mirror of
https://github.com/valitydev/SigmaHQ.git
synced 2024-11-08 18:23:52 +00:00
32 lines
1.2 KiB
YAML
32 lines
1.2 KiB
YAML
|
title: Detects Suspicious Commandline escape
|
||
|
|
description: Detects suspicious process that use escape characters
|
||
|
|
status: experimental
|
||
|
|
reference:
|
||
|
|
- https://twitter.com/vysecurity/status/885545634958385153
|
||
|
|
- https://twitter.com/Hexacorn/status/885553465417756673
|
||
|
|
- https://twitter.com/Hexacorn/status/885570278637678592
|
||
|
|
- https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
|
||
|
|
- http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
|
||
|
|
author: juju4
|
||
|
|
logsource:
|
||
|
|
product: windows
|
||
|
|
service: security
|
||
|
|
description: 'Requirements: Audit Policy : Detailed Tracking > Audit Process creation, Group Policy : Administrative Templates\System\Audit Process Creation'
|
||
|
|
detection:
|
||
|
|
selection:
|
||
|
|
EventID: 4688
|
||
|
|
CommandLine:
|
||
|
|
- '^'
|
||
|
|
- '@'
|
||
|
|
# 0x002D -, 0x2013 , 0x2014 , 0x2015 ― ... FIXME! how to match hexa form?
|
||
|
|
- '-'
|
||
|
|
- '―'
|
||
|
|
- 'c:/'
|
||
|
|
- '<TAB>'
|
||
|
|
- '^h^t^t^p'
|
||
|
|
- 'h"t"t"p'
|
||
|
|
condition: selection
|
||
|
|
falsepositives:
|
||
|
|
- False positives depend on scripts and administrative tools used in the monitored environment
|
||
|
|
level: medium
|