ATTACK [PTsecurity] Suspicious Remote WMI Win32_Process create

SID: 10002000Rev: 20 views
Sourceptresearch/attackdetection
CreatedDecember 13, 2021
UpdatedDecember 13, 2021
Classificationattempted-admin
alert tcp any any -> $HOME_NET any (msg:"ATTACK [PTsecurity] Suspicious Remote WMI Win32_Process create"; flow:established, to_server; content:"__PARAMETERS|00 00|"; content:"http://"; distance:0; pcre:"/__PARAMETERS\x00\x00[^\x00]+?(?:cmd|powershell)[^\x00]+?http:\/\//"; flowbits:isset, WMI.Win32_Process.Create; classtype:attempted-admin; reference:url, github.com/ptresearch/AttackDetection; sid:10002000; rev:2;)

References

urlgithub.com/ptresearch/AttackDetection

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!