Detections

The custom Wazuh rules I wrote for the gaps Phase 2 found. Each one lists what it catches and a known false positive.

LSASS memory access (credential dumping)

#100010level 12Credential AccessT1003.001

Validated in lab

Catches

Any process opening a handle to lsass.exe (Sysmon event 10). This is the gap that mattered most: the comsvcs.dll dump ran and the defaults stayed silent.

Known false positives

Legitimate security tooling and Windows itself (svchost.exe, MicrosoftEdgeUpdate.exe) read LSASS. In the lab these fired the rule, so in a real environment you exclude known-good source images before alerting.

Example it fired on

Credential dumping: C:\WINDOWS\system32\svchost.exe accessed LSASS memory

Rule XML

<rule id="100010" level="12">
  <if_group>windows</if_group>
  <field name="win.system.channel">Microsoft-Windows-Sysmon/Operational</field>
  <field name="win.system.eventID">^10$</field>
  <field name="win.eventdata.targetImage" type="pcre2">(?i)\\lsass\.exe$</field>
  <description>Credential dumping: $(win.eventdata.sourceImage) accessed LSASS memory</description>
  <mitre><id>T1003.001</id></mitre>
</rule>

Discovery via built-in binaries

#100020level 6DiscoveryT1033 T1082 T1016

Validated in lab

Catches

Common recon tools running (whoami, systeminfo, ipconfig, net, nltest, quser, hostname, tasklist). Low severity on purpose: one alone is normal admin work. The value is correlation, several from one host in a short window.

Known false positives

High. Admins and scripts run these constantly. Do not page on a single hit; use it as a correlation signal.

Example it fired on

Discovery: recon binary executed -> whoami.exe

Rule XML

<rule id="100020" level="6">
  <if_group>windows</if_group>
  <field name="win.system.channel">Microsoft-Windows-Sysmon/Operational</field>
  <field name="win.system.eventID">^1$</field>
  <field name="win.eventdata.originalFileName" type="pcre2">(?i)^(whoami\.exe|systeminfo\.exe|ipconfig\.exe|net\.exe|net1\.exe|nltest\.exe|quser\.exe|hostname\.exe|tasklist\.exe)$</field>
  <description>Discovery: recon binary executed -> $(win.eventdata.originalFileName)</description>
  <mitre><id>T1033</id><id>T1082</id><id>T1016</id></mitre>
</rule>

Registry Run key persistence

#100030level 10PersistenceT1547.001

Untested

Catches

A value written to a Run or RunOnce autostart key (Sysmon event 13).

Known false positives

Installers and updaters legitimately add Run keys. Medium severity, so it surfaces for review without paging.

Rule XML

<rule id="100030" level="10">
  <if_group>windows</if_group>
  <field name="win.system.channel">Microsoft-Windows-Sysmon/Operational</field>
  <field name="win.system.eventID">^13$</field>
  <field name="win.eventdata.targetObject" type="pcre2">(?i)\\(CurrentVersion\\Run|CurrentVersion\\RunOnce)\\</field>
  <description>Persistence: registry Run key value set -> $(win.eventdata.targetObject)</description>
  <mitre><id>T1547.001</id></mitre>
</rule>

Archiving tool launched (exfil staging)

#100040level 8CollectionT1560.001

Untested

Catches

makecab.exe or diantz.exe launching (Sysmon event 1), used to stage data for exfil.

Known false positives

Windows servicing and some installers call makecab. Medium severity.

Rule XML

<rule id="100040" level="8">
  <if_group>windows</if_group>
  <field name="win.system.channel">Microsoft-Windows-Sysmon/Operational</field>
  <field name="win.system.eventID">^1$</field>
  <field name="win.eventdata.originalFileName" type="pcre2">(?i)^(makecab\.exe|diantz\.exe)$</field>
  <description>Collection: archiving tool launched -> $(win.eventdata.commandLine)</description>
  <mitre><id>T1560.001</id></mitre>
</rule>

Scheduled task created from command line

#100050level 8PersistenceT1053.005

Untested

Catches

schtasks.exe /create (Sysmon event 1). The defaults only caught the script this test dropped in C:\, not the task registration. This names the technique correctly.

Known false positives

Legitimate software installs scheduled tasks. Medium severity.

Rule XML

<rule id="100050" level="8">
  <if_group>windows</if_group>
  <field name="win.system.channel">Microsoft-Windows-Sysmon/Operational</field>
  <field name="win.system.eventID">^1$</field>
  <field name="win.eventdata.originalFileName" type="pcre2">(?i)^schtasks\.exe$</field>
  <field name="win.eventdata.commandLine" type="pcre2">(?i)/create</field>
  <description>Persistence: scheduled task created from command line -> $(win.eventdata.commandLine)</description>
  <mitre><id>T1053.005</id></mitre>
</rule>