cowWhySo/permission-command-corpus huggingface dataset:
Command: rundll32
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.lateral-movement, attack.t1021.002, attack.t1570, attack.execution, attack.t1569.002
Source rule: Rundll32 Execution Without Parameters
Notes: Sigma process_creation rule; status=test; level=high
Command: rundll32.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.lateral-movement, attack.t1021.002, attack.t1570, attack.execution, attack.t1569.002
Source rule: Rundll32 Execution Without Parameters
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\lxss\wslhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.lateral-movement, attack.t1021.001
Source rule: New Remote Desktop Connection Initiated Via Mstsc.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: PowerShell.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.t1037.001, attack.persistence
Source rule: Uncommon Userinit Child Process
Notes: Sigma process_creation rule; status=test; level=high
Command: megasync.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Renamed MegaSync Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Potentially Suspicious Cabinet File Expansion
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\PROGRA~1\WinZip\WZPREL~1.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004
Source rule: Use NTFS Short Name in Image
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\explorer.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004
Source rule: Use NTFS Short Name in Image
Notes: Sigma process_creation rule; status=test; level=medium
Command: BOINC.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1553
Source rule: Renamed BOINC Client Execution
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\Dism.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004
Source rule: Use Short Name Path in Image
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\cleanmgr.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004
Source rule: Use Short Name Path in Image
Notes: Sigma process_creation rule; status=test; level=medium
Command: msteams.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion
Source rule: Renamed Microsoft Teams Execution
Notes: Sigma process_creation rule; status=test; level=medium
Command: teams.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion
Source rule: Renamed Microsoft Teams Execution
Notes: Sigma process_creation rule; status=test; level=medium
Command: whoami.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1033, car.2016-03-001
Source rule: Renamed Whoami Execution
Notes: Sigma process_creation rule; status=test; level=critical
Command: gpg.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.impact, attack.t1486
Source rule: Renamed Gpg.EXE Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\odbcconf.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218.008
Source rule: Suspicious Response File Execution Via Odbcconf.EXE
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\runonce.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218.008
Source rule: Suspicious Response File Execution Via Odbcconf.EXE
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\SysWOW64\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.001
Source rule: Change PowerShell Policies to an Insecure Level
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.001
Source rule: Change PowerShell Policies to an Insecure Level
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\SysWOW64\WerFault.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1216
Source rule: Uncommon Sigverif.EXE Child Process
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\WerFault.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1216
Source rule: Uncommon Sigverif.EXE Child Process
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\services.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion
Source rule: Execution of Suspicious File Type Extension
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\explorer.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1216
Source rule: Suspicious CustomShellHost Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: Cmd.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Notes: Sigma process_creation rule; status=test; level=high
Command: PowerShell.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Notes: Sigma process_creation rule; status=test; level=high
Command: PowerShell_ISE.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Notes: Sigma process_creation rule; status=test; level=high
Command: cscript.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Notes: Sigma process_creation rule; status=test; level=high
Command: pwsh.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Notes: Sigma process_creation rule; status=test; level=high
Command: wscript.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Notes: Sigma process_creation rule; status=test; level=high
Command: csi.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.defense-evasion, attack.t1127
Source rule: Suspicious Use of CSharp Interactive Console
Notes: Sigma process_creation rule; status=test; level=high
Command: cmd.exe /c "ver"
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.t1203
Source rule: Suspicious ArcSOC.exe Child Process
Notes: Sigma process_creation rule; status=experimental; level=high
Command: C:\Windows\System32\wpbbin.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.defense-evasion, attack.t1542.001
Source rule: UEFI Persistence Via Wpbbin - ProcessCreation
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Program Files (x86)\ManageEngine\uems_agent\bin\dcfaservice64.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1070, attack.t1562, attack.t1562.002
Source rule: Filter Driver Unloaded Via Fltmc.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\PSEXESVC.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: Renamed PsExec Service Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: psexesvc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: Renamed PsExec Service Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\conhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.persistence, attack.t1546.003
Source rule: WMI Backdoor Exchange Transport Agent
Notes: Sigma process_creation rule; status=test; level=critical
Command: C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.persistence, attack.t1543.003
Source rule: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\inetsrv\iissetup.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.t1505.003
Source rule: IIS Native-Code Module Command Line Installation
Notes: Sigma process_creation rule; status=test; level=medium
Command: "C:\Windows\system32\msconfig.exe" -5
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Using MSConfig Token Modification - Process
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.001
Source rule: Hidden Powershell in Link File Pattern
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\explorer.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.001
Source rule: Hidden Powershell in Link File Pattern
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\CCM\Ccm32BitLauncher.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218.007
Source rule: Msiexec Quiet Installation
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\ProgramData\chocolatey\choco.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.005, attack.t1059.007, attack.defense-evasion, attack.t1218.005, attack.t1027.004
Source rule: Csc.EXE Execution Form Potentially Suspicious Parent
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\inetsrv\w3wp.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.005, attack.t1059.007, attack.defense-evasion, attack.t1218.005, attack.t1027.004
Source rule: Csc.EXE Execution Form Potentially Suspicious Parent
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\sdiagnhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.005, attack.t1059.007, attack.defense-evasion, attack.t1218.005, attack.t1027.004
Source rule: Csc.EXE Execution Form Potentially Suspicious Parent
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\PSEXESVC.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: PsExec Service Child Process Execution as LOCAL SYSTEM
Notes: Sigma process_creation rule; status=test; level=high
Command: schtasks.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.execution, attack.persistence, attack.privilege-escalation, attack.t1036.003, attack.t1053.005
Source rule: Renamed Schtasks Execution
Notes: Sigma process_creation rule; status=experimental; level=high
Command: PowerShell.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: PowerShell Execution With Potential Decryption Capabilities
Notes: Sigma process_creation rule; status=test; level=high
Command: pwsh.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution
Source rule: PowerShell Execution With Potential Decryption Capabilities
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\control.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Execution via WorkFolders.exe
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Program Files (x86)\Notepad++\notepad++.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Program Files\Notepad++\notepad++.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Gpscript Execution
Notes: Sigma process_creation rule; status=test; level=medium
Command: ftp.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.defense-evasion, attack.t1202
Source rule: Renamed FTP.EXE Execution
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\wbem\WmiPrvSE.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218
Source rule: Potential Suspicious Mofcomp Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: vmnat.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.persistence, attack.defense-evasion, attack.t1574.001
Source rule: Renamed Vmnat.exe Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: bash.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1202
Source rule: Indirect Command Execution From Script File Via Bash.EXE
Notes: Sigma process_creation rule; status=test; level=medium
Command: Microsoft.NodejsTools.PressAnyKey.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.defense-evasion, attack.t1218
Source rule: Visual Studio NodejsTools PressAnyKey Renamed Execution
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\lxss\wslhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.command-and-control, attack.t1219.002
Source rule: Mstsc.EXE Execution With Local RDP File
Notes: Sigma process_creation rule; status=test; level=low
Command: msdt.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1036.003
Source rule: Renamed Msdt.EXE Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: +R +H +S +A \\\*.cui
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.001
Source rule: Hiding Files with Attrib.exe
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\\WINDOWS\\system32\\\*.bat
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.001
Source rule: Hiding Files with Attrib.exe
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.t1505.003, attack.t1190, attack.initial-access, attack.persistence, attack.privilege-escalation
Source rule: Suspicious Child Process Of SQL Server
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\control.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218.011
Source rule: Potentially Suspicious Rundll32 Activity
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Program Files\Amazon\SSM\ssm-document-worker.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.defense-evasion, attack.t1027, attack.t1059.001
Source rule: Potential PowerShell Command Line Obfuscation
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Using Disk Cleanup
Notes: Sigma process_creation rule; status=test; level=high
Command: "C:\Windows\system32\dism.exe" /online /quiet /norestart /add-package /packagepath:"C:\Windows\system32\pe386" /ignorecheck
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1548.002
Source rule: UAC Bypass Using NTFS Reparse Point - Process
Notes: Sigma process_creation rule; status=test; level=high
Command: :\$WINDOWS.~BT\Sources\SetupHost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059.001
Source rule: Non Interactive PowerShell Process Spawned
Notes: Sigma process_creation rule; status=test; level=low
Command: Dbgview.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.resource-development, attack.t1588.002
Source rule: Renamed SysInternals DebugView Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: TeamViewer_Desktop.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.initial-access, attack.t1133
Source rule: Remote Access Tool - Team Viewer Session Started On Windows Host
Notes: Sigma process_creation rule; status=test; level=low
Command: TeamViewer_Service.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.initial-access, attack.t1133
Source rule: Remote Access Tool - Team Viewer Session Started On Windows Host
Notes: Sigma process_creation rule; status=test; level=low
Command: AutoIt.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Renamed AutoIt Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: AutoIt2.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Renamed AutoIt Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: AutoIt3.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027
Source rule: Renamed AutoIt Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\System32\cmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218.010
Source rule: Scripting/CommandLine Process Spawned Regsvr32
Notes: Sigma process_creation rule; status=test; level=medium
Command: NirCmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.defense-evasion, attack.t1202
Source rule: Renamed NirCmd.EXE Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: dllhost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.defense-evasion, attack.t1055
Source rule: Dllhost.EXE Execution Anomaly
Notes: Sigma process_creation rule; status=test; level=high