SigmaHQ/rules/windows/process_creation/win_mmc_spawn_shell.yml

title: MMC Spawning Windows Shell
status: experimental
description: Detects a Windows command line executable started from MMC.
author: Karneades, Swisscom CSIRT
tags:
    - attack.lateral_movement
    - attack.t1175
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: '*\mmc.exe'
        Image:
            - '*\cmd.exe'
            - '*\powershell.exe'
            - '*\wscript.exe'
            - '*\cscript.exe'
            - '*\sh.exe'
            - '*\bash.exe'
            - '*\reg.exe'
            - '*\regsvr32.exe'
            - '*\BITSADMIN*'
    condition: selection
fields:
    - CommandLine
    - Image
    - ParentCommandLine
level: high
Add new rule for detecting MMC spawning a shell Add (analog to win_mshta_spawn_shell.yml) a dedicated rule for dedecting MMC spawning a shell. See https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_mshta_spawn_shell.yml. And it should cover the (removed) cmd part from the existing rule https://github.com/Neo23x0/sigma/blob/master/rules/windows/process_creation/win_susp_mmc_source.yml. 2019-08-05 16:42:31 +00:00			`title: MMC Spawning Windows Shell`
			`status: experimental`
			`description: Detects a Windows command line executable started from MMC.`
			`author: Karneades, Swisscom CSIRT`
			`tags:`
			`- attack.lateral_movement`
			`- attack.t1175`
			`logsource:`
			`category: process_creation`
			`product: windows`
			`detection:`
			`selection:`
			`ParentImage: '*\mmc.exe'`
			`Image:`
			`- '*\cmd.exe'`
			`- '*\powershell.exe'`
			`- '*\wscript.exe'`
			`- '*\cscript.exe'`
			`- '*\sh.exe'`
			`- '*\bash.exe'`
			`- '*\reg.exe'`
			`- '*\regsvr32.exe'`
			`- '\BITSADMIN'`
			`condition: selection`
			`fields:`
			`- CommandLine`
			`- Image`
			`- ParentCommandLine`
			`level: high`