title: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966
id: e6f81941-b1cd-4766-87db-9fc156f658ee
status: test
description: Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation
references:
    - https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
author: Florian Roth (Nextron Systems)
date: 2022-11-09
modified: 2025-11-03
tags:
    - attack.privilege-escalation
    - detection.emerging-threats
    - cve.2022-37966
logsource:
    product: windows
    service: system
detection:
    selection:
        EventID: 42
        Provider_Name:
            - 'Kerberos-Key-Distribution-Center'
            - 'Microsoft-Windows-Kerberos-Key-Distribution-Center'
        Level: 2  # Error
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential KamiKakaBot Activity - Winlogon Shell Persistence
id: c9b86500-1ec2-4de6-9120-d744c8fb5caf
status: test
description: |
    Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.
references:
    - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
author: Nasreddine Bencherchali (Nextron Systems), X__Junior
date: 2024-03-22
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'
        Details|contains|all:
            - '-nop -w h'
            - '$env'
            - 'explorer.exe'
            - 'Start-Process'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential Kapeka Decrypted Backdoor Indicator
id: 20228d05-dd68-435d-8b4e-e7e64938880c
status: test
description: |
    Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges.
    The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-03
tags:
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection_generic:
        TargetFilename|contains:
            - ':\ProgramData\'
            - '\AppData\Local\'
        TargetFilename|re: '\\[a-zA-Z]{5,6}\.wll'
    selection_specific:
        TargetFilename|endswith:
            - '\win32log.exe'
            - '\crdss.exe'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Potential Ke3chang/TidePool Malware Activity
id: 7b544661-69fc-419f-9a59-82ccc328f205
status: test
description: Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020
references:
    - https://web.archive.org/web/20200618080300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
    - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
author: Markus Neis, Swisscom
date: 2020-06-18
modified: 2023-03-10
tags:
    - attack.defense-impairment
    - attack.g0004
    - attack.t1685
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        # Ke3chang and TidePool both modify the IEHarden registry key, as well as the following list of keys.
        # Setting these registry keys is unique to the Ke3chang and TidePool malware families.
        # HKCU\Software\Microsoft\Internet Explorer\Main\Check_Associations
        # HKCU\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize
        # HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IEharden
        CommandLine|contains:
            - '-Property DWORD -name DisableFirstRunCustomize -value 2 -Force'
            - '-Property String -name Check_Associations -value'
            - '-Property DWORD -name IEHarden -value 0 -Force'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Kerberos Coercion by Spoofing SPNs via DNS Manipulation
id: b07e58cf-cacc-4135-8473-ccb2eba63dd2
related:
    - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing
      type: similar
    - id: 5588576c-5898-4fac-bcdd-7475a60e8f43 # Suspicious DNS Query Indicating Kerberos Coercion via DNS Object Spoofing - Network
      type: similar
    - id: 0ed99dda-6a35-11ef-8c99-0242ac120002 # Kerberos Coercion Via DNS SPN Spoofing Attempt
      type: similar
status: experimental
description: |
    Detects modifications to DNS records in Active Directory where the Distinguished Name (DN) contains a base64-encoded blob
    matching the pattern "1UWhRCAAAAA...BAAAA". This pattern corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure,
    commonly used in Kerberos coercion attacks. Adversaries may exploit this to coerce victim systems into authenticating to
    attacker-controlled hosts by spoofing SPNs via DNS. It is one of the strong indicators of a Kerberos coercion attack,.
    where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
    Please investigate the user account that made the changes, as it is likely a low-privileged account that has been compromised.
references:
    - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
    - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-20
tags:
    - attack.collection
    - attack.credential-access
    - attack.t1557.003
    - attack.persistence
    - attack.privilege-escalation
logsource:
    product: windows
    service: security
    definition: |
      By default these events are not logged by default for MicrosoftDNS objects in Active Directory.
      To enable detection, configure an AuditRule on the DNS object container with the "CreateChild" permission for the "Everyone" principal.
      This can be accomplished using tools such as Set-AuditRule (see https://github.com/OTRF/Set-AuditRule).
detection:
    selection_directory_service_changes:
        EventID:
            - 5136
            - 5137
        ObjectClass: 'dnsNode'
        ObjectDN|contains|all: # ObjectDN">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>
            - 'UWhRCA'
            - 'BAAAA'
            - 'CN=MicrosoftDNS'
    selection_directory_service_access:
        EventID: 4662
        AdditionalInfo|contains|all: # AdditionalInfo">DC=foo-11UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAA,DC=domain.com,CN=MicrosoftDNS,DC=DomainDnsZones,DC=domain,DC=com</Data>
            - 'UWhRCA'
            - 'BAAAA'
            - 'CN=MicrosoftDNS'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Potential LSASS Process Dump Via Procdump
id: 5afee48e-67dd-4e03-a783-f74259dcf998
status: stable
description: |
    Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
    This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
    LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
    Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
    - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
    - https://x.com/wietze/status/1958302556033065292?s=12
author: Florian Roth (Nextron Systems)
date: 2018-10-30
modified: 2025-10-19
tags:
    - attack.stealth
    - attack.t1036
    - attack.credential-access
    - attack.t1003.001
    - car.2013-05-009
logsource:
    category: process_creation
    product: windows
detection:
    selection_flags:
        CommandLine|contains|windash:
            - ' -ma '
            - ' -mm ' # Mini dump
            - ' -mp ' # Miniplus dump
    selection_process:
        CommandLine|contains:
            - ' ls' # Short for lsass
            - ' keyiso'
            - ' samss'
    condition: all of selection_*
falsepositives:
    - Unlikely, because no one should dump an lsass process memory
    - Another tool that uses command line flags similar to ProcDump
level: high

title: Potential LethalHTA Technique Execution
id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471
status: test
description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process
references:
    - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
author: Markus Neis
date: 2018-06-07
modified: 2023-02-07
tags:
    - attack.stealth
    - attack.t1218.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\svchost.exe'
        Image|endswith: '\mshta.exe'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Local File Read Vulnerability In JVM Based Application
id: e032f5bc-4563-4096-ae3b-064bab588685
status: test
description: |
    Detects potential local file read vulnerability in JVM based apps.
    If the exceptions are caused due to user input and contain path traversal payloads then it's a red flag.
references:
    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
author: Moti Harmats
date: 2023-02-11
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: application
    product: jvm
    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'
detection:
    keywords_local_file_read:
        '|all':
            - 'FileNotFoundException'
            - '/../../..'
    condition: keywords_local_file_read
falsepositives:
    - Application bugs
level: high

title: Potential MFA Bypass Using Legacy Client Authentication
id: 53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc
status: test
description: Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.
references:
    - https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
    - https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/
author: Harjot Singh, '@cyb3rjy0t'
date: 2023-03-20
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.initial-access
    - attack.credential-access
    - attack.stealth
    - attack.t1078.004
    - attack.t1110
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        Status: 'Success'
        userAgent|contains:
            - 'BAV2ROPC'
            - 'CBAinPROD'
            - 'CBAinTAR'
    condition: selection
falsepositives:
    - Known Legacy Accounts
level: high

title: Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity
id: c3b2a774-3152-4989-83c1-7afc48fd1599
status: test
description: Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.
references:
    - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/
    - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
    - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/
    - https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-06-01
modified: 2024-08-13
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2023-34362
    - detection.emerging-threats
logsource:
    category: file_event
    product: windows
detection:
    selection_generic:
        TargetFilename|contains:
            - '\MOVEit Transfer\wwwroot\'
            - '\MOVEitTransfer\wwwroot\'
        TargetFilename|endswith:
            - '.7z'
            - '.bat'
            - '.dll'
            - '.exe'
            - '.ps1'
            - '.rar'
            - '.vbe'
            - '.vbs'
            - '.zip'
    selection_known_ioc:
        TargetFilename|endswith:
            - '\MOVEit Transfer\wwwroot\_human2.aspx.lnk'
            - '\MOVEit Transfer\wwwroot\_human2.aspx'
            - '\MOVEit Transfer\wwwroot\human2.aspx.lnk'
            - '\MOVEit Transfer\wwwroot\human2.aspx'
            - '\MOVEitTransfer\wwwroot\_human2.aspx.lnk'
            - '\MOVEitTransfer\wwwroot\_human2.aspx'
            - '\MOVEitTransfer\wwwroot\human2.aspx.lnk'
            - '\MOVEitTransfer\wwwroot\human2.aspx'
    # Uncomment selection if you wanna threat hunt for additional artifacts
    # selection_cmdline:
    #    TargetFilename|contains: ':\Windows\TEMP\'
    #    TargetFilename|endswith: '.cmdline'
    selection_compiled_asp:
        CreationUtcTime|startswith:
            - '2023-03- '
            - '2023-04- '
            - '2023-05- '
            - '2023-06- '
        TargetFilename|contains|all:
            - '\Windows\Microsoft.net\Framework64\v'
            - '\Temporary ASP.NET Files\'
            - 'App_Web_'
        TargetFilename|endswith: '.dll'
    condition: 1 of selection_*
falsepositives:
    - To avoid FP, this rule should only be applied on MOVEit servers.
level: high

title: Potential MSTSC Shadowing Activity
id: 6ba5a05f-b095-4f0a-8654-b825f4f16334
status: test
description: Detects RDP session hijacking by using MSTSC shadowing
references:
    - https://twitter.com/kmkz_security/status/1220694202301976576
    - https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet
author: Florian Roth (Nextron Systems)
date: 2020-01-24
modified: 2023-02-05
tags:
    - attack.lateral-movement
    - attack.t1563.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains|all:
            - 'noconsentprompt'
            - 'shadow:'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Malicious Usage of CloudTrail System Manager
id: 38e7f511-3f74-41d4-836e-f57dfa18eead
status: test
description: |
    Detect when System Manager successfully executes commands against an instance.
references:
    - https://github.com/elastic/detection-rules/blob/v8.6.0/rules/integrations/aws/initial_access_via_system_manager.toml
author: jamesc-grafana
date: 2024-07-11
modified: 2025-12-08
tags:
    - attack.privilege-escalation
    - attack.initial-access
    - attack.t1566
    - attack.t1566.002
logsource:
    product: aws
    service: cloudtrail
detection:
    selection_event:
        eventName: 'SendCommand'
        eventSource: 'ssm.amazonaws.com'
    selection_status_success:
        errorCode: 'Success'
    selection_status_null:
        errorCode: null
    condition: selection_event and 1 of selection_status_*
falsepositives:
    - There are legitimate uses of SSM to send commands to EC2 instances
    - Legitimate users may have to use SSM to perform actions against machines in the Cloud to update or maintain them
level: high

title: Potential Manage-bde.wsf Abuse To Proxy Execution
id: c363385c-f75d-4753-a108-c1a8e28bdbda
status: test
description: Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution
references:
    - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/
    - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712
    - https://twitter.com/bohops/status/980659399495741441
    - https://twitter.com/JohnLaTwC/status/1223292479270600706
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems)
date: 2020-10-13
modified: 2023-02-03
tags:
    - attack.stealth
    - attack.t1216
logsource:
    category: process_creation
    product: windows
detection:
    selection_wscript_img:
        - Image|endswith: '\wscript.exe'
        - OriginalFileName: 'wscript.exe'
    selection_wscript_cli:
        CommandLine|contains: 'manage-bde.wsf'
    selection_parent:
        ParentImage|endswith:
            - '\cscript.exe'
            - '\wscript.exe'
        ParentCommandLine|contains: 'manage-bde.wsf'
    selection_filter_cmd:
        Image|endswith: '\cmd.exe'
    condition: all of selection_wscript_* or (selection_parent and not selection_filter_cmd)
falsepositives:
    - Unlikely
level: high

title: Potential Meterpreter/CobaltStrike Activity
id: 15619216-e993-4721-b590-4c520615a67d
status: test
description: Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
    - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
author: Teymur Kheirkhabarov, Ecco, Florian Roth
date: 2019-10-26
modified: 2023-02-05
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1134.001
    - attack.t1134.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        ParentImage|endswith: '\services.exe'
    selection_technique_1:
        # Examples:
        #   Meterpreter  getsystem technique 1: cmd.exe /c echo 559891bb017 > \\.\pipe\5e120a
        #   CobaltStrike getsystem technique 1b (expanded env var): %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
        #   CobaltStrike getsystem technique 1: %COMSPEC% /c echo 559891bb017 > \\.\pipe\5e120a
        CommandLine|contains|all:
            - '/c'
            - 'echo'
            - '\pipe\'
        CommandLine|contains:
            - 'cmd'
            - '%COMSPEC%'
    selection_technique_2:
        # meterpreter getsystem technique 2: rundll32.exe C:\Users\test\AppData\Local\Temp\tmexsn.dll,a /p:tmexsn
        CommandLine|contains|all:
            - 'rundll32'
            - '.dll,a'
            - '/p:'
    filter_defender:
        CommandLine|contains: 'MpCmdRun'
    condition: selection_img and 1 of selection_technique_* and not 1 of filter_*
falsepositives:
    - Commandlines containing components like cmd accidentally
    - Jobs and services started with cmd
level: high

title: Potential Mpclient.DLL Sideloading
id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
related:
    - id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
      type: similar
status: test
description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
author: Bhabesh Raj
date: 2022-08-02
modified: 2023-08-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: image_load
detection:
    selection:
        ImageLoaded|endswith: '\mpclient.dll'
        Image|endswith:
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
    filter_main_known_locations:
        Image|startswith:
            - 'C:\Program Files (x86)\Windows Defender\'
            - 'C:\Program Files\Microsoft Security Client\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential Mpclient.DLL Sideloading Via Defender Binaries
id: 7002aa10-b8d4-47ae-b5ba-51ab07e228b9
related:
    - id: 418dc89a-9808-4b87-b1d7-e5ae0cb6effc
      type: similar
status: test
description: Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
references:
    - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
author: Bhabesh Raj
date: 2022-08-01
modified: 2023-08-04
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\MpCmdRun.exe'
            - '\NisSrv.exe'
    filter_main_known_locations:
        Image|startswith:
            - 'C:\Program Files (x86)\Windows Defender\'
            - 'C:\Program Files\Microsoft Security Client\'
            - 'C:\Program Files\Windows Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high

title: Potential MsiExec Masquerading
id: e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144
status: test
description: Detects the execution of msiexec.exe from an uncommon directory
references:
    - https://twitter.com/200_okay_/status/1194765831911215104
author: Florian Roth (Nextron Systems)
date: 2019-11-14
modified: 2023-02-21
tags:
    - attack.stealth
    - attack.t1036.005
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\msiexec.exe'
        - OriginalFileName: '\msiexec.exe'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
    condition: selection and not filter
falsepositives:
    - Unknown
level: high

title: Potential MuddyWater APT Activity
id: 36222790-0d43-4fe8-86e4-674b27809543
status: test
description: Detects potential Muddywater APT activity
references:
    - https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-03-10
tags:
    - attack.execution
    - attack.stealth
    - attack.g0069
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_mshta:
        CommandLine|contains|all:
            - 'vbscript:Close(Execute("CreateObject('
            - 'powershell'
            - '-w 1 -exec Bypass'
            - '\ProgramData\'
    selection_survey:
        CommandLine|contains|all:
            - 'Win32_OperatingSystem'
            - 'Win32_NetworkAdapterConfiguration'
            - 'root\SecurityCenter2'
            - '[System.Net.DNS]'
    selection_pwsh_backdoor:
        CommandLine|contains|all:
            - '[Convert]::ToBase64String'
            - '[System.Text.Encoding]::UTF8.GetString]'
            - 'GetResponse().GetResponseStream()'
            - '[System.Net.HttpWebRequest]::Create('
            - '-bxor '
    condition: 1 of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential NTLM Coercion Via Certutil.EXE
id: 6c6d9280-e6d0-4b9d-80ac-254701b64916
status: test
description: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag
references:
    - https://github.com/LOLBAS-Project/LOLBAS/issues/243
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-09-01
modified: 2023-02-14
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\certutil.exe'
        - OriginalFileName: 'CertUtil.exe'
    selection_cli:
        CommandLine|contains|all:
            - ' -syncwithWU '
            - ' \\\\'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml

title: Potential NetWire RAT Activity - Registry
id: 1d218616-71b0-4c40-855b-9dbe75510f7f
status: test
description: Detects registry keys related to NetWire RAT
references:
    - https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing
    - https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
    - https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/
    - https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line
    - https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/
author: Christopher Peacock
date: 2021-10-07
modified: 2025-11-03
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_add
detection:
    selection:
        # The configuration information is usually stored under HKCU:\Software\Netwire - RedCanary
        TargetObject|contains: '\software\NetWire'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Netcat Reverse Shell Execution
id: 7f734ed0-4f47-46c0-837f-6ee62505abd9
status: test
description: Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
    - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/
    - https://www.infosecademy.com/netcat-reverse-shells/
    - https://man7.org/linux/man-pages/man1/ncat.1.html
author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'
date: 2023-04-07
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: linux
detection:
    selection_nc:
        Image|endswith:
            - '/nc'
            - '/ncat'
    selection_flags:
        CommandLine|contains:
            - ' -c '
            - ' -e '
    selection_shell:
        CommandLine|contains:
            - ' ash'
            - ' bash'
            - ' bsh'
            - ' csh'
            - ' ksh'
            - ' pdksh'
            - ' sh'
            - ' tcsh'
            - '/bin/ash'
            - '/bin/bash'
            - '/bin/bsh'
            - '/bin/csh'
            - '/bin/ksh'
            - '/bin/pdksh'
            - '/bin/sh'
            - '/bin/tcsh'
            - '/bin/zsh'
            - '$IFSash'
            - '$IFSbash'
            - '$IFSbsh'
            - '$IFScsh'
            - '$IFSksh'
            - '$IFSpdksh'
            - '$IFSsh'
            - '$IFStcsh'
            - '$IFSzsh'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800
id: 7ba05b43-adad-4c02-b5e9-c8c35cdf9fa8
status: test
description: |
    Detects potential exploitation attempts of Nimbuspwn vulnerabilities CVE-2022-29799 and CVE-2022-27800 in Linux systems.
references:
    - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/
    - https://github.com/Immersive-Labs-Sec/nimbuspwn
author: Bhabesh Raj
date: 2022-05-04
modified: 2025-11-03
tags:
    - attack.privilege-escalation
    - attack.t1068
    - detection.emerging-threats
    - cve.2022-29799
    - cve.2022-27800
logsource:
    product: linux
detection:
    keywords:
        '|all':
            - 'networkd-dispatcher'
            - 'Error handling notification for interface'
            - '../../'
    condition: keywords
falsepositives:
    - Unknown
level: high

title: Potential Notepad++ CVE-2025-49144 Exploitation
id: 933f0bb5-0681-4fe7-8a17-4e6cccbaac44
status: experimental
description: |
    Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
    This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
    The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49144
    - https://x.com/NullSecurityX/status/1937444064867029179
author: Swachchhanda Shrawan Poudel (Nextron Systems)
date: 2025-06-26
tags:
    - attack.persistence
    - attack.privilege-escalation
    - attack.execution
    - attack.stealth
    - attack.t1574.008
    - cve.2025-49144
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\regsvr32.exe'
        CommandLine|startswith: 'regsvr32 /s'
        CommandLine|contains: '\contextMenu\NppShell.dll'
    filter_main_legit_regsvr32:
        Image:
            - 'C:\Windows\System32\regsvr32.exe'
            - 'C:\Windows\SysWOW64\regsvr32.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potential OGNL Injection Exploitation In JVM Based Application
id: 4d0af518-828e-4a04-a751-a7d03f3046ad
status: test
description: |
    Detects potential OGNL Injection exploitation, which may lead to RCE.
    OGNL is an expression language that is supported in many JVM based systems.
    OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)
references:
    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
author: Moti Harmats
date: 2023-02-11
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2017-5638
    - cve.2022-26134
logsource:
    category: application
    product: jvm
    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'
detection:
    keywords:
        - 'org.apache.commons.ognl.OgnlException'
        - 'ExpressionSyntaxException'
    condition: keywords
falsepositives:
    - Application bugs
level: high

title: Potential OWASSRF Exploitation Attempt - Proxy
id: 1ddf4596-1908-43c9-add2-1d2c2fcc4797
status: test
description: Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
references:
    - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
    - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-22
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        cs-method: 'POST'
        sc-status: 200
        c-uri|contains|all:
            - '/owa/'
            - '/powershell'
        c-uri|contains:
            - '@'
            - '%40'
    filter_main_ua:
        c-useragent:
            - 'ClientInfo'
            - 'Microsoft WinRM Client'
            - 'Exchange BackEnd Probes'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Web vulnerability scanners
level: high

title: Potential OWASSRF Exploitation Attempt - Webserver
id: 181f49fa-0b21-4665-a98c-a57025ebb8c7
status: test
description: Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint
references:
    - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
    - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-22
modified: 2023-01-02
tags:
    - attack.initial-access
    - attack.t1190
    - detection.emerging-threats
logsource:
    category: webserver
detection:
    selection:
        cs-method: 'POST'
        sc-status: 200
        cs-uri-query|contains|all:
            - '/owa/'
            - '/powershell'
        cs-uri-query|contains:
            - '@'
            - '%40'
    filter_main_ua:
        cs-user-agent:
            - 'ClientInfo'
            - 'Microsoft WinRM Client'
            - 'Exchange BackEnd Probes'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Web vulnerability scanners
level: high

title: Potential Okta Password in AlternateID Field
id: 91b76b84-8589-47aa-9605-c837583b82a9
status: test
description: |
    Detects when a user has potentially entered their password into the
    username field, which will cause the password to be retained in log files.
references:
    - https://developer.okta.com/docs/reference/api/system-log/
    - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data
    - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm
author: kelnage
date: 2023-04-03
modified: 2026-04-27
tags:
    - attack.credential-access
    - attack.t1552
logsource:
    product: okta
    service: okta
detection:
    selection:
        legacyEventType: 'core.user_auth.login_failed'
    filter_main:
        # Okta service account names start with 0oa
        # Email addresses are the default format for Okta usernames, so attempt
        # to exclude alternateIds that look like valid emails
        # If your Okta configuration uses different character restrictions, you
        # will need to update this regular expression to reflect that or disable the rule for your environment
        # Possible false negatives are failed login attempts with a password that looks like a valid email address
        actor.alternateId|re: '(^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10})'
    condition: selection and not filter_main
falsepositives:
    - Unlikely
level: high

title: Potential Operation Triangulation C2 Beaconing Activity - DNS
id: 7fc30d63-728d-48d9-ad6f-14d14f4accf7
related:
    - id: aa03c712-75c6-438b-8d42-de88f2427e09 # Proxy C2
      type: similar
status: test
description: Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB
references:
    - https://securelist.com/operation-triangulation/109842/
    - https://www-fsb-ru.translate.goog/fsb/press/message/[email protected]?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
author: Florian Roth (Nextron Systems)
date: 2023-06-01
tags:
    - attack.command-and-control
    - attack.g0020
    - detection.emerging-threats
logsource:
    category: dns
detection:
    selection:
        query:
            - 'addatamarket.net'
            - 'ans7tv.net'
            - 'anstv.net'
            - 'backuprabbit.com'
            - 'businessvideonews.com'
            - 'cloudsponcer.com'
            - 'datamarketplace.net'
            - 'growthtransport.com'
            - 'mobilegamerstats.com'
            - 'snoweeanalytics.com'
            - 'tagclick-cdn.com'
            - 'topographyupdates.com'
            - 'unlimitedteacup.com'
            - 'virtuallaughing.com'
            - 'web-trackers.com'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Operation Triangulation C2 Beaconing Activity - Proxy
id: aa03c712-75c6-438b-8d42-de88f2427e09
related:
    - id: 7fc30d63-728d-48d9-ad6f-14d14f4accf7 # DNS C2
      type: similar
status: test
description: Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB
references:
    - https://securelist.com/operation-triangulation/109842/
    - https://www-fsb-ru.translate.goog/fsb/press/message/[email protected]?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
author: Florian Roth (Nextron Systems)
date: 2023-06-01
tags:
    - attack.command-and-control
    - attack.g0020
    - detection.emerging-threats
logsource:
    category: proxy
detection:
    selection:
        cs-host|contains:
            - 'addatamarket.net'
            - 'ans7tv.net'
            - 'anstv.net'
            - 'backuprabbit.com'
            - 'businessvideonews.com'
            - 'cloudsponcer.com'
            - 'datamarketplace.net'
            - 'growthtransport.com'
            - 'mobilegamerstats.com'
            - 'snoweeanalytics.com'
            - 'tagclick-cdn.com'
            - 'topographyupdates.com'
            - 'unlimitedteacup.com'
            - 'virtuallaughing.com'
            - 'web-trackers.com'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential PHP Reverse Shell
id: c6714a24-d7d5-4283-a36b-3ffd091d5f7e
status: test
description: |
    Detects usage of the PHP CLI with the "-r" flag which allows it to run inline PHP code. The rule looks for calls to the "fsockopen" function which allows the creation of sockets.
    Attackers often leverage this in combination with functions such as "exec" or "fopen" to initiate a reverse shell connection.
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
author: '@d4ns4n_'
date: 2023-04-07
tags:
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|contains: '/php'
        CommandLine|contains|all:
            - ' -r '
            - 'fsockopen'
        CommandLine|contains:
            - 'ash'
            - 'bash'
            - 'bsh'
            - 'csh'
            - 'ksh'
            - 'pdksh'
            - 'sh'
            - 'tcsh'
            - 'zsh'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential POWERTRASH Script Execution
id: 4e19528a-f081-40dd-be09-90c39352bd64
status: test
description: Detects potential execution of the PowerShell script POWERTRASH
references:
    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-04
tags:
    - attack.execution
    - attack.t1059.001
    - attack.g0046
    - detection.emerging-threats
logsource:
    product: windows
    category: ps_script
    definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
    selection:
        ScriptBlockText|contains|all:
            - 'IO.Compression.DeflateStream'
            - 'IO.MemoryStream'
            - '::FromBase64String'
            - 'GetDelegateForFunctionPointer'
            - '.Invoke()'
            - 'GlobalAssemblyCache'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential PSFactoryBuffer COM Hijacking
id: 243380fa-11eb-4141-af92-e14925e77c1b
status: test
description: Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
references:
    - https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine
    - https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html
    - https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection
    - https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html
author: BlackBerry Threat Research and Intelligence Team - @Joseliyo_Jstnk
date: 2023-06-07
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.015
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\CLSID\{c90250f3-4d7d-4991-9b69-a5c5bc1c2ae6}\InProcServer32\(Default)'
    filter_main:
        Details:
            - '%windir%\System32\ActXPrxy.dll'
            - 'C:\Windows\System32\ActXPrxy.dll'
    condition: selection and not filter_main
falsepositives:
    - Unknown
level: high

title: Potential Perl Reverse Shell Execution
id: 259df6bc-003f-4306-9f54-4ff1a08fa38e
status: test
description: Detects execution of the perl binary with the "-e" flag and common strings related to potential reverse shell activity
references:
    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
    - https://www.revshells.com/
author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'
date: 2023-04-07
tags:
    - attack.execution
logsource:
    category: process_creation
    product: linux
detection:
    selection_img:
        Image|endswith: '/perl'
        CommandLine|contains: ' -e '
    selection_content:
        - CommandLine|contains|all:
              - 'fdopen('
              - '::Socket::INET'
        - CommandLine|contains|all:
              - 'Socket'
              - 'connect'
              - 'open'
              - 'exec'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

title: Potential Persistence Via App Paths Default Property
id: 707e097c-e20f-4f67-8807-1f72ff4500d6
status: test
description: |
    Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence
    The entries found under App Paths are used primarily for the following purposes.
    First, to map an application's executable file name to that file's fully qualified path.
    Second, to prepend information to the PATH environment variable on a per-application, per-process basis.
references:
    - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
    - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-10
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.012
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths'
        TargetObject|endswith:
            - '(Default)'
            - 'Path'
        Details|contains:
            # Add more suspicious paths or binaries as you see fit.
            - '\Users\Public'
            - '\AppData\Local\Temp\'
            - '\Windows\Temp\'
            - '\Desktop\'
            - '\Downloads\'
            - '%temp%'
            - '%tmp%'
            - 'iex'
            - 'Invoke-'
            - 'rundll32'
            - 'regsvr32'
            - 'mshta'
            - 'cscript'
            - 'wscript'
            - '.bat'
            - '.hta'
            - '.dll'
            - '.ps1'
    condition: selection
falsepositives:
    - Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it)
level: high

title: Potential Persistence Via AutodialDLL
id: e6fe26ee-d063-4f5b-b007-39e90aaf50e3
status: test
description: Detects change the the "AutodialDLL" key which could be used as a persistence method to load custom DLL via the "ws2_32" library
references:
    - https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
    - https://persistence-info.github.io/Data/autodialdll.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-10
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\WinSock2\Parameters\AutodialDLL'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential Persistence Via CHM Helper DLL
id: 976dd1f2-a484-45ec-aa1d-0e87e882262b
status: test
description: Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence
references:
    - https://persistence-info.github.io/Data/htmlhelpauthor.html
    - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Microsoft\HtmlHelp Author\Location'
            - '\Software\WOW6432Node\Microsoft\HtmlHelp Author\Location'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via DLLPathOverride
id: a1b1fd53-9c4a-444c-bae0-34a330fc7aa8
status: test
description: Detects when an attacker adds a new "DLLPathOverride" value to the "Natural Language" key in order to achieve persistence which will get invoked by "SearchIndexer.exe" process
references:
    - https://persistence-info.github.io/Data/naturallanguage6.html
    - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection_root:
        # The path can be for multiple languages
        # Example:  HKLM\System\CurrentControlSet\Control\ContentIndex\Language\English_UK
        #           HKLM\System\CurrentControlSet\Control\ContentIndex\Language\English_US
        #           HKLM\System\CurrentControlSet\Control\ContentIndex\Language\Neutral
        TargetObject|contains: '\SYSTEM\CurrentControlSet\Control\ContentIndex\Language\'
    selection_values:
        TargetObject|contains:
            - '\StemmerDLLPathOverride'
            - '\WBDLLPathOverride'
            - '\StemmerClass'
            - '\WBreakerClass'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via Excel Add-in - Registry
id: 961e33d1-4f86-4fcf-80ab-930a708b2f82
status: test
description: Detect potential persistence via the creation of an excel add-in (XLL) file to make it run automatically when Excel is started.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
author: frack113
date: 2023-01-15
modified: 2023-08-17
tags:
    - attack.persistence
    - attack.t1137.006
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'Software\Microsoft\Office\'
        TargetObject|endswith: '\Excel\Options'
        Details|startswith: '/R '
        Details|endswith: '.xll'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via GlobalFlags
id: 36803969-5421-41ec-b92f-8500f79c23b0
related:
    - id: c81fe886-cac0-4913-a511-2822d72ff505
      type: obsolete
status: test
description: Detects registry persistence technique using the GlobalFlags and SilentProcessExit keys
references:
    - https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
    - https://www.deepinstinct.com/2021/02/16/lsass-memory-dumps-are-stealthier-than-ever-before-part-2/
author: Karneades, Jonhnathan Ribeiro, Florian Roth
date: 2018-04-11
modified: 2023-06-05
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1546.012
    - car.2013-01-002
logsource:
    category: registry_set
    product: windows
detection:
    selection_global_flag:
        TargetObject|contains|all:
            - '\Microsoft\Windows NT\CurrentVersion\'
            - '\Image File Execution Options\'
            - '\GlobalFlag'
    selection_silent_process:
        TargetObject|contains|all:
            - '\Microsoft\Windows NT\CurrentVersion\'
            - '\SilentProcessExit\'
        TargetObject|contains:
            - '\ReportingMode'
            - '\MonitorProcess'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via LSA Extensions
id: 41f6531d-af6e-4c6e-918f-b946f2b85a36
status: test
description: |
    Detects when an attacker modifies the "REG_MULTI_SZ" value named "Extensions" to include a custom DLL to achieve persistence via lsass.
    The "Extensions" list contains filenames of DLLs being automatically loaded by lsass.exe. Each DLL has its InitializeLsaExtension() method called after loading.
references:
    - https://persistence-info.github.io/Data/lsaaextension.html
    - https://twitter.com/0gtweet/status/1476286368385019906
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SYSTEM\CurrentControlSet\Control\LsaExtensionConfig\LsaSrv\Extensions'
    condition: selection
falsepositives:
    - Unlikely
level: high

title: Potential Persistence Via Logon Scripts - CommandLine
id: 21d856f9-9281-4ded-9377-51a1a6e2a432
related:
    - id: 0a98a10c-685d-4ab0-bddc-b6bdd1d48458
      type: derived
status: test
description: Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence
references:
    - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
author: Tom Ueltschi (@c_APT_ure)
date: 2019-01-12
modified: 2023-06-09
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1037.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains: 'UserInitMprLogonScript'
    condition: selection
falsepositives:
    - Legitimate addition of Logon Scripts via the command line by administrators or third party tools
level: high

title: Potential Persistence Via Microsoft Office Add-In
id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936
status: test
description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).
references:
    - Internal Research
    - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
    - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
author: NVISO
date: 2020-05-11
modified: 2023-02-08
tags:
    - attack.persistence
    - attack.t1137.006
logsource:
    category: file_event
    product: windows
detection:
    selection_wlldropped:
        TargetFilename|contains: '\Microsoft\Word\Startup\'
        TargetFilename|endswith: '.wll'
    selection_xlldropped:
        TargetFilename|contains: '\Microsoft\Excel\Startup\'
        TargetFilename|endswith: '.xll'
    selection_xladropped:
        TargetFilename|contains: 'Microsoft\Excel\XLSTART\'
        TargetFilename|endswith: '.xlam'
    selection_generic:
        TargetFilename|contains: '\Microsoft\Addins\'
        TargetFilename|endswith:
            - '.xlam'
            - '.xla'
            - '.ppam'
    condition: 1 of selection_*
falsepositives:
    - Legitimate add-ins
level: high

title: Potential Persistence Via Microsoft Office Startup Folder
id: 0e20c89d-2264-44ae-8238-aeeaba609ece
status: test
description: Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
references:
    - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
    - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2022-06-02
modified: 2023-06-22
tags:
    - attack.persistence
    - attack.t1137
logsource:
    category: file_event
    product: windows
detection:
    selection_word_paths:
        - TargetFilename|contains: '\Microsoft\Word\STARTUP'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\STARTUP'
    selection_word_extension:
        TargetFilename|endswith:
            - '.doc'
            - '.docm'
            - '.docx'
            - '.dot'
            - '.dotm'
            - '.rtf'
    selection_excel_paths:
        - TargetFilename|contains: '\Microsoft\Excel\XLSTART'
        - TargetFilename|contains|all:
              - '\Office'
              - '\Program Files'
              - '\XLSTART'
    selection_excel_extension:
        TargetFilename|endswith:
            - '.xls'
            - '.xlsm'
            - '.xlsx'
            - '.xlt'
            - '.xltm'
    filter_main_office:
        Image|endswith:
            - '\WINWORD.exe'
            - '\EXCEL.exe'
    condition: (all of selection_word_* or all of selection_excel_*) and not filter_main_office
falsepositives:
    - Loading a user environment from a backup or a domain controller
    - Synchronization of templates
level: high

title: Potential Persistence Via Mpnotify
id: 92772523-d9c1-4c93-9547-b0ca500baba3
status: test
description: Detects when an attacker register a new SIP provider for persistence and defense evasion
references:
    - https://persistence-info.github.io/Data/mpnotify.html
    - https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-07-21
modified: 2023-08-17
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify'
    condition: selection
falsepositives:
    - Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way
level: high

title: Potential Persistence Via MyComputer Registry Keys
id: 8fbe98a8-8f9d-44f8-aa71-8c572e29ef06
status: test
description: Detects modification to the "Default" value of the "MyComputer" key and subkeys to point to a custom binary that will be launched whenever the associated action is executed (see reference section for example)
references:
    - https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-08-09
modified: 2024-01-11
tags:
    - attack.persistence
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\Microsoft\Windows\CurrentVersion\Explorer\MyComputer'
        TargetObject|endswith: '(Default)'
    condition: selection
falsepositives:
    - Unlikely but if you experience FPs add specific processes and locations you would like to monitor for
level: high

title: Potential Persistence Via Outlook Form
id: c3edc6a5-d9d4-48d8-930e-aab518390917
status: test
description: Detects the creation of a new Outlook form which can contain malicious code
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
    - https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
    - https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/
author: Tobias Michalski (Nextron Systems)
date: 2021-06-10
modified: 2023-02-22
tags:
    - attack.persistence
    - attack.t1137.003
logsource:
    product: windows
    category: file_event
detection:
    selection:
        Image|endswith: '\outlook.exe'
        TargetFilename|contains:
            - '\AppData\Local\Microsoft\FORMS\IPM'
            - '\Local Settings\Application Data\Microsoft\Forms' # Windows XP
    condition: selection
falsepositives:
    - Legitimate use of outlook forms
level: high

title: Potential Persistence Via Outlook Home Page
id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
related:
    - id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
      type: similar
status: test
description: |
    Detects potential persistence activity via outlook home page.
    An attacker can set a home page to achieve code execution and persistence by editing the WebView registry keys.
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70
    - https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us
    - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
date: 2021-06-09
modified: 2024-08-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains|all:
            - '\Software\Microsoft\Office\'
            - '\Outlook\WebView\'
        TargetObject|endswith: '\URL'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting
id: 396ae3eb-4174-4b9b-880e-dc0364d78a19
status: test
description: Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
    - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2021-04-05
modified: 2023-08-17
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.command-and-control
    - attack.t1137
    - attack.t1008
    - attack.t1546
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Outlook\LoadMacroProviderOnBoot'
        Details|contains: '0x00000001'
    condition: selection
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via Outlook Today Page
id: 487bb375-12ef-41f6-baae-c6a1572b4dd1
related:
    - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76
      type: similar
status: test
description: |
    Detects potential persistence activity via outlook today page.
    An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl".
references:
    - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74
    - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand
date: 2021-06-10
modified: 2024-08-07
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    product: windows
    category: registry_set
detection:
    selection_main:
        TargetObject|contains|all:
            - 'Software\Microsoft\Office\'
            - '\Outlook\Today\'
    selection_value_stamp:
        TargetObject|endswith: '\Stamp'
        Details: 'DWORD (0x00000001)'
    selection_value_url:
        TargetObject|endswith:
            - '\URL'
            - '\UserDefinedUrl'
    filter_main_office:
        Image|startswith:
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\'
            - 'C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\'
        Image|endswith: '\OfficeClickToRun.exe'
    condition: selection_main and 1 of selection_value_* and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

title: Potential Persistence Via PlistBuddy
id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb
status: test
description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility
references:
    - https://redcanary.com/blog/clipping-silver-sparrows-wings/
    - https://www.manpagez.com/man/8/PlistBuddy/
author: Sohan G (D4rkCiph3r)
date: 2023-02-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1543.001
    - attack.t1543.004
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/PlistBuddy'
        CommandLine|contains|all:
            - 'RunAtLoad'
            - 'true'
        CommandLine|contains:
            - 'LaunchAgents'
            - 'LaunchDaemons'
    condition: selection
falsepositives:
    - Unknown
level: high