title: PUA - Fast Reverse Proxy (FRP) Execution
id: 32410e29-5f94-4568-b6a3-d91a8adad863
status: test
description: Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
references:
    - https://asec.ahnlab.com/en/38156/
    - https://github.com/fatedier/frp
author: frack113, Florian Roth
date: 2022-09-02
modified: 2024-11-23
tags:
    - attack.command-and-control
    - attack.t1090
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\frpc.exe'
            - '\frps.exe'
    selection_cli:
        CommandLine|contains: '\frpc.ini'
    selection_hashes:
        # v0.44.0
        Hashes|contains:
            - "MD5=7D9C233B8C9E3F0EA290D2B84593C842"
            - "SHA1=06DDC9280E1F1810677935A2477012960905942F"
            - "SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C"
    condition: 1 of selection_*
falsepositives:
    - Legitimate use
level: high

title: PUA - Kernel Driver Utility (KDU) Execution
id: e76ca062-4de0-4d79-8d90-160a0d335eca
status: experimental
description: |
    Detects execution of the Kernel Driver Utility (KDU) tool.
    KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.
    Potentially allowing for privilege escalation, persistence, or evasion of security controls.
references:
    - https://github.com/h4rmy/KDU
    - https://huntress.com/blog/esxi-vm-escape-exploit
author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
date: 2026-01-02
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.t1543.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\kdu.exe'
              - '\hamakaze.exe'
        - OriginalFileName: 'hamakaze.exe'
    selection_cli_suspicious:
        CommandLine|contains:
            - '-map ' # map driver to the kernel and execute it entry point
            - '-prv ' # optional, select vulnerability driver provider
            - '-dse ' # write user defined value to the system DSE state flags; dse=0(disable),dse=1(enable)
            - '-ps ' #  modify process object of given ProcessID;
    condition: all of selection_*
falsepositives:
    - Legitimate driver development, testing, or administrative troubleshooting (e.g., enabling/disabling hardware)
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_kdu_driver_tool/info.yml

title: PUA - Memory Dump Mount Via MemProcFS
id: 8a1b2c3d-4e5f-6789-abcd-ef1234567890
status: experimental
description: |
    Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
    MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
    Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
    MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.
references:
    - https://github.com/ufrisk/MemProcFS
    - https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html#
    - https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2026-04-27
tags:
    - attack.credential-access
    - attack.t1003
    - attack.t1003.001
    - attack.t1003.004
    - attack.t1003.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\MemProcFS.exe'
        - OriginalFileName: 'MemProcFS.exe'
        - Description: 'MemProcFS'
    selection_cli:
        CommandLine|contains: '-device'
    condition: all of selection_*
falsepositives:
    - Legitimate use during memory forensics; if not part of authorized analysis, warrants urgent investigation
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_memprocfs/info.yml

title: PUA - NPS Tunneling Tool Execution
id: 68d37776-61db-42f5-bf54-27e87072d17e
status: test
description: Detects the use of NPS, a port forwarding and intranet penetration proxy server
references:
    - https://github.com/ehang-io/nps
author: Florian Roth (Nextron Systems)
date: 2022-10-08
modified: 2024-11-23
tags:
    - attack.command-and-control
    - attack.t1090
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\npc.exe'
    selection_cli_1:
        CommandLine|contains|all:
            - ' -server='
            - ' -vkey='
            - ' -password='
    selection_cli_2:
        CommandLine|contains: ' -config=npc'
    selection_hashes:
        # v0.26.10
        Hashes|contains:
            - "MD5=AE8ACF66BFE3A44148964048B826D005"
            - "SHA1=CEA49E9B9B67F3A13AD0BE1C2655293EA3C18181"
            - "SHA256=5A456283392FFCEEEACA3D3426C306EB470304637520D72FED1CC1FEBBBD6856"
    condition: 1 of selection_*
falsepositives:
    - Legitimate use
level: high

title: PUA - NSudo Execution
id: 771d1eb5-9587-4568-95fb-9ec44153a012
status: test
description: Detects the use of NSudo tool for command execution
references:
    - https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
date: 2022-01-24
modified: 2023-02-13
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\NSudo.exe'
              - '\NSudoLC.exe'
              - '\NSudoLG.exe'
        - OriginalFileName:
              - 'NSudo.exe'
              - 'NSudoLC.exe'
              - 'NSudoLG.exe'
    selection_cli:
        CommandLine|contains:
            # Covers Single/Double dash "-"/"--" + ":"
            - '-U:S ' # System
            - '-U:T ' # Trusted Installer
            - '-U:E ' # Elevated
            - '-P:E ' # Enable All Privileges
            - '-M:S ' # System Integrity
            - '-M:H ' # High Integrity
            # Covers Single/Double dash "-"/"--" + "="
            - '-U=S '
            - '-U=T '
            - '-U=E '
            - '-P=E '
            - '-M=S '
            - '-M=H '
            - '-ShowWindowMode:Hide'
    condition: all of selection_*
falsepositives:
    - Legitimate use by administrators
level: high

title: PUA - Netcat Suspicious Execution
id: e31033fc-33f0-4020-9a16-faf9b31cbf08
status: test
description: Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
references:
    - https://nmap.org/ncat/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
    - https://www.revshells.com/
author: frack113, Florian Roth (Nextron Systems)
date: 2021-07-21
modified: 2023-02-08
tags:
    - attack.command-and-control
    - attack.t1095
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        # can not use OriginalFileName as is empty
        Image|endswith:
            - '\nc.exe'
            - '\ncat.exe'
            - '\netcat.exe'
    selection_cmdline:
        # Typical command lines
        CommandLine|contains:
            - ' -lvp '
            - ' -lvnp'
            - ' -l -v -p '
            - ' -lv -p '
            - ' -l --proxy-type http '
            # - ' --exec cmd.exe ' # Not specific enough for netcat
            - ' -vnl --exec '
            - ' -vnl -e '
            - ' --lua-exec '
            - ' --sh-exec '
    condition: 1 of selection_*
falsepositives:
    - Legitimate ncat use
level: high

title: PUA - Ngrok Execution
id: ee37eb7c-a4e7-4cd5-8fa4-efa27f1c3f31
status: test
description: |
  Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
  Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
references:
    - https://ngrok.com/docs
    - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
    - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp
    - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection
    - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/
    - https://twitter.com/xorJosh/status/1598646907802451969
    - https://www.softwaretestinghelp.com/how-to-use-ngrok/
author: Florian Roth (Nextron Systems)
date: 2021-05-14
modified: 2023-02-21
tags:
    - attack.command-and-control
    - attack.t1572
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        CommandLine|contains:
            - ' tcp 139'
            - ' tcp 445'
            - ' tcp 3389'
            - ' tcp 5985'
            - ' tcp 5986'
    selection2:
        CommandLine|contains|all:
            - ' start '
            - '--all'
            - '--config'
            - '.yml'
    selection3:
        Image|endswith: 'ngrok.exe'
        CommandLine|contains:
            - ' tcp '
            - ' http '
            - ' authtoken '
    selection4:
        CommandLine|contains:
            - '.exe authtoken '
            - '.exe start --all'
    condition: 1 of selection*
falsepositives:
    - Another tool that uses the command line switches of Ngrok
    - Ngrok http 3978 (https://learn.microsoft.com/en-us/azure/bot-service/bot-service-debug-channel-ngrok?view=azure-bot-service-4.0)
level: high

title: PUA - Nimgrab Execution
id: 74a12f18-505c-4114-8d0b-8448dd5485c6
status: test
description: Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
author: frack113
date: 2022-08-28
modified: 2024-11-23
tags:
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection_name:
        Image|endswith: '\nimgrab.exe'
    selection_hashes:
        Hashes|contains:
            - MD5=2DD44C3C29D667F5C0EF5F9D7C7FFB8B
            - SHA256=F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559
            - IMPHASH=C07FDDD21D123EA9B3A08EEF44AAAC45
    condition: 1 of selection_*
falsepositives:
    - Legitimate use of Nim on a developer systems
level: high

title: PUA - NirCmd Execution As LOCAL SYSTEM
id: d9047477-0359-48c9-b8c7-792cedcdc9c4
status: test
description: Detects the use of NirCmd tool for command execution as SYSTEM user
references:
    - https://www.nirsoft.net/utils/nircmd.html
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
    - https://www.nirsoft.net/utils/nircmd2.html#using
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-01-24
modified: 2023-02-13
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: ' runassystem '
    condition: selection
falsepositives:
    - Legitimate use by administrators
level: high

title: PUA - PingCastle Execution From Potentially Suspicious Parent
id: b37998de-a70b-4f33-b219-ec36bf433dc0
related:
    - id: b1cb4ab6-ac31-43f4-adf1-d9d08957419c
      type: derived
status: test
description: |
    Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.
references:
    - https://github.com/vletoux/pingcastle
    - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
    - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d833004836507da36a58/Functions/Start-ADEnum.ps1#L450
    - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
    - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
    - https://github.com/802-1x/Compliance/blob/2e53df8b6e89686a0b91116b3f42c8f717dca820/Ping%20Castle/Get-PingCastle-HTMLComplianceReport.ps1#L8
    - https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2024-01-11
tags:
    - attack.reconnaissance
    - attack.t1595
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent_ext:
        ParentCommandLine|contains:
            - '.bat'
            - '.chm'
            - '.cmd'
            - '.hta'
            - '.htm'
            - '.html'
            - '.js'
            - '.lnk'
            - '.ps1'
            - '.vbe'
            - '.vbs'
            - '.wsf'
    selection_parent_path_1:
        ParentCommandLine|contains:
            - ':\Perflogs\'
            - ':\Temp\'
            - ':\Users\Public\'
            - ':\Windows\Temp\'
            - '\AppData\Local\Temp'
            - '\AppData\Roaming\'
            - '\Temporary Internet'
    selection_parent_path_2:
        - ParentCommandLine|contains|all:
              - ':\Users\'
              - '\Favorites\'
        - ParentCommandLine|contains|all:
              - ':\Users\'
              - '\Favourites\'
        - ParentCommandLine|contains|all:
              - ':\Users\'
              - '\Contacts\'
    selection_cli:
        - Image|endswith: '\PingCastle.exe'
        - OriginalFileName: PingCastle.exe
        - Product: 'Ping Castle'
        - CommandLine|contains:
              - '--scanner aclcheck'
              - '--scanner antivirus'
              - '--scanner computerversion'
              - '--scanner foreignusers'
              - '--scanner laps_bitlocker'
              - '--scanner localadmin'
              - '--scanner nullsession'
              - '--scanner nullsession-trust'
              - '--scanner oxidbindings'
              - '--scanner remote'
              - '--scanner share'
              - '--scanner smb'
              - '--scanner smb3querynetwork'
              - '--scanner spooler'
              - '--scanner startup'
              - '--scanner zerologon'
        - CommandLine|contains: '--no-enum-limit'
        - CommandLine|contains|all:
              - '--healthcheck'
              - '--level Full'
        - CommandLine|contains|all:
              - '--healthcheck'
              - '--server '
    condition: 1 of selection_parent_* and selection_parent_ext and selection_cli
falsepositives:
    - Unknown
level: high

title: PUA - Process Hacker Driver Load
id: 67add051-9ee7-4ad3-93ba-42935615ae8d
related:
    - id: 10cb6535-b31d-4512-9962-513dcbc42cc1
      type: similar
status: test
description: Detects driver load of the Process Hacker tool
references:
    - https://processhacker.sourceforge.io/
author: Florian Roth (Nextron Systems)
date: 2022-11-16
modified: 2024-11-23
tags:
    - attack.persistence
    - attack.privilege-escalation
    - cve.2021-21551
    - attack.t1543
logsource:
    category: driver_load
    product: windows
detection:
    selection:
        - ImageLoaded|endswith: '\kprocesshacker.sys'
        - Hashes|contains:
              - 'IMPHASH=821D74031D3F625BCBD0DF08B70F1E77'
              - 'IMPHASH=F86759BB4DE4320918615DC06E998A39'
              - 'IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18'
              - 'IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0'
    condition: selection
falsepositives:
    - Legitimate use of process hacker or system informer by developers or system administrators
level: high

title: PUA - Rclone Execution
id: e37db05d-d1f9-49c8-b464-cee1a4b11638
related:
    - id: a0d63692-a531-4912-ad39-4393325b2a9c
      type: obsolete
    - id: cb7286ba-f207-44ab-b9e6-760d82b84253
      type: obsolete
status: test
description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
references:
    - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
    - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
    - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
    - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
    - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group
date: 2021-05-10
modified: 2023-03-05
tags:
    - attack.exfiltration
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific_options:
        CommandLine|contains|all:
            - '--config '
            - '--no-check-certificate '
            - ' copy '
    selection_rclone_img:
        - Image|endswith: '\rclone.exe'
        - Description: 'Rsync for cloud storage'
    selection_rclone_cli:
        CommandLine|contains:
            - 'pass'
            - 'user'
            - 'copy'
            - 'sync'
            - 'config'
            - 'lsd'
            - 'remote'
            - 'ls'
            - 'mega'
            - 'pcloud'
            - 'ftp'
            - 'ignore-existing'
            - 'auto-confirm'
            - 'transfers'
            - 'multi-thread-streams'
            - 'no-check-certificate '
    condition: selection_specific_options or all of selection_rclone_*
falsepositives:
    - Unknown
level: high

title: PUA - Restic Backup Tool Execution
id: 6ddff2e8-ea1a-45d0-8938-93dfc1d67ae7
status: experimental
description: |
    Detects the execution of the Restic backup tool, which can be used for data exfiltration.
    Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
    If not legitimately used in the enterprise environment, its presence may indicate malicious activity.
references:
    - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
    - https://restic.net/
    - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-10-17
tags:
    - attack.exfiltration
    - attack.t1048
    - attack.t1567.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_specific:
        - CommandLine|contains|all:
              - '--password-file'
              - 'init'
              - ' -r '
        - CommandLine|contains|all:
              - '--use-fs-snapshot'
              - 'backup'
              - ' -r '
    selection_restic:
        CommandLine|contains:
            - 'sftp:'
            - 'rest:http'
            - 's3:s3.'
            - 's3.http'
            - 'azure:'
            - ' gs:'
            - 'rclone:'
            - 'swift:'
            - ' b2:'
        CommandLine|contains|all:
            - ' init '
            - ' -r '
    condition: 1 of selection_*
falsepositives:
    - Legitimate use of Restic for backup purposes within the organization.
level: high

title: PUA - RunXCmd Execution
id: 93199800-b52a-4dec-b762-75212c196542
status: test
description: Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts
references:
    - https://www.d7xtech.com/free-software/runx/
    - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
author: Florian Roth (Nextron Systems)
date: 2022-01-24
modified: 2023-02-14
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: process_creation
    product: windows
detection:
    selection_account:
        CommandLine|contains:
            - ' /account=system '
            - ' /account=ti '
    selection_exec:
        CommandLine|contains: '/exec='
    condition: all of selection_*
falsepositives:
    - Legitimate use by administrators
level: high

title: PUA - Seatbelt Execution
id: 38646daa-e78f-4ace-9de0-55547b2d30da
status: test
description: Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
references:
    - https://github.com/GhostPack/Seatbelt
    - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-10-18
modified: 2023-02-04
tags:
    - attack.discovery
    - attack.t1526
    - attack.t1087
    - attack.t1083
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\Seatbelt.exe'
        - OriginalFileName: 'Seatbelt.exe'
        - Description: 'Seatbelt'
        - CommandLine|contains:
              # This just a list of the commands that will produce the least amount of FP in "theory"
              # Comment out/in as needed in your environment
              # To get the full list of commands see reference section
              - ' DpapiMasterKeys'
              - ' InterestingProcesses'
              - ' InterestingFiles'
              - ' CertificateThumbprints'
              - ' ChromiumBookmarks'
              - ' ChromiumHistory'
              - ' ChromiumPresence'
              - ' CloudCredentials'
              - ' CredEnum'
              - ' CredGuard'
              - ' FirefoxHistory'
              - ' ProcessCreationEvents'
              # - ' RDPSessions'
              # - ' PowerShellHistory'
    selection_group_list:
        CommandLine|contains:
            - ' -group=misc'
            - ' -group=remote'
            - ' -group=chromium'
            - ' -group=slack'
            - ' -group=system'
            - ' -group=user'
            - ' -group=all'
    selection_group_output:
        CommandLine|contains: ' -outputfile='
    condition: selection_img or all of selection_group_*
falsepositives:
    - Unlikely
level: high

title: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
id: 455b9d50-15a1-4b99-853f-8d37655a4c1b
related:
    - id: 9a132afa-654e-11eb-ae93-0242ac130002
      type: similar
    - id: 514e7e3e-b3b4-4a67-af60-be20f139198b
      type: similar
status: test
description: Detects active directory enumeration activity using known AdFind CLI flags
references:
    - https://www.joeware.net/freetools/tools/adfind/
    - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
author: frack113
date: 2021-12-13
modified: 2023-03-05
tags:
    - attack.discovery
    - attack.t1087.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_password: # Listing password policy
        CommandLine|contains:
            - lockoutduration
            - lockoutthreshold
            - lockoutobservationwindow
            - maxpwdage
            - minpwdage
            - minpwdlength
            - pwdhistorylength
            - pwdproperties
    selection_enum_ad: # Enumerate Active Directory Admins
        CommandLine|contains: '-sc admincountdmp'
    selection_enum_exchange: # Enumerate Active Directory Exchange AD Objects
        CommandLine|contains: '-sc exchaddresses'
    condition: 1 of selection_*
falsepositives:
    - Authorized administrative activity
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration/info.yml

title: PUA - Wsudo Suspicious Execution
id: bdeeabc9-ff2a-4a51-be59-bb253aac7891
status: test
description: Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
references:
    - https://github.com/M2Team/Privexec/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-02
modified: 2023-02-14
tags:
    - attack.execution
    - attack.privilege-escalation
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_metadata:
        - Image|endswith: '\wsudo.exe'
        - OriginalFileName: 'wsudo.exe'
        - Description: 'Windows sudo utility'
        - ParentImage|endswith: '\wsudo-bridge.exe'
    selection_cli:
        CommandLine|contains:
            - '-u System'
            - '-uSystem'
            - '-u TrustedInstaller'
            - '-uTrustedInstaller'
            - ' --ti '
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: PUA- IOX Tunneling Tool Execution
id: d7654f02-e04b-4934-9838-65c46f187ebc
status: test
description: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
references:
    - https://github.com/EddieIvan01/iox
author: Florian Roth (Nextron Systems)
date: 2022-10-08
modified: 2024-11-23
tags:
    - attack.command-and-control
    - attack.t1090
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\iox.exe'
    selection_commandline:
        CommandLine|contains:
            - '.exe fwd -l '
            - '.exe fwd -r '
            - '.exe proxy -l '
            - '.exe proxy -r '
    selection_hashes:
        # v0.4
        Hashes|contains:
            - "MD5=9DB2D314DD3F704A02051EF5EA210993"
            - "SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD"
            - "SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731"
    condition: 1 of selection*
falsepositives:
    - Legitimate use
level: high

title: PaperCut MF/NG Exploitation Related Indicators
id: de1bd0b6-6d59-417c-86d9-a44114aede3b
status: test
description: Detects exploitation indicators related to PaperCut MF/NG Exploitation
references:
    - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
    - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-04-25
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        CommandLine|contains|all:
            - ' /c '
            - 'powershell'
            - '-nop -w hidden'
            - 'Invoke-WebRequest'
            - 'setup.msi'
            - '-OutFile'
    selection_2:
        CommandLine|contains|all:
            - 'msiexec '
            - '/i '
            - 'setup.msi '
            - '/qn '
            - 'IntegratorLogin=fimaribahundq'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: PaperCut MF/NG Potential Exploitation
id: 0934ac71-a331-4e98-a034-d49c491fbbcb
status: test
description: Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut
references:
    - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
    - https://github.com/huntresslabs/threat-intel/blob/3bad6b0fadfcca3ff5680923e74e39edd72f32da/2023/2023-04/20-PaperCut/win_susp_papercut_code_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
date: 2023-04-20
modified: 2023-04-25
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\pc-app.exe'
        Image|endswith:
            - '\bash.exe'
            - '\calc.exe'
            - '\certutil.exe'
            - '\cmd.exe'
            - '\csc.exe'
            - '\cscript.exe'
            - '\dllhost.exe'
            - '\mshta.exe'
            - '\msiexec.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\rundll32.exe'
            - '\scriptrunner.exe'
            - '\wmic.exe'
            - '\wscript.exe'
            - '\wsl.exe'
    condition: selection
falsepositives:
    - Legitimate administration activity
level: high

title: Password Change on Directory Service Restore Mode (DSRM) Account
id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
related:
    - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0
      type: similar
status: stable
description: |
    Detects potential attempts made to set the Directory Services Restore Mode administrator password.
    The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
    Attackers may change the password in order to obtain persistence.
references:
    - https://adsecurity.org/?p=1714
    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794
author: Thomas Patzke
date: 2017-02-19
modified: 2020-08-23
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1098
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4794
    condition: selection
falsepositives:
    - Initial installation of a domain controller.
level: high

title: Password Dumper Activity on LSASS
id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c
status: test
description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN
references:
    - https://twitter.com/jackcr/status/807385668833968128
author: sigma
date: 2017-02-12
modified: 2022-10-09
tags:
    - attack.credential-access
    - attack.t1003.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4656
        ProcessName|endswith: '\lsass.exe'
        AccessMask: '0x705'
        ObjectType: 'SAM_DOMAIN'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Password Dumper Remote Thread in LSASS
id: f239b326-2f41-4d6b-9dfa-c846a60ef505
status: stable
description: |
    Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
    The process in field Process is the malicious program. A single execution can lead to hundreds of events.
references:
    - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
author: Thomas Patzke
date: 2017-02-19
modified: 2021-06-21
tags:
    - attack.credential-access
    - attack.s0005
    - attack.t1003.001
logsource:
    product: windows
    category: create_remote_thread
detection:
    selection:
        TargetImage|endswith: '\lsass.exe'
        StartModule: ''
    condition: selection
falsepositives:
    - Antivirus products
level: high

title: Password Protected ZIP File Opened (Email Attachment)
id: 571498c8-908e-40b4-910b-d2369159a3da
status: test
description: Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
references:
    - https://twitter.com/sbousseaden/status/1523383197513379841
author: Florian Roth (Nextron Systems)
date: 2022-05-09
tags:
    - attack.initial-access
    - attack.stealth
    - attack.t1027
    - attack.t1566.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5379
        TargetName|contains|all:
            - 'Microsoft_Windows_Shell_ZipFolder:filename'
            - '\Temporary Internet Files\Content.Outlook'
    condition: selection
falsepositives:
    - Legitimate used of encrypted ZIP files
level: high

title: Password Protected ZIP File Opened (Suspicious Filenames)
id: 54f0434b-726f-48a1-b2aa-067df14516e4
status: test
description: Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.
references:
    - https://twitter.com/sbousseaden/status/1523383197513379841
author: Florian Roth (Nextron Systems)
date: 2022-05-09
tags:
    - attack.command-and-control
    - attack.stealth
    - attack.t1027
    - attack.t1105
    - attack.t1036
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 5379
        TargetName|contains: 'Microsoft_Windows_Shell_ZipFolder:filename'
    selection_filename:
        TargetName|contains:
            - 'invoice'
            - 'new order'
            - 'rechnung'
            - 'factura'
            - 'delivery'
            - 'purchase'
            - 'order'
            - 'payment'
    condition: selection and selection_filename
falsepositives:
    - Legitimate used of encrypted ZIP files
level: high

title: Password Spray Activity
id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9
status: test
description: Indicates that a password spray attack has been successfully performed.
references:
    - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
    - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
date: 2023-09-03
tags:
    - attack.t1110
    - attack.credential-access
logsource:
    product: azure
    service: riskdetection
detection:
    selection:
        riskEventType: 'passwordSpray'
    condition: selection
falsepositives:
    - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user.
level: high

title: Peach Sandstorm APT Process Activity Indicators
id: 2e7bbd54-2f26-476e-b4a1-ba5f1a012614
status: test
description: Detects process creation activity related to Peach Sandstorm APT
references:
    - https://twitter.com/MsftSecIntel/status/1737895710169628824
    - https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
author: X__Junior (Nextron Systems)
date: 2024-01-15
tags:
    - attack.execution
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'QP''s\*(58vaP!tF4'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Persistence Via Hhctrl.ocx
id: f10ed525-97fe-4fed-be7c-2feecca941b1
status: test
description: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary
references:
    - https://persistence-info.github.io/Data/hhctrl.html
    - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default)'
    filter:
        Details: 'C:\Windows\System32\hhctrl.ocx'
    condition: selection and not filter
falsepositives:
    - Unlikely
level: high

title: Persistence and Execution at Scale via GPO Scheduled Task
id: a8f29a7b-b137-4446-80a0-b804272f3da2
status: test
description: Detect lateral movement using GPO scheduled task, usually used to deploy ransomware at scale
references:
    - https://twitter.com/menasec1/status/1106899890377052160
    - https://www.secureworks.com/blog/ransomware-as-a-distraction
    - https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-0-16-1-scheduled-task-execution-at-scale-via-gpo.html
author: Samir Bousseaden
date: 2019-04-03
modified: 2024-09-04
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.lateral-movement
    - attack.t1053.005
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
    selection_5136:
        EventID: 5136
        AttributeLDAPDisplayName:
            - 'gPCMachineExtensionNames'
            - 'gPCUserExtensionNames'
        AttributeValue|contains:
            - 'CAB54552-DEEA-4691-817E-ED4A4D1AFC72'
            - 'AADCED64-746C-4633-A97C-D61349046527'
    selection_5145:
        EventID: 5145
        ShareName|endswith: '\SYSVOL' # looking for the string \\*\SYSVOL
        RelativeTargetName|endswith: 'ScheduledTasks.xml'
        AccessList|contains:
            - 'WriteData'
            - '%%4417'
    condition: 1 of selection_*
falsepositives:
    - If the source IP is not localhost then it's super suspicious, better to monitor both local and remote changes to GPO scheduled tasks.
level: high

title: PetitPotam Suspicious Kerberos TGT Request
id: 6a53d871-682d-40b6-83e0-b7c1a6c4e3a5
status: test
description: |
    Detect suspicious Kerberos TGT requests.
    Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes.
    One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus.
    This request will generate a 4768 event with some unusual fields depending on the environment.
    This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts.
references:
    - https://github.com/topotam/PetitPotam
    - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/
    - https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
author: Mauricio Velazco, Michael Haag
date: 2021-09-02
modified: 2022-10-05
tags:
    - attack.credential-access
    - attack.t1187
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Account Logon > Kerberos Authentication Service" must be configured for Success/Failure'
detection:
    selection:
        EventID: 4768
        TargetUserName|endswith: '$'
        CertThumbprint|contains: '*'
    filter_local:
        IpAddress: '::1'
    filter_thumbprint:
        CertThumbprint: ''
    condition: selection and not 1 of filter_*
falsepositives:
    - False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts.
level: high

title: Phishing Pattern ISO in Archive
id: fcdf69e5-a3d3-452a-9724-26f2308bf2b1
status: test
description: Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)
references:
    - https://twitter.com/1ZRR4H/status/1534259727059787783
    - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/
author: Florian Roth (Nextron Systems)
date: 2022-06-07
tags:
    - attack.initial-access
    - attack.t1566
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\Winrar.exe'
            - '\7zFM.exe'
            - '\peazip.exe'
        Image|endswith:
            - '\isoburn.exe'
            - '\PowerISO.exe'
            - '\ImgBurn.exe'
    condition: selection
falsepositives:
    - Legitimate cases in which archives contain ISO or IMG files and the user opens the archive and the image via clicking and not extraction
level: high

title: Pikabot Fake DLL Extension Execution Via Rundll32.EXE
id: 1bf0ba65-9a39-42a2-9271-31d31bf2f0bf
status: test
description: |
    Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.
references:
    - https://github.com/pr0xylife/Pikabot
    - https://tria.ge/231004-tp8k6sch9t/behavioral2
    - https://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
    - https://tria.ge/231212-r1bpgaefar/behavioral2
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
date: 2024-01-26
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\wscript.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - ':\ProgramData\'
            - ':\Users\Public\'
            - ':\Windows\Installer\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    filter_main_known_extension:
        - CommandLine|contains:
              - '.cpl '
              - '.cpl,'
              - '.dll '
              - '.dll,'
              - '.inf '
              - '.inf,'
        - CommandLine|endswith:
              - '.cpl'
              - '.cpl"'
              - '.dll'
              - '.dll"'
              - '.inf'
              - '.inf"'
              - ".cpl'"
              - ".dll'"
              - ".inf'"
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Ping Hex IP
id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd
status: test
description: Detects a ping command that uses a hex encoded IP address
references:
    - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna
    - https://twitter.com/vysecurity/status/977198418354491392
author: Florian Roth (Nextron Systems)
date: 2018-03-23
modified: 2025-10-17
tags:
    - attack.stealth
    - attack.t1140
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\ping.exe'
        CommandLine|re: '0x[a-fA-F0-9]{8}'
    condition: selection
falsepositives:
    - Unlikely, because no sane admin pings IP addresses in a hexadecimal form
level: high

title: Pingback Backdoor Activity
id: b2400ffb-7680-47c0-b08a-098a7de7e7a9
related:
    - id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b # DLL Load
      type: similar
    - id: 2bd63d53-84d4-4210-80ff-bf0658f1bf78 # File Indicators
      type: similar
status: test
description: Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
    - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
author: Bhabesh Raj
date: 2021-05-05
modified: 2023-02-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\updata.exe'
        CommandLine|contains|all:
            - 'config'
            - 'msdtc'
            - 'start'
            - 'auto'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Pingback Backdoor DLL Loading Activity
id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b
related:
    - id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b # File indicators
      type: similar
    - id: b2400ffb-7680-47c0-b08a-098a7de7e7a9 # Process Creation
      type: similar
status: test
description: Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
    - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
author: Bhabesh Raj
date: 2021-05-05
modified: 2023-02-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith: '\msdtc.exe'
        ImageLoaded: 'C:\Windows\oci.dll'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Pingback Backdoor File Indicators
id: 2bd63d53-84d4-4210-80ff-bf0658f1bf78
related:
    - id: 35a7dc42-bc6f-46e0-9f83-81f8e56c8d4b # DLL Load
      type: similar
    - id: b2400ffb-7680-47c0-b08a-098a7de7e7a9 # Process Creation
      type: similar
status: test
description: Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
references:
    - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
    - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
author: Bhabesh Raj
date: 2021-05-05
modified: 2023-02-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
    - detection.emerging-threats
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: 'updata.exe'
        TargetFilename: 'C:\Windows\oci.dll'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Possible CVE-2021-1675 Print Spooler Exploitation
id: 4e64668a-4da1-49f5-a8df-9e2d5b866718
status: test
description: Detects events of driver load errors in print service logs that could be a sign of successful exploitation attempts of print spooler vulnerability CVE-2021-1675
references:
    - https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
    - https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
    - https://twitter.com/fuzzyf10w/status/1410202370835898371
author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w, Tim Shelton
date: 2021-06-30
modified: 2022-11-15
tags:
    - attack.execution
    - attack.t1569
    - cve.2021-1675
    - detection.emerging-threats
logsource:
    product: windows
    service: printservice-admin
detection:
    selection:
        EventID: 808
        ErrorCode:
            - '0x45A'
            - '0x7e'
    keywords:
        - 'The print spooler failed to load a plug-in module'
        # default file names used in PoC codes
        - 'MyExploit.dll'
        - 'evil.dll'
        - '\addCube.dll'
        - '\rev.dll'
        - '\rev2.dll'
        - '\main64.dll'
        - '\mimilib.dll'
        - '\mimispool.dll'
    falsepositive:
        - ' registration timed out' # ex: The print spooler failed to load a plug-in module PrintConfig registration timed out
    condition: (selection or keywords) and not falsepositive
falsepositives:
    - Problems with printer drivers
level: high

title: Possible DCSync Attack
id: 56fda488-113e-4ce9-8076-afc2457922c3
status: test
description: Detects remote RPC calls to MS-DRSR from non DC hosts, which could indicate DCSync / DCShadow attacks.
references:
    - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
    - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md
    - https://github.com/zeronetworks/rpcfirewall
    - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/
author: Sagie Dulce, Dekel Paz
date: 2022-01-01
tags:
    - attack.t1033
    - attack.discovery
logsource:
    product: rpc_firewall
    category: application
    definition: 'Requirements: install and apply the RPC Firewall to all processes, enable DRSR UUID (e3514235-4b06-11d1-ab04-00c04fc2dcd2) for "dangerous" opcodes (not 0,1 or 12) only from trusted IPs (DCs)'
detection:
    selection:
        EventLog: RPCFW
        EventID: 3
        InterfaceUuid: e3514235-4b06-11d1-ab04-00c04fc2dcd2
    filter:
        OpNum:
            - 0
            - 1
            - 12
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: Possible Exploitation of Exchange RCE CVE-2021-42321
id: c92f1896-d1d2-43c3-92d5-7a5b35c217bb
status: test
description: Detects log entries that appear in exploitation attempts against MS Exchange RCE CVE-2021-42321
references:
    - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321
author: 'Florian Roth (Nextron Systems), @testanull'
date: 2021-11-18
modified: 2022-07-12
tags:
    - attack.lateral-movement
    - attack.t1210
    - detection.emerging-threats
logsource:
    product: windows
    service: msexchange-management
    # warning: The 'data' field used in the detection section is the container for the event data as a whole. You may have to adapt the rule for your backend accordingly
detection:
    selection:
        EventID:
            - 6
            - 8
        Data|contains:
            - 'Cmdlet failed. Cmdlet Get-App, '
            - 'Task Get-App throwing unhandled exception: System.InvalidCastException:'
    condition: selection
falsepositives:
    - Unknown, please report false positives via https://github.com/SigmaHQ/sigma/issues
level: high

title: Possible Impacket SecretDump Remote Activity
id: 252902e3-5830-4cf6-bf21-c22083dfd5cf
status: test
description: Detect AD credential dumping using impacket secretdump HKTL
references:
    - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
author: Samir Bousseaden, wagga
date: 2019-04-03
modified: 2022-08-11
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.003
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
    selection:
        EventID: 5145
        ShareName: '\\\\\*\\ADMIN$'  # looking for the string  \\*\ADMIN$
        RelativeTargetName|contains|all:
            - 'SYSTEM32\'
            - '.tmp'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Possible Impacket SecretDump Remote Activity - Zeek
id: 92dae1ed-1c9d-4eff-a567-33acbd95b00e
status: test
description: 'Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml'
references:
    - https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
author: 'Samir Bousseaden, @neu5ron'
date: 2020-03-19
modified: 2021-11-27
tags:
    - attack.credential-access
    - attack.t1003.002
    - attack.t1003.004
    - attack.t1003.003
logsource:
    product: zeek
    service: smb_files
detection:
    selection:
        path|contains|all:
            - '\'
            - 'ADMIN$'
        name|contains: 'SYSTEM32\'
        name|endswith: '.tmp'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Possible PetitPotam Coerce Authentication Attempt
id: 1ce8c8a3-2723-48ed-8246-906ac91061a6
status: test
description: Detect PetitPotam coerced authentication activity.
references:
    - https://github.com/topotam/PetitPotam
    - https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml
author: Mauricio Velazco, Michael Haag
date: 2021-09-02
modified: 2022-08-11
tags:
    - attack.credential-access
    - attack.t1187
logsource:
    product: windows
    service: security
    definition: 'The advanced audit policy setting "Object Access > Detailed File Share" must be configured for Success/Failure'
detection:
    selection:
        EventID: 5145
        ShareName|startswith: '\\\\' # looking for the string \\somethink\IPC$
        ShareName|endswith: '\IPC$'
        RelativeTargetName: lsarpc
        SubjectUserName: ANONYMOUS LOGON
    condition: selection
falsepositives:
    - Unknown. Feedback welcomed.
level: high

title: Possible Privilege Escalation via Weak Service Permissions
id: d937b75f-a665-4480-88a5-2f20e9f9b22a
status: test
description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://pentestlab.blog/2017/03/30/weak-service-permissions/
author: Teymur Kheirkhabarov
date: 2019-10-26
modified: 2024-12-01
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.011
logsource:
    category: process_creation
    product: windows
detection:
    scbynonadmin:
        Image|endswith: '\sc.exe'
        IntegrityLevel:
            - 'Medium'
            - 'S-1-16-8192'
    selection_binpath:
        CommandLine|contains|all:
            - 'config'
            - 'binPath'
    selection_failure:
        CommandLine|contains|all:
            - 'failure'
            - 'command'
    condition: scbynonadmin and 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Possible Shadow Credentials Added
id: f598ea0c-c25a-4f72-a219-50c44411c791
status: test
description: Detects possible addition of shadow credentials to an active directory object.
references:
    - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
    - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
    - https://twitter.com/SBousseaden/status/1581300963650187264?
author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
date: 2022-10-17
tags:
    - attack.persistence
    - attack.credential-access
    - attack.defense-impairment
    - attack.t1556
logsource:
    product: windows
    service: security
    definition: The "Audit Directory Service Changes" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)
detection:
    selection:
        EventID: 5136
        AttributeLDAPDisplayName: 'msDS-KeyCredentialLink'
        # If you experience a lot of FP you could uncomment the selection below
        # There could be other cases for other tooling add them accordingly
        # AttributeValue|contains: 'B:828'
        # OperationType: '%%14674' # Value Added
    # As stated in the FP sections it's better to filter out the expected accounts that perform this operation to tighten the logic
    # Uncomment the filter below and add the account name (or any other specific field) accordingly
    # Don't forget to add it to the condition section below
    # filter:
        # SubjectUserName: "%name%"
    condition: selection
falsepositives:
    - Modifications in the msDS-KeyCredentialLink attribute can be done legitimately by the Azure AD Connect synchronization account or the ADFS service account. These accounts can be added as Exceptions. (From elastic FP section)
level: high

title: Potential ACTINIUM Persistence Activity
id: e1118a8f-82f5-44b3-bb6b-8a284e5df602
status: test
description: Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.
references:
    - https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
author: Andreas Hunkeler (@Karneades)
date: 2022-02-07
modified: 2023-03-18
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053
    - attack.t1053.005
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'schtasks'
            - 'create'
            - 'wscript'
            - ' /e:vbscript'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential AMSI Bypass Via .NET Reflection
id: 30edb182-aa75-42c0-b0a9-e998bb29067c
related:
    - id: 4f927692-68b5-4267-871b-073c45f4f6fe
      type: obsolete
status: test
description: Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning
references:
    - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
    - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
author: Markus Neis, @Kostastsale
date: 2018-08-17
modified: 2023-02-03
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|contains|all:
              - 'System.Management.Automation.AmsiUtils'
              - 'amsiInitFailed'
        - CommandLine|contains|all:
              - '[Ref].Assembly.GetType'
              - 'SetValue($null,$true)'
              - 'NonPublic,Static'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential AMSI COM Server Hijacking
id: 160d2780-31f7-4922-8b3a-efce30e63e96
status: test
description: Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless
references:
    - https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/
    - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-comreg-bypass
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-04
modified: 2023-08-17
tags:
    - attack.defense-impairment
    - attack.t1685
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\(Default)'
    filter:
        Details: '%windir%\system32\amsi.dll'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: Potential APT FIN7 POWERHOLD Execution
id: 71c432c4-e4da-4eab-ba49-e60ea9a81bca
status: test
description: Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs
references:
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - attack.t1059.001
    - attack.g0046
    - detection.emerging-threats
logsource:
    product: windows
    category: ps_script
    definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
    selection:
        ScriptBlockText|contains|all:
            - '$env:APPDATA'
            - 'function MainPayload'
            - '::WriteAllBytes'
            - 'wscript.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity
id: 911389c7-5ae3-43ea-bab3-a947ebdeb85e
status: test
description: Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution
references:
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers/jcr:content/root/responsivegrid/responsivegrid/responsivegrid/image_253944286.img.png/1682500394900.png
    - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - attack.g0046
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        CommandLine|contains|all:
            - '-noni -nop -exe bypass -f \\\\'
            - 'ADMIN$'
    selection_2:
        CommandLine|contains|all:
            - '-ex bypass -noprof -nolog -nonint -f'
            - 'C:\Windows\Temp\'
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential APT FIN7 Related PowerShell Script Created
id: a88d9f45-ec8a-4b0e-85ee-c9f6a65e9128
status: test
description: Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts
references:
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - attack.g0046
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection:
        - TargetFilename|endswith: '_64refl.ps1'
        - TargetFilename: 'host_ip.ps1'
    condition: selection
falsepositives:
    - Unknown
level: high