Home/Detection rules/Palo Alto Cortex XDR
Tool
EDR / XDR

Palo Alto Cortex XDR

1,524 rules · Sigma detections in Palo Alto Cortex XDR syntax
The same Sigma detection corpus, machine-rendered into Palo Alto Cortex XDR query syntax and ready to paste. Switch platforms above for identical coverage in another language, or choose Sigma (generic) for the portable YAML.
Download all 1,524 rules (.zip, 675 KB) Every Palo Alto Cortex XDR query in this view, packaged to deploy.
Severity critical high medium low all severities Export CSV Export .zip
Filter by techniquepick techniques from the ATT&CK matrix
Reconnaissance4
Resource Development5
Initial Access7
Execution25
Persistence31
Privilege Escalation17
Stealth63
Defense Impairment16
Credential Access26
Discovery24
Lateral Movement10
Collection11
Command and Control18
Exfiltration7
Impact10
Using these Sigma rules
Deploy. Pick your SIEM above and paste the rendered query straight into a saved search or detection rule, or expand any rule to convert its generic YAML inline to the language you run.
Adapt. Map the field names to your log schema - Sigma assumes a normalised taxonomy - and tune thresholds and timeframes to your own baseline before you trust the alert.
Validate. Every rule is mapped to ATT&CK, so run the matching Atomic Red Team test on /atomic to confirm the rule actually fires before you rely on it.
Judge. Each rule shows a quality tier (Strong / Moderate / Basic) and an estimated alert-volume tier (Low / Medium / High FP), both scored deterministically from the rule's shape - status, detection depth, match breadth, log source, documented false positives and references. A rule existing is not the same as a rule being good, or being quiet; hover either tier for the breakdown. The FP estimate reads rule shape, not a measured rate, so use it to pick what to tune first before you deploy.
◈

Detection rules

50 shown of 1,524
high Strong High FP
Time Travel Debugging Utility Usage
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
status test author Ensar Şamil, @sblmsrsn, @oscd_initiative ATT&CK sub-technique id 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 actor_process_image_path contains "\tttracer.exe")
view Sigma YAML 
title: Time Travel Debugging Utility Usage
id: 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a
related:
    - id: e76c8240-d68f-4773-8880-5c6f63595aaf
      type: derived
status: test
description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
    - https://twitter.com/mattifestation/status/1196390321783025666
    - https://twitter.com/oulusoyum/status/1191329746069655553
author: 'Ensar Şamil, @sblmsrsn, @oscd_initiative'
date: 2020-10-06
modified: 2022-10-09
tags:
    - attack.credential-access
    - attack.stealth
    - attack.t1218
    - attack.t1003.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\tttracer.exe'
    condition: selection
falsepositives:
    - Legitimate usage by software developers/testers
level: high
Convert to SIEM query
high Strong High FP
Time Travel Debugging Utility Usage - Image
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
status test author Ensar Şamil, @sblmsrsn, @oscd_initiative ATT&CK sub-technique id e76c8240-d68f-4773-8880-5c6f63595aaf
cortex_xdr query
config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_module_path in ("*\ttdrecord.dll", "*\ttdwriter.dll", "*\ttdloader.dll")))
view Sigma YAML 
title: Time Travel Debugging Utility Usage - Image
id: e76c8240-d68f-4773-8880-5c6f63595aaf
status: test
description: Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
    - https://twitter.com/mattifestation/status/1196390321783025666
    - https://twitter.com/oulusoyum/status/1191329746069655553
author: 'Ensar Şamil, @sblmsrsn, @oscd_initiative'
date: 2020-10-06
modified: 2022-12-02
tags:
    - attack.credential-access
    - attack.stealth
    - attack.t1218
    - attack.t1003.001
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith:
            - '\ttdrecord.dll'
            - '\ttdwriter.dll'
            - '\ttdloader.dll'
    condition: selection
falsepositives:
    - Legitimate usage by software developers/testers
level: high
Convert to SIEM query
high Moderate High FP
Trickbot Malware Activity
Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"
status stable author Florian Roth (Nextron Systems) ATT&CK technique id 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_path contains "\wermgr.exe" and 
 actor_process_image_path contains "\rundll32.exe" and 
 actor_process_command_line contains "DllRegisterServer"))
view Sigma YAML 
title: Trickbot Malware Activity
id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
related:
    - id: c37510b8-2107-4b78-aa32-72f251e7a844
      type: similar
status: stable
description: Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"
references:
    - https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20
    - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
author: Florian Roth (Nextron Systems)
date: 2020-11-26
modified: 2021-11-27
tags:
    - attack.execution
    - attack.t1559
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wermgr.exe'
        ParentImage|endswith: '\rundll32.exe'
        ParentCommandLine|contains: 'DllRegisterServer'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
Triple Cross eBPF Rootkit Default LockFile
Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id c0239255-822c-4630-b7f1-35362bcb8f44
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 action_file_name = "/tmp/rootlog")
view Sigma YAML 
title: Triple Cross eBPF Rootkit Default LockFile
id: c0239255-822c-4630-b7f1-35362bcb8f44
status: test
description: Detects the creation of the file "rootlog" which is used by the TripleCross rootkit as a way to check if the backdoor is already running.
references:
    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L33
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-05
modified: 2022-12-31
tags:
    - attack.stealth
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename: '/tmp/rootlog'
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate High FP
Triple Cross eBPF Rootkit Default Persistence
Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 1a2ea919-d11d-4d1e-8535-06cda13be20f
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 action_file_name contains "ebpfbackdoor")
view Sigma YAML 
title: Triple Cross eBPF Rootkit Default Persistence
id: 1a2ea919-d11d-4d1e-8535-06cda13be20f
status: test
description: Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method
references:
    - https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-05
modified: 2022-12-31
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.003
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|endswith: 'ebpfbackdoor'
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate Medium FP
Triple Cross eBPF Rootkit Execve Hijack
Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 0326c3c8-7803-4a0f-8c5c-368f747f7c3e
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_process_image_path contains "/sudo" and 
 action_process_image_command_line contains "execve_hijack"))
view Sigma YAML 
title: Triple Cross eBPF Rootkit Execve Hijack
id: 0326c3c8-7803-4a0f-8c5c-368f747f7c3e
status: test
description: Detects execution of a the file "execve_hijack" which is used by the Triple Cross rootkit as a way to elevate privileges
references:
    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/src/helpers/execve_hijack.c#L275
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-05
tags:
    - attack.privilege-escalation
    - attack.stealth
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sudo'
        CommandLine|contains: 'execve_hijack'
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate High FP
Triple Cross eBPF Rootkit Install Commands
Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 22236d75-d5a0-4287-bf06-c93b1770860f
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_process_image_path contains "/sudo" and 
 (action_process_image_command_line contains " tc " and 
 action_process_image_command_line contains " enp0s3 ") and 
 (action_process_image_command_line in ("* qdisc *", "* filter *"))))
view Sigma YAML 
title: Triple Cross eBPF Rootkit Install Commands
id: 22236d75-d5a0-4287-bf06-c93b1770860f
status: test
description: Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script
references:
    - https://github.com/h3xduck/TripleCross/blob/1f1c3e0958af8ad9f6ebe10ab442e75de33e91de/apps/deployer.sh
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-05
tags:
    - attack.stealth
    - attack.t1014
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/sudo'
        CommandLine|contains|all:
            - ' tc '
            - ' enp0s3 '
        CommandLine|contains:
            - ' qdisc '
            - ' filter '
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate High FP
TropicTrooper Campaign November 2018
Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
status stable author @41thexplorer, Microsoft Defender ATP ATT&CK sub-technique id 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_process_image_command_line contains "abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc")
view Sigma YAML 
title: TropicTrooper Campaign November 2018
id: 8c7090c3-e0a0-4944-bd08-08c3a0cecf79
status: stable
description: Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia
references:
    - https://www.microsoft.com/en-us/security/blog/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
author: '@41thexplorer, Microsoft Defender ATP'
date: 2019-11-12
modified: 2020-08-27
tags:
    - attack.execution
    - attack.t1059.001
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc'
    condition: selection
level: high
Convert to SIEM query
high Moderate Medium FP
Trust Access Disable For VBApplications
Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
status test author Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\Security\AccessVBOM" and 
 (action_registry_value_name = "DWORD (0x00000001)" or 
 action_registry_data = "DWORD (0x00000001)")))
view Sigma YAML 
title: Trust Access Disable For VBApplications
id: 1a5c46e9-f32f-42f7-b2bc-6e9084db7fbf
related:
    - id: 9b894e57-033f-46cf-b7fa-a52804181973
      type: obsolete
status: test
description: Detects registry changes to Microsoft Office "AccessVBOM" to a value of "1" which disables trust access for VBA on the victim machine and lets attackers execute malicious macros without any Microsoft Office warnings.
references:
    - https://twitter.com/inversecos/status/1494174785621819397
    - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/
    - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/
author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems)
date: 2020-05-22
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Security\AccessVBOM'
        Details: 'DWORD (0x00000001)'
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate High FP
Trusted Path Bypass via Windows Directory Spoofing
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
status experimental author Swachchhanda Shrawan Poudel (Nextron Systems) ATT&CK sub-technique id 0cbe38c0-270c-41d9-ab79-6e5a9a669290
cortex_xdr query
config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_module_path in ("*:\Windows \System32\*", "*:\Windows \SysWOW64\*")))
view Sigma YAML 
title: Trusted Path Bypass via Windows Directory Spoofing
id: 0cbe38c0-270c-41d9-ab79-6e5a9a669290
related:
    - id: 4ac47ed3-44c2-4b1f-9d51-bf46e8914126
      type: similar
status: experimental
description: |
    Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
    This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
references:
    - https://x.com/Wietze/status/1933495426952421843
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-17
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.007
    - attack.t1548.002
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|contains:
            - ':\Windows \System32\'  # Note the space between "Windows" and "System32"
            - ':\Windows \SysWOW64\'  # Note the space between "Windows" and "SysWOW64"
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Abusing Winsat Path Parsing - File
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 155dbf56-e0a4-4dd0-8905-8a98705045e8
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name contains "C:\Users\" and 
 (action_file_name in ("*\AppData\Local\Temp\system32\winsat.exe", "*\AppData\Local\Temp\system32\winmm.dll"))))
view Sigma YAML 
title: UAC Bypass Abusing Winsat Path Parsing - File
id: 155dbf56-e0a4-4dd0-8905-8a98705045e8
status: test
description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|endswith:
            - '\AppData\Local\Temp\system32\winsat.exe'
            - '\AppData\Local\Temp\system32\winmm.dll'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Abusing Winsat Path Parsing - Process
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 7a01183d-71a2-46ad-ad5c-acd989ac1793
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288")) and 
 actor_process_image_path contains "\AppData\Local\Temp\system32\winsat.exe" and 
 actor_process_command_line contains "C:\Windows \system32\winsat.exe"))
view Sigma YAML 
title: UAC Bypass Abusing Winsat Path Parsing - Process
id: 7a01183d-71a2-46ad-ad5c-acd989ac1793
status: test
description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
        ParentImage|endswith: '\AppData\Local\Temp\system32\winsat.exe'
        ParentCommandLine|contains: 'C:\Windows \system32\winsat.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Abusing Winsat Path Parsing - Registry
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 6597be7b-ac61-4ac8-bef4-d3ec88174853
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\Root\InventoryApplicationFile\winsat.exe|" and 
 action_registry_key_name contains "\LowerCaseLongPath" and 
 (action_registry_value_name contains "c:\users\" or 
 action_registry_data contains "c:\users\") and 
 (action_registry_value_name contains "\appdata\local\temp\system32\winsat.exe" or 
 action_registry_data contains "\appdata\local\temp\system32\winsat.exe")))
view Sigma YAML 
title: UAC Bypass Abusing Winsat Path Parsing - Registry
id: 6597be7b-ac61-4ac8-bef4-d3ec88174853
status: test
description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Root\InventoryApplicationFile\winsat.exe|'
        TargetObject|endswith: '\LowerCaseLongPath'
        Details|startswith: 'c:\users\'
        Details|endswith: '\appdata\local\temp\system32\winsat.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Tools Using ComputerDefaults
Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 3c05e90d-7eba-4324-9972-5d7f711a60a8
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (((action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288")) and 
 action_process_image_path = "C:\Windows\System32\ComputerDefaults.exe") and 
 (not 
 (actor_process_image_path in ("*:\Windows\System32*", "*:\Program Files*")))))
view Sigma YAML 
title: UAC Bypass Tools Using ComputerDefaults
id: 3c05e90d-7eba-4324-9972-5d7f711a60a8
status: test
description: Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-31
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
        Image: 'C:\Windows\System32\ComputerDefaults.exe'
    filter:
        ParentImage|contains:
            - ':\Windows\System32'
            - ':\Program Files'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using .NET Code Profiler on MMC
Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 93a19907-d4f9-4deb-9f91-aac4692776a6
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name contains "C:\Users\" and 
 action_file_name contains "\AppData\Local\Temp\pe386.dll"))
view Sigma YAML 
title: UAC Bypass Using .NET Code Profiler on MMC
id: 93a19907-d4f9-4deb-9f91-aac4692776a6
status: test
description: Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|endswith: '\AppData\Local\Temp\pe386.dll'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using ChangePK and SLUI
Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 503d581c-7df0-4bbe-b9be-5840c0ecc1fc
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_path contains "\changepk.exe" and 
 actor_process_image_path contains "\slui.exe" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using ChangePK and SLUI
id: 503d581c-7df0-4bbe-b9be-5840c0ecc1fc
status: test
description: Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)
references:
    - https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
    - https://github.com/hfiref0x/UACME
    - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\changepk.exe'
        ParentImage|endswith: '\slui.exe'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Consent and Comctl32 - File
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 62ed5b55-f991-406a-85d9-e8e8fdf18789
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name contains "C:\Windows\System32\consent.exe.@" and 
 action_file_name contains "\comctl32.dll"))
view Sigma YAML 
title: UAC Bypass Using Consent and Comctl32 - File
id: 62ed5b55-f991-406a-85d9-e8e8fdf18789
status: test
description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Windows\System32\consent.exe.@'
        TargetFilename|endswith: '\comctl32.dll'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Consent and Comctl32 - Process
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 1ca6bd18-0ba0-44ca-851c-92ed89a61085
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\consent.exe" and 
 action_process_image_path contains "\werfault.exe" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using Consent and Comctl32 - Process
id: 1ca6bd18-0ba0-44ca-851c-92ed89a61085
status: test
description: Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\consent.exe'
        Image|endswith: '\werfault.exe'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Disk Cleanup
Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id b697e69c-746f-4a86-9f59-7bfff8eab881
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_command_line contains "\"\system32\cleanmgr.exe /autoclean /d C:" and 
 actor_process_command_line = "C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using Disk Cleanup
id: b697e69c-746f-4a86-9f59-7bfff8eab881
status: test
description: Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|endswith: '"\system32\cleanmgr.exe /autoclean /d C:'
        ParentCommandLine: 'C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using DismHost
Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 853e74f9-9392-4935-ad3b-2e8c040dae86
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path contains "C:\Users\" and 
 actor_process_image_path contains "\AppData\Local\Temp\" and 
 actor_process_image_path contains "\DismHost.exe") and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using DismHost
id: 853e74f9-9392-4935-ad3b-2e8c040dae86
status: test
description: Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|contains|all:
            - 'C:\Users\'
            - '\AppData\Local\Temp\'
            - '\DismHost.exe'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate High FP
UAC Bypass Using Event Viewer RecentViews
Detects the pattern of UAC Bypass using Event Viewer RecentViews
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 30fc8de7-d833-40c4-96b6-28319fbc4f6c
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line in ("*\Event Viewer\RecentViews*", "*\EventV~1\RecentViews*")) and 
 action_process_image_command_line contains ">"))
view Sigma YAML 
title: UAC Bypass Using Event Viewer RecentViews
id: 30fc8de7-d833-40c4-96b6-28319fbc4f6c
related:
    - id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
      type: similar
status: test
description: Detects the pattern of UAC Bypass using Event Viewer RecentViews
references:
    - https://twitter.com/orange_8361/status/1518970259868626944
    - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-11-22
tags:
    - attack.privilege-escalation
    - attack.stealth
logsource:
    category: process_creation
    product: windows
detection:
    selection_path:
        # Example: ysoserial.exe -o raw -f BinaryFormatter - g DataSet -c calc > RecentViews & copy RecentViews %LOCALAPPDATA%\Microsoft\EventV~1\RecentViews & eventvwr.exe
        CommandLine|contains:
            - '\Event Viewer\RecentViews'
            - '\EventV~1\RecentViews'
    selection_redirect:
        CommandLine|contains: '>'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using EventVwr
Detects the pattern of a UAC bypass using Windows Event Viewer
status test author Antonio Cocomazzi (idea), Florian Roth (Nextron Systems) ATT&CK tactic-only id 63e4f530-65dc-49cc-8f80-ccfa95c69d43
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name in ("*\Microsoft\Event Viewer\RecentViews", "*\Microsoft\EventV~1\RecentViews")) and 
 (not 
 (actor_process_image_path in ("C:\Windows\System32\*", "C:\Windows\SysWOW64\*")))))
view Sigma YAML 
title: UAC Bypass Using EventVwr
id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43
status: test
description: Detects the pattern of a UAC bypass using Windows Event Viewer
references:
    - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
    - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
    - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems)
date: 2022-04-27
modified: 2022-11-22
tags:
    - attack.privilege-escalation
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith:
            # Removed the start just in case the logging backend doesn't expand ENV variables when they're used
            - '\Microsoft\Event Viewer\RecentViews'
            - '\Microsoft\EventV~1\RecentViews'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using IDiagnostic Profile
Detects the "IDiagnosticProfileUAC" UAC bypass technique
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 4cbef972-f347-4170-b62a-8253f6168e6d
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\DllHost.exe" and 
 actor_process_command_line contains " /Processid:{12C21EA7-2EB8-4B55-9249-AC243DA8C666}" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using IDiagnostic Profile
id: 4cbef972-f347-4170-b62a-8253f6168e6d
status: test
description: Detects the "IDiagnosticProfileUAC" UAC bypass technique
references:
    - https://github.com/Wh04m1001/IDiagnosticProfileUAC
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-03
modified: 2024-12-01
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\DllHost.exe'
        ParentCommandLine|contains: ' /Processid:{12C21EA7-2EB8-4B55-9249-AC243DA8C666}'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate High FP
UAC Bypass Using IDiagnostic Profile - File
Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 48ea844d-19b1-4642-944e-fe39c2cc1fec
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\DllHost.exe" and 
 action_file_name contains "C:\Windows\System32\" and 
 action_file_name contains ".dll"))
view Sigma YAML 
title: UAC Bypass Using IDiagnostic Profile - File
id: 48ea844d-19b1-4642-944e-fe39c2cc1fec
status: test
description: Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique
references:
    - https://github.com/Wh04m1001/IDiagnosticProfileUAC
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-03
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\DllHost.exe'
        TargetFilename|startswith: 'C:\Windows\System32\'
        TargetFilename|endswith: '.dll'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using IEInstal - File
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id bdd8157d-8e85-4397-bb82-f06cc9c71dbb
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path = "C:\Program Files\Internet Explorer\IEInstal.exe" and 
 action_file_name contains "C:\Users\" and 
 action_file_name contains "\AppData\Local\Temp\" and 
 action_file_name contains "consent.exe"))
view Sigma YAML 
title: UAC Bypass Using IEInstal - File
id: bdd8157d-8e85-4397-bb82-f06cc9c71dbb
status: test
description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        Image: 'C:\Program Files\Internet Explorer\IEInstal.exe'
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|contains: '\AppData\Local\Temp\'
        TargetFilename|endswith: 'consent.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using IEInstal - Process
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 80fc36aa-945e-4181-89f2-2f907ab6775d
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288")) and 
 actor_process_image_path contains "\ieinstal.exe" and 
 action_process_image_path contains "\AppData\Local\Temp\" and 
 action_process_image_path contains "consent.exe"))
view Sigma YAML 
title: UAC Bypass Using IEInstal - Process
id: 80fc36aa-945e-4181-89f2-2f907ab6775d
status: test
description: Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
        ParentImage|endswith: '\ieinstal.exe'
        Image|contains: '\AppData\Local\Temp\'
        Image|endswith: 'consent.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Iscsicpl - ImageLoad
Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 9ed5959a-c43c-4c59-84e3-d28628429456
cortex_xdr query
config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path = "C:\Windows\SysWOW64\iscsicpl.exe" and 
 action_module_path contains "\iscsiexe.dll") and 
 (not 
 (action_module_path contains "C:\Windows\" and 
 action_module_path contains "iscsiexe.dll"))))
view Sigma YAML 
title: UAC Bypass Using Iscsicpl - ImageLoad
id: 9ed5959a-c43c-4c59-84e3-d28628429456
status: test
description: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%
references:
    - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
    - https://twitter.com/wdormann/status/1547583317410607110
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-17
modified: 2022-07-25
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image: C:\Windows\SysWOW64\iscsicpl.exe
        ImageLoaded|endswith: '\iscsiexe.dll'
    filter:
        ImageLoaded|contains|all:
            - 'C:\Windows\'
            - 'iscsiexe.dll'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using MSConfig Token Modification - File
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 41bb431f-56d8-4691-bb56-ed34e390906f
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name contains "C:\Users\" and 
 action_file_name contains "\AppData\Local\Temp\pkgmgr.exe"))
view Sigma YAML 
title: UAC Bypass Using MSConfig Token Modification - File
id: 41bb431f-56d8-4691-bb56-ed34e390906f
status: test
description: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|endswith: '\AppData\Local\Temp\pkgmgr.exe'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using MSConfig Token Modification - Process
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id ad92e3f9-7eb6-460e-96b1-582b0ccbb980
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288")) and 
 actor_process_image_path contains "\AppData\Local\Temp\pkgmgr.exe" and 
 action_process_image_command_line = "\"C:\Windows\system32\msconfig.exe\" -5"))
view Sigma YAML 
title: UAC Bypass Using MSConfig Token Modification - Process
id: ad92e3f9-7eb6-460e-96b1-582b0ccbb980
status: test
description: Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
        ParentImage|endswith: '\AppData\Local\Temp\pkgmgr.exe'
        CommandLine: '"C:\Windows\system32\msconfig.exe" -5'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using NTFS Reparse Point - File
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 7fff6773-2baa-46de-a24a-b6eec1aba2d1
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_file_name contains "C:\Users\" and 
 action_file_name contains "\AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1.DLL"))
view Sigma YAML 
title: UAC Bypass Using NTFS Reparse Point - File
id: 7fff6773-2baa-46de-a24a-b6eec1aba2d1
status: test
description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|endswith: '\AppData\Local\Temp\api-ms-win-core-kernel32-legacy-l1.DLL'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Strong Medium FP
UAC Bypass Using NTFS Reparse Point - Process
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 39ed3c80-e6a1-431b-9df3-911ac53d08a7
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_command_line contains "\"C:\Windows\system32\wusa.exe\"  /quiet C:\Users\" and 
 action_process_image_command_line contains "\AppData\Local\Temp\update.msu" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))) or 
 (actor_process_command_line = "\"C:\Windows\system32\dism.exe\" /online /quiet /norestart /add-package /packagepath:\"C:\Windows\system32\pe386\" /ignorecheck" and 
 (((action_process_integrity_level gte 12288 and action_process_integrity_level lt 16384) or action_process_integrity_level gte 16384)) and 
 (action_process_image_command_line contains "C:\Users\" and 
 action_process_image_command_line contains "\AppData\Local\Temp\" and 
 action_process_image_command_line contains "\dismhost.exe {") and 
 action_process_image_path contains "\DismHost.exe")))
view Sigma YAML 
title: UAC Bypass Using NTFS Reparse Point - Process
id: 39ed3c80-e6a1-431b-9df3-911ac53d08a7
status: test
description: Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-30
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|startswith: '"C:\Windows\system32\wusa.exe"  /quiet C:\Users\'
        CommandLine|endswith: '\AppData\Local\Temp\update.msu'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    selection2:
        ParentCommandLine: '"C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Windows\system32\pe386" /ignorecheck'
        IntegrityLevel:
            - 'High'
            - 'System'
        CommandLine|contains|all:
            - 'C:\Users\'
            - '\AppData\Local\Temp\'
            - '\dismhost.exe {'
        Image|endswith: '\DismHost.exe'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using PkgMgr and DISM
Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id a743ceba-c771-4d75-97eb-8a90f7f4844c
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (actor_process_image_path contains "\pkgmgr.exe" and 
 action_process_image_path contains "\dism.exe" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using PkgMgr and DISM
id: a743ceba-c771-4d75-97eb-8a90f7f4844c
status: test
description: Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\pkgmgr.exe'
        Image|endswith: '\dism.exe'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Windows Media Player - File
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 68578b43-65df-4f81-9a9b-92f32711a951
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_file_name contains "C:\Users\" and 
 action_file_name contains "\AppData\Local\Temp\OskSupport.dll") or 
 (actor_process_image_path = "C:\Windows\system32\DllHost.exe" and 
 action_file_name = "C:\Program Files\Windows Media Player\osk.exe")))
view Sigma YAML 
title: UAC Bypass Using Windows Media Player - File
id: 68578b43-65df-4f81-9a9b-92f32711a951
status: test
description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2022-10-09
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: file_event
    product: windows
detection:
    selection1:
        TargetFilename|startswith: 'C:\Users\'
        TargetFilename|endswith: '\AppData\Local\Temp\OskSupport.dll'
    selection2:
        Image: 'C:\Windows\system32\DllHost.exe'
        TargetFilename: 'C:\Program Files\Windows Media Player\osk.exe'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Windows Media Player - Process
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 0058b9e5-bcd7-40d4-9205-95ca5a16d7b2
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_process_image_path = "C:\Program Files\Windows Media Player\osk.exe" or 
 (action_process_image_path = "C:\Windows\System32\cmd.exe" and 
 actor_process_command_line = "\"C:\Windows\system32\mmc.exe\" \"C:\Windows\system32\eventvwr.msc\" /s")) and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass Using Windows Media Player - Process
id: 0058b9e5-bcd7-40d4-9205-95ca5a16d7b2
status: test
description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img_1:
        Image: 'C:\Program Files\Windows Media Player\osk.exe'
    selection_img_2:
        Image: 'C:\Windows\System32\cmd.exe'
        ParentCommandLine: '"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s'
    selection_integrity:
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: 1 of selection_img_* and selection_integrity
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass Using Windows Media Player - Registry
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 5f9db380-ea57-4d1e-beab-8a2d33397e93
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe" and 
 (action_registry_value_name = "Binary Data" or 
 action_registry_data = "Binary Data")))
view Sigma YAML 
title: UAC Bypass Using Windows Media Player - Registry
id: 5f9db380-ea57-4d1e-beab-8a2d33397e93
status: test
description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)
references:
    - https://github.com/hfiref0x/UACME
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe'
        Details: 'Binary Data'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate High FP
UAC Bypass Via Wsreset
Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.
status test author oscd.community, Dmitry Uchakin ATT&CK sub-technique id 6ea3bf32-9680-422d-9f50-e90716b12a66
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter event_type = ENUM.REGISTRY and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command")
view Sigma YAML 
title: UAC Bypass Via Wsreset
id: 6ea3bf32-9680-422d-9f50-e90716b12a66
status: test
description: Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.
references:
    - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly
    - https://lolbas-project.github.io/lolbas/Binaries/Wsreset
author: oscd.community, Dmitry Uchakin
date: 2020-10-07
modified: 2021-11-27
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: '\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\Shell\open\command'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass WSReset
Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config
status test author Christian Burkard (Nextron Systems) ATT&CK sub-technique id 89a9a0e0-f61a-42e5-8957-b1479565a658
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_process_image_path contains "\wsreset.exe" and 
 (action_process_integrity_level in ("High", "System", "S-1-16-16384", "S-1-16-12288"))))
view Sigma YAML 
title: UAC Bypass WSReset
id: 89a9a0e0-f61a-42e5-8957-b1479565a658
status: test
description: Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
    - https://github.com/hfiref0x/UACME
    - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
author: Christian Burkard (Nextron Systems)
date: 2021-08-23
modified: 2024-12-01
tags:
    - attack.privilege-escalation
    - attack.t1548.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\wsreset.exe'
        IntegrityLevel:
            - 'High'
            - 'System'
            - 'S-1-16-16384' # System
            - 'S-1-16-12288' # High
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Strong Medium FP
UAC Bypass With Fake DLL
Attempts to load dismcore.dll after dropping it
status test author oscd.community, Dmitry Uchakin ATT&CK sub-technique id a5ea83a7-05a5-44c1-be2e-addccbbd8c03
cortex_xdr query
config case_sensitive = false | preset=xdr_image_load | filter event_type = ENUM.LOAD_IMAGE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path contains "\dism.exe" and 
 action_module_path contains "\dismcore.dll") and 
 (not 
 action_module_path = "C:\Windows\System32\Dism\dismcore.dll")))
view Sigma YAML 
title: UAC Bypass With Fake DLL
id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03
status: test
description: Attempts to load dismcore.dll after dropping it
references:
    - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility
author: oscd.community, Dmitry Uchakin
date: 2020-10-06
modified: 2022-12-25
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1548.002
    - attack.t1574.001
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\dism.exe'
        ImageLoaded|endswith: '\dismcore.dll'
    filter:
        ImageLoaded: 'C:\Windows\System32\Dism\dismcore.dll'
    condition: selection and not filter
falsepositives:
    - Actions of a legitimate telnet client
level: high
Convert to SIEM query
high Moderate High FP
UAC Bypass via Event Viewer
Detects UAC bypass method using Windows event viewer
status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 7c81fec3-1c1d-43b0-996a-46753041b1b6
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_registry_key_name contains "\mscfile\shell\open\command")
view Sigma YAML 
title: UAC Bypass via Event Viewer
id: 7c81fec3-1c1d-43b0-996a-46753041b1b6
status: test
description: Detects UAC bypass method using Windows event viewer
references:
    - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
    - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
author: Florian Roth (Nextron Systems)
date: 2017-03-19
modified: 2023-09-28
tags:
    - attack.privilege-escalation
    - attack.t1548.002
    - car.2019-04-001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|endswith: '\mscfile\shell\open\command'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UAC Bypass via Sdclt
Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
status test author Omer Yampel, Christian Burkard (Nextron Systems) ATT&CK sub-technique id 5b872a46-3b90-45c1-8419-f675db8053aa
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (action_registry_key_name contains "Software\Classes\exefile\shell\runas\command\isolatedCommand" or 
 (action_registry_key_name contains "Software\Classes\Folder\shell\open\command\SymbolicLinkValue" and 
 (action_registry_value_name ~= "-1[0-9]{3}\\Software\\Classes\\" or 
 action_registry_data ~= "-1[0-9]{3}\\Software\\Classes\\"))))
view Sigma YAML 
title: UAC Bypass via Sdclt
id: 5b872a46-3b90-45c1-8419-f675db8053aa
status: test
description: Detects the pattern of UAC Bypass using registry key manipulation of sdclt.exe (e.g. UACMe 53)
references:
    - https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/
    - https://github.com/hfiref0x/UACME
author: Omer Yampel, Christian Burkard (Nextron Systems)
date: 2017-03-17
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.t1548.002
    - car.2019-04-001
logsource:
    category: registry_set
    product: windows
detection:
    selection1:
        TargetObject|endswith: 'Software\Classes\exefile\shell\runas\command\isolatedCommand'
    selection2:
        TargetObject|endswith: 'Software\Classes\Folder\shell\open\command\SymbolicLinkValue'
        Details|re: '-1[0-9]{3}\\Software\\Classes\\'
    condition: 1 of selection*
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UEFI Persistence Via Wpbbin - FileCreation
Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_file_name = "C:\Windows\System32\wpbbin.exe")
view Sigma YAML 
title: UEFI Persistence Via Wpbbin - FileCreation
id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f
status: test
description: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method
references:
    - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
    - https://persistence-info.github.io/Data/wpbbin.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-18
tags:
    - attack.persistence
    - attack.stealth
    - attack.t1542.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename: 'C:\Windows\System32\wpbbin.exe'
    condition: selection
falsepositives:
    - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)
level: high
Convert to SIEM query
high Moderate Medium FP
UEFI Persistence Via Wpbbin - ProcessCreation
Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK sub-technique id 4abc0ec4-db5a-412f-9632-26659cddf145
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 action_process_image_path = "C:\Windows\System32\wpbbin.exe")
view Sigma YAML 
title: UEFI Persistence Via Wpbbin - ProcessCreation
id: 4abc0ec4-db5a-412f-9632-26659cddf145
status: test
description: Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section
references:
    - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
    - https://persistence-info.github.io/Data/wpbbin.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-18
tags:
    - attack.persistence
    - attack.stealth
    - attack.t1542.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image: 'C:\Windows\System32\wpbbin.exe'
    condition: selection
falsepositives:
    - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip)
level: high
Convert to SIEM query
high Strong Medium FP
UNC2452 Process Creation Patterns
Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries
status test author Florian Roth (Nextron Systems) ATT&CK sub-technique id 9be34ad0-b6a7-4fbd-91cf-fc7ec1047f5f
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 (((action_process_image_command_line in ("*7z.exe a -v500m -mx9 -r0 -p*", "*7z.exe a -mx9 -r0 -p*")) and 
 (action_process_image_command_line contains ".zip" and 
 action_process_image_command_line contains ".txt")) or 
 ((action_process_image_command_line in ("*7z.exe a -v500m -mx9 -r0 -p*", "*7z.exe a -mx9 -r0 -p*")) and 
 (action_process_image_command_line contains ".zip" and 
 action_process_image_command_line contains ".log")) or 
 ((actor_process_command_line contains "wscript.exe" and 
 actor_process_command_line contains ".vbs") and 
 (action_process_image_command_line contains "rundll32.exe" and 
 action_process_image_command_line contains "C:\Windows" and 
 action_process_image_command_line contains ".dll,Tk_")) or 
 (actor_process_image_path contains "\rundll32.exe" and 
 (actor_process_command_line contains "C:\Windows" and 
 actor_process_command_line contains ".dll") and 
 action_process_image_command_line contains "cmd.exe /C ") or 
 (actor_process_image_path contains "\rundll32.exe" and 
 action_process_image_path contains "\dllhost.exe" and 
 action_process_image_command_line = "")))
view Sigma YAML 
title: UNC2452 Process Creation Patterns
id: 9be34ad0-b6a7-4fbd-91cf-fc7ec1047f5f
status: test
description: Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries
references:
    - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
author: Florian Roth (Nextron Systems)
date: 2021-01-22
modified: 2024-09-12
tags:
    - attack.execution
    - attack.t1059.001
    - detection.emerging-threats
    # - sunburst
    # - unc2452
logsource:
    category: process_creation
    product: windows
detection:
    # To avoid writing complex condition. "selection_generic_1" and "selection_generic_2" are the same except for the extension used.
    selection_generic_1:
        CommandLine|contains:
            - '7z.exe a -v500m -mx9 -r0 -p'
            - '7z.exe a -mx9 -r0 -p'
        CommandLine|contains|all:
            - '.zip'
            - '.txt'
    selection_generic_2:
        CommandLine|contains:
            - '7z.exe a -v500m -mx9 -r0 -p'
            - '7z.exe a -mx9 -r0 -p'
        CommandLine|contains|all:
            - '.zip'
            - '.log'
    selection_generic_3:
        ParentCommandLine|contains|all:
            - 'wscript.exe'
            - '.vbs'
        CommandLine|contains|all:
            - 'rundll32.exe'
            - 'C:\Windows'
            - '.dll,Tk_'
    selection_generic_4:
        ParentImage|endswith: '\rundll32.exe'
        ParentCommandLine|contains|all:
            - 'C:\Windows'
            - '.dll'
        CommandLine|contains: 'cmd.exe /C '
    selection_generic_5:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith: '\dllhost.exe'
        CommandLine: ''
    condition: 1 of selection_generic_*
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate High FP
UNC4841 - Barracuda ESG Exploitation Indicators
Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 5627c337-a9b2-407a-a82d-5fd97035ff39
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_file_name in ("*/11111.tar", "*/aacore.sh", "*/appcheck.sh", "*/autoins", "*/BarracudaMailService", "*/etc/cron.daily/core_check.sh", "*/etc/cron.daily/core.sh", "*/etc/cron.hourly/aacore.sh", "*/etc/cron.hourly/appcheck.sh", "*/etc/cron.hourly/core.sh", "*/get_fs_info.pl", "*/imgdata.jpg", "*/install_att_v2.tar", "*/install_bvp74_auth.tar", "*/install_helo.tar", "*/install_reuse.tar", "*/intent_helo", "*/intent_reuse", "*/intentbas", "*/mod_attachment.lua", "*/mod_content.lua", "*/mod_require_helo.lua", "*/mod_rtf", "*/mod_sender.lua", "*/mod_udp.so", "*/nfsd_stub.ko", "*/resize_reisertab", "*/resize_risertab", "*/resize2fstab", "*/rverify", "*/saslautchd", "*/sendscd", "*/snapshot.tar", "*/tmp/p", "*/tmp/p7", "*/tmp/t", "*/update_v2.sh", "*/update_v31.sh", "*/update_v35.sh", "*/update_version")))
view Sigma YAML 
title: UNC4841 - Barracuda ESG Exploitation Indicators
id: 5627c337-a9b2-407a-a82d-5fd97035ff39
status: test
description: Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
modified: 2025-08-19
tags:
    - attack.execution
    - attack.persistence
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '/11111.tar'
            - '/aacore.sh'
            - '/appcheck.sh'
            - '/autoins'
            - '/BarracudaMailService'
            - '/etc/cron.daily/core_check.sh'
            - '/etc/cron.daily/core.sh'
            - '/etc/cron.hourly/aacore.sh'
            - '/etc/cron.hourly/appcheck.sh'
            - '/etc/cron.hourly/core.sh'
            - '/get_fs_info.pl'
            - '/imgdata.jpg'
            - '/install_att_v2.tar'
            - '/install_bvp74_auth.tar'
            - '/install_helo.tar'
            - '/install_reuse.tar'
            - '/intent_helo'
            - '/intent_reuse'
            - '/intentbas'
            # - '/mknod'
            - '/mod_attachment.lua'
            - '/mod_content.lua'
            - '/mod_require_helo.lua'
            - '/mod_rtf'
            - '/mod_sender.lua'
            - '/mod_udp.so'
            - '/nfsd_stub.ko'
            - '/resize_reisertab'
            - '/resize_risertab'
            - '/resize2fstab'
            - '/rverify'
            - '/saslautchd'
            - '/sendscd'
            - '/snapshot.tar'
            - '/tmp/p'
            - '/tmp/p7'
            - '/tmp/t'
            - '/update_v2.sh'
            - '/update_v31.sh'
            - '/update_v35.sh'
            - '/update_version'
    condition: selection
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Moderate High FP
UNC4841 - Download Compressed Files From Temp.sh Using Wget
Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 60d050c4-e253-4d9a-b673-5ac100cfddfb
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_process_image_path contains "/wget" and 
 action_process_image_command_line contains "https://temp.sh/" and 
 (action_process_image_command_line in ("*.rar", "*.zip"))))
view Sigma YAML 
title: UNC4841 - Download Compressed Files From Temp.sh Using Wget
id: 60d050c4-e253-4d9a-b673-5ac100cfddfb
status: test
description: Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.stealth
    - attack.t1140
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/wget'
        CommandLine|contains: 'https://temp.sh/'
        CommandLine|endswith:
            - '.rar'
            - '.zip'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Strong Medium FP
UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 23835beb-ec38-4e74-a5d4-b99af6684e91
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 ((action_process_image_path contains "/wget" and 
 action_process_image_command_line ~= "https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" and 
 action_process_image_command_line contains "--no-check-certificate" and 
 action_process_image_command_line contains ".tar") and 
 (not 
 (action_process_image_command_line in ("*https://10.*", "*https://192.168.*", "*https://172.16.*", "*https://172.17.*", "*https://172.18.*", "*https://172.19.*", "*https://172.20.*", "*https://172.21.*", "*https://172.22.*", "*https://172.23.*", "*https://172.24.*", "*https://172.25.*", "*https://172.26.*", "*https://172.27.*", "*https://172.28.*", "*https://172.29.*", "*https://172.30.*", "*https://172.31.*", "*https://127.*", "*https://169.254.*")))))
view Sigma YAML 
title: UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
id: 23835beb-ec38-4e74-a5d4-b99af6684e91
status: test
description: Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.stealth
    - attack.t1140
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/wget'
        CommandLine|re: 'https://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
        CommandLine|contains: '--no-check-certificate'
        CommandLine|endswith: '.tar'
    filter_main_local_ips:
        # Note: Uncomment this filter if you want to exclude local IPs
        CommandLine|contains:
            - 'https://10.' # 10.0.0.0/8
            - 'https://192.168.' # 192.168.0.0/16
            - 'https://172.16.' # 172.16.0.0/12
            - 'https://172.17.'
            - 'https://172.18.'
            - 'https://172.19.'
            - 'https://172.20.'
            - 'https://172.21.'
            - 'https://172.22.'
            - 'https://172.23.'
            - 'https://172.24.'
            - 'https://172.25.'
            - 'https://172.26.'
            - 'https://172.27.'
            - 'https://172.28.'
            - 'https://172.29.'
            - 'https://172.30.'
            - 'https://172.31.'
            - 'https://127.' # 127.0.0.0/8
            - 'https://169.254.' # 169.254.0.0/16
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate High FP
UNC4841 - Email Exfiltration File Pattern
Detects filename pattern of email related data used by UNC4841 for staging and exfiltration
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK tactic-only id 0785f462-60b0-4031-9ff4-b4f3a0ba589a
cortex_xdr query
config case_sensitive = false | preset=xdr_file | filter event_type = ENUM.FILE and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 action_file_name ~= "/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}\.tar\.gz")
view Sigma YAML 
title: UNC4841 - Email Exfiltration File Pattern
id: 0785f462-60b0-4031-9ff4-b4f3a0ba589a
status: test
description: Detects filename pattern of email related data used by UNC4841 for staging and exfiltration
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.execution
    - attack.persistence
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: linux
    category: file_event
detection:
    selection:
        TargetFilename|re: '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}\.tar\.gz'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Moderate Medium FP
UNC4841 - SSL Certificate Exfiltration Via Openssl
Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.
status test author Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 60911c07-f989-4362-84af-c609828ef829
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_LINUX and 
 (action_process_image_path contains "/openssl" and 
 action_process_image_command_line ~= "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" and 
 (action_process_image_command_line contains "s_client" and 
 action_process_image_command_line contains "-quiet" and 
 action_process_image_command_line contains "-connect") and 
 (action_process_image_command_line in ("*:443*", "*:8080*"))))
view Sigma YAML 
title: UNC4841 - SSL Certificate Exfiltration Via Openssl
id: 60911c07-f989-4362-84af-c609828ef829
status: test
description: Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.
references:
    - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-16
tags:
    - attack.stealth
    - attack.t1140
    - detection.emerging-threats
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|endswith: '/openssl'
        CommandLine|re: '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
        CommandLine|contains|all:
            - 's_client'
            - '-quiet'
            - '-connect'
        CommandLine|contains:
            - ':443'
            - ':8080'
    condition: selection
falsepositives:
    - Unknown
level: high
Convert to SIEM query
high Strong Medium FP
Uncommon Child Process Of Setres.EXE
Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.
status test author @gott_cyber, Nasreddine Bencherchali (Nextron Systems) ATT&CK technique id 835e75bf-4bfd-47a4-b8a6-b766cac8bcb7
cortex_xdr query
config case_sensitive = false | preset=xdr_process | filter (event_type = ENUM.PROCESS and 
 event_sub_type = ENUM.PROCESS_START) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((actor_process_image_path contains "\setres.exe" and 
 action_process_image_path contains "\choice") and 
 (not 
 (action_process_image_path in ("*C:\Windows\System32\choice.exe", "*C:\Windows\SysWOW64\choice.exe")))))
view Sigma YAML 
title: Uncommon Child Process Of Setres.EXE
id: 835e75bf-4bfd-47a4-b8a6-b766cac8bcb7
status: test
description: |
    Detects uncommon child process of Setres.EXE.
    Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution.
    It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.
references:
    - https://lolbas-project.github.io/lolbas/Binaries/Setres/
    - https://twitter.com/0gtweet/status/1583356502340870144
    - https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html
    - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
author: '@gott_cyber, Nasreddine Bencherchali (Nextron Systems)'
date: 2022-12-11
modified: 2024-06-26
tags:
    - attack.stealth
    - attack.t1218
    - attack.t1202
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\setres.exe'
        Image|contains: '\choice'
    filter_main_legit_location:
        Image|endswith:
            - 'C:\Windows\System32\choice.exe'
            - 'C:\Windows\SysWOW64\choice.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
Convert to SIEM query
high Strong High FP
Uncommon Extension In Keyboard Layout IME File Registry Value
Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
status test author X__Junior (Nextron Systems) ATT&CK technique id b888e3f2-224d-4435-b00b-9dd66e9ea1f1
cortex_xdr query
config case_sensitive = false | preset=xdr_registry | filter (event_type = ENUM.REGISTRY and 
 event_sub_type = ENUM.REGISTRY_SET_VALUE) and 
 (agent_os_type = ENUM.AGENT_OS_WINDOWS and 
 ((action_registry_key_name contains "\Control\Keyboard Layouts\" and 
 action_registry_key_name contains "Ime File") and 
 (not 
 (action_registry_value_name contains ".ime" or 
 action_registry_data contains ".ime"))))
view Sigma YAML 
title: Uncommon Extension In Keyboard Layout IME File Registry Value
id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1
related:
    - id: 9d8f9bb8-01af-4e15-a3a2-349071530530
      type: derived
status: test
description: |
    Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message.
    Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path.
    IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
references:
    - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
author: X__Junior (Nextron Systems)
date: 2023-11-21
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains|all:
            - '\Control\Keyboard Layouts\'
            - 'Ime File'
    filter_main_known_extension:
        Details|endswith: '.ime'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean.
level: high
Convert to SIEM query
Showing 751-800 of 1,524
Prev 16 Next
◈SOC and Response
◆Detection Engineering
◎Threat Hunting
▲Red Team and Pentest
■Compliance and GRC
◉Atlas
Search Tools & malware CWE Package vulns
◯About
All capabilities Pricing API docs Privacy policy Terms of service
threatengine.sh