Rule Library

Sigma Rules

13 rules found for "Josh Nickels"

3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhighexperimental

Azure Login Bypassing Conditional Access Policies

Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.

Microsoft 365audit
TA0004 · Privilege EscalationTA0003 · PersistenceTA0001 · Initial AccessTA0005 · Defense Evasion+1
Josh Nickels+1Wed Jan 08cloud
Detectionlowtest

Remote Access Tool - Team Viewer Session Started On Linux Host

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

LinuxProcess Creation
TA0003 · PersistenceTA0001 · Initial AccessT1133 · External Remote Services
Josh Nickels+1Mon Mar 11linux
Detectionlowtest

Remote Access Tool - Team Viewer Session Started On MacOS Host

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

macOSProcess Creation
TA0003 · PersistenceTA0001 · Initial AccessT1133 · External Remote Services
Josh Nickels+1Mon Mar 11macos
Detectionmediumtest

Group Policy Abuse for Privilege Addition

Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.

Windowssecurity
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1484.001 · Group Policy Modification
Elastic Security+2Wed Sep 04windows
Detectionmediumtest

Startup/Logon Script Added to Group Policy Object

Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.

Windowssecurity
TA0003 · PersistenceTA0005 · Defense EvasionTA0004 · Privilege EscalationT1484.001 · Group Policy Modification+1
Elastic Security+2Fri Sep 06windows
Detectionlowtest

DNS Query Request To OneLaunch Update Service

Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application. When the OneLaunch application is installed it will attempt to get updates from this domain.

WindowsDNS Query
TA0006 · Credential AccessTA0009 · CollectionT1056 · Input Capture
Josh NickelsMon Feb 26windows
Detectionlowexperimental

Suspicious Deno File Written from Remote Source

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

WindowsFile Event
TA0002 · ExecutionT1204 · User ExecutionT1059.007 · JavaScriptTA0011 · Command and Control+1
Josh Nickels+1Thu May 22windows
Detectionlowtest

BitLockerTogo.EXE Execution

Detects the execution of "BitLockerToGo.EXE". BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system. This is a rarely used application and usage of it at all is worth investigating. Malware such as Lumma stealer has been seen using this process as a target for process hollowing.

WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
Josh Nickels+1Thu Jul 11windows
Detectionlowtest

Remote Access Tool - Team Viewer Session Started On Windows Host

Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.

WindowsProcess Creation
TA0003 · PersistenceTA0001 · Initial AccessT1133 · External Remote Services
Josh Nickels+1Mon Mar 11windows
Detectionhightest

Mshtml.DLL RunHTMLApplication Suspicious Usage

Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)

WindowsProcess Creation
TA0005 · Defense EvasionTA0002 · Execution
Nasreddine Bencherchali (Nextron Systems)+4Sun Aug 14windows
Detectionhightest

Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

WindowsProcess Creation
TA0005 · Defense EvasionT1027 · Obfuscated Files or Information
François Hubaut+2Mon Sep 02windows
Emerging Threatmediumtest

DarkGate - Drop DarkGate Loader In C:\Temp Directory

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

WindowsFile Event
TA0002 · ExecutionT1059 · Command and Scripting Interpreterdetection.emerging-threats
Tomasz Dyduch+1Fri May 312024
Threat Huntmediumtest

Potential Password Reconnaissance Via Findstr.EXE

Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages

WindowsProcess Creation
TA0006 · Credential AccessT1552.001 · Credentials In Filesdetection.threat-hunting
Josh NickelsThu May 18windows