Palo Alto Cortex XDR detection rules

high Strong High FP

Potential LSASS Process Dump Via Procdump

Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.

status stable author Florian Roth (Nextron Systems) ATT&CK sub-technique id 5afee48e-67dd-4e03-a783-f74259dcf998

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line contains " -ma " or 
 action_process_image_command_line contains " /ma " or 
 action_process_image_command_line contains " –ma " or 
 action_process_image_command_line contains " —ma " or 
 action_process_image_command_line contains " ―ma " or 
 action_process_image_command_line contains " -mm " or 
 action_process_image_command_line contains " /mm " or 
 action_process_image_command_line contains " –mm " or 
 action_process_image_command_line contains " —mm " or 
 action_process_image_command_line contains " ―mm " or 
 action_process_image_command_line contains " -mp " or 
 action_process_image_command_line contains " /mp " or 
 action_process_image_command_line contains " –mp " or 
 action_process_image_command_line contains " —mp " or 
 action_process_image_command_line contains " ―mp ") and 
 (action_process_image_command_line in ("* ls*", "* keyiso*", "* samss*"))))

view Sigma YAML

title: Potential LSASS Process Dump Via Procdump
id: 5afee48e-67dd-4e03-a783-f74259dcf998
status: stable
description: |
    Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
    This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
    LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
    Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
    - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
    - https://x.com/wietze/status/1958302556033065292?s=12
author: Florian Roth (Nextron Systems)
date: 2018-10-30
modified: 2025-10-19
tags:
    - attack.stealth
    - attack.t1036
    - attack.credential-access
    - attack.t1003.001
    - car.2013-05-009
logsource:
    category: process_creation
    product: windows
detection:
    selection_flags:
        CommandLine|contains|windash:
            - ' -ma '
            - ' -mm ' # Mini dump
            - ' -mp ' # Miniplus dump
    selection_process:
        CommandLine|contains:
            - ' ls' # Short for lsass
            - ' keyiso'
            - ' samss'
    condition: all of selection_*
falsepositives:
    - Unlikely, because no one should dump an lsass process memory
    - Another tool that uses command line flags similar to ProcDump
level: high

Convert to SIEM query

high Moderate Medium FP

Potential LethalHTA Technique Execution

Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

status test author Markus Neis ATT&CK sub-technique id ed5d72a6-f8f4-479d-ba79-02f6a80d7471

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\svchost.exe" and 
 action_process_image_path contains "\mshta.exe"))

view Sigma YAML

title: Potential LethalHTA Technique Execution
id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471
status: test
description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process
references:
    - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
author: Markus Neis
date: 2018-06-07
modified: 2023-02-07
tags:
    - attack.stealth
    - attack.t1218.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith: '\mshta.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential MSTSC Shadowing Activity

Detects RDP session hijacking by using MSTSC shadowing

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 6ba5a05f-b095-4f0a-8654-b825f4f16334

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_command_line contains "noconsentprompt" and 
 action_process_image_command_line contains "shadow:"))

view Sigma YAML

title: Potential MSTSC Shadowing Activity
id: 6ba5a05f-b095-4f0a-8654-b825f4f16334
status: test
description: Detects RDP session hijacking by using MSTSC shadowing
references:
    - https://twitter.com/kmkz_security/status/1220694202301976576
    - https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet
author: Florian Roth (Nextron Systems)
date: 2020-01-24
modified: 2023-02-05
tags:
    - attack.lateral-movement
    - attack.t1563.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'noconsentprompt'
            - 'shadow:'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong Medium FP

Potential Meterpreter/CobaltStrike Activity

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

status test author Teymur Kheirkhabarov, Ecco, Florian Roth ATT&CK sub-technique id 15619216-e993-4721-b590-4c520615a67d

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\services.exe" and 
 (((action_process_image_command_line contains "/c" and 
 action_process_image_command_line contains "echo" and 
 action_process_image_command_line contains "\pipe\") and 
 (action_process_image_command_line in ("*cmd*", "*%COMSPEC%*"))) or 
 (action_process_image_command_line contains "rundll32" and 
 action_process_image_command_line contains ".dll,a" and 
 action_process_image_command_line contains "/p:")) and 
 (not 
 action_process_image_command_line contains "MpCmdRun")))

view Sigma YAML

title: Potential Meterpreter/CobaltStrike Activity
id: 15619216-e993-4721-b590-4c520615a67d
status: test
description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
author: Teymur Kheirkhabarov, Ecco, Florian Roth
date: 2019-10-26
modified: 2023-02-05
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1134.001
    - attack.t1134.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        ParentImage|endswith: '\services.exe'
    selection_technique_1:
        # Examples:
        #   Meterpreter  getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
        #   CobaltStrike getsystem technique 1b (expanded env var): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
        #   CobaltStrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
        CommandLine|contains|all:
            - '/c'
            - 'echo'
            - '\pipe\'
        CommandLine|contains:
            - 'cmd'
            - '%COMSPEC%'
    selection_technique_2:
        # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
        CommandLine|contains|all:
            - 'rundll32'
            - '.dll,a'
            - '/p:'
    filter_defender:
        CommandLine|contains: 'MpCmdRun'
    condition: selection_img and 1 of selection_technique_* and not 1 of filter_*
falsepositives:
    - Commandlines containing components like cmd accidentally
    - Jobs and services started with cmd
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Mpclient.DLL Sideloading

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

status test author Bhabesh Raj ATT&CK sub-technique id 418dc89a-9808-4b87-b1d7-e5ae0cb6effc

cortex_xdr query

config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_module_path contains "\mpclient.dll" and 
 (actor_process_image_path in ("*\MpCmdRun.exe", "*\NisSrv.exe"))) and 
 (not 
 (actor_process_image_path in ("C:\Program Files (x86)\Windows Defender\*", "C:\Program Files\Microsoft Security Client\*", "C:\Program Files\Windows Defender\*", "C:\ProgramData\Microsoft\Windows Defender\Platform\*", "C:\Windows\WinSxS\*")))))

view Sigma YAML

title: Potential Mpclient.DLL Sideloading
id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
related:
    - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
      type: similar
status: test
description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
author: Bhabesh Raj
date: 2022-08-02
modified: 2023-08-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '\mpclient.dll'
        Image|endswith:
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
    filter_main_known_locations:
        Image|startswith:
            - 'C:\Program Files (x86)\Windows Defender\'
            - 'C:\Program Files\Microsoft Security Client\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate High FP

Potential Mpclient.DLL Sideloading Via Defender Binaries

Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

status test author Bhabesh Raj ATT&CK sub-technique id 7002aa10-b8d4-47ae-b5ba-51ab07e228b9

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_path in ("*\MpCmdRun.exe", "*\NisSrv.exe")) and 
 (not 
 (action_process_image_path in ("C:\Program Files (x86)\Windows Defender\*", "C:\Program Files\Microsoft Security Client\*", "C:\Program Files\Windows Defender\*", "C:\ProgramData\Microsoft\Windows Defender\Platform\*", "C:\Windows\WinSxS\*")))))

view Sigma YAML

title: Potential Mpclient.DLL Sideloading Via Defender Binaries
id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
related:
    - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
      type: similar
status: test
description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
author: Bhabesh Raj
date: 2022-08-01
modified: 2023-08-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
    filter_main_known_locations:
        Image|startswith:
            - 'C:\Program Files (x86)\Windows Defender\'
            - 'C:\Program Files\Microsoft Security Client\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate Medium FP

Potential MuddyWater APT Activity

Detects potential Muddywater APT activity

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 36222790-0d43-4fe8-86e4-674b27809543

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line contains "vbscript:Close(Execute(\"CreateObject(" and 
 action_process_image_command_line contains "powershell" and 
 action_process_image_command_line contains "-w 1 -exec Bypass" and 
 action_process_image_command_line contains "\ProgramData\") or 
 (action_process_image_command_line contains "Win32_OperatingSystem" and 
 action_process_image_command_line contains "Win32_NetworkAdapterConfiguration" and 
 action_process_image_command_line contains "root\SecurityCenter2" and 
 action_process_image_command_line contains "[System.Net.DNS]") or 
 (action_process_image_command_line contains "[Convert]::ToBase64String" and 
 action_process_image_command_line contains "[System.Text.Encoding]::UTF8.GetString]" and 
 action_process_image_command_line contains "GetResponse().GetResponseStream()" and 
 action_process_image_command_line contains "[System.Net.HttpWebRequest]::Create(" and 
 action_process_image_command_line contains "-bxor ")))

view Sigma YAML

title: Potential MuddyWater APT Activity
id: 36222790-0d43-4fe8-86e4-674b27809543
status: test
description: Detects potential Muddywater APT activity
references:
    - https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-10
tags:
    - attack.execution
    - attack.stealth
    - attack.g0069
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        CommandLine|contains|all:
            - 'vbscript:Close(Execute("CreateObject('
            - 'powershell'
            - '-w 1 -exec Bypass'
            - '\ProgramData\'
    selection_survey:
        CommandLine|contains|all:
            - 'Win32_OperatingSystem'
            - 'Win32_NetworkAdapterConfiguration'
            - 'root\SecurityCenter2'
            - '[System.Net.DNS]'
    selection_pwsh_backdoor:
        CommandLine|contains|all:
            - '[Convert]::ToBase64String'
            - '[System.Text.Encoding]::UTF8.GetString]'
            - 'GetResponse().GetResponseStream()'
            - '[System.Net.HttpWebRequest]::Create('
            - '-bxor '
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate High FP

Potential NetWire RAT Activity - Registry

Detects registry keys related to NetWire RAT

status test author Christopher Peacock ATT&CK technique id 1d218616-71b0-4c40-855b-9dbe75510f7f

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_CREATE_KEY) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\software\NetWire")

view Sigma YAML

title: Potential NetWire RAT Activity - Registry
id: 1d218616-71b0-4c40-855b-9dbe75510f7f
status: test
description: Detects registry keys related to NetWire RAT
references:
    - https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing
    - https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
    - https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/
    - https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line
    - https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/
author: Christopher Peacock
date: 2021-10-07
modified: 2025-11-03
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_add
detection:
    selection:
        # The configuration information is usually stored under HKCU:\Software\Netwire - RedCanary
        TargetObject|contains: '\software\NetWire'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong Medium FP

Potential Netcat Reverse Shell Execution

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

status test author @d4ns4n_, Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 7f734ed0-4f47-46c0-837f-6ee62505abd9

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 ((action_process_image_path in ("*/nc", "*/ncat")) and 
 (action_process_image_command_line in ("* -c *", "* -e *")) and 
 (action_process_image_command_line in ("* ash*", "* bash*", "* bsh*", "* csh*", "* ksh*", "* pdksh*", "* sh*", "* tcsh*", "*/bin/ash*", "*/bin/bash*", "*/bin/bsh*", "*/bin/csh*", "*/bin/ksh*", "*/bin/pdksh*", "*/bin/sh*", "*/bin/tcsh*", "*/bin/zsh*", "*$IFSash*", "*$IFSbash*", "*$IFSbsh*", "*$IFScsh*", "*$IFSksh*", "*$IFSpdksh*", "*$IFSsh*", "*$IFStcsh*", "*$IFSzsh*"))))

view Sigma YAML

title: Potential Netcat Reverse Shell Execution
id: 7f734ed0-4f47-46c0-837f-6ee62505abd9
status: test
description: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
    - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/
    - https://www.infosecademy.com/netcat-reverse-shells/
    - https://man7.org/linux/man-pages/man1/ncat.1.html
author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'
date: 2023-04-07
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_nc:
        Image|endswith:
            - '/nc'
            - '/ncat'
    selection_flags:
        CommandLine|contains:
            - ' -c '
            - ' -e '
    selection_shell:
        CommandLine|contains:
            - ' ash'
            - ' bash'
            - ' bsh'
            - ' csh'
            - ' ksh'
            - ' pdksh'
            - ' sh'
            - ' tcsh'
            - '/bin/ash'
            - '/bin/bash'
            - '/bin/bsh'
            - '/bin/csh'
            - '/bin/ksh'
            - '/bin/pdksh'
            - '/bin/sh'
            - '/bin/tcsh'
            - '/bin/zsh'
            - '$IFSash'
            - '$IFSbash'
            - '$IFSbsh'
            - '$IFScsh'
            - '$IFSksh'
            - '$IFSpdksh'
            - '$IFSsh'
            - '$IFStcsh'
            - '$IFSzsh'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Notepad++ CVE-2025-49144 Exploitation

Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.

status experimental author Swachchhanda Shrawan Poudel (Nextron Systems) ATT&CK sub-technique id 933f0bb5-0681-4fe7-8a17-4e6cccbaac44

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_path contains "\regsvr32.exe" and 
 action_process_image_command_line contains "regsvr32 /s" and 
 action_process_image_command_line contains "\contextMenu\NppShell.dll") and 
 (not 
 (action_process_image_path in ("C:\Windows\System32\regsvr32.exe", "C:\Windows\SysWOW64\regsvr32.exe")))))

view Sigma YAML

title: Potential Notepad++ CVE-2025-49144 Exploitation
id: 933f0bb5-0681-4fe7-8a17-4e6cccbaac44
status: experimental
description: |
    Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
    This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
    The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49144
    - https://x.com/NullSecurityX/status/1937444064867029179
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-26
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.008
    - cve.2025-49144
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\regsvr32.exe'
        CommandLine|startswith: 'regsvr32 /s'
        CommandLine|contains: '\contextMenu\NppShell.dll'
    filter_main_legit_regsvr32:
        Image:
            - 'C:\Windows\System32\regsvr32.exe'
            - 'C:\Windows\SysWOW64\regsvr32.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential PHP Reverse Shell

Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets. Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.

status test author @d4ns4n_ ATT&CK tactic-only id c6714a24-d7d5-4283-a36b-3ffd091d5f7e

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_process_image_path contains "/php" and 
 (action_process_image_command_line contains " -r " and 
 action_process_image_command_line contains "fsockopen") and 
 (action_process_image_command_line in ("*ash*", "*bash*", "*bsh*", "*csh*", "*ksh*", "*pdksh*", "*sh*", "*tcsh*", "*zsh*"))))

view Sigma YAML

title: Potential PHP Reverse Shell
id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e
status: test
description: |
    Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets.
    Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
author: '@d4ns4n_'
date: 2023-04-07
tags:
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|contains: '/php'
        CommandLine|contains|all:
            - ' -r '
            - 'fsockopen'
        CommandLine|contains:
            - 'ash'
            - 'bash'
            - 'bsh'
            - 'csh'
            - 'ksh'
            - 'pdksh'
            - 'sh'
            - 'tcsh'
            - 'zsh'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential PSFactoryBuffer COM Hijacking

Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.

status test author BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk ATT&CK sub-technique id 243380fa-11eb-4141-af92-e14925e77c1b

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)" and 
 (not 
 ((action_registry_value_name in ("%windir%\System32\ActXPrxy.dll", "C:\Windows\System32\ActXPrxy.dll")) or 
 (action_registry_data in ("%windir%\System32\ActXPrxy.dll", "C:\Windows\System32\ActXPrxy.dll"))))))

view Sigma YAML

title: Potential PSFactoryBuffer COM Hijacking
id: 243380fa-11eb-4141-af92-e14925e77c1b
status: test
description: Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
references:
    - https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
    - https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
    - https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
    - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html
author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
date: 2023-06-07
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'
    filter_main:
        Details:
            - '%windir%\System32\ActXPrxy.dll'
            - 'C:\Windows\System32\ActXPrxy.dll'
    condition: selection and not filter_main
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Perl Reverse Shell Execution

Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity

status test author @d4ns4n_, Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 259df6bc-003f-4306-9f54-4ff1a08fa38e

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 ((action_process_image_path contains "/perl" and 
 action_process_image_command_line contains " -e ") and 
 ((action_process_image_command_line contains "fdopen(" and 
 action_process_image_command_line contains "::Socket::INET") or 
 (action_process_image_command_line contains "Socket" and 
 action_process_image_command_line contains "connect" and 
 action_process_image_command_line contains "open" and 
 action_process_image_command_line contains "exec"))))

view Sigma YAML

title: Potential Perl Reverse Shell Execution
id: 259df6bc-003f-4306-9f54-4ff1a08fa38e
status: test
description: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'
date: 2023-04-07
tags:
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/perl'
        CommandLine|contains: ' -e '
    selection_content:
        - CommandLine|contains|all:
              - 'fdopen('
              - '::Socket::INET'
        - CommandLine|contains|all:
              - 'Socket'
              - 'connect'
              - 'open'
              - 'exec'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong High FP

Potential Persistence Via App Paths Default Property

Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application's executable file name to that file's fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis.

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 707e097c-e20f-4f67-8807-1f72ff4500d6

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths" and 
 (action_registry_key_name in ("*(Default)", "*Path")) and 
 ((action_registry_value_name in ("*\Users\Public*", "*\AppData\Local\Temp\*", "*\Windows\Temp\*", "*\Desktop\*", "*\Downloads\*", "*%temp%*", "*%tmp%*", "*iex*", "*Invoke-*", "*rundll32*", "*regsvr32*", "*mshta*", "*cscript*", "*wscript*", "*.bat*", "*.hta*", "*.dll*", "*.ps1*")) or 
 (action_registry_data in ("*\Users\Public*", "*\AppData\Local\Temp\*", "*\Windows\Temp\*", "*\Desktop\*", "*\Downloads\*", "*%temp%*", "*%tmp%*", "*iex*", "*Invoke-*", "*rundll32*", "*regsvr32*", "*mshta*", "*cscript*", "*wscript*", "*.bat*", "*.hta*", "*.dll*", "*.ps1*")))))

view Sigma YAML

title: Potential Persistence Via App Paths Default Property
id: 707e097c-e20f-4f67-8807-1f72ff4500d6
status: test
description: |
    Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence
    The entries found under App Paths are used primarily for the following purposes.
    First, to map an application's executable file name to that file's fully qualified path.
    Second, to prepend information to the PATH environment variable on a per-application, per-process basis.
references:
    - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
    - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-10
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.012
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths'
        TargetObject|endswith:
            - '(Default)'
            - 'Path'
        Details|contains:
            # Add more suspicious paths or binaries as you see fit.
            - '\Users\Public'
            - '\AppData\Local\Temp\'
            - '\Windows\Temp\'
            - '\Desktop\'
            - '\Downloads\'
            - '%temp%'
            - '%tmp%'
            - 'iex'
            - 'Invoke-'
            - 'rundll32'
            - 'regsvr32'
            - 'mshta'
            - 'cscript'
            - 'wscript'
            - '.bat'
            - '.hta'
            - '.dll'
            - '.ps1'
    condition: selection
falsepositives:
    - Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via AutodialDLL

Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id e6fe26ee-d063-4f5b-b007-39e90aaf50e3

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\Services\WinSock2\Parameters\AutodialDLL")

view Sigma YAML

title: Potential Persistence Via AutodialDLL
id: e6fe26ee-d063-4f5b-b007-39e90aaf50e3
status: test
description: Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library
references:
    - https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
    - https://persistence-info.github.io/Data/autodialdll.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-10
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\WinSock2\Parameters\AutodialDLL'
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via CHM Helper DLL

Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 976dd1f2-a484-45ec-aa1d-0e87e882262b

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name in ("*\Software\Microsoft\HtmlHelp Author\Location*", "*\Software\WOW6432Node\Microsoft\HtmlHelp Author\Location*")))

view Sigma YAML

title: Potential Persistence Via CHM Helper DLL
id: 976dd1f2-a484-45ec-aa1d-0e87e882262b
status: test
description: Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence
references:
    - https://persistence-info.github.io/Data/htmlhelpauthor.html
    - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\HtmlHelp Author\Location'
            - '\Software\WOW6432Node\Microsoft\HtmlHelp Author\Location'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via DLLPathOverride

Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id a1b1fd53-9c4a-444c-bae0-34a330fc7aa8

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\SYSTEM\CurrentControlSet\Control\ContentIndex\Language\" and 
 (action_registry_key_name in ("*\StemmerDLLPathOverride*", "*\WBDLLPathOverride*", "*\StemmerClass*", "*\WBreakerClass*"))))

view Sigma YAML

title: Potential Persistence Via DLLPathOverride
id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8
status: test
description: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process
references:
    - https://persistence-info.github.io/Data/naturallanguage6.html
    - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection_root:
        # The path can be for multiple languages
        # Example:  HKLM\System\CurrentControlSet\Control\ContentIndex\Language\English_UK
        #           HKLM\System\CurrentControlSet\Control\ContentIndex\Language\English_US
        #           HKLM\System\CurrentControlSet\Control\ContentIndex\Language\Neutral
        TargetObject|contains: '\SYSTEM\CurrentControlSet\Control\ContentIndex\Language\'
    selection_values:
        TargetObject|contains:
            - '\StemmerDLLPathOverride'
            - '\WBDLLPathOverride'
            - '\StemmerClass'
            - '\WBreakerClass'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Persistence Via Excel Add-in - Registry

Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.

status test author frack113 ATT&CK sub-technique id 961e33d1-4f86-4fcf-80ab-930a708b2f82

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "Software\Microsoft\Office\" and 
 action_registry_key_name contains "\Excel\Options" and 
 (action_registry_value_name contains "/R " or 
 action_registry_data contains "/R ") and 
 (action_registry_value_name contains ".xll" or 
 action_registry_data contains ".xll")))

view Sigma YAML

title: Potential Persistence Via Excel Add-in - Registry
id: 961e33d1-4f86-4fcf-80ab-930a708b2f82
status: test
description: Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
author: frack113
date: 2023-01-15
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.t1137.006
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'Software\Microsoft\Office\'
        TargetObject|endswith: '\Excel\Options'
        Details|startswith: '/R '
        Details|endswith: '.xll'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Persistence Via GlobalFlags

Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys

status test author Karneades, Jonhnathan Ribeiro, Florian Roth ATT&CK sub-technique id 36803969-5421-41ec-b92f-8500f79c23b0

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name contains "\Microsoft\Windows NT\CurrentVersion\" and 
 action_registry_key_name contains "\Image File Execution Options\" and 
 action_registry_key_name contains "\GlobalFlag") or 
 ((action_registry_key_name contains "\Microsoft\Windows NT\CurrentVersion\" and 
 action_registry_key_name contains "\SilentProcessExit\") and 
 (action_registry_key_name in ("*\ReportingMode*", "*\MonitorProcess*")))))

view Sigma YAML

title: Potential Persistence Via GlobalFlags
id: 36803969-5421-41ec-b92f-8500f79c23b0
related:
    - id: c81fe886-cac0-4913-a511-2822d72ff505
      type: obsolete
status: test
description: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
references:
    - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
    - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
author: Karneades, Jonhnathan Ribeiro, Florian Roth
date: 2018-04-11
modified: 2023-06-05
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.012
    - car.2013-01-002
logsource:
    category: registry_set
    product: windows
detection:
    selection_global_flag:
        TargetObject|contains|all:
            - '\Microsoft\Windows NT\CurrentVersion\'
            - '\Image File Execution Options\'
            - '\GlobalFlag'
    selection_silent_process:
        TargetObject|contains|all:
            - '\Microsoft\Windows NT\CurrentVersion\'
            - '\SilentProcessExit\'
        TargetObject|contains:
            - '\ReportingMode'
            - '\MonitorProcess'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via LSA Extensions

Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass. The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 41f6531d-af6e-4c6e-918f-b946f2b85a36

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions")

view Sigma YAML

title: Potential Persistence Via LSA Extensions
id: 41f6531d-af6e-4c6e-918f-b946f2b85a36
status: test
description: |
    Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass.
    The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
references:
    - https://persistence-info.github.io/Data/lsaaextension.html
    - https://twitter.com/0gtweet/status/1476286368385019906
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions'
    condition: selection
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via Logon Scripts - CommandLine

Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

status test author Tom Ueltschi (@c_APT_ure) ATT&CK sub-technique id 21d856f9-9281-4ded-9377-51a1a6e2a432

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_process_image_command_line contains "UserInitMprLogonScript")

view Sigma YAML

title: Potential Persistence Via Logon Scripts - CommandLine
id: 21d856f9-9281-4ded-9377-51a1a6e2a432
related:
    - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
      type: derived
status: test
description: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
references:
    - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
author: Tom Ueltschi (@c_APT_ure)
date: 2019-01-12
modified: 2023-06-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1037.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'UserInitMprLogonScript'
    condition: selection
falsepositives:
    - Legitimate addition of Logon Scripts via the command line by administrators or third party tools
level: high

Convert to SIEM query

high Strong Medium FP

Potential Persistence Via Microsoft Office Add-In

Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

status test author NVISO ATT&CK sub-technique id 8e1cb247-6cf6-42fa-b440-3f27d57e9936

cortex_xdr query

config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name contains "\Microsoft\Word\Startup\" and 
 action_file_name contains ".wll") or 
 (action_file_name contains "\Microsoft\Excel\Startup\" and 
 action_file_name contains ".xll") or 
 (action_file_name contains "Microsoft\Excel\XLSTART\" and 
 action_file_name contains ".xlam") or 
 (action_file_name contains "\Microsoft\Addins\" and 
 (action_file_name in ("*.xlam", "*.xla", "*.ppam")))))

view Sigma YAML

title: Potential Persistence Via Microsoft Office Add-In
id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936
status: test
description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
references:
    - Internal Research
    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
    - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
author: NVISO
date: 2020-05-11
modified: 2023-02-08
tags:
    - attack.persistence
    - attack.t1137.006
logsource:
    category: file_event
    product: windows
detection:
    selection_wlldropped:
        TargetFilename|contains: '\Microsoft\Word\Startup\'
        TargetFilename|endswith: '.wll'
    selection_xlldropped:
        TargetFilename|contains: '\Microsoft\Excel\Startup\'
        TargetFilename|endswith: '.xll'
    selection_xladropped:
        TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
        TargetFilename|endswith: '.xlam'
    selection_generic:
        TargetFilename|contains: '\Microsoft\Addins\'
        TargetFilename|endswith:
            - '.xlam'
            - '.xla'
            - '.ppam'
    condition: 1 of selection_*
falsepositives:
    - Legitimate add-ins
level: high

Convert to SIEM query

high Strong Medium FP

Potential Persistence Via Microsoft Office Startup Folder

Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

status test author Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 0e20c89d-2264-44ae-8238-aeeaba609ece

cortex_xdr query

config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((((action_file_name contains "\Microsoft\Word\STARTUP" or 
 (action_file_name contains "\Office" and 
 action_file_name contains "\Program Files" and 
 action_file_name contains "\STARTUP")) and 
 (action_file_name in ("*.doc", "*.docm", "*.docx", "*.dot", "*.dotm", "*.rtf"))) or 
 ((action_file_name contains "\Microsoft\Excel\XLSTART" or 
 (action_file_name contains "\Office" and 
 action_file_name contains "\Program Files" and 
 action_file_name contains "\XLSTART")) and 
 (action_file_name in ("*.xls", "*.xlsm", "*.xlsx", "*.xlt", "*.xltm")))) and 
 (not 
 (actor_process_image_path in ("*\WINWORD.exe", "*\EXCEL.exe")))))

view Sigma YAML

title: Potential Persistence Via Microsoft Office Startup Folder
id: 0e20c89d-2264-44ae-8238-aeeaba609ece
status: test
description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
references:
    - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
    - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-02
modified: 2023-06-22
tags:
    - attack.persistence
    - attack.t1137
logsource:
    category: file_event
    product: windows
detection:
    selection_word_paths:
        - TargetFilename|contains: '\Microsoft\Word\STARTUP'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\STARTUP'
    selection_word_extension:
        TargetFilename|endswith:
            - '.doc'
            - '.docm'
            - '.docx'
            - '.dot'
            - '.dotm'
            - '.rtf'
    selection_excel_paths:
        - TargetFilename|contains: '\Microsoft\Excel\XLSTART'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\XLSTART'
    selection_excel_extension:
        TargetFilename|endswith:
            - '.xls'
            - '.xlsm'
            - '.xlsx'
            - '.xlt'
            - '.xltm'
    filter_main_office:
        Image|endswith:
            - '\WINWORD.exe'
            - '\EXCEL.exe'
    condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office
falsepositives:
    - Loading a user environment from a backup or a domain controller
    - Synchronization of templates
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via Mpnotify

Detects when an attacker register a new SIP provider for persistence and defense evasion

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 92772523-d9c1-4c93-9547-b0ca500baba3

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify")

view Sigma YAML

title: Potential Persistence Via Mpnotify
id: 92772523-d9c1-4c93-9547-b0ca500baba3
status: test
description: Detects when an attacker register a new SIP provider for persistence and defense evasion
references:
    - https://persistence-info.github.io/Data/mpnotify.html
    - https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify'
    condition: selection
falsepositives:
    - Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way
level: high

Convert to SIEM query

high Strong Medium FP

Potential Persistence Via MyComputer Registry Keys

Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\Microsoft\Windows\CurrentVersion\Explorer\MyComputer" and 
 action_registry_key_name contains "(Default)"))

view Sigma YAML

title: Potential Persistence Via MyComputer Registry Keys
id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
status: test
description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
references:
    - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-09
modified: 2024-01-11
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\MyComputer'
        TargetObject|endswith: '(Default)'
    condition: selection
falsepositives:
    - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high

Convert to SIEM query

high Strong Medium FP

Potential Persistence Via Outlook Form

Detects the creation of a new Outlook form which can contain malicious code

status test author Tobias Michalski (Nextron Systems) ATT&CK sub-technique id c3edc6a5-d9d4-48d8-930e-aab518390917

cortex_xdr query

config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\outlook.exe" and 
 (action_file_name in ("*\AppData\Local\Microsoft\FORMS\IPM*", "*\Local Settings\Application Data\Microsoft\Forms*"))))

view Sigma YAML

title: Potential Persistence Via Outlook Form
id: c3edc6a5-d9d4-48d8-930e-aab518390917
status: test
description: Detects the creation of a new Outlook form which can contain malicious code
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
    - https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
    - https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/
author: Tobias Michalski (Nextron Systems)
date: 2021-06-10
modified: 2023-02-22
tags:
    - attack.persistence
    - attack.t1137.003
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\outlook.exe'
        TargetFilename|contains:
            - '\AppData\Local\Microsoft\FORMS\IPM'
            - '\Local Settings\Application Data\Microsoft\Forms' # Windows XP
    condition: selection
falsepositives:
    - Legitimate use of outlook forms
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via Outlook Home Page

Detects potential persistence activity via outlook home page. An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.

status test author Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand ATT&CK technique id ddd171b5-2cc6-4975-9e78-f0eccd08cc76

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name contains "\Software\Microsoft\Office\" and 
 action_registry_key_name contains "\Outlook\WebView\") and 
 action_registry_key_name contains "\URL"))

view Sigma YAML

title: Potential Persistence Via Outlook Home Page
id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
related:
    - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
      type: similar
status: test
description: |
    Detects potential persistence activity via outlook home page.
    An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70
    - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us
    - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
date: 2021-06-09
modified: 2024-08-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains|all:
            - '\Software\Microsoft\Office\'
            - '\Outlook\WebView\'
        TargetObject|endswith: '\URL'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting

Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 396ae3eb-4174-4b9b-880e-dc0364d78a19

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\Outlook\LoadMacroProviderOnBoot" and 
 (action_registry_value_name contains "0x00000001" or 
 action_registry_data contains "0x00000001")))

view Sigma YAML

title: Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
id: 396ae3eb-4174-4b9b-880e-dc0364d78a19
status: test
description: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
    - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2021-04-05
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.command-and-control
    - attack.t1137
    - attack.t1008
    - attack.t1546
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Outlook\LoadMacroProviderOnBoot'
        Details|contains: '0x00000001'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong Medium FP

Potential Persistence Via Outlook Today Page

Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".

status test author Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand ATT&CK technique id 487bb375-12ef-41f6-baae-c6a1572b4dd1

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name contains "Software\Microsoft\Office\" and 
 action_registry_key_name contains "\Outlook\Today\") and 
 ((action_registry_key_name contains "\Stamp" and 
 (action_registry_value_name = "DWORD (0x00000001)" or 
 action_registry_data = "DWORD (0x00000001)")) or 
 (action_registry_key_name in ("*\URL", "*\UserDefinedUrl"))) and 
 (not 
 ((actor_process_image_path in ("C:\Program Files\Common Files\Microsoft Shared\ClickToRun\*", "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\*")) and 
 actor_process_image_path contains "\OfficeClickToRun.exe"))))

view Sigma YAML

title: Potential Persistence Via Outlook Today Page
id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
related:
    - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
      type: similar
status: test
description: |
    Detects potential persistence activity via outlook today page.
    An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
    - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
date: 2021-06-10
modified: 2024-08-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection_main:
        TargetObject|contains|all:
            - 'Software\Microsoft\Office\'
            - '\Outlook\Today\'
    selection_value_stamp:
        TargetObject|endswith: '\Stamp'
        Details: 'DWORD (0x00000001)'
    selection_value_url:
        TargetObject|endswith:
            - '\URL'
            - '\UserDefinedUrl'
    filter_main_office:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
        Image|endswith: '\OfficeClickToRun.exe'
    condition: selection_main and 1 of selection_value_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via PlistBuddy

Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility

status test author Sohan G (D4rkCiph3r) ATT&CK sub-technique id 65d506d3-fcfe-4071-b4b2-bcefe721bbbb

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_MAC and 
 (action_process_image_path contains "/PlistBuddy" and 
 (action_process_image_command_line contains "RunAtLoad" and 
 action_process_image_command_line contains "true") and 
 (action_process_image_command_line in ("*LaunchAgents*", "*LaunchDaemons*"))))

view Sigma YAML

title: Potential Persistence Via PlistBuddy
id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb
status: test
description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
references:
    - https://redcanary.com/blog/clipping-silver-sparrows-wings/
    - https://www.manpagez.com/man/8/PlistBuddy/
author: Sohan G (D4rkCiph3r)
date: 2023-02-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1543.001
    - attack.t1543.004
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/PlistBuddy'
        CommandLine|contains|all:
            - 'RunAtLoad'
            - 'true'
        CommandLine|contains:
            - 'LaunchAgents'
            - 'LaunchDaemons'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via Powershell Search Order Hijacking - Task

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

status test author pH-T (Nextron Systems), Florian Roth (Nextron Systems) ATT&CK sub-technique id b66474aa-bd92-4333-a16c-298155b120df

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path = "C:\WINDOWS\System32\svchost.exe" and 
 (actor_process_command_line contains "-k netsvcs" and 
 actor_process_command_line contains "-s Schedule") and 
 (action_process_image_command_line in ("* -windowstyle hidden", "* -w hidden", "* -ep bypass", "* -noni"))))

view Sigma YAML

title: Potential Persistence Via Powershell Search Order Hijacking - Task
id: b66474aa-bd92-4333-a16c-298155b120df
related:
    - id: 6e8811ee-90ba-441e-8486-5653e68b2299
      type: similar
status: test
description: Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader
references:
    - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
author: pH-T (Nextron Systems), Florian Roth (Nextron Systems)
date: 2022-04-08
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage: 'C:\WINDOWS\System32\svchost.exe'
        ParentCommandLine|contains|all:
            - '-k netsvcs'
            - '-s Schedule'
        CommandLine|endswith:
            - ' -windowstyle hidden'
            - ' -w hidden'
            - ' -ep bypass'
            - ' -noni'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Persistence Via Shim Database In Uncommon Location

Detects the installation of a new shim database where the file is located in a non-default location

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 6b6976a3-b0e6-4723-ac24-ae38a737af41

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name contains "\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\" and 
 action_registry_key_name contains "\DatabasePath") and 
 (not 
 (action_registry_value_name contains ":\Windows\AppPatch\Custom" or 
 action_registry_data contains ":\Windows\AppPatch\Custom"))))

view Sigma YAML

title: Potential Persistence Via Shim Database In Uncommon Location
id: 6b6976a3-b0e6-4723-ac24-ae38a737af41
status: test
description: Detects the installation of a new shim database where the file is located in a non-default location
references:
    - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
    - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
    - https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-01
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.011
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains|all:
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\InstalledSDB\'
            - '\DatabasePath'
    filter_main_known_locations:
        Details|contains: ':\Windows\AppPatch\Custom'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Persistence Via TypedPaths

Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 086ae989-9ca6-4fe7-895a-759c5544f247

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\" and 
 (not 
 (actor_process_image_path in ("C:\Windows\explorer.exe", "C:\Windows\SysWOW64\explorer.exe")))))

view Sigma YAML

title: Potential Persistence Via TypedPaths
id: 086ae989-9ca6-4fe7-895a-759c5544f247
status: test
description: Detects modification addition to the 'TypedPaths' key in the user or admin registry from a non standard application. Which might indicate persistence attempt
references:
    - https://twitter.com/dez_/status/1560101453150257154
    - https://forensafe.com/blogs/typedpaths.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-22
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths\'
    filter:
        Image:
            - 'C:\Windows\explorer.exe'
            - 'C:\Windows\SysWOW64\explorer.exe'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong Medium FP

Potential Pikabot Hollowing Activity

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

status test author Andreas Braathen (mnemonic.io) ATT&CK sub-technique id d8937fe7-42d5-4b4d-8178-e089c908f63f

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path contains "\rundll32.exe" and 
 (action_process_image_path in ("*\SearchFilterHost.exe", "*\SearchProtocolHost.exe", "*\sndvol.exe", "*\wermgr.exe", "*\wwahost.exe"))) and 
 (not 
 (action_process_image_path contains "\sndvol.exe" and 
 actor_process_command_line contains "mmsys.cpl"))))

view Sigma YAML

title: Potential Pikabot Hollowing Activity
id: d8937fe7-42d5-4b4d-8178-e089c908f63f
status: test
description: |
    Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
    The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
references:
    - https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
    - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
    - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055.012
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith:
            # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
            - '\SearchFilterHost.exe'
            - '\SearchProtocolHost.exe'
            - '\sndvol.exe'
            - '\wermgr.exe'
            - '\wwahost.exe'
    filter_main_legit_sndvol:
        Image|endswith: '\sndvol.exe'
        ParentCommandLine|contains: 'mmsys.cpl'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong Medium FP

Potential PlugX Activity

Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id aeab5ec5-be14-471a-80e8-e344418305c2

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_path contains "\CamMute.exe" and 
 (not 
 (action_process_image_path in ("*\Lenovo\Communication Utility\*", "*\Lenovo\Communications Utility\*")))) or 
 (action_process_image_path contains "\chrome_frame_helper.exe" and 
 (not 
 action_process_image_path contains "\Google\Chrome\application\")) or 
 (action_process_image_path contains "\dvcemumanager.exe" and 
 (not 
 action_process_image_path contains "\Microsoft Device Emulator\")) or 
 (action_process_image_path contains "\Gadget.exe" and 
 (not 
 action_process_image_path contains "\Windows Media Player\")) or 
 (action_process_image_path contains "\hcc.exe" and 
 (not 
 action_process_image_path contains "\HTML Help Workshop\")) or 
 (action_process_image_path contains "\hkcmd.exe" and 
 (not 
 (action_process_image_path in ("*\System32\*", "*\SysNative\*", "*\SysWow64\*")))) or 
 (action_process_image_path contains "\Mc.exe" and 
 (not 
 (action_process_image_path in ("*\Microsoft Visual Studio*", "*\Microsoft SDK*", "*\Windows Kit*")))) or 
 (action_process_image_path contains "\MsMpEng.exe" and 
 (not 
 (action_process_image_path in ("*\Microsoft Security Client\*", "*\Windows Defender\*", "*\AntiMalware\*")))) or 
 (action_process_image_path contains "\msseces.exe" and 
 (not 
 (action_process_image_path in ("*\Microsoft Security Center\*", "*\Microsoft Security Client\*", "*\Microsoft Security Essentials\*")))) or 
 (action_process_image_path contains "\OInfoP11.exe" and 
 (not 
 action_process_image_path contains "\Common Files\Microsoft Shared\")) or 
 (action_process_image_path contains "\OleView.exe" and 
 (not 
 (action_process_image_path in ("*\Microsoft Visual Studio*", "*\Microsoft SDK*", "*\Windows Kit*", "*\Windows Resource Kit\*")))) or 
 (action_process_image_path contains "\rc.exe" and 
 (not 
 (action_process_image_path in ("*\Microsoft Visual Studio*", "*\Microsoft SDK*", "*\Windows Kit*", "*\Windows Resource Kit\*", "*\Microsoft.NET\*"))))))

view Sigma YAML

title: Potential PlugX Activity
id: aeab5ec5-be14-471a-80e8-e344418305c2
status: test
description: Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
references:
    - http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
    - https://countuponsecurity.com/2017/06/07/threat-hunting-in-the-enterprise-with-appcompatprocessor/
author: Florian Roth (Nextron Systems)
date: 2017-06-12
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.s0013
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_cammute:
        Image|endswith: '\CamMute.exe'
    filter_cammute:
        Image|contains:
            - '\Lenovo\Communication Utility\'
            - '\Lenovo\Communications Utility\'
    selection_chrome_frame:
        Image|endswith: '\chrome_frame_helper.exe'
    filter_chrome_frame:
        Image|contains: '\Google\Chrome\application\'
    selection_devemu:
        Image|endswith: '\dvcemumanager.exe'
    filter_devemu:
        Image|contains: '\Microsoft Device Emulator\'
    selection_gadget:
        Image|endswith: '\Gadget.exe'
    filter_gadget:
        Image|contains: '\Windows Media Player\'
    selection_hcc:
        Image|endswith: '\hcc.exe'
    filter_hcc:
        Image|contains: '\HTML Help Workshop\'
    selection_hkcmd:
        Image|endswith: '\hkcmd.exe'
    filter_hkcmd:
        Image|contains:
            - '\System32\'
            - '\SysNative\'
            - '\SysWow64\'
    selection_mc:
        Image|endswith: '\Mc.exe'
    filter_mc:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
    selection_msmpeng:
        Image|endswith: '\MsMpEng.exe'
    filter_msmpeng:
        Image|contains:
            - '\Microsoft Security Client\'
            - '\Windows Defender\'
            - '\AntiMalware\'
    selection_msseces:
        Image|endswith: '\msseces.exe'
    filter_msseces:
        Image|contains:
            - '\Microsoft Security Center\'
            - '\Microsoft Security Client\'
            - '\Microsoft Security Essentials\'
    selection_oinfo:
        Image|endswith: '\OInfoP11.exe'
    filter_oinfo:
        Image|contains: '\Common Files\Microsoft Shared\'
    selection_oleview:
        Image|endswith: '\OleView.exe'
    filter_oleview:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
            - '\Windows Resource Kit\'
    selection_rc:
        Image|endswith: '\rc.exe'
    filter_rc:
        Image|contains:
            - '\Microsoft Visual Studio'
            - '\Microsoft SDK'
            - '\Windows Kit'
            - '\Windows Resource Kit\'
            - '\Microsoft.NET\'
    condition: ( selection_cammute and not filter_cammute ) or ( selection_chrome_frame and not filter_chrome_frame ) or ( selection_devemu and not filter_devemu ) or ( selection_gadget and not filter_gadget ) or ( selection_hcc and not filter_hcc ) or ( selection_hkcmd and not filter_hkcmd ) or ( selection_mc and not filter_mc ) or ( selection_msmpeng and not filter_msmpeng ) or ( selection_msseces and not filter_msseces ) or ( selection_oinfo and not filter_oinfo ) or ( selection_oleview and not filter_oleview ) or ( selection_rc and not filter_rc )
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential PowerShell Execution Policy Tampering - ProcCreation

Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id cf2e938e-9a3e-4fe8-a347-411642b28a9f

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line in ("*\ShellIds\Microsoft.PowerShell\ExecutionPolicy*", "*\Policies\Microsoft\Windows\PowerShell\ExecutionPolicy*")) and 
 (action_process_image_command_line in ("*Bypass*", "*RemoteSigned*", "*Unrestricted*"))))

view Sigma YAML

title: Potential PowerShell Execution Policy Tampering - ProcCreation
id: cf2e938e-9a3e-4fe8-a347-411642b28a9f
related:
    - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 # ProcCreation Registry
      type: similar
    - id: 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180 # ProcCreation Cmdlet
      type: similar
    - id: 61d0475c-173f-4844-86f7-f3eebae1c66b # PowerShell ScriptBlock
      type: similar
status: test
description: Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine
references:
    - https://learn.microsoft.com/de-de/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-11
tags:
    - attack.defense-impairment
logsource:
    product: windows
    category: process_creation
detection:
    selection_path:
        CommandLine|contains:
            - '\ShellIds\Microsoft.PowerShell\ExecutionPolicy'
            - '\Policies\Microsoft\Windows\PowerShell\ExecutionPolicy'
    selection_values:
        CommandLine|contains:
            - 'Bypass'
            - 'RemoteSigned'
            - 'Unrestricted'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential PowerShell Obfuscation Via WCHAR/CHAR

Detects suspicious encoded character syntax often used for defense evasion

status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id e312efd0-35a1-407f-8439-b8d434b438a6

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_command_line in ("*[char]0x*", "*(WCHAR)0x*")))

view Sigma YAML

title: Potential PowerShell Obfuscation Via WCHAR/CHAR
id: e312efd0-35a1-407f-8439-b8d434b438a6
status: test
description: Detects suspicious encoded character syntax often used for defense evasion
references:
    - https://twitter.com/0gtweet/status/1281103918693482496
author: Florian Roth (Nextron Systems)
date: 2020-07-09
modified: 2025-03-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1059.001
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - '[char]0x'
            - '(WCHAR)0x'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential PrintNightmare Exploitation Attempt

Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675

status test author Bhabesh Raj ATT&CK technique id 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf

cortex_xdr query

config case_sensitive = false | preset=xdr_file | filter (event_type = ENUM.FILE and 
 event_sub_type = ENUM.FILE_REMOVE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\spoolsv.exe" and 
 action_file_name contains "C:\Windows\System32\spool\drivers\x64\3\"))

view Sigma YAML

title: Potential PrintNightmare Exploitation Attempt
id: 5b2bbc47-dead-4ef7-8908-0cf73fcbecbf
status: test
description: Detect DLL deletions from Spooler Service driver folder. This might be a potential exploitation attempt of CVE-2021-1675
references:
    - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
    - https://github.com/cube0x0/CVE-2021-1675
author: Bhabesh Raj
date: 2021-07-01
modified: 2023-02-17
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574
    - cve.2021-1675
    - detection.emerging-threats
logsource:
    category: file_delete
    product: windows
detection:
    selection:
        Image|endswith: '\spoolsv.exe'
        TargetFilename|contains: 'C:\Windows\System32\spool\drivers\x64\3\'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Privilege Escalation Attempt Via .Exe.Local Technique

Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

status test author Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash) ATT&CK tactic-only id 07a99744-56ac-40d2-97b7-2095967b0e03

cortex_xdr query

config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name in ("C:\Windows\System32\logonUI.exe.local*", "C:\Windows\System32\werFault.exe.local*", "C:\Windows\System32\consent.exe.local*", "C:\Windows\System32\narrator.exe.local*", "C:\Windows\System32\wermgr.exe.local*")) and 
 action_file_name contains "\comctl32.dll"))

view Sigma YAML

title: Potential Privilege Escalation Attempt Via .Exe.Local Technique
id: 07a99744-56ac-40d2-97b7-2095967b0e03
status: test
description: Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"
references:
    - https://github.com/binderlabs/DirCreate2System
    - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
author: Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash)
date: 2022-12-16
modified: 2022-12-19
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith:
            - 'C:\Windows\System32\logonUI.exe.local'
            - 'C:\Windows\System32\werFault.exe.local'
            - 'C:\Windows\System32\consent.exe.local'
            - 'C:\Windows\System32\narrator.exe.local'
            - 'C:\Windows\System32\wermgr.exe.local'
        TargetFilename|endswith: '\comctl32.dll'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong High FP

Potential Privilege Escalation To LOCAL SYSTEM

Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

status test author Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 207b0396-3689-42d9-8399-4222658efc99

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line contains " -s cmd" or 
 action_process_image_command_line contains " /s cmd" or 
 action_process_image_command_line contains " –s cmd" or 
 action_process_image_command_line contains " —s cmd" or 
 action_process_image_command_line contains " ―s cmd" or 
 action_process_image_command_line contains " -s -i cmd" or 
 action_process_image_command_line contains " -s /i cmd" or 
 action_process_image_command_line contains " -s –i cmd" or 
 action_process_image_command_line contains " -s —i cmd" or 
 action_process_image_command_line contains " -s ―i cmd" or 
 action_process_image_command_line contains " /s -i cmd" or 
 action_process_image_command_line contains " /s /i cmd" or 
 action_process_image_command_line contains " /s –i cmd" or 
 action_process_image_command_line contains " /s —i cmd" or 
 action_process_image_command_line contains " /s ―i cmd" or 
 action_process_image_command_line contains " –s -i cmd" or 
 action_process_image_command_line contains " –s /i cmd" or 
 action_process_image_command_line contains " –s –i cmd" or 
 action_process_image_command_line contains " –s —i cmd" or 
 action_process_image_command_line contains " –s ―i cmd" or 
 action_process_image_command_line contains " —s -i cmd" or 
 action_process_image_command_line contains " —s /i cmd" or 
 action_process_image_command_line contains " —s –i cmd" or 
 action_process_image_command_line contains " —s —i cmd" or 
 action_process_image_command_line contains " —s ―i cmd" or 
 action_process_image_command_line contains " ―s -i cmd" or 
 action_process_image_command_line contains " ―s /i cmd" or 
 action_process_image_command_line contains " ―s –i cmd" or 
 action_process_image_command_line contains " ―s —i cmd" or 
 action_process_image_command_line contains " ―s ―i cmd" or 
 action_process_image_command_line contains " -i -s cmd" or 
 action_process_image_command_line contains " -i /s cmd" or 
 action_process_image_command_line contains " -i –s cmd" or 
 action_process_image_command_line contains " -i —s cmd" or 
 action_process_image_command_line contains " -i ―s cmd" or 
 action_process_image_command_line contains " /i -s cmd" or 
 action_process_image_command_line contains " /i /s cmd" or 
 action_process_image_command_line contains " /i –s cmd" or 
 action_process_image_command_line contains " /i —s cmd" or 
 action_process_image_command_line contains " /i ―s cmd" or 
 action_process_image_command_line contains " –i -s cmd" or 
 action_process_image_command_line contains " –i /s cmd" or 
 action_process_image_command_line contains " –i –s cmd" or 
 action_process_image_command_line contains " –i —s cmd" or 
 action_process_image_command_line contains " –i ―s cmd" or 
 action_process_image_command_line contains " —i -s cmd" or 
 action_process_image_command_line contains " —i /s cmd" or 
 action_process_image_command_line contains " —i –s cmd" or 
 action_process_image_command_line contains " —i —s cmd" or 
 action_process_image_command_line contains " —i ―s cmd" or 
 action_process_image_command_line contains " ―i -s cmd" or 
 action_process_image_command_line contains " ―i /s cmd" or 
 action_process_image_command_line contains " ―i –s cmd" or 
 action_process_image_command_line contains " ―i —s cmd" or 
 action_process_image_command_line contains " ―i ―s cmd" or 
 action_process_image_command_line contains " -s pwsh" or 
 action_process_image_command_line contains " /s pwsh" or 
 action_process_image_command_line contains " –s pwsh" or 
 action_process_image_command_line contains " —s pwsh" or 
 action_process_image_command_line contains " ―s pwsh" or 
 action_process_image_command_line contains " -s -i pwsh" or 
 action_process_image_command_line contains " -s /i pwsh" or 
 action_process_image_command_line contains " -s –i pwsh" or 
 action_process_image_command_line contains " -s —i pwsh" or 
 action_process_image_command_line contains " -s ―i pwsh" or 
 action_process_image_command_line contains " /s -i pwsh" or 
 action_process_image_command_line contains " /s /i pwsh" or 
 action_process_image_command_line contains " /s –i pwsh" or 
 action_process_image_command_line contains " /s —i pwsh" or 
 action_process_image_command_line contains " /s ―i pwsh" or 
 action_process_image_command_line contains " –s -i pwsh" or 
 action_process_image_command_line contains " –s /i pwsh" or 
 action_process_image_command_line contains " –s –i pwsh" or 
 action_process_image_command_line contains " –s —i pwsh" or 
 action_process_image_command_line contains " –s ―i pwsh" or 
 action_process_image_command_line contains " —s -i pwsh" or 
 action_process_image_command_line contains " —s /i pwsh" or 
 action_process_image_command_line contains " —s –i pwsh" or 
 action_process_image_command_line contains " —s —i pwsh" or 
 action_process_image_command_line contains " —s ―i pwsh" or 
 action_process_image_command_line contains " ―s -i pwsh" or 
 action_process_image_command_line contains " ―s /i pwsh" or 
 action_process_image_command_line contains " ―s –i pwsh" or 
 action_process_image_command_line contains " ―s —i pwsh" or 
 action_process_image_command_line contains " ―s ―i pwsh" or 
 action_process_image_command_line contains " -i -s pwsh" or 
 action_process_image_command_line contains " -i /s pwsh" or 
 action_process_image_command_line contains " -i –s pwsh" or 
 action_process_image_command_line contains " -i —s pwsh" or 
 action_process_image_command_line contains " -i ―s pwsh" or 
 action_process_image_command_line contains " /i -s pwsh" or 
 action_process_image_command_line contains " /i /s pwsh" or 
 action_process_image_command_line contains " /i –s pwsh" or 
 action_process_image_command_line contains " /i —s pwsh" or 
 action_process_image_command_line contains " /i ―s pwsh" or 
 action_process_image_command_line contains " –i -s pwsh" or 
 action_process_image_command_line contains " –i /s pwsh" or 
 action_process_image_command_line contains " –i –s pwsh" or 
 action_process_image_command_line contains " –i —s pwsh" or 
 action_process_image_command_line contains " –i ―s pwsh" or 
 action_process_image_command_line contains " —i -s pwsh" or 
 action_process_image_command_line contains " —i /s pwsh" or 
 action_process_image_command_line contains " —i –s pwsh" or 
 action_process_image_command_line contains " —i —s pwsh" or 
 action_process_image_command_line contains " —i ―s pwsh" or 
 action_process_image_command_line contains " ―i -s pwsh" or 
 action_process_image_command_line contains " ―i /s pwsh" or 
 action_process_image_command_line contains " ―i –s pwsh" or 
 action_process_image_command_line contains " ―i —s pwsh" or 
 action_process_image_command_line contains " ―i ―s pwsh" or 
 action_process_image_command_line contains " -s powershell" or 
 action_process_image_command_line contains " /s powershell" or 
 action_process_image_command_line contains " –s powershell" or 
 action_process_image_command_line contains " —s powershell" or 
 action_process_image_command_line contains " ―s powershell" or 
 action_process_image_command_line contains " -s -i powershell" or 
 action_process_image_command_line contains " -s /i powershell" or 
 action_process_image_command_line contains " -s –i powershell" or 
 action_process_image_command_line contains " -s —i powershell" or 
 action_process_image_command_line contains " -s ―i powershell" or 
 action_process_image_command_line contains " /s -i powershell" or 
 action_process_image_command_line contains " /s /i powershell" or 
 action_process_image_command_line contains " /s –i powershell" or 
 action_process_image_command_line contains " /s —i powershell" or 
 action_process_image_command_line contains " /s ―i powershell" or 
 action_process_image_command_line contains " –s -i powershell" or 
 action_process_image_command_line contains " –s /i powershell" or 
 action_process_image_command_line contains " –s –i powershell" or 
 action_process_image_command_line contains " –s —i powershell" or 
 action_process_image_command_line contains " –s ―i powershell" or 
 action_process_image_command_line contains " —s -i powershell" or 
 action_process_image_command_line contains " —s /i powershell" or 
 action_process_image_command_line contains " —s –i powershell" or 
 action_process_image_command_line contains " —s —i powershell" or 
 action_process_image_command_line contains " —s ―i powershell" or 
 action_process_image_command_line contains " ―s -i powershell" or 
 action_process_image_command_line contains " ―s /i powershell" or 
 action_process_image_command_line contains " ―s –i powershell" or 
 action_process_image_command_line contains " ―s —i powershell" or 
 action_process_image_command_line contains " ―s ―i powershell" or 
 action_process_image_command_line contains " -i -s powershell" or 
 action_process_image_command_line contains " -i /s powershell" or 
 action_process_image_command_line contains " -i –s powershell" or 
 action_process_image_command_line contains " -i —s powershell" or 
 action_process_image_command_line contains " -i ―s powershell" or 
 action_process_image_command_line contains " /i -s powershell" or 
 action_process_image_command_line contains " /i /s powershell" or 
 action_process_image_command_line contains " /i –s powershell" or 
 action_process_image_command_line contains " /i —s powershell" or 
 action_process_image_command_line contains " /i ―s powershell" or 
 action_process_image_command_line contains " –i -s powershell" or 
 action_process_image_command_line contains " –i /s powershell" or 
 action_process_image_command_line contains " –i –s powershell" or 
 action_process_image_command_line contains " –i —s powershell" or 
 action_process_image_command_line contains " –i ―s powershell" or 
 action_process_image_command_line contains " —i -s powershell" or 
 action_process_image_command_line contains " —i /s powershell" or 
 action_process_image_command_line contains " —i –s powershell" or 
 action_process_image_command_line contains " —i —s powershell" or 
 action_process_image_command_line contains " —i ―s powershell" or 
 action_process_image_command_line contains " ―i -s powershell" or 
 action_process_image_command_line contains " ―i /s powershell" or 
 action_process_image_command_line contains " ―i –s powershell" or 
 action_process_image_command_line contains " ―i —s powershell" or 
 action_process_image_command_line contains " ―i ―s powershell") and 
 (not 
 (action_process_image_command_line in ("*paexec*", "*PsExec*", "*accepteula*")))))

view Sigma YAML

title: Potential Privilege Escalation To LOCAL SYSTEM
id: 207b0396-3689-42d9-8399-4222658efc99
related:
    - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23 # PsExec specific rule
      type: similar
status: test
description: Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
    - https://www.poweradmin.com/paexec/
    - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2021-05-22
modified: 2024-03-05
tags:
    - attack.resource-development
    - attack.t1587.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Escalation to LOCAL_SYSTEM
        CommandLine|contains|windash:
            # Note that you don't need to add the ".exe" part when using psexec/paexec
            # The "-" can also be replaced with "/"
            # The order of args isn't important
            # "cmd" can be replaced by "powershell", "pwsh" or any other console like software
            - ' -s cmd'
            - ' -s -i cmd'
            - ' -i -s cmd'
            # Pwsh (For PowerShell 7)
            - ' -s pwsh'
            - ' -s -i pwsh'
            - ' -i -s pwsh'
            # PowerShell (For PowerShell 5)
            - ' -s powershell'
            - ' -s -i powershell'
            - ' -i -s powershell'
    filter_main_exclude_coverage:
        # This filter exclude strings covered by 8834e2f7-6b4b-4f09-8906-d2276470ee23
        CommandLine|contains:
            - 'paexec'
            - 'PsExec'
            - 'accepteula'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Weird admins that rename their tools
    - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing
level: high

Convert to SIEM query

high Moderate High FP

Potential Privilege Escalation via Service Permissions Weakness

Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

status test author Teymur Kheirkhabarov ATT&CK sub-technique id 0f9c21f1-6a73-4b0e-9809-cb562cb8d981

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_integrity_level in ("Medium", "S-1-16-8192")) and 
 (action_process_image_command_line contains "ControlSet" and 
 action_process_image_command_line contains "services") and 
 (action_process_image_command_line in ("*\ImagePath*", "*\FailureCommand*", "*\ServiceDll*"))))

view Sigma YAML

title: Potential Privilege Escalation via Service Permissions Weakness
id: 0f9c21f1-6a73-4b0e-9809-cb562cb8d981
status: test
description: Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/
author: Teymur Kheirkhabarov
date: 2019-10-26
modified: 2024-12-01
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.011
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        IntegrityLevel:
            - 'Medium'
            - 'S-1-16-8192'
        CommandLine|contains|all:
            - 'ControlSet'
            - 'services'
        CommandLine|contains:
            - '\ImagePath'
            - '\FailureCommand'
            - '\ServiceDll'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Strong High FP

Potential Process Injection Via Msra.EXE

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

status test author Alexander McDonald ATT&CK technique id 744a188b-0415-4792-896f-11ddb0588dbc

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\msra.exe" and 
 actor_process_command_line contains "msra.exe" and 
 (action_process_image_path in ("*\arp.exe", "*\cmd.exe", "*\net.exe", "*\netstat.exe", "*\nslookup.exe", "*\route.exe", "*\schtasks.exe", "*\whoami.exe"))))

view Sigma YAML

title: Potential Process Injection Via Msra.EXE
id: 744a188b-0415-4792-896f-11ddb0588dbc
status: test
description: Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics
references:
    - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
    - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf
author: Alexander McDonald
date: 2022-06-24
modified: 2023-02-03
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\msra.exe'
        ParentCommandLine|endswith: 'msra.exe'
        Image|endswith:
            - '\arp.exe'
            - '\cmd.exe'
            - '\net.exe'
            - '\netstat.exe'
            - '\nslookup.exe'
            - '\route.exe'
            - '\schtasks.exe'
            - '\whoami.exe'
    condition: selection
falsepositives:
    - Legitimate use of Msra.exe
level: high

Convert to SIEM query

high Moderate High FP

Potential Provisioning Registry Key Abuse For Binary Proxy Execution

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

status test author Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel ATT&CK technique id 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_process_image_command_line contains "SOFTWARE\Microsoft\Provisioning\Commands\")

view Sigma YAML

title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution
id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25
related:
    - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c # CLI Generic
      type: similar
    - id: f9999590-1f94-4a34-a91e-951e47bedefd # CLI Abuse
      type: similar
    - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 # Registry
      type: similar
status: test
description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
    - https://twitter.com/0gtweet/status/1674399582162153472
author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
date: 2023-08-08
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'SOFTWARE\Microsoft\Provisioning\Commands\'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG

Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

status test author Swachchhanda Shrawan Poudel ATT&CK technique id 7021255e-5db3-4946-a8b9-0ba7a4644a69

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\SOFTWARE\Microsoft\Provisioning\Commands\")

view Sigma YAML

title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG
id: 7021255e-5db3-4946-a8b9-0ba7a4644a69
related:
    - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c # CLI Generic
      type: similar
    - id: f9999590-1f94-4a34-a91e-951e47bedefd # CLI Abuse
      type: similar
    - id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 # CLI Registry
      type: similar
status: test
description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
    - https://twitter.com/0gtweet/status/1674399582162153472
author: Swachchhanda Shrawan Poudel
date: 2023-08-02
modified: 2023-08-17
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: registry_set
    product: windows
    definition: 'Requirements: The registry key "\SOFTWARE\Microsoft\Provisioning\Commands\" and its subkey must be monitored'
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Provisioning\Commands\'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential PsExec Remote Execution

Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

status test author Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id ea011323-7045-460b-b2d7-0f7442ea6b38

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line contains "accepteula" and 
 action_process_image_command_line contains " -u " and 
 action_process_image_command_line contains " -p " and 
 action_process_image_command_line contains " \\") and 
 (not 
 (action_process_image_command_line in ("*\\localhost*", "*\\127.*")))))

view Sigma YAML

title: Potential PsExec Remote Execution
id: ea011323-7045-460b-b2d7-0f7442ea6b38
status: test
description: Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
    - https://www.poweradmin.com/paexec/
    - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-02-28
modified: 2025-09-01
tags:
    - attack.resource-development
    - attack.t1587.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Accepting EULA in commandline - often used in automated attacks
        CommandLine|contains|all:
            - 'accepteula'
            - ' -u '
            - ' -p '
            - ' \\\\'
    filter_main_localhost:
        CommandLine|contains:
            - '\\\\localhost'
            - '\\\\127.'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate High FP

Potential Qakbot Registry Activity

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

status test author Hieu Tran ATT&CK technique id 1c8e96cd-2bed-487d-9de0-b46c90cade56

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter event_type = ENUM.REGISTRY and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\Software\firm\soft\Name")

view Sigma YAML

title: Potential Qakbot Registry Activity
id: 1c8e96cd-2bed-487d-9de0-b46c90cade56
status: test
description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
references:
    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
author: Hieu Tran
date: 2023-03-13
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\firm\soft\Name'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Qakbot Rundll32 Execution

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

status test author X__Junior (Nextron Systems) ATT&CK tactic-only id cf879ffb-793a-4753-9a14-bc8f37cc90df

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (((actor_process_image_path in ("*\cmd.exe", "*\cscript.exe", "*\curl.exe", "*\mshta.exe", "*\powershell.exe", "*\pwsh.exe", "*\wscript.exe")) and 
 action_process_image_path contains "\rundll32.exe" and 
 (action_process_image_command_line in ("*:\ProgramData\*", "*:\Users\Public\*", "*\AppData\Local\Temp\*", "*\AppData\Roaming\*"))) and 
 action_process_image_command_line contains ".dll"))

view Sigma YAML

title: Potential Qakbot Rundll32 Execution
id: cf879ffb-793a-4753-9a14-bc8f37cc90df
status: test
description: Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.
references:
    - https://github.com/pr0xylife/Qakbot/
author: X__Junior (Nextron Systems)
date: 2023-05-24
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection_paths:
        ParentImage|endswith:
            # Note: Only add processes seen used by Qakbot to avoid collision with other strains of malware
            - '\cmd.exe'
            - '\cscript.exe'
            - '\curl.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            # Note: Only add paths seen used by Qakbot to avoid collision with other strains of malware
            - ':\ProgramData\'
            - ':\Users\Public\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    selection_extension:
        CommandLine|contains: '.dll'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Convert to SIEM query

high Strong Medium FP

Potential RDP Tunneling Via Plink

Execution of plink to perform data exfiltration and tunneling

status test author Florian Roth (Nextron Systems) ATT&CK technique id f38ce0b9-5e97-4b47-a211-7dc8d8b871da

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_path contains "\plink.exe" and 
 action_process_image_command_line contains ":127.0.0.1:3389") or 
 ((action_process_image_path contains "\plink.exe" and 
 action_process_image_command_line contains ":3389") and 
 (action_process_image_command_line in ("* -P 443*", "* -P 22*")))))

view Sigma YAML

title: Potential RDP Tunneling Via Plink
id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da
related:
    - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d # ssh.exe
      type: similar
status: test
description: Execution of plink to perform data exfiltration and tunneling
references:
    - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
author: Florian Roth (Nextron Systems)
date: 2022-08-04
modified: 2023-01-27
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection_a:
        Image|endswith: '\plink.exe'
        CommandLine|contains: ':127.0.0.1:3389'
    selection_b1:
        Image|endswith: '\plink.exe'
        CommandLine|contains: ':3389'
    selection_b2:
        CommandLine|contains:
            - ' -P 443'
            - ' -P 22'
    condition: selection_a or all of selection_b*
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential RDP Tunneling Via SSH

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id f7d7ebd5-a016-46e2-9c54-f9932f2d386d

cortex_xdr query

config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_path contains "\ssh.exe" and 
 action_process_image_command_line contains ":3389"))

view Sigma YAML

title: Potential RDP Tunneling Via SSH
id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d
related:
    - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da # plink.exe
      type: similar
status: test
description: Execution of ssh.exe to perform data exfiltration and tunneling through RDP
references:
    - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-12
modified: 2023-01-25
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ssh.exe'
        CommandLine|contains: ':3389'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

high Moderate Medium FP

Potential Ransomware Activity Using LegalNotice Message

Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages

status test author frack113 ATT&CK sub-technique id 8b9606c9-28be-4a38-b146-0e313cc232c1

cortex_xdr query

config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name in ("*\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption*", "*\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText*")) and 
 ((action_registry_value_name in ("*encrypted*", "*Unlock-Password*", "*paying*")) or 
 (action_registry_data in ("*encrypted*", "*Unlock-Password*", "*paying*")))))

view Sigma YAML

title: Potential Ransomware Activity Using LegalNotice Message
id: 8b9606c9-28be-4a38-b146-0e313cc232c1
status: test
description: Detect changes to the "LegalNoticeCaption" or "LegalNoticeText" registry values where the message set contains keywords often used in ransomware ransom messages
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1491.001/T1491.001.md
author: frack113
date: 2022-12-11
modified: 2023-08-17
tags:
    - attack.impact
    - attack.t1491.001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains:
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption'
            - '\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText'
        Details|contains:
            - 'encrypted'
            - 'Unlock-Password'
            - 'paying'
    condition: selection
falsepositives:
    - Unknown
level: high

Convert to SIEM query

Palo Alto Cortex XDR

Detection rules