SigmaHQ/rules/windows/sysmon/sysmon_susp_mmc_source.yml

title: Processes created by MMC 
status: experimental
description: Processes started by MMC could by a sign of lateral movement using MMC application COM object 
references:
    - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        ParentImage: '*\mmc.exe'
        Image: '*\cmd.exe'
    exclusion:
        CommandLine: '*\RunCmd.cmd'
    condition: selection and not exclusion
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - unknown
level: medium
Rule review * Typos * Added false positive descriptions 2017-02-24 22:44:42 +00:00			`title: Processes created by MMC`
New rules and cleanup 2017-02-12 14:50:39 +00:00			`status: experimental`
Consistency between format description and examples - description/comment -> title/description - addition of reference 2017-01-10 21:40:59 +00:00			`description: Processes started by MMC could by a sign of lateral movement using MMC application COM object`
Change All "str" references to be "list"to mach schema update 2018-01-27 23:24:16 +00:00			`references:`
			`- https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`logsource:`
Sysmon as 'service' of product 'windows' 2017-03-13 08:23:08 +00:00			`product: windows`
			`service: sysmon`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventID: 1`
			`ParentImage: '*\mmc.exe'`
			`Image: '*\cmd.exe'`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`exclusion:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`CommandLine: '*\RunCmd.cmd'`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`condition: selection and not exclusion`
Added field names to first rules 2017-09-12 21:54:04 +00:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`falsepositives:`
			`- unknown`
Added "logsource" sections and new rule 2017-02-18 23:31:59 +00:00			`level: medium`