alirezaaminzadeh/secembed-pairs huggingface dataset:
Query: Sigma rule for Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat acto
Matching passage: Sigma rule: Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat acto. Logsource: azure / auditlogs. Rule: title: Multi Factor Authentication Disabled For User Account id: b18454c8-0be3-41f7-86bc-9c614611b839 status: test description: 'Detects changes to the "StrongAuthenticationRequirement" value, where the state is set to "0" or "Disabled". Threat actors were seen disabling multi factor authentication for users in order to maintain or achieve access to the account. Also see in SIM Swap attacks. ' references: - https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/ author: Harjot Singh (@cyb3rjy0t) date: 2024-08-21 tags: - attack.credential-access - attack.persistence logsource: product: azure service: auditlogs definition: 'Requirements: The TargetResources array needs to be mapped accurately in order for this rule to work' detection: selection: LoggedByService: Core Directory Category: UserManagement OperationName: Update user TargetResources.ModifiedProperties.DisplayName: StrongAuthenticationRequirement TargetResources.ModifiedProperties.NewValue|contains: State":0 condition: selection falsepositives: - Legitimate authorized activity. level: medium
Near-miss passage: Sigma rule: Identifies when a Firewall Policy is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Network Firewall Policy Modified or Deleted id: 83c17918-746e-4bd9-920b-8e098bf88c23 status: test description: Identifies when a Firewall Policy is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-09-02 modified: 2022-08-23 tags: - attack.impact - attack.defense-impairment - attack.t1686.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/JOIN/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/CERTIFICATES/ACTION - MICROSOFT.NETWORK/FIREWALLPOLICIES/DELETE condition: selection falsepositives: - Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Query: detection rule: Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros
Matching passage: Sigma rule: Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros. Logsource: windows / registry_set. Rule: title: Disable Macro Runtime Scan Scope id: ab871450-37dc-4a3a-997f-6662aa8ae0f1 description: Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros status: test date: 2022-10-25 modified: 2023-08-17 author: Nasreddine Bencherchali (Nextron Systems) references: - https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/ - https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope - https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \SOFTWARE\ - \Microsoft\Office\ - \Common\Security TargetObject|endswith: \MacroRuntimeScanScope Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects uses of the createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: CreateDump Process Dump id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 related: - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e type: similar status: test description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-04 modified: 2022-08-19 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \createdump.exe - OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: CommandLine|contains: - ' -u ' - ' --full ' - ' -f ' - ' --name ' - '.dmp ' condition: all of selection_* falsepositives: - Command lines that use the same flags level: high
Query: rule covering Detects Obfuscated Powershell via use Rundll32 in Scripts
Matching passage: Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use Rundll32 - Security id: cd0f7229-d16f-42de-8fe3-fba365fbcb3a related: - id: 641a4bfb-c017-44f7-800c-2aee0184ce9b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll ServiceFileName|contains: - value - invoke - comspec - iex condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files o. Logsource: windows / process_creation. Rule: title: JScript Compiler Execution id: 52788a70-f1da-40dd-8fbd-73b5865d6568 status: test description: 'Detects the execution of the "jsc.exe" (JScript Compiler). Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Jsc/ - https://www.phpied.com/make-your-javascript-a-windows-exe/ - https://twitter.com/DissectMalware/status/998797808907046913 author: frack113 date: 2022-05-02 modified: 2024-04-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \jsc.exe - OriginalFileName: jsc.exe condition: selection falsepositives: - Legitimate use to compile JScript by developers. level: low
Query: describe CVE-2015-6059
Matching passage: CVE-2015-6059. CWE: CWE-200. CVSS: 4.300000190734863. The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."
Near-miss passage: CVE-2015-5089. CWE: CWE-200. CVSS: 5.0. Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors, a different vulnerability than CVE-2014-8450, CVE-2015-4449, CVE-2015-4450, CVE-2015-5088, and CVE-2015-5092.
Query: write Sigma for The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting
Matching passage: Sigma rule: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting. Logsource: windows / process_creation. Rule: title: Use of Scriptrunner.exe id: 64760eef-87f7-4ed3-93fd-655668ea9420 status: test description: The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting references: - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-01 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ScriptRunner.exe - OriginalFileName: ScriptRunner.exe selection_cli: CommandLine|contains: ' -appvscript ' condition: all of selection* falsepositives: - Legitimate use when App-v is deployed level: medium
Near-miss passage: Sigma rule: Detects programs that connect to known malware callback ports based on threat intelligence reports.. Logsource: linux / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication - Linux id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376 related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: derived status: test description: 'Detects programs that connect to known malware callback ports based on threat intelligence reports. ' references: - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors author: hasselj date: 2024-05-10 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: linux detection: selection: Initiated: 'true' DestinationPort: - 888 - 999 - 2200 - 2222 - 4000 - 4444 - 6789 - 8531 - 50501 - 51820 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Query: patch priority for CVE-2015-0751
Matching passage: CVE-2015-0751. CWE: CWE-20. CVSS: 7.800000190734863. Cisco IP Phone 7861, when firmware from Cisco Unified Communications Manager 10.3(1) is used, allows remote attackers to cause a denial of service via crafted packets, aka Bug ID CSCus81800.
Near-miss passage: CVE-2015-4393. CWE: CWE-20. CVSS: 6.0. The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename.
Query: CWE for Cleartext Storage of Sensitive Information
Matching passage: CWE-312 Cleartext Storage of Sensitive Information. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Near-miss passage: CWE-317 Cleartext Storage of Sensitive Information in GUI. The product stores sensitive information in cleartext within the GUI.
Query: exploit Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before
Matching passage: CVE-2015-3115. CWE: CWE-284. CVSS: 5.0. Adobe Flash Player before 13.0.0.302 and 14.x through 18.x before 18.0.0.203 on Windows and OS X and before 11.2.202.481 on Linux, Adobe AIR before 18.0.0.180, Adobe AIR SDK before 18.0.0.180, and Adobe AIR SDK & Compiler before 18.0.0.180 allow remote attackers to bypass the Same Origin Policy via unspecified vectors, a different vulnerability than CVE-2014-0578, CVE-2015-3116, CVE-2015-3125, and CVE-2015-5116.
Near-miss passage: CVE-2015-3672. CWE: CWE-284. CVSS: 7.199999809265137. Admin Framework in Apple OS X before 10.10.4 does not properly handle authentication errors, which allows local users to obtain admin privileges via unspecified vectors.
Query: Sigma YAML for windows / process_creation
Matching passage: Sigma rule: Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child rela. Logsource: windows / process_creation. Rule: title: Windows Binary Executed From WSL id: ed825c86-c009-4014-b413-b76003e33d35 status: test description: 'Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 tags: - attack.execution - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|re: '[a-zA-Z]:\\' CurrentDirectory|contains: \\\\wsl.localhost condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects disabling of Multi Factor Authentication.. Logsource: m365 / audit. Rule: title: Disabling Multi Factor Authentication id: 60de9b57-dc4d-48b9-a6a0-b39e0469f876 status: test description: Detects disabling of Multi Factor Authentication. references: - https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/ author: Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule) date: 2023-09-18 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.006 logsource: service: audit product: m365 detection: selection: Operation|contains: Disable Strong Authentication. condition: selection falsepositives: - Unlikely level: high
Query: describe CVE-2015-5043
Matching passage: CVE-2015-5043. CWE: CWE-264. CVSS: 7.199999809265137. diag in IBM Security Guardium 8.2 before p6015, 9.0 before p6015, 9.1, 9.5, and 10.0 before p6015 allows local users to obtain root access via unspecified key sequences.
Near-miss passage: CVE-2015-6362. CWE: CWE-264. CVSS: 4.0. The web GUI in Cisco Connected Grid Network Management System (CG-NMS) 3.0(0.35) and 3.0(0.54) allows remote authenticated users to bypass intended access restrictions and modify the configuration by leveraging the Monitor-Only role, aka Bug ID CSCuw42640.
Query: exploit IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated u
Matching passage: CVE-2015-7455. CWE: CWE-264. CVSS: 3.0999999046325684. IBM WebSphere Portal 7.x through 7.0.0.2 CF29, 8.0.x before 8.0.0.1 CF20, and 8.5.x before 8.5.0.0 CF09 uses weak permissions for content items, which allows remote authenticated users to make modifications via the authoring UI.
Near-miss passage: CVE-2015-7717. CWE: CWE-264. CVSS: 9.300000190734863. mediaserver in Android 5.x before 5.1.1 LMY48T and 6.0 before 2015-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 19573085, a different vulnerability than CVE-2015-6596.
Query: CVE similar to CVE-2015-0394
Matching passage: CVE-2015-0394. CWE: UNKNOWN. CVSS: 4.0. Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Report Distribution.
Near-miss passage: CVE-2015-8876. CWE: UNKNOWN. CVSS: 9.800000190734863. Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exception objects, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or trigger unintended method execution via crafted serialized data.
Query: vulnerability: Object Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8
Matching passage: CVE-2015-2428. CWE: CWE-264. CVSS: 2.0999999046325684. Object Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels during interaction with object symbolic links that originated in a sandboxed process, which allows local users to gain privileges via a crafted application, aka "Windows Object Manager Elevation of Privilege Vulnerability."
Near-miss passage: CVE-2015-0801. CWE: CWE-264. CVSS: 7.5. Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 allow remote attackers to bypass the Same Origin Policy and execute arbitrary JavaScript code with chrome privileges via vectors involving anchor navigation, a similar issue to CVE-2015-0818.
Query: detect Detects common commands used in Windows webshells in logs
Matching passage: Sigma rule: Detects common commands used in Windows webshells. Logsource: webserver. Rule: title: Windows Webshell Strings id: 7ff9db12-1b94-4a79-ba68-a2402c5d6729 status: test description: Detects common commands used in Windows webshells references: - https://bad-jubies.github.io/RCE-NOW-WHAT/ - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2017-02-19 modified: 2022-11-18 tags: - attack.persistence - attack.t1505.003 logsource: category: webserver detection: selection_method: cs-method: GET selection_keywords: - =whoami - =net%20user - =net+user - =net%2Buser - =cmd%20/c% - =cmd+/c+ - =cmd%2B/c% - =cmd%20/r% - =cmd+/r+ - =cmd%2B/r% - =cmd%20/k% - =cmd+/k+ - =cmd%2B/k% - =powershell% - =powershell+ - =tasklist% - =tasklist+ - =wmic% - =wmic+ - =ssh% - =ssh+ - =python% - =python+ - =python3% - =python3+ - =ipconfig - =wget% - =wget+ - =curl% - =curl+ - =certutil - =copy%20%5C%5C - =dsquery% - =dsquery+ - =nltest% - =nltest+ condition: all of selection_* falsepositives: - Web sites like wikis with articles on os commands and pages that include the os commands in the URLs - User searches in search boxes of the respective website level: high
Near-miss passage: Sigma rule: Detects buffer overflow attempts in Unix system log files. Logsource: linux. Rule: title: Buffer Overflow Attempts id: 18b042f0-2ecd-4b6e-9f8d-aa7a7e7de781 status: test description: Detects buffer overflow attempts in Unix system log files references: - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/attack_rules.xml - https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html - https://www.giac.org/paper/gcih/266/review-ftp-protocol-cyber-defense-initiative/102802 - https://blu.org/mhonarc/discuss/2001/04/msg00285.php - https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/ author: Florian Roth (Nextron Systems) date: 2017-03-01 modified: 2025-03-17 tags: - attack.t1068 - attack.privilege-escalation logsource: product: linux detection: keywords: - attempt to execute code on stack by - 0bin0sh1 - AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - stack smashing detected condition: keywords falsepositives: - Base64 encoded data in log entries level: high
Query: risk of openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon ex
Matching passage: CVE-2015-5986. CWE: CWE-20. CVSS: 7.099999904632568. openpgpkey_61.c in named in ISC BIND 9.9.7 before 9.9.7-P3 and 9.10.x before 9.10.2-P4 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via a crafted DNS response.
Near-miss passage: CVE-2015-8726. CWE: CWE-20. CVSS: 5.5. wiretap/vwr.c in the VeriWave file parser in Wireshark 1.12.x before 1.12.9 and 2.0.x before 2.0.1 does not validate certain signature and Modulation and Coding Scheme (MCS) data, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.
Query: risk of The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-i
Matching passage: CVE-2015-4640. CWE: CWE-254. CVSS: 2.9000000953674316. The SwiftKey language-pack update implementation on Samsung Galaxy S4, S4 Mini, S5, and S6 devices relies on an HTTP connection to the skslm.swiftkey.net server, which allows man-in-the-middle attackers to write to language-pack files by modifying an HTTP response. NOTE: CVE-2015-4640 exploitation can be combined with CVE-2015-4641 exploitation for man-in-the-middle code execution.
Near-miss passage: CVE-2015-6473. CWE: CWE-254. CVSS: 9.800000190734863. WAGO IO 750-849 01.01.27 and WAGO IO 750-881 01.02.05 do not contain privilege separation.
Query: detection rule: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Matching passage: Sigma rule: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe CommandLine|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects LOLBINs and applications that should not legitimately drop script files to disk. This may indicate malware stagi. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Script id: 7d604714-e071-49ff-8726-edeb95a70679 status: test description: 'Detects LOLBINs and applications that should not legitimately drop script files to disk. This may indicate malware staging or abuse of a trusted binary for script-based code execution. ' references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 - https://dmpdump.github.io/posts/TelegramRat/ - https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior author: frack113, Florian Roth (Nextron Systems) date: 2022-08-21 modified: 2026-05-11 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \eqnedt32.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \mshta.exe - \AcroRd32.exe - \RdrCEF.exe - \hh.exe - \finger.exe TargetFilename|endswith: - .bat - .chm - .csproj - .hta - .js - .jse - .proj - .ps1 - .py - .scf - .vbe - .vbs - .wsf - .wsh filter_main_mshta: Image|endswith: \mshta.exe TargetFilename|endswith: .hta condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script/info.yml