Operation Wocao Activity

{
  "process_creation": {
    "EventID": 1,
    "Channel": "Microsoft-Windows-Sysmon/Operational"
  },
  "selection": {
    "CommandLine
| contains": [
      "checkadmin.exe 127.0.0.1 -all",
      "netsh advfirewall firewall add rule name=powershell dir=in",
      "cmd /c powershell.exe -ep bypass -file c:\\s.ps1",
      "/tn win32times /f",
      "create win32times binPath=",
      "\\c$\\windows\\system32\\devmgr.dll",
      " -exec bypass -enc JgAg",
      "type *keepass\\KeePass.config.xml",
      "iie.exe iie.txt",
      "reg query HKEY_CURRENT_USER\\Software\\\\*\\PuTTY\\Sessions\\"
    ]
  },
  "condition": "process_creation and selection"
}

False Positives

• ⚠ Administrators that use checkadmin.exe tool to enumerate local administrators