{"id":"ab9e3b40-0c85-4ba1-aede-455d226fd124","title":"Suspicious Redirection to Local Admin Share","description":"Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-16","modified":"2023-12-28","tags":["attack.exfiltration","attack.t1048"],"technique_ids":["T1048"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/","http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml","source_sha256":"abd316c7a8c9cecedade6a9bc970c056b3b00e9d8daa5d94909f5d85a253e42a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Redirection to Local Admin Share\nid: ab9e3b40-0c85-4ba1-aede-455d226fd124\nstatus: test\ndescription: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers\nreferences:\n    - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/\n    - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-01-16\nmodified: 2023-12-28\ntags:\n    - attack.exfiltration\n    - attack.t1048\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_redirect:\n        CommandLine|contains: '>'\n    selection_share:\n        CommandLine|contains:\n            - '\\\\\\\\127.0.0.1\\\\admin$\\\\'\n            - '\\\\\\\\localhost\\\\admin$\\\\'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1048","id":"T1048","name":"Exfiltration Over Alternative Protocol","page":"techniques/enterprise/T1048/"}],"data_path":"data/detection-rules/ab9e3b40-0c85-4ba1-aede-455d226fd124.json","kind":"sigma"}