Skip to content

Commit 0da8594

Browse files
github-actions[bot]hach1yon
github-actions[bot]
and
hach1yon
authored
Sigma Rule Update (2026-04-23 20:46:08) (#1020)
Co-authored-by: hach1yon <hach1yon@users.noreply.github.com>
1 parent 2046b5c commit 0da8594

5 files changed

Lines changed: 243 additions & 0 deletions

‎sigma/builtin/process_creation/proc_creation_win_hktl_netexec.yml‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
title: HackTool - NetExec Execution
2+
id: 837269f1-83f1-229a-c835-4371ad44e510
3+
related:
4+
- id: 7638e5fe-600c-4289-a968-f49dd537ec7d
5+
type: derived
6+
status: experimental
7+
description: |
8+
Detects execution of the hacktool NetExec.
9+
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
10+
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
11+
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
12+
references:
13+
- https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
14+
- https://github.com/Pennyw0rth/NetExec
15+
- https://www.netexec.wiki/
16+
author: Chirag Damani
17+
date: 2026-03-29
18+
tags:
19+
- attack.discovery
20+
- attack.t1018
21+
- attack.lateral-movement
22+
- attack.t1021
23+
logsource:
24+
category: process_creation
25+
product: windows
26+
detection:
27+
process_creation:
28+
EventID: 4688
29+
Channel: Security
30+
selection:
31+
CommandLine|contains:
32+
- ' ftp '
33+
- ' ldap '
34+
- ' mssql '
35+
- ' nfs '
36+
- ' rdp '
37+
- ' smb '
38+
- ' ssh '
39+
- ' vnc '
40+
- ' winrm '
41+
- ' wmi '
42+
NewProcessName|endswith: \nxc.exe
43+
condition: process_creation and selection
44+
falsepositives:
45+
- Legitimate use of NetExec by security professionals or system administrators for network assessment and management.
46+
level: high
47+
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_netexec/info.yml
48+
ruletype: Sigma

‎sigma/builtin/process_creation/proc_creation_win_python_base64_encoded_execution.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
title: Python One-Liners with Base64 Decoding
2+
id: 89d785d7-fec2-209e-53a3-19a670b7e0ea
3+
related:
4+
- id: 55e862a8-dd9c-4651-807a-f21fcad56716
5+
type: similar
6+
- id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
7+
type: derived
8+
status: experimental
9+
description: |
10+
Detects Python one-liners that use base64 decoding functions in command line executions.
11+
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
12+
references:
13+
- https://docs.python.org/3/library/base64.html
14+
- https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
15+
- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
16+
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
17+
date: 2026-03-09
18+
tags:
19+
- attack.execution
20+
- attack.t1059.006
21+
- attack.defense-evasion
22+
- attack.t1027.010
23+
logsource:
24+
category: process_creation
25+
product: windows
26+
detection:
27+
process_creation:
28+
EventID: 4688
29+
Channel: Security
30+
selection_img:
31+
- NewProcessName|contains: \python
32+
- OriginalFileName|contains: python
33+
selection_cli:
34+
CommandLine|contains|all:
35+
- import
36+
- base64
37+
- ' -c'
38+
CommandLine|contains:
39+
- .decode
40+
- b16decode
41+
- b32decode
42+
- b32hexdecode
43+
- b64decode
44+
- b85decode
45+
- z85decode
46+
condition: process_creation and (all of selection_*)
47+
falsepositives:
48+
- Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
49+
level: high
50+
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
51+
ruletype: Sigma

‎sigma/sysmon/file/file_event/file_event_win_hktl_netexec_file_indicators.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
title: HackTool - NetExec File Indicators
2+
id: bfafc85b-b7a8-f884-6231-10607569111e
3+
related:
4+
- id: efc21479-9e83-41da-8cf1-122e06ba8db3
5+
type: derived
6+
status: experimental
7+
description: |
8+
Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
9+
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
10+
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
11+
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
12+
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
13+
Active Directory enumeration, credential harvesting, and remote code execution.
14+
references:
15+
- https://github.com/Pennyw0rth/NetExec
16+
- https://www.netexec.wiki/
17+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
18+
date: 2026-04-08
19+
tags:
20+
- attack.execution
21+
- attack.lateral-movement
22+
- attack.discovery
23+
- attack.t1021.002
24+
- attack.t1059.005
25+
- sysmon
26+
logsource:
27+
product: windows
28+
category: file_event
29+
detection:
30+
file_event:
31+
EventID: 11
32+
Channel: Microsoft-Windows-Sysmon/Operational
33+
selection:
34+
- Image|contains: \nxc-windows-latest\
35+
- TargetFilename|contains|all:
36+
- \Temp\_MEI
37+
- \nxc\data\
38+
condition: file_event and selection
39+
falsepositives:
40+
- Unknown
41+
level: high
42+
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml
43+
ruletype: Sigma

‎sigma/sysmon/process_creation/proc_creation_win_hktl_netexec.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
title: HackTool - NetExec Execution
2+
id: bf950c44-b573-6c09-c1cc-45745bded2bc
3+
related:
4+
- id: 7638e5fe-600c-4289-a968-f49dd537ec7d
5+
type: derived
6+
status: experimental
7+
description: |
8+
Detects execution of the hacktool NetExec.
9+
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
10+
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
11+
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
12+
references:
13+
- https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
14+
- https://github.com/Pennyw0rth/NetExec
15+
- https://www.netexec.wiki/
16+
author: Chirag Damani
17+
date: 2026-03-29
18+
tags:
19+
- attack.discovery
20+
- attack.t1018
21+
- attack.lateral-movement
22+
- attack.t1021
23+
- sysmon
24+
logsource:
25+
category: process_creation
26+
product: windows
27+
detection:
28+
process_creation:
29+
EventID: 1
30+
Channel: Microsoft-Windows-Sysmon/Operational
31+
selection:
32+
Image|endswith: \nxc.exe
33+
CommandLine|contains:
34+
- ' ftp '
35+
- ' ldap '
36+
- ' mssql '
37+
- ' nfs '
38+
- ' rdp '
39+
- ' smb '
40+
- ' ssh '
41+
- ' vnc '
42+
- ' winrm '
43+
- ' wmi '
44+
condition: process_creation and selection
45+
falsepositives:
46+
- Legitimate use of NetExec by security professionals or system administrators for network assessment and management.
47+
level: high
48+
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_netexec/info.yml
49+
ruletype: Sigma

‎sigma/sysmon/process_creation/proc_creation_win_python_base64_encoded_execution.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
title: Python One-Liners with Base64 Decoding
2+
id: 23f449fe-55a7-4f4f-7026-aed63cfaab29
3+
related:
4+
- id: 55e862a8-dd9c-4651-807a-f21fcad56716
5+
type: similar
6+
- id: 50a0aa3d-ab16-4594-a8aa-5145a6e6792b
7+
type: derived
8+
status: experimental
9+
description: |
10+
Detects Python one-liners that use base64 decoding functions in command line executions.
11+
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.
12+
references:
13+
- https://docs.python.org/3/library/base64.html
14+
- https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
15+
- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
16+
author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
17+
date: 2026-03-09
18+
tags:
19+
- attack.execution
20+
- attack.t1059.006
21+
- attack.defense-evasion
22+
- attack.t1027.010
23+
- sysmon
24+
logsource:
25+
category: process_creation
26+
product: windows
27+
detection:
28+
process_creation:
29+
EventID: 1
30+
Channel: Microsoft-Windows-Sysmon/Operational
31+
selection_img:
32+
- Image|contains: \python
33+
- OriginalFileName|contains: python
34+
selection_cli:
35+
CommandLine|contains|all:
36+
- import
37+
- base64
38+
- ' -c'
39+
CommandLine|contains:
40+
- .decode
41+
- b16decode
42+
- b32decode
43+
- b32hexdecode
44+
- b64decode
45+
- b85decode
46+
- z85decode
47+
condition: process_creation and (all of selection_*)
48+
falsepositives:
49+
- Legitimate use of Python for decoding data, which is uncommon in typical enterprise environments but possible in development or data analysis contexts.
50+
level: high
51+
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_python_base64_encoded_execution/info.yml
52+
ruletype: Sigma

0 commit comments

Comments
 (0)