cowWhySo/permission-command-corpus huggingface dataset:
Command: /usr/bin/dd
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: linux
ATT&CK tags: attack.impact, attack.t1485
Source rule: DD File Overwrite
Notes: Sigma process_creation rule; status=test; level=low
Command: bash -i
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: linux
ATT&CK tags: attack.execution, attack.defense-evasion, attack.t1059.004, attack.t1036
Source rule: Interactive Bash Suspicious Children
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\svchost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.initial-access, attack.t1190, attack.execution, attack.t1569.002, cve.2022-26809, detection.emerging-threats
Source rule: Potential CVE-2022-26809 Exploitation Attempt
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\ProgramData\DRM\CLR\CLR.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.persistence, attack.defense-evasion, attack.t1574.001, attack.g0044, detection.emerging-threats
Source rule: Winnti Malware HK University Campaign
Notes: Sigma process_creation rule; status=test; level=critical
Command: C:\Windows\MsMpEng.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.g0115, detection.emerging-threats
Source rule: REvil Kaseya Incident Malware Patterns
Notes: Sigma process_creation rule; status=test; level=critical
Command: C:\Windows\cert.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.g0115, detection.emerging-threats
Source rule: REvil Kaseya Incident Malware Patterns
Notes: Sigma process_creation rule; status=test; level=critical
Command: C:\kworking1\agent.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.g0115, detection.emerging-threats
Source rule: REvil Kaseya Incident Malware Patterns
Notes: Sigma process_creation rule; status=test; level=critical
Command: C:\kworking\agent.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.t1059, attack.g0115, detection.emerging-threats
Source rule: REvil Kaseya Incident Malware Patterns
Notes: Sigma process_creation rule; status=test; level=critical
Command: jpinst.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, detection.emerging-threats
Source rule: Potential SNAKE Malware Installation Binary Indicator
Notes: Sigma process_creation rule; status=test; level=high
Command: jpsetup.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, detection.emerging-threats
Source rule: Potential SNAKE Malware Installation Binary Indicator
Notes: Sigma process_creation rule; status=test; level=high
Command: ipconfig.exe /all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1016, attack.t1049, attack.t1087, detection.emerging-threats
Source rule: Potential Pikabot Discovery Activity
Notes: Sigma process_creation rule; status=test; level=high
Command: netstat.exe -aon
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1016, attack.t1049, attack.t1087, detection.emerging-threats
Source rule: Potential Pikabot Discovery Activity
Notes: Sigma process_creation rule; status=test; level=high
Command: whoami.exe /all
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1016, attack.t1049, attack.t1087, detection.emerging-threats
Source rule: Potential Pikabot Discovery Activity
Notes: Sigma process_creation rule; status=test; level=high
Command: Cmd.Exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, cve.2023-36874, detection.emerging-threats
Source rule: Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: powershell.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, cve.2023-36874, detection.emerging-threats
Source rule: Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: powershell_ise.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, cve.2023-36874, detection.emerging-threats
Source rule: Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
Notes: Sigma process_creation rule; status=test; level=high
Command: C:\Windows\SysWOW64\regsvr32.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.privilege-escalation, attack.defense-evasion, attack.t1574.008, cve.2025-49144, detection.emerging-threats
Source rule: Potential Notepad++ CVE-2025-49144 Exploitation
Notes: Sigma process_creation rule; status=experimental; level=high
Command: C:\Windows\System32\regsvr32.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.persistence, attack.privilege-escalation, attack.defense-evasion, attack.t1574.008, cve.2025-49144, detection.emerging-threats
Source rule: Potential Notepad++ CVE-2025-49144 Exploitation
Notes: Sigma process_creation rule; status=experimental; level=high
Command: C:\Program Files\internet explorer\iediagcmd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.command-and-control, attack.execution, attack.defense-evasion, attack.t1218, attack.lateral-movement, attack.t1105, detection.emerging-threats, cve.2025-33053
Source rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053
Notes: Sigma process_creation rule; status=experimental; level=high
Command: C:\Windows\System32\CustomShellHost.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.command-and-control, attack.execution, attack.defense-evasion, attack.t1218, attack.lateral-movement, attack.t1105, detection.emerging-threats, cve.2025-33053
Source rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053
Notes: Sigma process_creation rule; status=experimental; level=high
Command: dir %TEMP%\\*.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0010, attack.execution, attack.t1059, attack.lateral-movement, attack.t1021.002, attack.discovery, attack.t1083, attack.t1135, detection.emerging-threats
Source rule: Turla Group Lateral Movement
Notes: Sigma process_creation rule; status=test; level=critical
Command: dir c:\\*.doc* /s
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0010, attack.execution, attack.t1059, attack.lateral-movement, attack.t1021.002, attack.discovery, attack.t1083, attack.t1135, detection.emerging-threats
Source rule: Turla Group Lateral Movement
Notes: Sigma process_creation rule; status=test; level=critical
Command: net use \\\\%DomainController%\C$ "P@ssw0rd" *
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0010, attack.execution, attack.t1059, attack.lateral-movement, attack.t1021.002, attack.discovery, attack.t1083, attack.t1135, detection.emerging-threats
Source rule: Turla Group Lateral Movement
Notes: Sigma process_creation rule; status=test; level=critical
Command: PowerShell.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.initial-access, attack.t1195.002, attack.execution, attack.command-and-control, attack.defense-evasion, attack.t1059.003, attack.t1059.005, attack.t1105, detection.emerging-threats
Source rule: Axios NPM Compromise Indicators - Windows
Notes: Sigma process_creation rule; status=experimental; level=high
Command: C:\Windows\system32\Service.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.privilege-escalation, attack.execution, attack.persistence, attack.g0049, attack.t1053.005, attack.s0111, attack.t1543.003, attack.defense-evasion, attack.t1112, attack.command-and-control, attack.t1071.004, detection.emerging-threats
Source rule: OilRig APT Activity
Notes: Sigma process_creation rule; status=test; level=critical
Command: sc query dokan1
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1007, detection.threat-hunting
Source rule: SC.EXE Query Execution
Notes: Sigma process_creation rule; status=test; level=low
Command: sc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.discovery, attack.t1007, detection.threat-hunting
Source rule: SC.EXE Query Execution
Notes: Sigma process_creation rule; status=test; level=low
Command: regsvr32 /s rpcproxy.dll
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1218, detection.threat-hunting
Source rule: Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly
Notes: Sigma process_creation rule; status=test; level=medium
Command: *rar.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.collection, attack.t1560.001, detection.threat-hunting
Source rule: Potentially Suspicious Compression Tool Parameters
Notes: Sigma process_creation rule; status=test; level=medium
Command: 7z*.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.collection, attack.t1560.001, detection.threat-hunting
Source rule: Potentially Suspicious Compression Tool Parameters
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\SysWOW64\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027, detection.threat-hunting
Source rule: Potential Suspicious Execution From GUID Like Folder Names
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\Windows\System32\drvinst.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027, detection.threat-hunting
Source rule: Potential Suspicious Execution From GUID Like Folder Names
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\Windows\System32\msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1027, detection.threat-hunting
Source rule: Potential Suspicious Execution From GUID Like Folder Names
Notes: Sigma process_creation rule; status=test; level=low
Command: C:\Program Files\GPSoftware\Directory Opus\dopus.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004, detection.threat-hunting
Source rule: Use Short Name Path in Command Line
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\Dism.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004, detection.threat-hunting
Source rule: Use Short Name Path in Command Line
Notes: Sigma process_creation rule; status=test; level=medium
Command: C:\Windows\System32\cleanmgr.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.t1564.004, detection.threat-hunting
Source rule: Use Short Name Path in Command Line
Notes: Sigma process_creation rule; status=test; level=medium
Command: Cmd.Exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: CompatTelRunner.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: Discord.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: EXPLORER.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: IE4UINIT.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: MpCmdRun.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: NGenTask.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: OneDriveSetup.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: PowerShell.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: REGSVR32.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: Spotify.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: electron.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: httpd.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: mmc.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: mscorsvw.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: msiexec.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: smss.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense-evasion, attack.privilege-escalation, attack.t1055, detection.threat-hunting
Source rule: Potential Executable Run Itself As Sacrificial Process
Notes: Sigma process_creation rule; status=experimental; level=low
Command: sc stop KSCWebConsoleMessageQueue
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.impact, attack.t1489
Source rule: Stop Windows Service
Notes: Sigma process_creation rule; status=deprecated; level=low
Command: sc stop LGHUBUpdaterService
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.impact, attack.t1489
Source rule: Stop Windows Service
Notes: Sigma process_creation rule; status=deprecated; level=low
Command: C:\Windows\PSEXESVC.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.execution, attack.s0029, attack.t1569.002
Source rule: PsExec Service Start
Notes: Sigma process_creation rule; status=deprecated; level=low
Command: C:\Windows\System32\mshta.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0032, attack.execution, attack.t1106
Source rule: Lazarus Activity Apr21
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: C:\Windows\System32\rundll32.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0032, attack.execution, attack.t1106
Source rule: Lazarus Activity Apr21
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: C:\Windows\System32\wbem\wmiprvse.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.g0032, attack.execution, attack.t1106
Source rule: Lazarus Activity Apr21
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: copy \\?\GLOBALROOT\Device\\*\config\SAM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: copy \\?\GLOBALROOT\Device\\*\windows\ntds\ntds.dit
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: esentutl.exe /y /vss *\SAM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: esentutl.exe /y /vss *\SYSTEM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: esentutl.exe /y /vss *\ntds.dit*
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: reg SAVE HKLM\SYSTEM
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: vssadmin create shadow /for=C:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: vssadmin delete shadows /for=C:
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: vssadmin.exe Delete Shadows
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.credential_access, attack.t1003
Source rule: Activity Related to NTDS.dit Domain Hash Retrieval
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: RUNDLL32.EXE
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
Source rule: Renamed Rundll32.exe Execution
Notes: Sigma process_creation rule; status=deprecated; level=high
Command: C:\Program Files\Box\Box\FS\streem.exe
Label: bad (risk class: suspicious, obfuscation: plain)
Category: process_creation
Platform: windows
ATT&CK tags: attack.defense_evasion, attack.t1218.010, car.2019-04-002, car.2019-04-003
Source rule: Regsvr32 Anomaly
Notes: Sigma process_creation rule; status=deprecated; level=high