SigmaHQ/rules/windows/sysmon/sysmon_susp_mmc_source.yml

title: Proceses created by MMC 
status: experimental
description: Processes started by MMC could by a sign of lateral movement using MMC application COM object 
reference: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
detection:
    selection:
        EventLog: Microsoft-Windows-Sysmon/Operational
        EventID: 1
        ParentImage: '*\mmc.exe'
        Image: '*\cmd.exe'
    exclusion:
        CommandLine: '*\RunCmd.cmd'
    condition: selection and not exclusion
falsepositives:
    - unknown
level: high
Consistency between format description and examples - description/comment -> title/description - addition of reference 2017-01-10 21:40:59 +00:00			`title: Proceses created by MMC`
New rules and cleanup 2017-02-12 14:50:39 +00:00			`status: experimental`
Consistency between format description and examples - description/comment -> title/description - addition of reference 2017-01-10 21:40:59 +00:00			`description: Processes started by MMC could by a sign of lateral movement using MMC application COM object`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`reference: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/`
			`detection:`
			`selection:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`EventLog: Microsoft-Windows-Sysmon/Operational`
			`EventID: 1`
			`ParentImage: '*\mmc.exe'`
			`Image: '*\cmd.exe'`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`exclusion:`
Rule review and cleanup * removed unnecessary one element lists from definitions * converted some lists of one element maps to maps because the resulting OR linkage would cause wrong result. 2017-02-15 22:53:08 +00:00			`CommandLine: '*\RunCmd.cmd'`
Remove implicit selection number, first Sysmon example 2017-01-10 14:05:19 +00:00			`condition: selection and not exclusion`
			`falsepositives:`
			`- unknown`
Levels to low, medium, high, critical 2017-02-16 17:02:26 +00:00			`level: high`