Deployed Rules Of The Week

DNS Trace Log

1. DNS Trace Log

Microsoft Windows@Process Creation

2. Driver-DLL Installation Via Odbcconf.EXE
3. New Root Certificate Installed Via CertMgr.EXE
4. New Root Certificate Installed Via Certutil.EXE
5. Password Protected Compressed File Extraction Via 7Zip
6. Potential Qakbot Rundll32 Execution
7. Potential Regsvr32 Commandline Flag Anomaly
8. Potentially Suspicious Child Process Of Regsvr32
9. Potentially Suspicious Regsvr32 HTTP IP Pattern
10. Potentially Suspicious Regsvr32 HTTP-FTP Pattern
11. Qakbot Regsvr32 Calc Pattern
12. Qakbot Rundll32 Exports Execution
13. Qakbot Rundll32 Fake DLL Extension Execution
14. Regsvr32 DLL Execution With Suspicious File Extension
15. Regsvr32 DLL Execution With Uncommon Extension
16. Regsvr32 Execution From Highly Suspicious Location
17. Regsvr32 Execution From Potential Suspicious Location
18. Scripting-CommandLine Process Spawned Regsvr32
19. Small Sieve Malware CommandLine Indicator

Microsoft Windows@System Errors

20. Windows Server Shutdown Abnormal

Web Cache

21. iOS Implant URL Pattern
22. PwnDrp Access
23. Small Sieve Malware Potential C2 Communication
24. Suspicious Network Communication With IPFS
25. Ursnif Malware Download URL Pattern
26. Windows PowerShell User Agent
27. Windows WebDAV User Agent

Web Server

28. Suspicious Windows Strings In URI

Sysmon@Create Remote Thread

29. CreateRemoteThread API and LoadLibrary
30. Potential Credential Dumping Attempt Via PowerShell Remote Thread
31. Remote Thread Creation Ttdinject.exe Proxy
32. Remote Thread Creation Via PowerShell In Rundll32

Sysmon@Files

33. EventLog EVTX File Deleted
34. Exchange PowerShell Cmdlet History Deleted
35. File Deleted Via Sysinternals SDelete
36. IIS WebServer Access Logs Deleted
37. PowerShell Console History Logs Deleted
38. Prefetch File Deleted
39. TeamViewer Log File Deleted
40. Tomcat WebServer Logs Deleted
41. Unusual File Deletion by Dns.exe
42. Malicious PowerShell Scripts – FileCreation
43. Potential Binary Or Script Dropper Via PowerShell
44. Potential MOVEit Transfer Exploitation
45. Potential Startup Shortcut Persistence Via PowerShell.EXE
46. Potential Suspicious PowerShell Module File Created
47. PowerShell Module File Created
48. PowerShell Script Dropped Via PowerShell.EXE
49. Rclone Config File Creation
50. Small Sieve Malware File Indicator Creation

Sysmon@Image Load

51. Sysmon@Image Load

Sysmon@Registry

1. Small Sieve Malware Registry Persistence