Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combo

Alerts on Windows command lines containing Grixba-like mode/input/scan parameter combinations during reconnaissance.

FreeUnreviewedSigmahighv1

windows-process-creation-grixba-reconnaissance-tool-command-line-parameter-combo-af688c76

title: "Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combo"
id: 370d715e-e8d0-4cba-b1fa-989e1dd90b02
status: experimental
description: This rule flags Windows process creation events where the command line contains specific argument patterns associated with the Grixba reconnaissance tool. The behavior matters because attackers can use recon and enumeration tools to gather information and identify targets before further actions. Detection relies on process_creation telemetry with detailed command-line capture to match the required combinations of mode, input, scan, and scan option substrings.
references:
  - https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
  - https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml
author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-26
tags:
  - attack.reconnaissance
  - attack.t1595.001
  - attack.discovery
  - attack.t1046
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_mode_flag:
    CommandLine|contains:
      - "-m "
      - "-mode "
      - "-m:"
      - "-mode:"
  selection_input_flag:
    CommandLine|contains:
      - "-i "
      - "-input "
      - "-i:"
      - "-input:"
  selection_scan_value:
    CommandLine|contains:
      - "scan "
      - "scanall "
  selection_input_options:
    CommandLine|contains:
      - ":f "
      - ":r "
      - ":s "
      - " f "
      - " r "
      - " s "
  condition: all of selection_*
falsepositives:
  - Legitimate tools that use similar command-line argument structures (e.g., a tool with '--mode scan' and '--input file.txt') could trigger this rule. However, the specific combinations are indicative of reconnaissance or defense evasion.
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon/info.yml
license: DRL-1.1
related:
  - id: af688c76-4ce4-4309-bfdd-e896f01acf27
    type: derived

What it detects

This rule flags Windows process creation events where the command line contains specific argument patterns associated with the Grixba reconnaissance tool. The behavior matters because attackers can use recon and enumeration tools to gather information and identify targets before further actions. Detection relies on process_creation telemetry with detailed command-line capture to match the required combinations of mode, input, scan, and scan option substrings.

Known false positives

Legitimate tools that use similar command-line argument structures (e.g., a tool with '--mode scan' and '--input file.txt') could trigger this rule. However, the specific combinations are indicative of reconnaissance or defense evasion.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.