deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: File Download via CertOC.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-16
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects when a user downloads a file by using CertOC.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certoc.exe"
    },
    {
      "OriginalFileName": "CertOC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "-GetCACAPS",
      "http"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
Sigma Detection Rule: Potential Shim Database Persistence via Sdbinst.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Markus Neis
Date: 2019-01-16
ATT&CK techniques: T1546.011
Log source: windows/process_creation

Description:
Detects installation of a new shim using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\sdbinst.exe"
    },
    {
      "OriginalFileName": "sdbinst.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": ".sdb"
  },
  "filter_optional_iis": {
    "ParentImage|endswith": "\\msiexec.exe",
    "CommandLine|contains": [
      ":\\Program Files (x86)\\IIS Express\\iisexpressshim.sdb",
      ":\\Program Files\\IIS Express\\iisexpressshim.sdb"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
Sigma Detection Rule: PDQ Deploy Remote Adminstartion Tool Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-10-01
ATT&CK techniques: T1072
Log source: windows/process_creation

Description:
Detect use of PDQ Deploy remote admin tool

Detection logic:
{
  "selection": [
    {
      "Description": "PDQ Deploy Console"
    },
    {
      "Product": "PDQ Deploy"
    },
    {
      "Company": "PDQ.com"
    },
    {
      "OriginalFileName": "PDQDeployConsole.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md
  - https://www.pdq.com/pdq-deploy/
Sigma Detection Rule: HackTool - SharpImpersonation Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sai Prashanth Pulisetti @pulisettis, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-27
ATT&CK techniques: T1134.001, T1134.003
Log source: windows/process_creation

Description:
Detects execution of the SharpImpersonation tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SharpImpersonation.exe"
    },
    {
      "OriginalFileName": "SharpImpersonation.exe"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|contains|all": [
        " user:",
        " binary:"
      ]
    },
    {
      "CommandLine|contains|all": [
        " user:",
        " shellcode:"
      ]
    },
    {
      "CommandLine|contains": [
        " technique:CreateProcessAsUserW",
        " technique:ImpersonateLoggedOnuser"
      ]
    }
  ],
  "condition": "1 of selection_*"
}

References:
  - https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/
  - https://github.com/S3cur3Th1sSh1t/SharpImpersonation
Sigma Detection Rule: Indirect Command Execution From Script File Via Bash.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-15
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly.
This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        ":\\Windows\\System32\\bash.exe",
        ":\\Windows\\SysWOW64\\bash.exe"
      ]
    },
    {
      "OriginalFileName": "Bash.exe"
    }
  ],
  "filter_main_cli_flag": {
    "CommandLine|contains": [
      "bash.exe -",
      "bash -"
    ]
  },
  "filter_main_no_cli": {
    "CommandLine": null
  },
  "filter_main_empty": {
    "CommandLine": ""
  },
  "filter_main_no_flag": {
    "CommandLine": [
      "bash.exe",
      "bash"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Bash/
  - https://linux.die.net/man/1/bash
  - Internal Research
Sigma Detection Rule: Potential LSASS Process Dump Via Procdump
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2018-10-30
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.


Detection logic:
{
  "selection_flags": {
    "CommandLine|contains|windash": [
      " -ma ",
      " -mm ",
      " -mp "
    ]
  },
  "selection_process": {
    "CommandLine|contains": [
      " ls",
      " keyiso",
      " samss"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
  - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
  - https://x.com/wietze/status/[PII_REDACTED]33065292?s=12
Sigma Detection Rule: Permission Check Via Accesschk.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-13
ATT&CK techniques: T1069.001
Log source: windows/process_creation

Description:
Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges

Detection logic:
{
  "selection_img": [
    {
      "Product|endswith": "AccessChk"
    },
    {
      "Description|contains": "Reports effective permissions"
    },
    {
      "Image|endswith": [
        "\\accesschk.exe",
        "\\accesschk64.exe"
      ]
    },
    {
      "OriginalFileName": "accesschk.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "uwcqv ",
      "kwsu ",
      "qwsu ",
      "uwdqs "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43
  - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW
  - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
  - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat
Sigma Detection Rule: Ping Hex IP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-03-23
ATT&CK techniques: T1140, T1027
Log source: windows/process_creation

Description:
Detects a ping command that uses a hex encoded IP address

Detection logic:
{
  "selection": {
    "Image|endswith": "\\ping.exe",
    "CommandLine|re": "0x[a-fA-F0-9]{8}"
  },
  "condition": "selection"
}

References:
  - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna
  - https://twitter.com/vysecurity/status/[PII_REDACTED]54491392
Sigma Detection Rule: Ie4uinit Lolbin Use From Invalid Path
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-07
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories

Detection logic:
{
  "lolbin": [
    {
      "Image|endswith": "\\ie4uinit.exe"
    },
    {
      "OriginalFileName": "IE4UINIT.EXE"
    }
  ],
  "filter_correct": {
    "CurrentDirectory": [
      "c:\\windows\\system32\\",
      "c:\\windows\\sysWOW64\\"
    ]
  },
  "filter_missing": {
    "CurrentDirectory": null
  },
  "condition": "lolbin and not 1 of filter_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/
  - https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
Sigma Detection Rule: Suspicious Binary In User Directory Spawned From Office Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jason Lynch
Date: 2019-04-02
ATT&CK techniques: T1204.002
Log source: windows/process_creation

Description:
Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\WINWORD.EXE",
      "\\EXCEL.EXE",
      "\\POWERPNT.exe",
      "\\MSPUB.exe",
      "\\VISIO.exe",
      "\\MSACCESS.exe",
      "\\EQNEDT32.exe"
    ],
    "Image|startswith": "C:\\users\\",
    "Image|endswith": ".exe"
  },
  "filter": {
    "Image|endswith": "\\Teams.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign
  - https://www.virustotal.com/gui/file/23160972c6ae07f740800fa28e421a81d7c0ca5d5cab95bc082b4a986fbac57
Sigma Detection Rule: Potential Arbitrary Code Execution Via Node.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc

Detection logic:
{
  "selection_main": {
    "Image|endswith": "\\node.exe",
    "CommandLine|contains": [
      " -e ",
      " --eval "
    ]
  },
  "selection_action_reverse_shell": {
    "CommandLine|contains|all": [
      ".exec(",
      "net.socket",
      ".connect",
      "child_process"
    ]
  },
  "condition": "selection_main and 1 of selection_action_*"
}

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return
  - https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/
  - https://nodejs.org/api/cli.html
Sigma Detection Rule: Potentially Suspicious Electron Application CommandLine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-05
Log source: windows/process_creation

Description:
Detects potentially suspicious CommandLine of electron apps (teams, discord, slack, etc.). This could be a sign of abuse to proxy execution through a signed binary.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\chrome.exe",
        "\\code.exe",
        "\\discord.exe",
        "\\GitHubDesktop.exe",
        "\\keybase.exe",
        "\\msedge_proxy.exe",
        "\\msedge.exe",
        "\\msedgewebview2.exe",
        "\\msteams.exe",
        "\\slack.exe",
        "\\Teams.exe"
      ]
    },
    {
      "OriginalFileName": [
        "chrome.exe",
        "code.exe",
        "discord.exe",
        "GitHubDesktop.exe",
        "keybase.exe",
        "msedge_proxy.exe",
        "msedge.exe",
        "msedgewebview2.exe",
        "msteams.exe",
        "slack.exe",
        "Teams.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "--browser-subprocess-path",
      "--gpu-launcher",
      "--renderer-cmd-prefix",
      "--utility-cmd-prefix"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://positive.security/blog/ms-officecmd-rce
  - https://lolbas-project.github.io/lolbas/Binaries/Teams/
  - https://lolbas-project.github.io/lolbas/Binaries/Msedge/
  - https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/
  - https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf
Sigma Detection Rule: New Service Creation Using PowerShell
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
Date: 2023-02-20
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects the creation of a new service using powershell.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "New-Service",
      "-BinaryPathName"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
Sigma Detection Rule: HackTool - SharpWSUS/WSUSpendu Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-07
ATT&CK techniques: T1210
Log source: windows/process_creation

Description:
Detects the execution of SharpWSUS or WSUSpendu, utilities that allow for lateral movement through WSUS.
Windows Server Update Services (WSUS) is a critical component of Windows systems and is frequently configured in a way that allows an attacker to circumvent internal networking limitations.


Detection logic:
{
  "selection_wsuspendu_inject": {
    "CommandLine|contains": " -Inject "
  },
  "selection_wsuspendu_payload": {
    "CommandLine|contains": [
      " -PayloadArgs ",
      " -PayloadFile "
    ]
  },
  "selection_sharpwsus_commands": {
    "CommandLine|contains": [
      " approve ",
      " create ",
      " check ",
      " delete "
    ]
  },
  "selection_sharpwsus_flags": {
    "CommandLine|contains": [
      " /payload:",
      " /payload=",
      " /updateid:",
      " /updateid="
    ]
  },
  "condition": "all of selection_wsuspendu_* or all of selection_sharpwsus_*"
}

References:
  - https://labs.nettitude.com/blog/introducing-sharpwsus/
  - https://github.com/nettitude/SharpWSUS
  - https://web.archive.org/web/[PII_REDACTED]4016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1
Sigma Detection Rule: New ActiveScriptEventConsumer Created Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-06-25
ATT&CK techniques: T1546.003
Log source: windows/process_creation

Description:
Detects WMIC executions in which an event consumer gets created. This could be used to establish persistence

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "ActiveScriptEventConsumer",
      " CREATE "
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/johnlatwc/status/[PII_REDACTED]21270282?s=12
  - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf
Sigma Detection Rule: Scheduled Task Executing Encoded Payload from Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-12
ATT&CK techniques: T1053.005, T1059.001
Log source: windows/process_creation

Description:
Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_create": {
    "CommandLine|contains": "/Create"
  },
  "selection_cli_encoding": {
    "CommandLine|contains": [
      "FromBase64String",
      "encodedcommand"
    ]
  },
  "selection_cli_get": {
    "CommandLine|contains": [
      "Get-ItemProperty",
      " gp "
    ]
  },
  "selection_cli_hive": {
    "CommandLine|contains": [
      "HKCU:",
      "HKLM:",
      "registry::",
      "HKEY_"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Sigma Detection Rule: Run Once Task Execution as Configured in Registry
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Avneet Singh @v3t0_, oscd.community, Christopher Peacock @SecurePeacock (updated)
Date: 2020-10-18
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
This rule detects the execution of Run Once task as configured in the registry

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\runonce.exe"
    },
    {
      "Description": "Run Once Wrapper"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|contains": "/AlternateShellStartup"
    },
    {
      "CommandLine|endswith": "/r"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/pabraeken/status/[PII_REDACTED]05789697
  - https://lolbas-project.github.io/lolbas/Binaries/Runonce/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]24156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA
Sigma Detection Rule: PUA - WebBrowserPassView Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-20
ATT&CK techniques: T1555.003
Log source: windows/process_creation

Description:
Detects the execution of WebBrowserPassView.exe. A password recovery tool that reveals the passwords stored by the following Web browsers, Internet Explorer (Version 4.0 - 11.0), Mozilla Firefox (All Versions), Google Chrome, Safari, and Opera

Detection logic:
{
  "selection": [
    {
      "Description": "Web Browser Password Viewer"
    },
    {
      "Image|endswith": "\\WebBrowserPassView.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1555.003/T1555.003.md
Sigma Detection Rule: Uncommon Userinit Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tom Ueltschi (@c_APT_ure), Tim Shelton
Date: 2019-01-12
ATT&CK techniques: T1037.001
Log source: windows/process_creation

Description:
Detects uncommon "userinit.exe" child processes, which could be a sign of uncommon shells or login scripts used for persistence.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\userinit.exe"
  },
  "filter_main_explorer": {
    "Image|endswith": ":\\WINDOWS\\explorer.exe"
  },
  "filter_optional_logonscripts": {
    "CommandLine|contains": [
      "netlogon.bat",
      "UsrLogon.cmd"
    ]
  },
  "filter_optional_windows_core": {
    "CommandLine": "PowerShell.exe"
  },
  "filter_optional_proquota": {
    "Image|endswith": [
      ":\\Windows\\System32\\proquota.exe",
      ":\\Windows\\SysWOW64\\proquota.exe"
    ]
  },
  "filter_optional_citrix": {
    "Image|endswith": [
      ":\\Program Files (x86)\\Citrix\\HDX\\bin\\cmstart.exe",
      ":\\Program Files (x86)\\Citrix\\HDX\\bin\\icast.exe",
      ":\\Program Files (x86)\\Citrix\\System32\\icast.exe",
      ":\\Program Files\\Citrix\\HDX\\bin\\cmstart.exe",
      ":\\Program Files\\Citrix\\HDX\\bin\\icast.exe",
      ":\\Program Files\\Citrix\\System32\\icast.exe"
    ]
  },
  "filter_optional_image_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
  - https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core
Sigma Detection Rule: Potential Cookies Session Hijacking
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-27
Log source: windows/process_creation

Description:
Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|re": "\\s-c\\s"
    },
    {
      "CommandLine|contains": "--cookie-jar"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://curl.se/docs/manpage.html
Sigma Detection Rule: Wab Execution From Non Default Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
Log source: windows/process_creation

Description:
Detects execution of wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) from non default locations as seen with bumblebee activity

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\wab.exe",
      "\\wabmig.exe"
    ]
  },
  "filter": {
    "Image|startswith": [
      "C:\\Windows\\WinSxS\\",
      "C:\\Program Files\\Windows Mail\\",
      "C:\\Program Files (x86)\\Windows Mail\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: Suspicious Desktopimgdownldr Command
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-03
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects a suspicious Microsoft desktopimgdownldr execution with parameters used to download files from the Internet

Detection logic:
{
  "selection1": {
    "CommandLine|contains": " /lockscreenurl:"
  },
  "selection1_filter": {
    "CommandLine|contains": [
      ".jpg",
      ".jpeg",
      ".png"
    ]
  },
  "selection_reg": {
    "CommandLine|contains|all": [
      "reg delete",
      "\\PersonalizationCSP"
    ]
  },
  "condition": "( selection1 and not selection1_filter ) or selection_reg"
}

References:
  - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]45741825
Sigma Detection Rule: Suspicious Msiexec Execute Arbitrary DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-16
ATT&CK techniques: T1218.007
Log source: windows/process_creation

Description:
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)


Detection logic:
{
  "selection": {
    "Image|endswith": "\\msiexec.exe",
    "CommandLine|contains|windash": " /Y"
  },
  "filter_main_legit_path": {
    "CommandLine|contains": [
      "\\MsiExec.exe\" /Y \"C:\\Program Files\\",
      "\\MsiExec.exe\" /Y \"C:\\Program Files (x86)\\",
      "\\MsiExec.exe\" /Y \"C:\\Windows\\System32\\",
      "\\MsiExec.exe\" /Y \"C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://twitter.com/_st0pp3r_/status/[PII_REDACTED]96897281