Thomas Patzke
924e1feb54
* Added UUIDs to all contributed rules * Moved unsupported logic directory out of rules/ because this breaks CI testing.
20 lines
603 B
YAML
20 lines
603 B
YAML
title: Suspicious reverse connect via HTTP proxy
|
|
id: ef24fb9e-add2-4607-abd2-04ca3e9a590f
|
|
status: experimental
|
|
description: Detects auth on proxy-server by machine account (aka SYSTEM)
|
|
author: Ilyas Ochkov, oscd.community
|
|
references:
|
|
- https://blog.redxorblue.com/2019/09/proxy-aware-payload-testing.html
|
|
tags:
|
|
- attack.command_and_control
|
|
- attack.t1043
|
|
logsource:
|
|
category: proxy
|
|
detection:
|
|
selection:
|
|
username|re: '\S+\$$'
|
|
condition: selection
|
|
falsepositives:
|
|
- Update OS or other softs which start by SYSTEM
|
|
- User account with $ in attribute "SamAccountName"
|