1type: trigger
2name: sigmahq/proc_creation_win_pua_adfind_susp_usage
3description: |
4  Detects AdFind execution with common flags seen used during attacks
5filter: |
6  (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'domainlist' || evt.Parsed.CommandLine contains 'trustdmp' || evt.Parsed.CommandLine contains 'dcmodes' || evt.Parsed.CommandLine contains 'adinfo' || evt.Parsed.CommandLine contains ' dclist ' || evt.Parsed.CommandLine contains 'computer_pwdnotreqd' || evt.Parsed.CommandLine contains 'objectcategory=' || evt.Parsed.CommandLine contains '-subnets -f' || evt.Parsed.CommandLine contains 'name="Domain Admins"' || evt.Parsed.CommandLine contains '-sc u:' || evt.Parsed.CommandLine contains 'domainncs' || evt.Parsed.CommandLine contains 'dompol' || evt.Parsed.CommandLine contains ' oudmp ' || evt.Parsed.CommandLine contains 'subnetdmp' || evt.Parsed.CommandLine contains 'gpodmp' || evt.Parsed.CommandLine contains 'fspdmp' || evt.Parsed.CommandLine contains 'users_noexpire' || evt.Parsed.CommandLine contains 'computers_active' || evt.Parsed.CommandLine contains 'computers_pwdnotreqd')
7blackhole: 2m
8#status: test
9labels:
10  service: windows
11  confidence: 1
12  spoofable: 0
13  classification:
14   - attack.t1018
15   - attack.t1087.002
16   - attack.t1482
17   - attack.t1069.002
18
19  label: "PUA - AdFind Suspicious Execution"
20  behavior : "windows:audit"
21  remediation: false
22
23scope:
24  type: ParentProcessId
25  expression: evt.Parsed.ParentProcessId
26
27