Merge pull request #571 from Neo23x0/devel

rule: whoami as local system
SigmaHQ · Dec 22, 2019 · 04afccc · 04afccc
2 parents a7ca386 + fc8607b
commit 04afccc
Showing 1 changed file with 22 additions and 0 deletions.
diff --git a/rules/windows/process_creation/win_susp_whoami_localsystem.yml b/rules/windows/process_creation/win_susp_whoami_localsystem.yml
@@ -0,0 +1,22 @@
+title: Whoami as LOCAL_SYSTEM
+id: 1453b1a4-261b-4daf-afe1-2a400a838b5c
+status: experimental
+description: Detects the execution of whoami as LOCAL_SYSTEM, often used after privilege escalation by attackers who want to evaluate the new user context
+author: Florian Roth
+date: 2019/12/22
+tags:
+ - attack.discovery
+ - attack.t1033
+ - car.2016-03-001
+logsource:
+ category: process_creation
+ product: windows
+detection:
+ selection:
+ Image|contains: '\whoami.exe'
+ User: 'NT AUTHORITY\SYSTEM' 
+ condition: selection
+falsepositives:
+ - Admin activity
+ - Scripts and administrative tools used in the monitored environment
+level: critical