Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combination
Alerts on Windows command lines containing Grixba-like mode/input/scan parameter combinations during reconnaissance.
- Product
- windows
- Category
- process_creation
- Author
- yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-26
- Updated
- 2026-07-31
ATT&CK techniques
Recon → DiscoveryResource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line includes specific flag patterns for mode (-m/-mode) and input (-i/-input), along with scan indicators and associated input options. Such structured command-line usage can indicate automated reconnaissance or data collection staging by malware. It relies on process_creation telemetry with full command-line arguments to match the defined parameter combinations.
Reporting behind it
- fieldeffect.comhttps://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
- thedfirreport.comhttps://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Grixba Reconnaissance Tool Command-Line Parameter Combination"
id: 370d715e-e8d0-4cba-b1fa-989e1dd90b02
status: experimental
description: This rule flags Windows process creation events where the command line includes specific flag patterns for mode (-m/-mode) and input (-i/-input), along with scan indicators and associated input options. Such structured command-line usage can indicate automated reconnaissance or data collection staging by malware. It relies on process_creation telemetry with full command-line arguments to match the defined parameter combinations.
references:
- https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon.yml
author: yxinmiracle, Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-26
tags:
- attack.reconnaissance
- attack.t1595.001
- attack.discovery
- attack.t1046
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_mode_flag:
CommandLine|contains:
- "-m "
- "-mode "
- "-m:"
- "-mode:"
selection_input_flag:
CommandLine|contains:
- "-i "
- "-input "
- "-i:"
- "-input:"
selection_scan_value:
CommandLine|contains:
- "scan "
- "scanall "
selection_input_options:
CommandLine|contains:
- ":f "
- ":r "
- ":s "
- " f "
- " r "
- " s "
condition: all of selection_*
falsepositives:
- Legitimate tools that use similar command-line argument structures (e.g., a tool with '--mode scan' and '--input file.txt') could trigger this rule. However, the specific combinations are indicative of reconnaissance or defense evasion.
level: high
regression_tests_path: regression_data/rules-emerging-threats/2025/Malware/Grixba/proc_creation_win_malware_grixba_recon/info.yml
license: DRL-1.1
related:
- id: af688c76-4ce4-4309-bfdd-e896f01acf27
type: derived