title: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
id: c3d76afc-93df-461e-8e67-9b2bad3f2ac4
status: test
description: |
    Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.
author: '@Kostastsale'
references:
    - https://ss64.com/nt/shell.html
date: 2022-12-22
modified: 2024-08-23
tags:
    - attack.discovery
    - attack.t1135
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        Image|endswith: '\explorer.exe'
        CommandLine|contains: 'shell:mycomputerfolder'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_explorer_folder_shortcut_via_shell_binary/info.yml

title: HackTool - SharpView Execution
id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
related:
    - id: dcd74b95-3f36-4ed9-9598-0490951643aa
      type: similar
status: test
description: Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems
references:
    - https://github.com/tevora-threat/SharpView/
    - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
author: frack113
date: 2021-12-10
modified: 2023-02-14
tags:
    - attack.discovery
    - attack.t1049
    - attack.t1069.002
    - attack.t1482
    - attack.t1135
    - attack.t1033
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - OriginalFileName: 'SharpView.exe'
        - Image|endswith: '\SharpView.exe'
        - CommandLine|contains:
              # - 'Add-DomainGroupMember'
              # - 'Add-DomainObjectAcl'
              # - 'Add-ObjectAcl'
              - 'Add-RemoteConnection'
              - 'Convert-ADName'
              - 'ConvertFrom-SID'
              - 'ConvertFrom-UACValue'
              - 'Convert-SidToName'
              # - 'ConvertTo-SID'
              - 'Export-PowerViewCSV'
              # - 'Find-DomainLocalGroupMember'
              - 'Find-DomainObjectPropertyOutlier'
              - 'Find-DomainProcess'
              - 'Find-DomainShare'
              - 'Find-DomainUserEvent'
              - 'Find-DomainUserLocation'
              - 'Find-ForeignGroup'
              - 'Find-ForeignUser'
              - 'Find-GPOComputerAdmin'
              - 'Find-GPOLocation'
              - 'Find-Interesting' # 'Find-InterestingDomainAcl', 'Find-InterestingDomainShareFile', 'Find-InterestingFile'
              - 'Find-LocalAdminAccess'
              - 'Find-ManagedSecurityGroups'
              # - 'Get-ADObject'
              - 'Get-CachedRDPConnection'
              - 'Get-DFSshare'
              # - 'Get-DNSRecord'
              # - 'Get-DNSZone'
              # - 'Get-Domain'
              - 'Get-DomainComputer'
              - 'Get-DomainController'
              - 'Get-DomainDFSShare'
              - 'Get-DomainDNSRecord'
              # - 'Get-DomainDNSZone'
              - 'Get-DomainFileServer'
              - 'Get-DomainForeign' # 'Get-DomainForeignGroupMember', 'Get-DomainForeignUser'
              - 'Get-DomainGPO' # 'Get-DomainGPOComputerLocalGroupMapping', 'Get-DomainGPOLocalGroup', 'Get-DomainGPOUserLocalGroupMapping'
              - 'Get-DomainGroup' # 'Get-DomainGroupMember'
              - 'Get-DomainGUIDMap'
              - 'Get-DomainManagedSecurityGroup'
              - 'Get-DomainObject' # 'Get-DomainObjectAcl'
              - 'Get-DomainOU'
              - 'Get-DomainPolicy' # 'Get-DomainPolicyData'
              - 'Get-DomainSID'
              - 'Get-DomainSite'
              - 'Get-DomainSPNTicket'
              - 'Get-DomainSubnet'
              - 'Get-DomainTrust' # 'Get-DomainTrustMapping'
              # - 'Get-DomainUser'
              - 'Get-DomainUserEvent'
              # - 'Get-Forest'
              - 'Get-ForestDomain'
              - 'Get-ForestGlobalCatalog'
              - 'Get-ForestTrust'
              - 'Get-GptTmpl'
              - 'Get-GroupsXML'
              # - 'Get-GUIDMap'
              # - 'Get-IniContent'
              # - 'Get-IPAddress'
              - 'Get-LastLoggedOn'
              - 'Get-LoggedOnLocal'
              - 'Get-NetComputer' # 'Get-NetComputerSiteName'
              - 'Get-NetDomain' # 'Get-NetDomainController', 'Get-NetDomainTrust'
              - 'Get-NetFileServer'
              - 'Get-NetForest' # 'Get-NetForestCatalog', 'Get-NetForestDomain', 'Get-NetForestTrust'
              - 'Get-NetGPO' # 'Get-NetGPOGroup'
              # - 'Get-NetGroup'
              - 'Get-NetGroupMember'
              - 'Get-NetLocalGroup' # 'Get-NetLocalGroupMember'
              - 'Get-NetLoggedon'
              - 'Get-NetOU'
              - 'Get-NetProcess'
              - 'Get-NetRDPSession'
              - 'Get-NetSession'
              - 'Get-NetShare'
              - 'Get-NetSite'
              - 'Get-NetSubnet'
              - 'Get-NetUser'
              # - 'Get-ObjectAcl'
              - 'Get-PathAcl'
              - 'Get-PrincipalContext'
              # - 'Get-Proxy'
              - 'Get-RegistryMountedDrive'
              - 'Get-RegLoggedOn'
              # - 'Get-SiteName'
              # - 'Get-UserEvent'
              # - 'Get-WMIProcess'
              - 'Get-WMIRegCachedRDPConnection'
              - 'Get-WMIRegLastLoggedOn'
              - 'Get-WMIRegMountedDrive'
              - 'Get-WMIRegProxy'
              - 'Invoke-ACLScanner'
              - 'Invoke-CheckLocalAdminAccess'
              - 'Invoke-Kerberoast'
              - 'Invoke-MapDomainTrust'
              - 'Invoke-RevertToSelf'
              - 'Invoke-Sharefinder'
              - 'Invoke-UserImpersonation'
              # - 'New-DomainGroup'
              # - 'New-DomainUser'
              - 'Remove-DomainObjectAcl'
              - 'Remove-RemoteConnection'
              - 'Request-SPNTicket'
              # - 'Resolve-IPAddress'
              # - 'Set-ADObject'
              - 'Set-DomainObject'
              # - 'Set-DomainUserPassword'
              - 'Test-AdminAccess'
    condition: selection
falsepositives:
    - Unknown
level: high

title: PUA - Advanced IP Scanner Execution
id: bef37fa2-f205-4a7b-b484-0759bfd5f86f
status: test
description: Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
references:
    - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
    - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
    - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc
    - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
    - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner
author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy
date: 2020-05-12
modified: 2023-02-07
tags:
    - attack.discovery
    - attack.t1046
    - attack.t1135
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|contains: '\advanced_ip_scanner' # Covers also advanced_ip_scanner_console.exe
        - OriginalFileName|contains: 'advanced_ip_scanner' # Covers also advanced_ip_scanner_console.exe
        - Description|contains: 'Advanced IP Scanner'
    selection_cli:
        CommandLine|contains|all:
            - '/portable'
            - '/lng'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative use
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner/info.yml

title: PUA - Advanced Port Scanner Execution
id: 54773c5f-f1cc-4703-9126-2f797d96a69d
status: test
description: Detects the use of Advanced Port Scanner.
references:
    - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
author: Nasreddine Bencherchali (Nextron Systems)
date: 2021-12-18
modified: 2023-02-07
tags:
    - attack.discovery
    - attack.t1046
    - attack.t1135
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|contains: '\advanced_port_scanner'
        - OriginalFileName|contains: 'advanced_port_scanner' # Covers also advanced_port_scanner_console.exe
        - Description|contains: 'Advanced Port Scanner'
    selection_cli:
        CommandLine|contains|all:
            - '/portable'
            - '/lng'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administrative use
    - Tools with similar commandline (very rare)
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml