Mint Sandstorm - ManageEngine Suspicious Process Execution
Detects suspicious process execution originating from ManageEngine applications, as observed in attacks attributed to Mint Sandstorm. The rule specifically looks for PowerShell, `lsass` related commands, `wget`, `curl`, script execution, local group modifications, network user additions, registry modifications for Defender or LSA, WMIC for process creation or shadow copy deletion, `vssadmin` for shadow deletion, and `wbadmin` for catalog deletion, all originating from a ManageEngine parent process. It filters out legitimate ManageEngine downloads.
Sigma
