rules.ndjson

{"id": "974a88fe-37b2-48b8-aa5e-440b8fa13074", "name": "SIGMA - Execution From Suspicious Path via Vshadow", "enabled": true, "throttle": "no_actions", "interval": "1m", "author": ["lazarg"], "description": "Detects executable invocation from suspicious paths via vshadow.", "rule_id": "974a88fe-37b2-48b8-aa5e-440b8fa13074", "false_positives": ["Unknown"], "from": "now-2m", "immutable": false, "license": "DRL", "output_index": "", "meta": {"from": "1m"}, "max_signals": 100, "risk_score": 73, "risk_score_mapping": [], "severity": "high", "severity_mapping": [], "threat": [{"tactic": {"id": "TA0005", "reference": "https://attack.mitre.org/tactics/TA0005", "name": "Defense-Evasion"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1127", "reference": "https://attack.mitre.org/techniques/T1127", "name": "Trusted Developer Utilities Proxy Execution", "subtechnique": []}]}], "tags": [], "to": "now", "references": ["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/", "https://gist.github.com/mattifestation/5f9de750470c9e0e1f9c9c33f0ec3e56"], "version": 1, "exceptions_list": [], "related_integrations": [], "required_fields": [], "setup": "", "type": "query", "language": "lucene", "index": ["logs-*"], "query": "process.parent.executable:*\\\\vshadow.exe AND process.parent.command_line:(*\\-exec* OR *\\/exec* OR *\u2013exec* OR *\u2014exec* OR *\u2015exec*) AND (process.executable:(*\\\\windows\\\\system32\\\\microsoft\\\\crypto\\\\rsa\\\\machinekeys* OR *\\\\windows\\\\system32\\\\tasks_migrated\\\\microsoft\\\\windows\\\\pla\\\\system* OR *\\\\windows\\\\syswow64\\\\tasks\\\\microsoft\\\\windows\\\\pla\\\\system* OR *\\\\windows\\\\debug\\\\wia* OR *\\\\windows\\\\system32\\\\tasks* OR *\\\\windows\\\\syswow64\\\\tasks* OR *\\\\windows\\\\tasks* OR *\\\\windows\\\\registration\\\\crmlog* OR *\\\\windows\\\\system32\\\\com\\\\dmp* OR *\\\\windows\\\\system32\\\\fxstmp* OR *\\\\windows\\\\system32\\\\spool\\\\drivers\\\\color* OR *\\\\windows\\\\system32\\\\spool\\\\printers* OR *\\\\windows\\\\system32\\\\spool\\\\servers* OR *\\\\windows\\\\syswow64\\\\com\\\\dmp* OR *\\\\windows\\\\syswow64\\\\fxstmp* OR *\\\\windows\\\\temp* OR *\\\\windows\\\\tracing*))", "filters": [], "actions": []}
{"id": "0022869c-49f7-4ff2-ba03-85ac42ddac58", "name": "SIGMA - System Information Discovery via Registry Queries", "enabled": true, "throttle": "no_actions", "interval": "1m", "author": ["lazarg"], "description": "The rule identifies attempts to query system information directly from the Windows Registry.", "rule_id": "0022869c-49f7-4ff2-ba03-85ac42ddac58", "false_positives": ["Unlikely"], "from": "now-2m", "immutable": false, "license": "DRL", "output_index": "", "meta": {"from": "1m"}, "max_signals": 100, "risk_score": 21, "risk_score_mapping": [], "severity": "low", "severity_mapping": [], "threat": [{"tactic": {"id": "TA0007", "reference": "https://attack.mitre.org/tactics/TA0007", "name": "Discovery"}, "framework": "MITRE ATT&CK", "technique": [{"id": "T1082", "reference": "https://attack.mitre.org/techniques/T1082", "name": "System Information Discovery", "subtechnique": []}]}], "tags": [], "to": "now", "references": ["https://cert.gov.ua/article/6277849", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-39---discover-os-product-name-via-registry", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1082/T1082.md#atomic-test-40---discover-os-build-number-via-registry", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1124/T1124.md#atomic-test-6---discover-system-time-zone-via-registry"], "version": 1, "exceptions_list": [], "related_integrations": [], "required_fields": [], "setup": "", "type": "query", "language": "lucene", "index": ["logs-*"], "query": "((process.executable:*\\\\reg.exe AND process.command_line:*query* AND process.command_line:(*\\-v* OR *\\/v* OR *\u2013v* OR *\u2014v* OR *\u2015v*)) OR ((process.executable:(*\\\\powershell.exe OR *\\\\pwsh.exe)) AND (process.command_line:(*Get\\-ItemPropertyValue* OR *gpv*)))) AND (process.command_line:(*\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\TimeZoneInformation* OR *\\\\SYSTEM\\\\CurrentControlSet\\\\Services\\\\Tcpip\\\\Parameters\\\\Interfaces* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ Defender* OR *\\\\SYSTEM\\\\CurrentControlSet\\\\Services* OR *\\\\SOFTWARE\\\\Microsoft\\\\Windows\\ NT\\\\CurrentVersion\\\\Schedule\\\\TaskCache\\\\Tasks*))", "filters": [], "actions": []}