rules/windows/sysmon/sysmon_susp_mmc_source.yml

title: Processes created by MMC 
status: experimental
description: Processes started by MMC could by a sign of lateral movement using MMC application COM object 
reference: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        ParentImage: '*\mmc.exe'
        Image: '*\cmd.exe'
    exclusion:
        CommandLine: '*\RunCmd.cmd'
    condition: selection and not exclusion
falsepositives:
    - unknown
level: medium
Rule review 2017-02-24 23:44:42 +01:00			`title: Processes created by MMC`
New rules and cleanup 2017-02-12 15:50:39 +01:00			`status: experimental`
Consistency between format description and examples 2017-01-10 22:40:59 +01:00			`description: Processes started by MMC could by a sign of lateral movement using MMC application COM object`
Remove implicit selection number, first Sysmon example 2017-01-10 15:05:19 +01:00			`reference: https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/`
Added "logsource" sections and new rule 2017-02-19 00:31:59 +01:00			`logsource:`
Sysmon as 'service' of product 'windows' 2017-03-13 09:23:08 +01:00			`product: windows`
			`service: sysmon`
Remove implicit selection number, first Sysmon example 2017-01-10 15:05:19 +01:00			`detection:`
			`selection:`
Rule review and cleanup 2017-02-15 23:53:08 +01:00			`EventID: 1`
			`ParentImage: '*\mmc.exe'`
			`Image: '*\cmd.exe'`
Remove implicit selection number, first Sysmon example 2017-01-10 15:05:19 +01:00			`exclusion:`
Rule review and cleanup 2017-02-15 23:53:08 +01:00			`CommandLine: '*\RunCmd.cmd'`
Remove implicit selection number, first Sysmon example 2017-01-10 15:05:19 +01:00			`condition: selection and not exclusion`
			`falsepositives:`
			`- unknown`
Added "logsource" sections and new rule 2017-02-19 00:31:59 +01:00			`level: medium`