valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

new rules detecting the creation of a local hidden user

Browse Source
This commit is contained in:
phantinuss 2021-05-05 15:06:00 +02:00
parent 4b520de373
commit 254a3bb122
No known key found for this signature in database
GPG Key ID: 10E5D3C9141CC9FF
2 changed files with 48 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
rules/windows/builtin/win_hidden_user_creation.yml Normal file
View File

@ -0,0 +1,25 @@
title: Hidden Local User Creation
id: 7b449a5e-1db5-4dd0-a2dc-4e3a67282538
description: Detects the creation of a local hidden user account which should not happen for event ID 4720.
status: experimental
tags:
- attack.persistence
- attack.t1136.001
references:
- https://twitter.com/SBousseaden/status/1387743867663958021
author: Christian Burkard
date: 2021/05/03
logsource:
product: windows
service: security
detection:
selection:
EventID: 4720
TargetUserName|endswith: '$'
condition: selection
fields:
- EventCode
- AccountName
falsepositives:
- unkown
level: high

23
rules/windows/registry_event/sysmon_registry_add_local_hidden_user.yml Normal file
View File

@ -0,0 +1,23 @@
title: Creation of a local hidden user account by Registry
id: 460479f3-80b7-42da-9c43-2cc1d54dbccd
description: Sysmon registry detection of a local hidden user account.
status: experimental
date: 2021/05/03
author: Christian Burkard
tags:
- attack.persistence
- attack.t1136.001
references:
- https://twitter.com/SBousseaden/status/1387530414185664538
logsource:
product: windows
service: registry_event
detection:
selection:
TargetObject|startswith: 'HKLM\SAM\SAM\Domains\Account\Users\Names\'
TargetObject|endswith: '$'
Image|endswith: "lsass.exe"
condition: selection
falsepositives:
- unknown
level: high