Rule Library
Sigma Rules
3 rules found for "Liran Ravich"
3,707Total
3,116Detection
451Emerging
137Hunting
Detectionhighexperimental
Uncommon Svchost Command Line Parameter
Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
WindowsProcess Creation
TA0005 · Defense EvasionTA0004 · Privilege EscalationT1036.005 · Match Legitimate Name or LocationT1055 · Process Injection+1
Liran RavichFri Nov 14windows
Detectionmediumexperimental
Potential Lateral Movement via Windows Remote Shell
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.
WindowsProcess Creation
TA0008 · Lateral MovementT1021.006 · Windows Remote Management
Liran RavichWed Oct 22windows
Detectionhighexperimental
Winrs Local Command Execution
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
WindowsProcess Creation
TA0008 · Lateral MovementTA0005 · Defense EvasionT1021.006 · Windows Remote ManagementT1218 · System Binary Proxy Execution
Liran Ravich+1Wed Oct 22windows