MITRE ATT&CK technique
Obtain Capabilities detection rulesT1588
Obtain Capabilities (T1588) is a MITRE ATT&CK technique in the Resource Development tactic. This page lists the 12 community-maintained Sigma detection rules in the library mapped to T1588 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux.
Tactic
Hacktool Execution - Imphash
criticalDetects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed
windows · process_creation
Antivirus - Relevant File Paths Alerts Signature
highDetects an Antivirus alert in a highly relevant file path or with a relevant file name. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
antivirus
Hacktool Execution - PE Metadata
highDetects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed
windows · process_creation
Relevant Anti-Virus Signature Keywords In Application Log
highDetects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.
windows
Relevant ClamAV Message
highDetects relevant ClamAV messages
linux
Renamed SysInternals DebugView Execution
highDetects suspicious renamed SysInternals DebugView execution
windows · process_creation
Suspicious Execution Of Renamed Sysinternals Tools - Registry
highDetects the creation of the "accepteula" key related to the Sysinternals tools being created from executables with the wrong name (e.g. a renamed Sysinternals tool)
windows · registry_set
Usage of Renamed Sysinternals Tools - RegistrySet
highDetects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution
windows · registry_set
PUA - Sysinternals Tools Execution - Registry
mediumDetects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key.
windows · registry_set
Suspicious Keyboard Layout Load
mediumDetects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
windows · registry_set
Potential Execution of Sysinternals Tools
lowDetects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools
windows · process_creation
PUA - Sysinternal Tool Execution - Registry
lowDetects the execution of a Sysinternals Tool via the creation of the "accepteula" registry key
windows · registry_set