Rules Contributing to Suspicious Connection to Another Process Alerts

The following rules are used to identify suspicious activity with Suspicious Connection to Another Process. Any one or more of these will trigger Suspicious Connection to Another Process Alert. Details for each rule can be viewed by clicking the More Details link in the description.

Title

Description

Remote PowerShell Sessions Network Connections (WinRM)

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

Rule ID

windows_security_166

Query

{'selection': {'EventID': 5156, 'DestPort': ['5985', '5986'], 'LayerRTID': '44'}, 'condition': 'selection'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows Security Events

Rule Source

SigmaHQ,13acf386-b8c6-4fe0-9a6e-c4756b974698

Author: Roberto Rodriguez @Cyb3rWard0g

Tactics, Techniques, and Procedures

T1059.001

References

N/A

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/09/12 high

  • Legitimate use of remote PowerShell execution

Suspicious Outbound Kerberos Connection - Security

Detects suspicious outbound network activity via kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.

Rule ID

windows_security_167

Query

{'selection': {'EventID': 5156, 'DestPort': '88'}, 'filter_exact': {'Application': ['C:\\Windows\\System32\\lsass.exe', 'C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe', 'C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe', 'C:\\Program Files\\Mozilla Firefox\\firefox.exe', 'C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe']}, 'condition': 'selection and not 1 of filter_*'}

Log Source

Stellar Cyber Windows Server Sensor configured for:

  • Collecting Windows Security Events

Rule Source

SigmaHQ,eca91c7c-9214-47b9-b4c5-cb1d7e4f2350

Author: Ilyas Ochkov, oscd.community

Tactics, Techniques, and Procedures

T1558.003

References

N/A

Additional Information

Maturity Creation Date Risk Level False Positives
test 2019/10/24 high

  • Web Browsers