Sigma rule: Mint Sandstorm - ManageEngine Suspicious Process Execution

Rule

Title

Mint Sandstorm - ManageEngine Suspicious Process Execution

Status

test

Level

critical

Author

Nasreddine Bencherchali (Nextron Systems), MSTIC (idea)

Date

2023-04-20

Modified

2025-10-19

File

rules-emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_manage_engine_susp_child_process.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Log source

product

windows

category

process_creation

Detection

selection_parent_path:
    ParentImage|contains:
        - 'manageengine'
        - 'ServiceDesk'
selection_parent_image:
    ParentImage|contains: '\java'
selection_special_child_powershell_img:
    Image|endswith:
        - '\powershell.exe'
        - '\powershell_ise.exe'
selection_special_child_powershell_cli:
    - CommandLine|contains:
          - ' echo '
          - '-dumpmode'
          - '-ssh'
          - '.dmp'
          - 'add-MpPreference'
          - 'adscredentials'
          - 'bitsadmin'
          - 'certutil'
          - 'csvhost.exe'
          - 'DownloadFile'
          - 'DownloadString'
          - 'dsquery'
          - 'ekern.exe'
          - 'FromBase64String'
          - 'iex '
          - 'iex('
          - 'Invoke-Expression'
          - 'Invoke-WebRequest'
          - 'localgroup administrators'
          - 'o365accountconfiguration'
          - 'samaccountname='
          - 'set-MpPreference'
          - 'svhost.exe'
          - 'System.IO.Compression'
          - 'System.IO.MemoryStream'
          - 'usoprivate'
          - 'usoshared'
          - 'whoami'
    - CommandLine|re: '[-/–][Ee^]{1,2}[ncodema^]*\s[A-Za-z0-9+/=]{15,}'
    - CommandLine|re: 'net\s+user'
    - CommandLine|re: 'net\s+group'
    - CommandLine|re: 'query\ssession'
selection_special_child_lsass_1:
    CommandLine|contains: 'lsass'
selection_special_child_lsass_2:
    CommandLine|contains:
        - 'procdump'
        - 'tasklist'
        - 'findstr'
selection_child_wget:
    Image|endswith: '\wget.exe'
    CommandLine|contains: 'http'
selection_child_curl:
    Image|endswith: '\curl.exe'
    CommandLine|contains: 'http'
selection_child_script:
    CommandLine|contains:
        - 'E:jscript'
        - 'e:vbscript'
selection_child_localgroup:
    CommandLine|contains|all:
        - 'localgroup Administrators'
        - '/add'
selection_child_net:
    CommandLine|contains: 'net' # Covers net1
    CommandLine|contains|all:
        - 'user'
        - '/add'
selection_child_reg:
    - CommandLine|contains|all:
          - 'reg add'
          - 'DisableAntiSpyware'
          - '\Microsoft\Windows Defender'
    - CommandLine|contains|all:
          - 'reg add'
          - 'DisableRestrictedAdmin'
          - 'CurrentControlSet\Control\Lsa'
selection_child_wmic_1:
    CommandLine|contains|all:
        - 'wmic'
        - 'process call create'
selection_child_wmic_2:
    CommandLine|contains|all:
        - 'wmic'
        - 'delete'
        - 'shadowcopy'
selection_child_vssadmin:
    CommandLine|contains|all:
        - 'vssadmin'
        - 'delete'
        - 'shadows'
selection_child_wbadmin:
    CommandLine|contains|all:
        - 'wbadmin'
        - 'delete'
        - 'catalog'
filter_main:
    CommandLine|contains|all:
        - 'download.microsoft.com'
        - 'manageengine.com'
        - 'msiexec'
condition: all of selection_parent_* and (all of selection_special_child_powershell_* or all of selection_special_child_lsass_* or 1 of selection_child_*) and not filter_main

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• detection.emerging-threats

References

• https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/TA/Mint-Sandstorm/proc_creation_win_apt_mint_sandstorm_manage_engine_susp_child_process.yml