title: Suspicious PowerShell EncodedCommand
id: 11111111-2222-3333-4444-555555555555
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains: "EncodedCommand"
condition: selection
level: high
title short human-readable name logsource where the event comes from detection selection logic condition boolean expression over selections falsepositives expected benign matches level low / medium / high / critical tags attack.t1059, attack.execution, etc.
Image|endswith: '\powershell.exe' CommandLine|contains: 'IEX' ParentImage|contains|all: - 'cmd.exe' - 'powershell' CommandLine|re: '(?i)frombase64string|encodedcommand' User|startswith: 'NT AUTHORITY\'
condition: selection
condition: selection1 and not filter_main
condition: 1 of selection_*
condition: all of them
condition: selection_a or selection_b
# pattern:
selection_img and selection_cmd and not filter_fp
| Modifier | Meaning | Example |
|---|---|---|
| |contains | substring match | CommandLine|contains: 'rundll32' |
| |startswith | starts with | TargetFilename|startswith: 'C:\Users\' |
| |endswith | ends with | Image|endswith: '\cmd.exe' |
| |all | all list values required | CommandLine|contains|all: ['-enc','JAB'] |
| |re | regex | CommandLine|re: '(?i)whoami|net user' |
| |base64offset | match inside base64 chunks | CommandLine|base64offset|contains: 'powershell' |
| |cidr | IP in subnet | DestinationIp|cidr: '10.0.0.0/8' |
title: Suspicious LOLBins
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith:
- '\rundll32.exe'
- '\regsvr32.exe'
- '\mshta.exe'
- '\certutil.exe'
condition: selection
title: Repeated DNS Query to Suspicious Domain
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 22
QueryName|endswith: '.evil.tld'
condition: selection
sigma list targets sigma convert -t splunk rule.yml sigma convert -t es-qs rule.yml sigma check rule.yml # whole directory sigma convert -t splunk rules/*.yml
chainsaw hunt Logs/ --rules sigma/rules/ --mapping sigma-event-logs-all.yml hayabusa hunt -d Logs -r sigma/rules -o hits.csv # practical CTF flow 1. build timeline 2. grep obvious LOLBins 3. run Sigma rules 4. inspect hits manually