admin/olafhartong-sysmon-modular
1
0
Fork 0
mirror of https://github.com/olafhartong/sysmon-modular synced 2026-06-08 16:29:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add rpcping detection to 1_lol

Browse Source
This commit is contained in:
Connor Shade
2023-04-13 12:46:47 -04:00
parent 5ecab710e0
commit 83311344bc
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
1_process_creation/include_living_off_the_land.xml
+7
View File
@@ -54,6 +54,13 @@
<CommandLine condition="contains">ifm</CommandLine>
</Rule>
<ParentImage name="technique_id=T1003,technique_name=Credential Dumping" condition="is">diskshadow.exe</ParentImage> <!--This only applies to versions of Windows Server-->
<Rule name="technique_id=T1003,technique_name=Credential Dumping (Likely)" groupRelation="and">
<!-- Implementation of this Sigma detection https://github.com/SigmaHQ/sigma/blob/08ca62cc8860f4660e945805d0dd615ce75258c1/rules/windows/process_creation/win_susp_rpcping.yml -->
<OriginalFileName condition="image">rpcping.exe</OriginalFileName>
<CommandLine condition="contains any">\s;-s</CommandLine>
<CommandLine condition="contains any">-u;\u;-t;\t</CommandLine>
<CommandLine condition="contains any">NTLM;ncacn_np</CommandLine>
</Rule>
<OriginalFileName name="technique_id=T1003,technique_name=Credential Dumping" condition="is">rpcping.exe</OriginalFileName>
<Rule name="Ingress Tool Transfer" groupRelation="or">