Detection rules › Sigma
Potential COM Objects Download Cradles Usage - Process Creation
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Command & Control | T1105 Ingress Tool Transfer |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
| Security-Auditing | 4688 | A new process has been created. |
Stages and Predicates
Stage 1: all of selection_1
CommandLine|contains: '[Type]::GetTypeFromCLSID('
Stage 2: all of selection_2
or:
CommandLine|contains: '000209FF-0000-0000-C000-000000000046'
CommandLine|contains: '00024500-0000-0000-C000-000000000046'
CommandLine|contains: '0002DF01-0000-0000-C000-000000000046'
CommandLine|contains: '2087c2f4-2cef-4953-a8ab-66779b670495'
CommandLine|contains: '88d96a0a-f192-11d4-a65f-0040963251e5'
CommandLine|contains: '88d96a0b-f192-11d4-a65f-0040963251e5'
CommandLine|contains: 'AFB40FFD-B609-40A3-9828-F88BBE11E4E3'
CommandLine|contains: 'AFBA6B42-5692-48EA-8141-DC517DCF0EF1'
CommandLine|contains: 'F5078F35-C551-11D3-89B9-0000F81FE221'
CommandLine|contains: 'F6D90F16-9C73-11D3-B32E-00C04F990BB4'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|