Skip to content

Commit a739da1

Browse files
unrootedunrooted
committed
add sigma rules for Windows Sandbox
1 parent 2dbc894 commit a739da1

6 files changed

Lines changed: 252 additions & 0 deletions

‎rules/windows/process_creation/proc_creation_win_wsb_exec_system.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
title: Headless SYSTEM-Context Command Execution Via Windows Sandbox CLI
2+
id: 86fdab07-ef1e-4528-bf4b-e1f9eefd1546
3+
status: experimental
4+
description: |
5+
Detects use of the wsb.exe exec subcommand with -r System, which executes a command inside an already-running Windows Sandbox in the NT AUTHORITY\SYSTEM context.
6+
references:
7+
- https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli#exec
8+
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsb/
9+
author: Konrad 'unrooted' Klawikowski
10+
date: 2026-07-22
11+
tags:
12+
- attack.execution
13+
- attack.defense-evasion
14+
- attack.privilege-escalation
15+
- attack.t1218
16+
- attack.t1564.006
17+
logsource:
18+
category: process_creation
19+
product: windows
20+
detection:
21+
selection_image:
22+
- Image|endswith: '\wsb.exe'
23+
- OriginalFileName: 'wsb.exe'
24+
selection_subcommand:
25+
CommandLine|contains: ' exec '
26+
selection_system:
27+
CommandLine|contains:
28+
- ' -r System'
29+
- ' --run-as System'
30+
condition: all of selection_*
31+
fields:
32+
- CommandLine
33+
- ParentImage
34+
- ParentCommandLine
35+
- User
36+
falsepositives:
37+
- Internal IT or development automation that scripts SYSTEM-context tasks inside sandboxes for testing
38+
- Sandbox-based CI runners that need elevated execution
39+
level: medium

‎rules/windows/process_creation/proc_creation_win_wsb_inline_logoncommand.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
title: Potential Fileless Execution Via Windows Sandbox CLI Inline LogonCommand
2+
id: 3d9ac57f-46ea-4e59-a581-a59f61bb3a18
3+
status: experimental
4+
description: |
5+
Detects use of wsb.exe (Windows Sandbox CLI, available on Windows 11 24H2 and later) to launch a sandbox from an inline XML configuration that contains an embedded <LogonCommand>.
6+
references:
7+
- https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli
8+
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsb/
9+
- https://github.com/secdev02/SandBoxShenanigans
10+
author: Konrad 'unrooted' Klawikowski
11+
date: 2026-07-22
12+
tags:
13+
- attack.execution
14+
- attack.defense-evasion
15+
- attack.t1564.006
16+
logsource:
17+
category: process_creation
18+
product: windows
19+
detection:
20+
selection_image:
21+
- Image|endswith: '\wsb.exe'
22+
- OriginalFileName: 'wsb.exe'
23+
selection_args:
24+
CommandLine|contains|all:
25+
- '--config'
26+
- '<LogonCommand>'
27+
condition: all of selection_*
28+
fields:
29+
- CommandLine
30+
- ParentImage
31+
- ParentCommandLine
32+
- User
33+
falsepositives:
34+
- Developers or QA pipelines that spawn ad-hoc sandboxes from inline XML configurations for build verification
35+
- Power users who script Sandbox usage to avoid maintaining .wsb files
36+
level: medium

‎rules/windows/process_creation/proc_creation_win_wsb_lolbin_execution.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
title: Arbitrary Command Execution Using Windows Sandbox CLI
2+
id: 2116ff63-a084-4168-b10c-7a4750b53d6d
3+
related:
4+
- id: 3d9ac57f-46ea-4e59-a581-a59f61bb3a18
5+
type: similar
6+
- id: 86fdab07-ef1e-4528-bf4b-e1f9eefd1546
7+
type: similar
8+
- id: c8faeb88-b4de-4242-ba6c-57f7a75e114a
9+
type: similar
10+
status: experimental
11+
description: |
12+
Detects potential abuse of the Windows Sandbox CLI (wsb.exe, available on Windows 11 24H2 and later) as a LOLBIN.
13+
references:
14+
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsb/
15+
- https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli
16+
- https://web.archive.org/web/20250116184008/http://blog.syscall.party/2020/12/02/weaponizing-windows-sandbox.html
17+
- https://github.com/LloydLabs/wsb-detect
18+
author: Konrad 'unrooted' Klawikowski
19+
date: 2026-07-22
20+
tags:
21+
- attack.execution
22+
- attack.defense-evasion
23+
- attack.privilege-escalation
24+
- attack.lateral-movement
25+
- attack.exfiltration
26+
- attack.t1218
27+
- attack.t1564.006
28+
- attack.t1105
29+
logsource:
30+
category: process_creation
31+
product: windows
32+
detection:
33+
selection_img:
34+
- Image|endswith: '\wsb.exe'
35+
- OriginalFileName: 'wsb.exe'
36+
selection_cli:
37+
# Fileless inline-config execution via embedded LogonCommand
38+
- CommandLine|contains|all:
39+
- '--config'
40+
- '<LogonCommand>'
41+
# Headless SYSTEM-context exec, or runtime read-write host-folder sharing
42+
- CommandLine|contains:
43+
- ' -r System'
44+
- ' --run-as System'
45+
- '--allow-write'
46+
condition: all of selection_*
47+
falsepositives:
48+
- Developers, QA, or CI pipelines that script Windows Sandbox from inline XML configurations or drive a running sandbox via the wsb.exe CLI for build/test verification
49+
- Power users who script Sandbox usage to avoid maintaining .wsb files on disk
50+
level: medium

‎rules/windows/process_creation/proc_creation_win_wsb_server_spawn.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
title: Windows Sandbox Server Spawned (Enrichment Trigger for Headless Sandbox Detection)
2+
id: 5267fa06-a48c-41c1-beb0-d6990a2415a2
3+
status: experimental
4+
description: |
5+
Detects WindowsSandboxServer.exe spawning on the host.
6+
references:
7+
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsb/
8+
- https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli
9+
author: Konrad 'unrooted' Klawikowski
10+
date: 2026-05-30
11+
tags:
12+
- attack.execution
13+
- attack.defense-evasion
14+
- attack.t1564.006
15+
logsource:
16+
category: process_creation
17+
product: windows
18+
detection:
19+
selection:
20+
Image|endswith: '\WindowsSandboxServer.exe'
21+
condition: selection
22+
fields:
23+
- User
24+
- ProcessId
25+
- Image
26+
- ParentImage
27+
- ParentCommandLine
28+
falsepositives:
29+
- Every legitimate Sandbox launch (this rule is a low-precision enrichment trigger)
30+
level: low

‎rules/windows/process_creation/proc_creation_win_wsb_share_allow_write.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
title: Runtime Read-Write Host-Folder Sharing Via Windows Sandbox CLI
2+
id: c8faeb88-b4de-4242-ba6c-57f7a75e114a
3+
status: experimental
4+
description: |
5+
Detects use of the wsb.exe share subcommand with --allow-write, which dynamically maps a host folder into a running Windows Sandbox with sandbox-to-host write permissions.
6+
references:
7+
- https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli#share
8+
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsb/
9+
author: Konrad 'unrooted' Klawikowski
10+
date: 2026-07-22
11+
tags:
12+
- attack.lateral-movement
13+
- attack.exfiltration
14+
- attack.t1105
15+
logsource:
16+
category: process_creation
17+
product: windows
18+
detection:
19+
selection_image:
20+
- Image|endswith: '\wsb.exe'
21+
- OriginalFileName: 'wsb.exe'
22+
selection_args:
23+
CommandLine|contains|all:
24+
- ' share '
25+
- '--allow-write'
26+
condition: all of selection_*
27+
fields:
28+
- CommandLine
29+
- ParentImage
30+
- ParentCommandLine
31+
- User
32+
falsepositives:
33+
- Interactive Sandbox users adding folders to a running sandbox via the wsb.exe CLI as documented Microsoft workflow
34+
- Automation that intentionally grants write-back access to a sandbox for output collection
35+
level: medium

‎rules/windows/process_creation/proc_creation_win_wsb_start_exec_chain_correlation.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
title: Correlated Windows Sandbox CLI Abuse Chain (start + exec / share)
2+
id: ea1e01d2-f1b9-4d17-9c02-60945943f381
3+
status: experimental
4+
description: |
5+
Correlation rule that fires when the same User runs wsb.exe with `start` and then with `exec`, `share`, or `connect` within 10 minutes.
6+
references:
7+
- https://learn.microsoft.com/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli
8+
- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsb/
9+
author: Konrad 'unrooted' Klawikowski
10+
date: 2026-07-22
11+
tags:
12+
- attack.execution
13+
- attack.defense-evasion
14+
- attack.t1218
15+
- attack.t1564.006
16+
correlation:
17+
type: temporal
18+
rules:
19+
- wsb_start_event
20+
- wsb_followup_event
21+
group-by:
22+
- User
23+
timespan: 10m
24+
---
25+
title: Windows Sandbox CLI Start Event (Correlation Base Rule)
26+
name: wsb_start_event
27+
id: 3556b3d4-2e33-4f52-a6bb-eeaa960f6833
28+
logsource:
29+
category: process_creation
30+
product: windows
31+
detection:
32+
selection_image:
33+
- Image|endswith: '\wsb.exe'
34+
- OriginalFileName: 'wsb.exe'
35+
keyword:
36+
CommandLine|contains: ' start'
37+
condition: all of selection_* and keyword
38+
---
39+
title: Windows Sandbox CLI Follow-Up Event (Correlation Base Rule)
40+
name: wsb_followup_event
41+
id: 27157649-a411-4d70-8704-48712de67bc0
42+
logsource:
43+
category: process_creation
44+
product: windows
45+
detection:
46+
selection_image:
47+
- Image|endswith: '\wsb.exe'
48+
- OriginalFileName: 'wsb.exe'
49+
keyword:
50+
CommandLine|contains:
51+
- ' exec '
52+
- ' share '
53+
- ' connect '
54+
condition: all of selection_* and keyword
55+
fields:
56+
- CommandLine
57+
- User
58+
- ParentImage
59+
falsepositives:
60+
- Interactive Sandbox sessions where a user starts a sandbox via CLI and then issues follow-up commands (legitimate scripted workflow)
61+
- Sandbox-based CI/QA pipelines that chain start + exec
62+
level: medium

0 commit comments

Comments
 (0)