{"id":"02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf","title":"Potential COM Objects Download Cradles Usage - Process Creation","description":"Detects usage of COM objects that can be abused to download files in PowerShell by CLSID","author":"frack113","status":"test","level":"medium","date":"2022-12-25","modified":"","tags":["attack.command-and-control","attack.t1105"],"technique_ids":["T1105"],"logsource":{"product":"windows","category":"process_creation"},"falsepositives":["Legitimate use of the library"],"references":["https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0","https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml","source_sha256":"439846f84fc5a1f17bcc31f60eb3ec2a8b540739770d22233d684ea7f5066ad5","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_download_com_cradles.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential COM Objects Download Cradles Usage - Process Creation\nid: 02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf\nrelated:\n    - id: 3c7d1587-3b13-439f-9941-7d14313dbdfe\n      type: similar\nstatus: test\ndescription: Detects usage of COM objects that can be abused to download files in PowerShell by CLSID\nreferences:\n    - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0\n    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57\nauthor: frack113\ndate: 2022-12-25\ntags:\n    - attack.command-and-control\n    - attack.t1105\nlogsource:\n    product: windows\n    category: process_creation\ndetection:\n    selection_1:\n        CommandLine|contains: '[Type]::GetTypeFromCLSID('\n    selection_2:\n        CommandLine|contains:\n            - '0002DF01-0000-0000-C000-000000000046'\n            - 'F6D90F16-9C73-11D3-B32E-00C04F990BB4'\n            - 'F5078F35-C551-11D3-89B9-0000F81FE221'\n            - '88d96a0a-f192-11d4-a65f-0040963251e5'\n            - 'AFBA6B42-5692-48EA-8141-DC517DCF0EF1'\n            - 'AFB40FFD-B609-40A3-9828-F88BBE11E4E3'\n            - '88d96a0b-f192-11d4-a65f-0040963251e5'\n            - '2087c2f4-2cef-4953-a8ab-66779b670495'\n            - '000209FF-0000-0000-C000-000000000046'\n            - '00024500-0000-0000-C000-000000000046'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate use of the library\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"}],"data_path":"data/detection-rules/02b64f1b-3f33-4e67-aede-ef3b0a5a8fcf.json","kind":"sigma"}