
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2025-53770
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        ParentImage|endswith: '\w3wp.exe'
    selection_encoded_aspx:
        - CommandLine|wide|base64offset|contains: 'spinstall0.aspx'
        - CommandLine|base64|contains: 'spinstall0.aspx'
    selection_encoded_path:
        CommandLine|wide|base64offset|contains:
            - ':\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\15\TEMPLATE\LAYOUTS'
            - ':\PROGRA~1\COMMON~1\MICROS~1\WEBSER~1\16\TEMPLATE\LAYOUTS'
            - ':\Program Files\Common Files\Microsoft Shared\Web Server Extensions\15\TEMPLATE\LAYOUTS'
            - ':\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS'
    selection_ioc:
        CommandLine|contains:
            - '-EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0'
            - 'TEMPLATE\LAYOUTS\spinstall0.aspx'
    condition: (selection_img and 1 of selection_encoded_*) or selection_ioc
falsepositives:
    - Unknown
level: high

title: Potential Signing Bypass Via Windows Developer Features - Registry
id: b110ebaf-697f-4da1-afd5-b536fa27a2c1
related:
    - id: a383dec4-deec-4e6e-913b-ed9249670848
      type: similar
status: test
description: Detects when the enablement of developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.
references:
    - https://twitter.com/malmoeb/status/1560536653709598721
    - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-12
modified: 2023-08-17
tags:
    - attack.stealth
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Microsoft\Windows\CurrentVersion\AppModelUnlock'
            - '\Policies\Microsoft\Windows\Appx\'
        TargetObject|endswith:
            - '\AllowAllTrustedApps'
            - '\AllowDevelopmentWithoutDevLicense'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential SmadHook.DLL Sideloading
id: 24b6cf51-6122-469e-861a-22974e9c1e5b
status: test
description: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus
references:
    - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/
    - https://www.qurium.org/alerts/targeted-malware-against-crph/
author: X__Junior (Nextron Systems)
date: 2023-06-01
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\SmadHook32c.dll'
            - '\SmadHook64c.dll'
    filter_main_legit_path:
        Image:
            - 'C:\Program Files (x86)\SMADAV\SmadavProtect32.exe'
            - 'C:\Program Files (x86)\SMADAV\SmadavProtect64.exe'
            - 'C:\Program Files\SMADAV\SmadavProtect32.exe'
            - 'C:\Program Files\SMADAV\SmadavProtect64.exe'
        ImageLoaded|startswith:
            - 'C:\Program Files (x86)\SMADAV\'
            - 'C:\Program Files\SMADAV\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential Snatch Ransomware Activity
id: 5325945e-f1f0-406e-97b8-65104d393fff
status: stable
description: Detects specific process characteristics of Snatch ransomware word document droppers
references:
    - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
author: Florian Roth (Nextron Systems)
date: 2020-08-26
modified: 2025-10-19
tags:
    - attack.execution
    - attack.t1204
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|re: 'shutdown\s+/r /f /t 00' # Shutdown in safe mode immediately
        - CommandLine|re: 'net\s+stop SuperBackupMan'
    condition: selection
falsepositives:
    - Scripts that shutdown the system immediately and reboot them in safe mode are unlikely
level: high

title: Potential Startup Shortcut Persistence Via PowerShell.EXE
id: 92fa78e7-4d39-45f1-91a3-8b23f3f1088d
status: test
description: |
    Detects PowerShell writing startup shortcuts.
    This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
    Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
    In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"
references:
    - https://redcanary.com/blog/intelligence-insights-october-2021/
    - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder
author: Christopher Peacock '@securepeacock', SCYTHE
date: 2021-10-24
modified: 2023-02-23
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        TargetFilename|contains: '\start menu\programs\startup\'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Depending on your environment accepted applications may leverage this at times. It is recommended to search for anomalies inidicative of malware.
level: high

title: Potential Suspicious Child Process Of 3CXDesktopApp
id: 63f3605b-979f-48c2-b7cc-7f90523fed88
related:
    - id: 3c4b3bbf-36b4-470c-b6cf-f07e8b1c7e26 # Proxy C2
      type: similar
    - id: 76bc1601-9546-4b75-9419-06e0e8d10651 # Proxy GH
      type: similar
    - id: bd03a0dc-5d93-49eb-b2e8-2dfd268600f8 # DNS C2
      type: similar
    - id: 51eecf75-d069-43c7-9ea2-63f75499edd4 # net_connection C2
      type: similar
    - id: 93bbde78-dc86-4e73-9ffc-ff8a384ca89c # ProcCreation Exec
      type: similar
    - id: e7581747-1e44-4d4b-85a6-0db0b4a00f2a # ProcCreation Update
      type: similar
    - id: d0b65ad3-e945-435e-a7a9-438e62dd48e9 # ImageLoad
      type: similar
status: test
description: Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise
references:
    - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
    - https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-29
tags:
    - attack.command-and-control
    - attack.execution
    - attack.stealth
    - attack.t1218
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\3CXDesktopApp.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential SysInternals ProcDump Evasion
id: 79b06761-465f-4f88-9ef2-150e24d3d737
status: test
description: Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name
references:
    - https://twitter.com/mrd0x/status/1480785527901204481
author: Florian Roth (Nextron Systems)
date: 2022-01-11
modified: 2023-05-09
tags:
    - attack.stealth
    - attack.t1036
    - attack.t1003.001
    - attack.credential-access
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        CommandLine|contains:
            - 'copy procdump'
            - 'move procdump'
    selection_2:
        CommandLine|contains|all:
            - 'copy '
            - '.dmp '
        CommandLine|contains:
            - '2.dmp'
            - 'lsass'
            - 'out.dmp'
    selection_3:
        CommandLine|contains:
            - 'copy lsass.exe_'  # procdump default pattern e.g. lsass.exe_220111_085234.dmp
            - 'move lsass.exe_'  # procdump default pattern e.g. lsass.exe_220111_085234.dmp
    condition: 1 of selection_*
falsepositives:
    - False positives are expected in cases in which ProcDump just gets copied to a different directory without any renaming
level: high

title: Potential System DLL Sideloading From Non System Locations
id: 4fc0deee-0057-4998-ab31-d24e46e0aba4
status: test
description: Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
references:
    - https://hijacklibs.net/ # For list of DLLs that could be sideloaded (search for dlls mentioned here in there). Wietze Beukema (project and research)
    - https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/ # WindowsCodecs.dll
    - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/ # iphlpapi.dll
    - https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md # XForceIR (SideLoadHunter Project), Chris Spehn (research WFH Dridex)
    - https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-14
modified: 2025-12-03
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\aclui.dll'
            - '\activeds.dll'
            - '\adsldpc.dll'
            - '\aepic.dll'
            - '\apphelp.dll'
            - '\applicationframe.dll'
            - '\appvpolicy.dll'
            - '\appxalluserstore.dll'
            - '\appxdeploymentclient.dll'
            - '\archiveint.dll'
            - '\atl.dll'
            - '\audioses.dll'
            - '\auditpolcore.dll'
            - '\authfwcfg.dll'
            - '\authz.dll'
            - '\avrt.dll'
            - '\batmeter.dll'
            - '\bcd.dll'
            - '\bcp47langs.dll'
            - '\bcp47mrm.dll'
            - '\bcrypt.dll'
            - '\bderepair.dll'
            - '\bootmenuux.dll'
            - '\bootux.dll'
            - '\cabinet.dll'
            - '\cabview.dll'
            - '\certcli.dll'
            - '\certenroll.dll'
            - '\cfgmgr32.dll'
            - '\cldapi.dll'
            - '\clipc.dll'
            - '\clusapi.dll'
            - '\cmpbk32.dll'
            - '\cmutil.dll'
            - '\coloradapterclient.dll'
            - '\colorui.dll'
            - '\comdlg32.dll'
            - '\configmanager2.dll'
            - '\connect.dll'
            - '\coredplus.dll'
            - '\coremessaging.dll'
            - '\coreuicomponents.dll'
            - '\credui.dll'
            - '\cryptbase.dll'
            - '\cryptdll.dll'
            - '\cryptsp.dll'
            - '\cryptui.dll'
            - '\cryptxml.dll'
            - '\cscapi.dll'
            - '\cscobj.dll'
            - '\cscui.dll'
            - '\d2d1.dll'
            - '\d3d10_1.dll'
            - '\d3d10_1core.dll'
            - '\d3d10.dll'
            - '\d3d10core.dll'
            - '\d3d10warp.dll'
            - '\d3d11.dll'
            - '\d3d12.dll'
            - '\d3d9.dll'
            - '\d3dx9_43.dll'
            - '\dataexchange.dll'
            - '\davclnt.dll'
            - '\dcntel.dll'
            - '\dcomp.dll'
            - '\defragproxy.dll'
            - '\desktopshellext.dll'
            - '\deviceassociation.dll'
            - '\devicecredential.dll'
            - '\devicepairing.dll'
            - '\devobj.dll'
            - '\devrtl.dll'
            - '\dhcpcmonitor.dll'
            - '\dhcpcsvc.dll'
            - '\dhcpcsvc6.dll'
            - '\directmanipulation.dll'
            - '\dismapi.dll'
            - '\dismcore.dll'
            - '\dmcfgutils.dll'
            - '\dmcmnutils.dll'
            - '\dmcommandlineutils.dll'
            - '\dmenrollengine.dll'
            - '\dmenterprisediagnostics.dll'
            - '\dmiso8601utils.dll'
            - '\dmoleaututils.dll'
            - '\dmprocessxmlfiltered.dll'
            - '\dmpushproxy.dll'
            - '\dmxmlhelputils.dll'
            - '\dnsapi.dll'
            - '\dot3api.dll'
            - '\dot3cfg.dll'
            - '\dpx.dll'
            - '\drprov.dll'
            - '\drvstore.dll'
            - '\dsclient.dll'
            - '\dsparse.dll'
            - '\dsprop.dll'
            - '\dsreg.dll'
            - '\dsrole.dll'
            - '\dui70.dll'
            - '\duser.dll'
            - '\dusmapi.dll'
            - '\dwmapi.dll'
            - '\dwmcore.dll'
            - '\dwrite.dll'
            - '\dxcore.dll'
            - '\dxgi.dll'
            - '\dxva2.dll'
            - '\dynamoapi.dll'
            - '\eappcfg.dll'
            - '\eappprxy.dll'
            - '\edgeiso.dll'
            - '\edputil.dll'
            - '\efsadu.dll'
            - '\efsutil.dll'
            - '\esent.dll'
            - '\execmodelproxy.dll'
            - '\explorerframe.dll'
            - '\fastprox.dll'
            - '\faultrep.dll'
            - '\fddevquery.dll'
            - '\feclient.dll'
            - '\fhcfg.dll'
            - '\fhsvcctl.dll'
            - '\firewallapi.dll'
            - '\flightsettings.dll'
            - '\fltlib.dll'
            - '\framedynos.dll'
            - '\fveapi.dll'
            - '\fveskybackup.dll'
            - '\fvewiz.dll'
            - '\fwbase.dll'
            - '\fwcfg.dll'
            - '\fwpolicyiomgr.dll'
            - '\fwpuclnt.dll'
            - '\fxsapi.dll'
            - '\fxsst.dll'
            - '\fxstiff.dll'
            - '\getuname.dll'
            - '\gpapi.dll'
            - '\hid.dll'
            - '\hnetmon.dll'
            - '\httpapi.dll'
            - '\icmp.dll'
            - '\idstore.dll'
            - '\ieadvpack.dll'
            - '\iedkcs32.dll'
            - '\iernonce.dll'
            - '\iertutil.dll'
            - '\ifmon.dll'
            - '\ifsutil.dll'
            - '\inproclogger.dll'
            - '\iphlpapi.dll'
            - '\iri.dll'
            - '\iscsidsc.dll'
            - '\iscsium.dll'
            - '\isv.exe_rsaenh.dll'
            - '\iumbase.dll'
            - '\iumsdk.dll'
            - '\joinutil.dll'
            - '\kdstub.dll'
            - '\ksuser.dll'
            - '\ktmw32.dll'
            - '\licensemanagerapi.dll'
            - '\licensingdiagspp.dll'
            - '\linkinfo.dll'
            - '\loadperf.dll'
            - '\lockhostingframework.dll'
            - '\logoncli.dll'
            - '\logoncontroller.dll'
            - '\lpksetupproxyserv.dll'
            - '\lrwizdll.dll'
            - '\magnification.dll'
            - '\maintenanceui.dll'
            - '\mapistub.dll'
            - '\mbaexmlparser.dll'
            - '\mdmdiagnostics.dll'
            - '\mfc42u.dll'
            - '\mfcore.dll'
            - '\mfplat.dll'
            - '\mi.dll'
            - '\midimap.dll'
            - '\mintdh.dll'
            - '\miutils.dll'
            - '\mlang.dll'
            - '\mmdevapi.dll'
            - '\mobilenetworking.dll'
            - '\mpr.dll'
            - '\mprapi.dll'
            - '\mrmcorer.dll'
            - '\msacm32.dll'
            - '\mscms.dll'
            - '\mscoree.dll'
            - '\msctf.dll'
            - '\msctfmonitor.dll'
            - '\msdrm.dll'
            - '\msdtctm.dll'
            - '\msftedit.dll'
            - '\msi.dll'
            - '\msiso.dll'
            - '\msutb.dll'
            - '\msvcp110_win.dll'
            - '\mswb7.dll'
            - '\mswsock.dll'
            - '\msxml3.dll'
            - '\mtxclu.dll'
            - '\napinsp.dll'
            - '\ncrypt.dll'
            - '\ndfapi.dll'
            - '\netapi32.dll'
            - '\netid.dll'
            - '\netiohlp.dll'
            - '\netjoin.dll'
            - '\netplwiz.dll'
            - '\netprofm.dll'
            - '\netprovfw.dll'
            - '\netsetupapi.dll'
            - '\netshell.dll'
            - '\nettrace.dll'
            - '\netutils.dll'
            - '\networkexplorer.dll'
            - '\newdev.dll'
            - '\ninput.dll'
            - '\nlaapi.dll'
            - '\nlansp_c.dll'
            - '\npmproxy.dll'
            - '\nshhttp.dll'
            - '\nshipsec.dll'
            - '\nshwfp.dll'
            - '\ntdsapi.dll'
            - '\ntlanman.dll'
            - '\ntlmshared.dll'
            - '\ntmarta.dll'
            - '\ntshrui.dll'
            - '\oleacc.dll'
            - '\omadmapi.dll'
            - '\onex.dll'
            - '\opcservices.dll'
            - '\osbaseln.dll'
            - '\osksupport.dll'
            - '\osuninst.dll'
            - '\p2p.dll'
            - '\p2pnetsh.dll'
            - '\p9np.dll'
            - '\pcaui.dll'
            - '\pdh.dll'
            - '\peerdistsh.dll'
            - '\pkeyhelper.dll'
            - '\pla.dll'
            - '\playsndsrv.dll'
            - '\pnrpnsp.dll'
            - '\policymanager.dll'
            - '\polstore.dll'
            - '\powrprof.dll'
            - '\printui.dll'
            - '\prntvpt.dll'
            - '\profapi.dll'
            - '\propsys.dll'
            - '\proximitycommon.dll'
            - '\proximityservicepal.dll'
            - '\prvdmofcomp.dll'
            - '\puiapi.dll'
            - '\radcui.dll'
            - '\rasapi32.dll'
            - '\rasdlg.dll'
            - '\rasgcw.dll'
            - '\rasman.dll'
            - '\rasmontr.dll'
            - '\reagent.dll'
            - '\regapi.dll'
            - '\reseteng.dll'
            - '\resetengine.dll'
            - '\resutils.dll'
            - '\rmclient.dll'
            - '\rpcnsh.dll'
            - '\rsaenh.dll'
            - '\rtutils.dll'
            - '\rtworkq.dll'
            - '\samcli.dll'
            - '\samlib.dll'
            - '\sapi_onecore.dll'
            - '\sas.dll'
            - '\scansetting.dll'
            - '\scecli.dll'
            - '\schedcli.dll'
            - '\secur32.dll'
            - '\security.dll'
            - '\sensapi.dll'
            - '\shell32.dll'
            - '\shfolder.dll'
            - '\slc.dll'
            - '\snmpapi.dll'
            - '\spectrumsyncclient.dll'
            - '\spp.dll'
            - '\sppc.dll'
            - '\sppcext.dll'
            - '\srclient.dll'
            - '\srcore.dll'
            - '\srmtrace.dll'
            - '\srpapi.dll'
            - '\srvcli.dll'
            - '\ssp_isv.exe_rsaenh.dll'
            - '\ssp.exe_rsaenh.dll'
            - '\sspicli.dll'
            - '\ssshim.dll'
            - '\staterepository.core.dll'
            - '\structuredquery.dll'
            - '\sxshared.dll'
            - '\systemsettingsthresholdadminflowui.dll'
            - '\tapi32.dll'
            - '\tbs.dll'
            - '\tdh.dll'
            - '\textshaping.dll'
            - '\timesync.dll'
            - '\tpmcoreprovisioning.dll'
            - '\tquery.dll'
            - '\tsworkspace.dll'
            - '\ttdrecord.dll'
            - '\twext.dll'
            - '\twinapi.dll'
            - '\twinui.appcore.dll'
            - '\uianimation.dll'
            - '\uiautomationcore.dll'
            - '\uireng.dll'
            - '\uiribbon.dll'
            - '\umpdc.dll'
            - '\unattend.dll'
            - '\updatepolicy.dll'
            - '\upshared.dll'
            - '\urlmon.dll'
            - '\userenv.dll'
            - '\utildll.dll'
            - '\uxinit.dll'
            - '\uxtheme.dll'
            - '\vaultcli.dll'
            - '\vdsutil.dll'
            - '\version.dll'
            - '\virtdisk.dll'
            - '\vssapi.dll'
            - '\vsstrace.dll'
            - '\wbemprox.dll'
            - '\wbemsvc.dll'
            - '\wcmapi.dll'
            - '\wcnnetsh.dll'
            - '\wdi.dll'
            - '\wdscore.dll'
            - '\webservices.dll'
            - '\wecapi.dll'
            - '\wer.dll'
            - '\wevtapi.dll'
            - '\whhelper.dll'
            - '\wimgapi.dll'
            - '\winbio.dll'
            - '\winbrand.dll'
            - '\windows.storage.dll'
            - '\windows.storage.search.dll'
            - '\windows.ui.immersive.dll'
            - '\windowscodecs.dll'
            - '\windowscodecsext.dll'
            - '\windowsudk.shellcommon.dll'
            - '\winhttp.dll'
            - '\wininet.dll'
            - '\winipsec.dll'
            - '\winmde.dll'
            - '\winmm.dll'
            - '\winnsi.dll'
            - '\winrnr.dll'
            - '\winscard.dll'
            - '\winsqlite3.dll'
            - '\winsta.dll'
            - '\winsync.dll'
            - '\wkscli.dll'
            - '\wlanapi.dll'
            - '\wlancfg.dll'
            - '\wldp.dll'
            - '\wlidprov.dll'
            - '\wmiclnt.dll'
            - '\wmidcom.dll'
            - '\wmiutils.dll'
            - '\wmpdui.dll'
            - '\wmsgapi.dll'
            - '\wofutil.dll'
            - '\wpdshext.dll'
            - '\wscapi.dll'
            - '\wsdapi.dll'
            - '\wshbth.dll'
            - '\wshelper.dll'
            - '\wsmsvc.dll'
            - '\wtsapi32.dll'
            - '\wwancfg.dll'
            - '\wwapi.dll'
            - '\xmllite.dll'
            - '\xolehlp.dll'
            - '\xpsservices.dll'
            - '\xwizards.dll'
            - '\xwtpw32.dll'
            # From https://github.com/XForceIR/SideLoadHunter/blob/main/SideLoads/README.md
            - '\amsi.dll'
            - '\appraiser.dll'
            - '\COMRES.DLL'
            - '\cryptnet.dll'
            - '\DispBroker.dll'
            - '\dsound.dll'
            - '\dxilconv.dll'
            - '\FxsCompose.dll'
            - '\FXSRESM.DLL'
            - '\msdtcVSp1res.dll'
            - '\PrintIsolationProxy.dll'
            - '\rdpendp.dll'
            - '\rpchttp.dll'
            - '\storageusage.dll'
            - '\utcutil.dll'
            - '\WfsR.dll'
            # The DLLs below exists in "C:\Windows\System32\DriverStore\FileRepository\" folder. But there is also a copy located in "C:\ProgramData\Package Cache\XXXXXXX\Graphics\". If you see them being loaded from there. Please comment them out, don't add a filter for ProgramData :)
            - '\igd10iumd64.dll'
            - '\igd12umd64.dll'
            - '\igdumdim64.dll'
            - '\igdusc64.dll'
            # Other
            - '\TSMSISrv.dll'
            - '\TSVIPSrv.dll'
            - '\wbemcomn.dll'
            - '\WLBSCTRL.dll'
            - '\wow64log.dll'
            - '\WptsExtensions.dll'
    filter_main_generic:
        # Note: this filter is generic on purpose to avoid insane amount of FP from legitimate third party applications. A better approach would be to baseline everything and add specific filters to avoid blind spots
        ImageLoaded|contains:
            - 'C:\$WINDOWS.~BT\'
            - 'C:\$WinREAgent\'
            - 'C:\Windows\SoftwareDistribution\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SystemTemp\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\SyChpe32\' # “hybrid” binaries containing x86-to-ARM stubs to improve the x86 emulation performance
    filter_main_windows_temp:
        ImageLoaded|startswith: 'C:\Windows\Temp\'
        Image|startswith:
            - 'C:\Windows\WinSxS\arm64'
            - 'C:\Windows\UUS\arm64\'
        Image|endswith:
            - '\TiWorker.exe'
            - '\wuaucltcore.exe'
    filter_main_dot_net:
        ImageLoaded|startswith: 'C:\Windows\Microsoft.NET\'
        ImageLoaded|endswith: '\cscui.dll'
    filter_main_defender:
        ImageLoaded|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
        ImageLoaded|endswith: '\version.dll'
    filter_main_directx:
        ImageLoaded|startswith: 'C:\Program Files\WindowsApps\Microsoft.DirectXRuntime_'
        ImageLoaded|endswith: '\d3dx9_43.dll'
    filter_optional_exchange:
        ImageLoaded|startswith: 'C:\Program Files\Microsoft\Exchange Server\'
        ImageLoaded|endswith: '\mswb7.dll'
    filter_optional_arsenal_image_mounter:
        ImageLoaded|startswith: 'C:\Program Files\Arsenal-Image-Mounter-'
        ImageLoaded|endswith:
            - '\mi.dll'
            - '\miutils.dl'
    filter_optional_office_appvpolicy:
        Image: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe'
        ImageLoaded: 'C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll'
    filter_optional_azure:
        ImageLoaded|startswith: 'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
    filter_optional_dell:
        Image|contains:
            - 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
            - 'C:\Windows\System32\backgroundTaskHost.exe'
        ImageLoaded|startswith: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
    filter_optional_dell_wldp:
        Image|startswith: 'C:\Program Files\WindowsApps\DellInc.DellSupportAssistforPCs'
        Image|endswith: '\wldp.dll'
    filter_optional_checkpoint:
        Image|startswith:
            - 'C:\Program Files\CheckPoint\'
            - 'C:\Program Files (x86)\CheckPoint\'
        Image|endswith: '\SmartConsole.exe'
        ImageLoaded|startswith:
            - 'C:\Program Files\CheckPoint\'
            - 'C:\Program Files (x86)\CheckPoint\'
        ImageLoaded|endswith: '\PolicyManager.dll'
    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - Legitimate applications loading their own versions of the DLLs mentioned in this rule
level: high

title: Potential Tampering With Security Products Via WMIC
id: 847d5ff3-8a31-4737-a970-aeae8fe21765
related:
    - id: b53317a0-8acf-4fd1-8de8-a5401e776b96 # Generic Uninstall
      type: derived
status: test
description: Detects uninstallation or termination of security products using the WMIC utility
references:
    - https://twitter.com/cglyer/status/1355171195654709249
    - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
    - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
    - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
    - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-01-30
modified: 2023-02-14
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection_cli_1:
        CommandLine|contains|all:
            - 'wmic'
            - 'product where '
            - 'call'
            - 'uninstall'
            - '/nointeractive'
    selection_cli_2:
        CommandLine|contains|all:
            - 'wmic'
            - 'caption like '
        CommandLine|contains:
            - 'call delete'
            - 'call terminate'
    selection_cli_3:
        CommandLine|contains|all:
            - 'process '
            - 'where '
            - 'delete'
    selection_product:
        CommandLine|contains:
            - '%carbon%'
            - '%cylance%'
            - '%endpoint%'
            - '%eset%'
            - '%malware%'
            - '%Sophos%'
            - '%symantec%'
            - 'Antivirus'
            - 'AVG '
            - 'Carbon Black'
            - 'CarbonBlack'
            - 'Cb Defense Sensor 64-bit'
            - 'Crowdstrike Sensor'
            - 'Cylance '
            - 'Dell Threat Defense'
            - 'DLP Endpoint'
            - 'Endpoint Detection'
            - 'Endpoint Protection'
            - 'Endpoint Security'
            - 'Endpoint Sensor'
            - 'ESET File Security'
            - 'LogRhythm System Monitor Service'
            - 'Malwarebytes'
            - 'McAfee Agent'
            - 'Microsoft Security Client'
            - 'Sophos Anti-Virus'
            - 'Sophos AutoUpdate'
            - 'Sophos Credential Store'
            - 'Sophos Management Console'
            - 'Sophos Management Database'
            - 'Sophos Management Server'
            - 'Sophos Remote Management System'
            - 'Sophos Update Manager'
            - 'Threat Protection'
            - 'VirusScan'
            - 'Webroot SecureAnywhere'
            - 'Windows Defender'
    condition: 1 of selection_cli_* and selection_product
falsepositives:
    - Legitimate administration
level: high

title: Potential Ursnif Malware Activity - Registry
id: 21f17060-b282-4249-ade0-589ea3591558
status: test
description: Detects registry keys related to Ursnif malware.
references:
    - https://blog.yoroi.company/research/ursnif-long-live-the-steganography/
    - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
author: megan201296
date: 2019-02-13
modified: 2025-10-22
tags:
    - attack.persistence
    - attack.execution
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_add
detection:
    selection:
        TargetObject|endswith: '\Software\AppDataLow\Software\Microsoft\3A861D62-51E0-7C9D-AB0E-15700F2219A4'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Waveedit.DLL Sideloading
id: 71b31e99-9ad0-47d4-aeb5-c0ca3928eeeb
status: test
description: Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.
references:
    - https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html
author: X__Junior (Nextron Systems)
date: 2023-06-14
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\waveedit.dll'
    filter_main_legit_path:
        Image:
            - 'C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\waveedit.exe'
            - 'C:\Program Files\Nero\Nero Apps\Nero WaveEditor\waveedit.exe'
        ImageLoaded|startswith:
            - 'C:\Program Files (x86)\Nero\Nero Apps\Nero WaveEditor\'
            - 'C:\Program Files\Nero\Nero Apps\Nero WaveEditor\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential WerFault ReflectDebugger Registry Value Abuse
id: 0cf2e1c6-8d10-4273-8059-738778f981ad
related:
    - id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd
      type: derived
status: test
description: Detects potential WerFault "ReflectDebugger" registry value abuse for persistence.
references:
    - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
    - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
author: X__Junior
date: 2023-05-18
tags:
    - attack.stealth
    - attack.t1036.003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Windows\Windows Error Reporting\Hangs\ReflectDebugger'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential WinAPI Calls Via CommandLine
id: ba3f5c1b-6272-4119-9dbd-0bc8d21c2702
related:
    - id: 03d83090-8cba-44a0-b02f-0b756a050306
      type: derived
status: test
description: Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec
references:
    - https://twitter.com/m417z/status/1566674631788007425
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-06
modified: 2025-03-06
tags:
    - attack.execution
    - attack.t1106
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'AddSecurityPackage'
            - 'AdjustTokenPrivileges'
            - 'Advapi32'
            - 'CloseHandle'
            - 'CreateProcessWithToken'
            - 'CreatePseudoConsole'
            - 'CreateRemoteThread'
            - 'CreateThread'
            - 'CreateUserThread'
            - 'DangerousGetHandle'
            - 'DuplicateTokenEx'
            - 'EnumerateSecurityPackages'
            - 'FreeHGlobal'
            - 'FreeLibrary'
            - 'GetDelegateForFunctionPointer'
            - 'GetLogonSessionData'
            - 'GetModuleHandle'
            - 'GetProcAddress'
            - 'GetProcessHandle'
            - 'GetTokenInformation'
            - 'ImpersonateLoggedOnUser'
            - 'kernel32'
            - 'LoadLibrary'
            - 'memcpy'
            - 'MiniDumpWriteDump'
            # - 'msvcrt'
            - 'ntdll'
            - 'OpenDesktop'
            - 'OpenProcess'
            - 'OpenProcessToken'
            - 'OpenThreadToken'
            - 'OpenWindowStation'
            - 'PtrToString'
            - 'QueueUserApc'
            - 'ReadProcessMemory'
            - 'RevertToSelf'
            - 'RtlCreateUserThread'
            - 'secur32'
            - 'SetThreadToken'
            # - 'user32'
            - 'VirtualAlloc'
            - 'VirtualFree'
            - 'VirtualProtect'
            - 'WaitForSingleObject'
            - 'WriteInt32'
            - 'WriteProcessMemory'
            - 'ZeroFreeGlobalAllocUnicode'
    filter_optional_mpcmdrun:
        Image|endswith: '\MpCmdRun.exe'
        CommandLine|contains: 'GetLoadLibraryWAddress32'
    filter_optional_compatTelRunner:
        ParentImage|endswith: '\CompatTelRunner.exe'
        CommandLine|contains:
            - 'FreeHGlobal'
            - 'PtrToString'
            - 'kernel32'
            - 'CloseHandle'
    condition: selection and not 1 of filter_optional_*
falsepositives:
    - Some legitimate action or applications may use these functions. Investigate further to determine the legitimacy of the activity.
level: high

title: Potential Winnti Dropper Activity
id: 130c9e58-28ac-4f83-8574-0a4cc913b97e
status: test
description: Detects files dropped by Winnti as described in RedMimicry Winnti playbook
references:
    - https://redmimicry.com/posts/redmimicry-winnti/#dropper
author: Alexander Rausch
date: 2020-06-24
modified: 2023-01-05
tags:
    - attack.stealth
    - attack.t1027
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '\gthread-3.6.dll'
            - '\sigcmm-2.4.dll'
            - '\Windows\Temp\tmp.bat'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential WizardUpdate Malware Infection
id: f68c4a4f-19ef-4817-952c-50dce331f4b0
status: test
description: Detects the execution traces of the WizardUpdate malware. WizardUpdate is a macOS trojan that attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device.
references:
    - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97
    - https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset
    - https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/
author: Tim Rauch (rule), Elastic (idea)
date: 2022-10-17
tags:
    - attack.command-and-control
logsource:
    category: process_creation
    product: macos
detection:
    selection_1:
        Image|endswith: '/sh'
        CommandLine|contains|all:
            - '=$(curl '
            - 'eval'
    selection_2:
        Image|endswith: '/curl'
        CommandLine|contains: '_intermediate_agent_'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Potential appverifUI.DLL Sideloading
id: ee6cea48-c5b6-4304-a332-10fc6446f484
status: test
description: Detects potential DLL sideloading of "appverifUI.dll"
references:
    - https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
author: X__Junior (Nextron Systems)
date: 2023-06-20
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\appverifUI.dll'
    filter_main_legit_path:
        Image:
            - 'C:\Windows\SysWOW64\appverif.exe'
            - 'C:\Windows\System32\appverif.exe'
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 # Susp Paths
related:
    - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 # SuspChild
      type: similar
    - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 # TMP File
      type: similar
    - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 # Exec
      type: similar
status: test
description: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
    - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-14
modified: 2025-02-24
tags:
    - attack.execution
    - attack.stealth
    - attack.t1127
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|contains:
            - ':\Windows\Microsoft.NET\Framework\'
            - ':\Windows\Microsoft.NET\Framework64\'
            - ':\Windows\Microsoft.NET\FrameworkArm\'
            - ':\Windows\Microsoft.NET\FrameworkArm64\'
        Image|endswith: '\aspnet_compiler.exe'
        CommandLine|contains:
            # Note: add other potential suspicious paths
            - '\Users\Public\'
            - '\AppData\Local\Temp\'
            - '\AppData\Local\Roaming\'
            - ':\Temp\'
            - ':\Windows\Temp\'
            - ':\Windows\System32\Tasks\'
            - ':\Windows\Tasks\'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Call To Win32_NTEventlogFile Class
id: caf201a9-c2ce-4a26-9c3a-2b9525413711
related:
    - id: e2812b49-bae0-4b21-b366-7c142eafcde2
      type: similar
status: test
description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script
references:
    - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-07-13
tags:
    - attack.defense-impairment
logsource:
    category: process_creation
    product: windows
detection:
    selection_class:
        CommandLine|contains: 'Win32_NTEventlogFile'
    selection_function:
        CommandLine|contains:
            - '.BackupEventlog('
            - '.ChangeSecurityPermissions('
            - '.ChangeSecurityPermissionsEx('
            - '.ClearEventLog('
            - '.Delete('
            - '.DeleteEx('
            - '.Rename('
            - '.TakeOwnerShip('
            - '.TakeOwnerShipEx('
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Child Process Of Regsvr32
id: 6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca
related:
    - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d
      type: obsolete
status: test
description: Detects potentially suspicious child processes of "regsvr32.exe".
references:
    - https://redcanary.com/blog/intelligence-insights-april-2022/
    - https://www.echotrail.io/insights/search/regsvr32.exe
    - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo
author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-05-05
modified: 2023-05-26
tags:
    - attack.stealth
    - attack.t1218.010
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\regsvr32.exe'
        Image|endswith:
            - '\calc.exe'
            - '\cscript.exe'
            - '\explorer.exe'
            - '\mshta.exe'
            - '\net.exe'
            - '\net1.exe'
            - '\nltest.exe'
            - '\notepad.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\reg.exe'
            - '\schtasks.exe'
            - '\werfault.exe'
            - '\wscript.exe'
    filter_main_werfault:
        Image|endswith: '\werfault.exe'
        CommandLine|contains: ' -u -p '
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely, but can rarely occur. Apply additional filters accordingly.
level: high

title: Potentially Suspicious Command Executed Via Run Dialog Box - Registry
id: a7df0e9e-91a5-459a-a003-4cde67c2ff5d
related:
    - id: f9d091f6-f1c7-4873-a24f-050b4a02b4dd
      type: derived
status: test
description: |
    Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
    This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.
references:
    - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf
    - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
    - https://www.forensafe.com/blogs/runmrukey.html
    - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
author: Ahmed Farouk, Nasreddine Bencherchali
date: 2024-11-01
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: registry_set
detection:
    selection_key:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
    selection_powershell_command:
        Details|contains:
            - 'powershell'
            - 'pwsh'
    selection_powershell_susp_keywords:
        Details|contains:
            - ' -e '
            - ' -ec '
            - ' -en '
            - ' -enc '
            - ' -enco'
            - 'ftp'
            - 'Hidden'
            - 'http'
            - 'iex'
            - 'Invoke-'
    selection_wmic_command:
        Details|contains: 'wmic'
    selection_wmic_susp_keywords:
        Details|contains:
            - 'shadowcopy'
            - 'process call create'
    condition: selection_key and (all of selection_powershell_* or all of selection_wmic_*)
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Event Viewer Child Process
id: be344333-921d-4c4d-8bb8-e584cf584780
related:
    - id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
      type: derived
status: test
description: Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt
references:
    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
    - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
author: Florian Roth (Nextron Systems)
date: 2017-03-19
modified: 2023-09-28
tags:
    - attack.privilege-escalation
    - attack.t1548.002
    - car.2019-04-001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\eventvwr.exe'
    filter_main_generic:
        Image|endswith:
            - ':\Windows\System32\mmc.exe'
            - ':\Windows\System32\WerFault.exe'
            - ':\Windows\SysWOW64\WerFault.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious Execution From Parent Process In Public Folder
id: 69bd9b97-2be2-41b6-9816-fb08757a4d1a
status: test
description: |
    Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
references:
    - https://redcanary.com/blog/blackbyte-ransomware/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-02-25
modified: 2024-07-12
tags:
    - attack.execution
    - attack.stealth
    - attack.t1564
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains: ':\Users\Public\'
    selection_child:
        - Image|endswith:
              - '\bitsadmin.exe'
              - '\certutil.exe'
              - '\cmd.exe'
              - '\cscript.exe'
              - '\mshta.exe'
              - '\powershell.exe'
              - '\pwsh.exe'
              - '\regsvr32.exe'
              - '\rundll32.exe'
              - '\wscript.exe'
        - CommandLine|contains:
              - 'bitsadmin'
              - 'certutil'
              - 'cscript'
              - 'mshta'
              - 'powershell'
              - 'regsvr32'
              - 'rundll32'
              - 'wscript'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Potentially Suspicious ODBC Driver Registered
id: e4d22291-f3d5-4b78-9a0c-a1fbaf32a6a4
status: test
description: Detects the registration of a new ODBC driver where the driver is located in a potentially suspicious location
references:
    - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-23
modified: 2023-08-17
tags:
    - attack.credential-access
    - attack.persistence
    - attack.t1003
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\ODBC\ODBCINST.INI\'
        TargetObject|endswith:
            - '\Driver'
            - '\Setup'
        Details|contains:
            - ':\PerfLogs\'
            - ':\ProgramData\'
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\Registration\CRMLog'
            - ':\Windows\System32\com\dmp\'
            - ':\Windows\System32\FxsTmp\'
            - ':\Windows\System32\Microsoft\Crypto\RSA\MachineKeys\'
            - ':\Windows\System32\spool\drivers\color\'
            - ':\Windows\System32\spool\PRINTERS\'
            - ':\Windows\System32\spool\SERVERS\'
            - ':\Windows\System32\Tasks_Migrated\'
            - ':\Windows\System32\Tasks\Microsoft\Windows\SyncCenter\'
            - ':\Windows\SysWOW64\com\dmp\'
            - ':\Windows\SysWOW64\FxsTmp\'
            - ':\Windows\SysWOW64\Tasks\Microsoft\Windows\PLA\System\'
            - ':\Windows\SysWOW64\Tasks\Microsoft\Windows\SyncCenter\'
            - ':\Windows\Tasks\'
            - ':\Windows\Temp\'
            - ':\Windows\Tracing\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    condition: selection
falsepositives:
    - Unlikely
level: high