deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: MSSQL Add Account To Sysadmin Role
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-13
Log source: windows/

Description:
Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role

Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 33205,
    "Data|contains|all": [
      "object_name:sysadmin",
      "statement:alter server role [sysadmin] add member "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
Sigma Detection Rule: MSSQL Server Failed Logon
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), j4son
Date: 2023-10-11
ATT&CK techniques: T1110
Log source: windows/

Description:
Detects failed logon attempts from clients to MSSQL server.

Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 18456
  },
  "condition": "selection"
}

References:
  - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
Sigma Detection Rule: MSSQL XPCmdshell Suspicious Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
Log source: windows/

Description:
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands

Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 33205,
    "Data|contains|all": [
      "object_name:xp_cmdshell",
      "statement:EXEC"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Sigma Detection Rule: MSSQL Destructive Query
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Daniel Degasperi '@d4ns4n_'
Date: 2025-06-04
ATT&CK techniques: T1485
Log source: windows/

Description:
Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE".


Detection logic:
{
  "selection": {
    "Provider_Name": "MSSQLSERVER$AUDIT",
    "EventID": 33205,
    "Data|contains": [
      "statement:TRUNCATE TABLE",
      "statement:DROP TABLE",
      "statement:DROP DATABASE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
Sigma Detection Rule: MSSQL Disable Audit Settings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-13
Log source: windows/

Description:
Detects when an attacker calls the "ALTER SERVER AUDIT" or "DROP SERVER AUDIT" transaction in order to delete or disable audit logs on the server

Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 33205,
    "Data|contains": [
      "statement:ALTER SERVER AUDIT",
      "statement:DROP SERVER AUDIT"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
  - https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
Sigma Detection Rule: MSSQL Server Failed Logon From External Network
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: j4son
Date: 2023-10-11
ATT&CK techniques: T1110
Log source: windows/

Description:
Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.

Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 18456
  },
  "filter_main_local_ips": {
    "Data|contains": [
      "CLIENT: 10.",
      "CLIENT: 172.16.",
      "CLIENT: 172.17.",
      "CLIENT: 172.18.",
      "CLIENT: 172.19.",
      "CLIENT: 172.20.",
      "CLIENT: 172.21.",
      "CLIENT: 172.22.",
      "CLIENT: 172.23.",
      "CLIENT: 172.24.",
      "CLIENT: 172.25.",
      "CLIENT: 172.26.",
      "CLIENT: 172.27.",
      "CLIENT: 172.28.",
      "CLIENT: 172.29.",
      "CLIENT: 172.30.",
      "CLIENT: 172.31.",
      "CLIENT: 192.168.",
      "CLIENT: 127.",
      "CLIENT: 169.254.",
      "CLIENT: <local machine>"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/
  - https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html
Sigma Detection Rule: Restricted Software Access By SRP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-01-12
ATT&CK techniques: T1072
Log source: windows/

Description:
Detects restricted access to applications by the Software Restriction Policies (SRP) policy

Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-SoftwareRestrictionPolicies",
    "EventID": [
      865,
      866,
      867,
      868,
      882
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-policies/software-restriction-policies
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
Sigma Detection Rule: Ntdsutil Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
ATT&CK techniques: T1003.003
Log source: windows/

Description:
Detects potential abuse of ntdsutil to dump ntds.dit database

Detection logic:
{
  "selection": {
    "Provider_Name": "ESENT",
    "EventID": [
      216,
      325,
      326,
      327
    ],
    "Data|contains": "ntds.dit"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/mgreen27/status/[PII_REDACTED]04122882
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
Sigma Detection Rule: Dump Ntds.dit To Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
Log source: windows/

Description:
Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location

Detection logic:
{
  "selection_root": {
    "Provider_Name": "ESENT",
    "EventID": 325,
    "Data|contains": "ntds.dit"
  },
  "selection_paths": {
    "Data|contains": [
      ":\\ntds.dit",
      "\\Appdata\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Perflogs\\",
      "\\Temp\\",
      "\\Users\\Public\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/mgreen27/status/[PII_REDACTED]04122882
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11)
Sigma Detection Rule: CodeIntegrity - Revoked Kernel Driver Loaded
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects the load of a revoked kernel driver

Detection logic:
{
  "selection": {
    "EventID": [
      3021,
      3022
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Blocked Image Load With Revoked Certificate
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects blocked image load events with revoked certificates by code integrity.

Detection logic:
{
  "selection": {
    "EventID": 3036
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Unsigned Kernel Module Loaded
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects the presence of a loaded unsigned kernel module on the system.

Detection logic:
{
  "selection": {
    "EventID": 3001
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Blocked Image/Driver Load For Policy Violation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-10
ATT&CK techniques: T1543
Log source: windows/

Description:
Detects blocked load events that did not meet the authenticode signing level requirements or violated the code integrity policy.

Detection logic:
{
  "selection": {
    "EventID": 3077
  },
  "condition": "selection"
}

References:
  - https://twitter.com/wdormann/status/[PII_REDACTED]35320065
  - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe[PII_REDACTED]8f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
Sigma Detection Rule: CodeIntegrity - Disallowed File For Protected Processes Has Been Blocked
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects block events for files that are disallowed by code integrity for protected processes

Detection logic:
{
  "selection": {
    "EventID": 3104
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Revoked Image Loaded
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects image load events with revoked certificates by code integrity.

Detection logic:
{
  "selection": {
    "EventID": [
      3032,
      3035
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Unmet Signing Level Requirements By File Under Validation
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-20
Log source: windows/

Description:
Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired.
This event is best correlated with EID 3089 to determine the error of the validation.


Detection logic:
{
  "selection": {
    "EventID": [
      3033,
      3034
    ]
  },
  "filter_optional_dtrace": {
    "FileNameBuffer|endswith": "\\Program Files\\DTrace\\dtrace.dll",
    "ProcessNameBuffer|endswith": "\\Windows\\System32\\svchost.exe",
    "RequestedPolicy": 12
  },
  "filter_optional_av_generic": {
    "FileNameBuffer|contains": "\\Windows\\System32\\DriverStore\\FileRepository\\",
    "FileNameBuffer|endswith": "\\igd10iumd64.dll",
    "RequestedPolicy": 7
  },
  "filter_optional_electron_based_app": {
    "FileNameBuffer|endswith": "\\Windows\\System32\\nvspcap64.dll",
    "ProcessNameBuffer|endswith": [
      "\\AppData\\Local\\Keybase\\Gui\\Keybase.exe",
      "\\Microsoft\\Teams\\stage\\Teams.exe"
    ],
    "RequestedPolicy": 8
  },
  "filter_optional_bonjour": {
    "FileNameBuffer|endswith": "\\Program Files\\Bonjour\\mdnsNSP.dll",
    "ProcessNameBuffer|endswith": [
      "\\Windows\\System32\\svchost.exe",
      "\\Windows\\System32\\SIHClient.exe"
    ],
    "RequestedPolicy": [
      8,
      12
    ]
  },
  "filter_optional_msoffice_1": {
    "FileNameBuffer|contains": "\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\OFFICE",
    "FileNameBuffer|endswith": "\\MSOXMLMF.DLL",
    "RequestedPolicy": 7
  },
  "filter_optional_msoffice_2": {
    "ProcessNameBuffer|contains": "\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Office",
    "FileNameBuffer|contains": "\\Windows\\System32\\",
    "Requested

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]02814466
  - https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe[PII_REDACTED]8f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
Sigma Detection Rule: CodeIntegrity - Blocked Driver Load With Revoked Certificate
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
ATT&CK techniques: T1543
Log source: windows/

Description:
Detects blocked load attempts of revoked drivers

Detection logic:
{
  "selection": {
    "EventID": 3023
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Unmet WHQL Requirements For Loaded Kernel Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects loaded kernel modules that did not meet the WHQL signing requirements.

Detection logic:
{
  "selection": {
    "EventID": [
      3082,
      3083
    ]
  },
  "filter_optional_vmware": {
    "FileNameBuffer": [
      "system32\\drivers\\vsock.sys",
      "System32\\drivers\\vmci.sys"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: CodeIntegrity - Unsigned Image Loaded
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-06
Log source: windows/

Description:
Detects loaded unsigned image on the system

Detection logic:
{
  "selection": {
    "EventID": 3037
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations
  - Internal Research
Sigma Detection Rule: Microsoft Defender Blocked from Loading Unsigned DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2022-08-02
ATT&CK techniques: T1574.001
Log source: windows/

Description:
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL

Detection logic:
{
  "selection": {
    "EventID": [
      11,
      12
    ],
    "ProcessPath|endswith": [
      "\\MpCmdRun.exe",
      "\\NisSrv.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
Sigma Detection Rule: Unsigned Binary Loaded From Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-03
ATT&CK techniques: T1574.001
Log source: windows/

Description:
Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations

Detection logic:
{
  "selection": {
    "EventID": [
      11,
      12
    ],
    "ImageName|contains": [
      "\\Users\\Public\\",
      "\\PerfLogs\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\AppData\\Local\\Temp\\",
      "C:\\Windows\\TEMP\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/45fd5be71a51aa518b1b36d4e1f36af498084e27/ETWEventsList/CSV/Windows11/21H2/W11_21H2_Pro_20220719_22000.795/Providers/Microsoft-Windows-Security-Mitigations.csv
Sigma Detection Rule: Potential Script Proxy Execution Via CL_Mutexverifiers.ps1
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova, frack113
Date: 2022-05-21
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Detection logic:
{
  "selection_pwsh": {
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Image|endswith": "\\powershell.exe",
    "CommandLine|contains": " -nologo -windowstyle minimized -file "
  },
  "selection_temp": {
    "CommandLine|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Scripts/CL_mutexverifiers/
Sigma Detection Rule: Potential Signing Bypass Via Windows Developer Features
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/process_creation

Description:
Detects when a user enable developer features such as "Developer Mode" or "Application Sideloading". Which allows the user to install untrusted packages.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SystemSettingsAdminFlows.exe"
    },
    {
      "OriginalFileName": "SystemSettingsAdminFlows.EXE"
    }
  ],
  "selection_flag": {
    "CommandLine|contains": "TurnOnDeveloperFeatures"
  },
  "selection_options": {
    "CommandLine|contains": [
      "DeveloperUnlock",
      "EnableSideloading"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
Sigma Detection Rule: Renamed SysInternals DebugView Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-05-28
ATT&CK techniques: T1588.002
Log source: windows/process_creation

Description:
Detects suspicious renamed SysInternals DebugView execution

Detection logic:
{
  "selection": {
    "Product": "Sysinternals DebugView"
  },
  "filter": {
    "OriginalFileName": "Dbgview.exe",
    "Image|endswith": "\\Dbgview.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.epicturla.com/blog/sysinturla
Sigma Detection Rule: Renamed Mavinject.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth
Date: 2022-12-05
ATT&CK techniques: T1055.001, T1218.013
Log source: windows/process_creation

Description:
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Detection logic:
{
  "selection": {
    "OriginalFileName": [
      "mavinject32.exe",
      "mavinject64.exe"
    ]
  },
  "filter": {
    "Image|endswith": [
      "\\mavinject32.exe",
      "\\mavinject64.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md
  - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]07510784
  - https://reaqta.com/2017/12/mavinject-microsoft-injector/
Sigma Detection Rule: Suspicious Download From Direct IP Via Bitsadmin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1197, T1036.003
Log source: windows/process_creation

Description:
Detects usage of bitsadmin downloading a file using an URL that contains an IP

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      " /transfer ",
      " /create ",
      " /addfile "
    ]
  },
  "selection_extension": {
    "CommandLine|contains": [
      "://1",
      "://2",
      "://3",
      "://4",
      "://5",
      "://6",
      "://7",
      "://8",
      "://9"
    ]
  },
  "filter_seven_zip": {
    "CommandLine|contains": "://7-"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/