deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RTF_Byte_Nibble_Obfuscation_method1
Repository: InQuest/yara-rules
Detects: This signature is designed to detect the obfuscation method described by Boris Larin here https://securelist.com/disappearing-bytes/84017/
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$magic    = {7b 5c 72}
        $update   = "\\objupdate" nocase
        $data     = "\\objdata"   nocase
        $nibble_a = /([A-Fa-f0-9]\\'[A-Fa-f0-9]{4}){4}/
        $nibble_b = /(\\'[A-Fa-f0-9]+\\'[A-Fa-f0-9]{4}){4}/

Detection condition:
$magic in (0..30) and all of them and (#nibble_a > 10 or #nibble_b > 10)

Full rule:
rule RTF_Byte_Nibble_Obfuscation_method1
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "This signature is designed to detect the obfuscation method described by Boris Larin here https://securelist.com/disappearing-bytes/84017/"
    strings:
        $magic    = {7b 5c 72}
        $update   = "\\objupdate" nocase
        $data     = "\\objdata"   nocase
        $nibble_a = /([A-Fa-f0-9]\\'[A-Fa-f0-9]{4}){4}/
        $nibble_b = /(\\'[A-Fa-f0-9]+\\'[A-Fa-f0-9]{4}){4}/
    condition:
        $magic in (0..30) and all of them and (#nibble_a > 10 or #nibble_b > 10)
}
YARA Detection Rule: RTF_Byte_Nibble_Obfuscation_method2
Repository: InQuest/yara-rules

Pattern signatures:
$magic  = {7b 5c 72}
        $nibble = /\\objupdate.{0,1024}\\objdata.{0,1024}([A-Fa-f0-9]\\'[A-Fa-f0-9]{4}){2}/

Detection condition:
$magic in (0..30) and all of them

Full rule:
rule RTF_Byte_Nibble_Obfuscation_method2
{
    strings:
        $magic  = {7b 5c 72}
        $nibble = /\\objupdate.{0,1024}\\objdata.{0,1024}([A-Fa-f0-9]\\'[A-Fa-f0-9]{4}){2}/
    condition:
        $magic in (0..30) and all of them
}
YARA Detection Rule: Executable_Converted_to_MSI
Repository: InQuest/yara-rules
Detects: http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/
Author: InQuest Labs
Reference: https://github.com/InQuest/yara-rules

Pattern signatures:
$magic = /^\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00/
        $url   = "www.exetomsi.com" nocase

Detection condition:
$magic at 0 and $url

Full rule:
rule Executable_Converted_to_MSI
{
    meta:
        Author      = "InQuest Labs"
        URL         = "https://github.com/InQuest/yara-rules"
        Description = "http://blog.inquest.net/blog/2019/01/29/Carving-Sneaky-XLM-Files/"
    strings:
        $magic = /^\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1\x00\x00\x00/
        $url   = "www.exetomsi.com" nocase
    condition:
        $magic at 0 and $url
}
YARA Detection Rule: Adobe_Flash_DRM_Use_After_Free
Repository: InQuest/yara-rules

Pattern signatures:
$as   = "package"
        $exp1 = "import com.adobe.tvsdk.mediacore" 	// covers .*
        $exp2 = "createDispatcher("
        $exp3 = "createMediaPlayer("
        $exp4 = "drmManager.initialize("    		// com.adobe.tvsdk.mediacore.DRMOperationCompleteListener;
        $vara_1 = "push(this)"
        $vara_2 = "push(null)"
        $vara_3 = /pop\(\)\..+\s*=\s*.+pop\(\)/
        $varb_1 = /push\([^\)]{1,24}drmManager.initialize/

        // all the requisite pieces in a single function.
        $varc_1 = /\{[^\}]+createDispatcher\s*\([^\}]+createMediaPlayer\s*\([^\}]+drmManager\.initialize\s*\([^\}]+=\s*null[^\}]+\}/

Detection condition:
$as at 0 and all of ($exp*) and (all of ($vara*) or $varb_1 or $varc_1)

Full rule:
rule Adobe_Flash_DRM_Use_After_Free
{    
    meta:
        note  = "This YARA rule is intended to run atop of decompiled Flash."

    strings:
        $as   = "package"
        $exp1 = "import com.adobe.tvsdk.mediacore" 	// covers .*
        $exp2 = "createDispatcher("
        $exp3 = "createMediaPlayer("
        $exp4 = "drmManager.initialize("    		// com.adobe.tvsdk.mediacore.DRMOperationCompleteListener;
        $vara_1 = "push(this)"
        $vara_2 = "push(null)"
        $vara_3 = /pop\(\)\..+\s*=\s*.+pop\(\)/
        $varb_1 = /push\([^\)]{1,24}drmManager.initialize/

        // all the requisite pieces in a single function.
        $varc_1 = /\{[^\}]+createDispatcher\s*\([^\}]+createMediaPlayer\s*\([^\}]+drmManager\.initialize\s*\([^\}]+=\s*null[^\}]+\}/

    condition:
        $as at 0 and all of ($exp*) and (all of ($vara*) or $varb_1 or $varc_1)
}
YARA Detection Rule: AgentTesla
Repository: InQuest/yara-rules
Author: InQuest Labs

Pattern signatures:
$s0 = "SecretId1" ascii
        $s1 = "#GUID" ascii
        $s2 = "#Strings" ascii
        $s3 = "#Blob" ascii
        $s4 = "get_URL" ascii
        $s5 = "set_URL" ascii
        $s6 = "DecryptIePassword" ascii
        $s8 = "GetURLHashString" ascii
        $s9 = "DoesURLMatchWithHash" ascii

        $f0 = "GetSavedPasswords" ascii
        $f1 = "IESecretHeader" ascii
        $f2 = "RecoveredBrowserAccount" ascii
        $f4 = "PasswordDerivedBytes" ascii
        $f5 = "get_ASCII" ascii
        $f6 = "get_ComputerName" ascii
        $f7 = "get_WebServices" ascii
        $f8 = "get_UserName" ascii
        $f9 = "get_OSFullName" ascii
        $f10 = "ComputerInfo" ascii
        $f11 = "set_Sendwebcam" ascii
        $f12 = "get_Clipboard" ascii
        $f13 = "get_TotalFreeSpace" ascii
        $f14 = "get_IsAttached" ascii

        $x0 = "IELibrary.dll" ascii wide
        $x1 = "webpanel" ascii wide nocase
        $x2 = "smtp" ascii wide nocase
        
        $v5 = "vmware" ascii wide n

Detection condition:
(
            (
                5 of ($s*) or 
                7 of ($f*)
            ) and
            all of ($x*) and 
            all of ($v*) and
            $pdb
        )

Full rule:
rule AgentTesla
{
    meta:
        author = "InQuest Labs"
        source = "http://blog.inquest.net/blog/2018/05/22/field-notes-agent-tesla-open-directory/"
        created = "05/18/2018"
        TLP = "WHITE"
    strings:
        $s0 = "SecretId1" ascii
        $s1 = "#GUID" ascii
        $s2 = "#Strings" ascii
        $s3 = "#Blob" ascii
        $s4 = "get_URL" ascii
        $s5 = "set_URL" ascii
        $s6 = "DecryptIePassword" ascii
        $s8 = "GetURLHashString" ascii
        $s9 = "DoesURLMatchWithHash" ascii

        $f0 = "GetSavedPasswords" ascii
        $f1 = "IESecretHeader" ascii
        $f2 = "RecoveredBrowserAccount" ascii
        $f4 = "PasswordDerivedBytes" ascii
        $f5 = "get_ASCII" ascii
        $f6 = "get_ComputerName" ascii
        $f7 = "get_WebServices" ascii
        $f8 = "get_UserName" ascii
        $f9 = "get_OSFullName" ascii
        $f10 = "ComputerInfo" ascii
        $f11 = "set_Sendwebcam" ascii
        $f12 = "get_Clipboard" ascii
        $f13 = "get_TotalFreeSpace" ascii
        $f14 = "get_IsAttached" ascii

        $x0 = "IELibrary.dll" ascii wide
        $x1 = "webpanel" ascii wide nocase
        $x2 = "smtp" ascii wide nocase
        
        $v5 = "vmware" ascii wide nocase
        $v6 = "VirtualBox" ascii wide nocase
        $v7 = "vbox" ascii wide nocase
        $v9 = "avghookx.dll" ascii wide nocase

        $pdb = "IELibrary.pdb" ascii
    condition:
        (
            (
                5 of ($s*) or 
                7 of ($f*)
            ) and
            all of ($x*) and 
            all of ($v*) and
            $pdb
        )
}
YARA Detection Rule: GlowSpark_Downloader
Repository: InQuest/yara-rules

Pattern signatures:
$a1="79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116" ascii wide nocase

$a2="67,114,101,97,116,101,79,98,106,101,99,116,40,34,83,99,114,105,112,116,105,110,103,46,70,105,
108,101,83,121,115,116,101,109,79,98,106,101,99,116,34,41" ascii wide nocase

$a3="51,50,44,55,57,44,49,49,48,44,51,50,44,54,57,44,49,49,52,44,49,49,52,44,49,49,49,44,49,49,52,
44,51,50,44,56,50,44,49,48,49,44,49,49,53,44,49,49,55,44,49,48,57,44,49,48,49,44,51,50,44,55,56,44,
49,48,49,44,49,50,48" ascii wide nocase // The second stage of the script

Detection condition:
((filesize < 2000KB) and any of ($a*))

Full rule:
rule GlowSpark_Downloader
{
meta:

Author = inquest.net
discription = "GlowSpark_2n_Stage_Actinium_Downloader"
last_modified = "1.0"
date = 08.02.2022
    
strings:
$a1="79,110,32,69,114,114,111,114,32,82,101,115,117,109,101,32,78,101,120,116" ascii wide nocase

$a2="67,114,101,97,116,101,79,98,106,101,99,116,40,34,83,99,114,105,112,116,105,110,103,46,70,105,
108,101,83,121,115,116,101,109,79,98,106,101,99,116,34,41" ascii wide nocase

$a3="51,50,44,55,57,44,49,49,48,44,51,50,44,54,57,44,49,49,52,44,49,49,52,44,49,49,49,44,49,49,52,
44,51,50,44,56,50,44,49,48,49,44,49,49,53,44,49,49,55,44,49,48,57,44,49,48,49,44,51,50,44,55,56,44,
49,48,49,44,49,50,48" ascii wide nocase // The second stage of the script 

condition:

((filesize < 2000KB) and any of ($a*))
}
YARA Detection Rule: excel40_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$ole_marker       = {D0 CF 11 E0 A1 B1 1A E1}
        $velvet_sweatshop = {2F 00 06 00 00 00 59 B3 0A 9A}
        $macro_sheet_h0   = "Excel 4.0 Macros"
        $macro_sheet_h1   = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
        $macro_sheet_h2   = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
        $macro_sheet_h3   = {85 00 ?? ?? ?? ?? ?? ?? ?? 01 01}
        $macro_sheet_h4   = {85 00 ?? ?? ?? ?? ?? ?? ?? 02 01}
        $url              = /https?:\/\/[\w\/\.\-]+/ nocase ascii wide
        $dconn            = /\x76\x08\x00\x00\x04\x00[\x40-\x7f\xc0-\xff]/
        $magic_xlsx       = /^\x50\x4B\x03\x04/
        $anchor_xlsx      = /macrosheets\/[a-z0-9_-]+\.[a-z]+PK/ nocase

Detection condition:
new_file and
        (
            ($ole_marker in (0..1024) and (1 of ($macro_sheet_h*) or ($url and $dconn) or $velvet_sweatshop or math.entropy(0, filesize) >= 7.5))
            or
            ($magic_xlsx at 0 and $anchor_xlsx)
        )

Full rule:
rule excel40_hunter
{
    strings:
        $ole_marker       = {D0 CF 11 E0 A1 B1 1A E1}
        $velvet_sweatshop = {2F 00 06 00 00 00 59 B3 0A 9A}
        $macro_sheet_h0   = "Excel 4.0 Macros"
        $macro_sheet_h1   = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
        $macro_sheet_h2   = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
        $macro_sheet_h3   = {85 00 ?? ?? ?? ?? ?? ?? ?? 01 01}
        $macro_sheet_h4   = {85 00 ?? ?? ?? ?? ?? ?? ?? 02 01}
        $url              = /https?:\/\/[\w\/\.\-]+/ nocase ascii wide
        $dconn            = /\x76\x08\x00\x00\x04\x00[\x40-\x7f\xc0-\xff]/
        $magic_xlsx       = /^\x50\x4B\x03\x04/
        $anchor_xlsx      = /macrosheets\/[a-z0-9_-]+\.[a-z]+PK/ nocase

    condition:
        new_file and
        (
            ($ole_marker in (0..1024) and (1 of ($macro_sheet_h*) or ($url and $dconn) or $velvet_sweatshop or math.entropy(0, filesize) >= 7.5))
            or
            ($magic_xlsx at 0 and $anchor_xlsx)
        )
}
YARA Detection Rule: malflash_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$magic = { (43 | 46 | 5A) 57 53 }

Detection condition:
new_file and positives > 0 and not (uint16be(0x0) == 0x4d5a) and
        (
            file_type contains "flash" or
            tags      contains "flash" or
            $magic at 0
        )

Full rule:
rule malflash_hunter
{
    strings:
        $magic = { (43 | 46 | 5A) 57 53 }

    condition:
        new_file and positives > 0 and not (uint16be(0x0) == 0x4d5a) and
        (
            file_type contains "flash" or
            tags      contains "flash" or
            $magic at 0
        )
}
YARA Detection Rule: phish_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$pdf_header = "%PDF"

Detection condition:
new_file and
        (
            file_type contains "office" or
            file_type contains "pdf"    or
            tags      contains "office" or
            tags      contains "pdf"    or
            $pdf_header in (0..1024)
            
        )
            and
        (
            signatu

Full rule:
rule phish_hunter
{
    strings:
        $pdf_header = "%PDF"
    condition:
        new_file and
        (
            file_type contains "office" or
            file_type contains "pdf"    or
            tags      contains "office" or
            tags      contains "pdf"    or
            $pdf_header in (0..1024)
            
        )
            and
        (
            signatures matches /phish/i
        )
}
YARA Detection Rule: malpdf_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$pdf_header = "%PDF"
        $encrypted  = "/Encrypt"

Detection condition:
new_file and
        (
            file_type contains "pdf" or
            $pdf_header in (0..1024)
        )
        and (positives > 0 or $encrypted)

Full rule:
rule malpdf_hunter
{
    strings:
        $pdf_header = "%PDF"
        $encrypted  = "/Encrypt"
    condition:
        new_file and
        (
            file_type contains "pdf" or
            $pdf_header in (0..1024)
        )
        and (positives > 0 or $encrypted)
}
YARA Detection Rule: swfdoc_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$a = { 6e db 7c d2 6d ae cf 11 96 b8 44 45 53 54 00 00 }
        $b = { 57 53 }

Detection condition:
$a and $b and not (uint16be(0x0) == 0x4d5a)

Full rule:
rule swfdoc_hunter
{
    strings:
        $a = { 6e db 7c d2 6d ae cf 11 96 b8 44 45 53 54 00 00 }
        $b = { 57 53 }
    condition:
        $a and $b and not (uint16be(0x0) == 0x4d5a)
}
YARA Detection Rule: rtf_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$magic = "{\\rt"

Detection condition:
new_file and positives > 0 and
        (
            file_type contains "rtf" or
            tags      contains "rtf" or
            $magic    at 0
        )

Full rule:
rule rtf_hunter
{
    strings:
        $magic = "{\\rt"
    condition:
        new_file and positives > 0 and
        (
            file_type contains "rtf" or
            tags      contains "rtf" or
            $magic    at 0
        )
}
YARA Detection Rule: maldoc_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$ole_magic   = {D0 CF 11 E0 A1 B1 1A E1}
	$docx_magic  = /^\x50\x4B\x03\x04\x14\x00\x06\x00/
        $activex_1   = "word/activeX/activeX1.bin"
        $activex_2   = "word/activeX/activeX1.xml"
	$suspicious1 = { FF D8 FF E?} 
        $suspicious2 = { FF E1 ?? ?? 45 78 69 66 00 }
        $suspicious3 = "Xor" nocase wide ascii fullword
        $suspicious4 = "Followed Hyperlink" nocase wide ascii
        $suspicious5 = "equation native" nocase wide ascii
        $suspicious6 = "Microsoft Enhanced Cryptographic Provider" nocase wide ascii
        $suspicious7 = "EncryptedPackage" nocase wide ascii

Detection condition:
new_file and not (uint16be(0x0) == 0x4d5a)
        and
        (
            file_type contains "office" or
            tags      contains "office" or
            $docx_magic at 0 or
            $ole_magic  at 0
        )
        and
        (
            positives > 0 or
            all of ($active

Full rule:
rule maldoc_hunter
{
    strings:
        $ole_magic   = {D0 CF 11 E0 A1 B1 1A E1}
	$docx_magic  = /^\x50\x4B\x03\x04\x14\x00\x06\x00/
        $activex_1   = "word/activeX/activeX1.bin"
        $activex_2   = "word/activeX/activeX1.xml"
	$suspicious1 = { FF D8 FF E?} 
        $suspicious2 = { FF E1 ?? ?? 45 78 69 66 00 }
        $suspicious3 = "Xor" nocase wide ascii fullword
        $suspicious4 = "Followed Hyperlink" nocase wide ascii
        $suspicious5 = "equation native" nocase wide ascii
        $suspicious6 = "Microsoft Enhanced Cryptographic Provider" nocase wide ascii
        $suspicious7 = "EncryptedPackage" nocase wide ascii
	condition:
        new_file and not (uint16be(0x0) == 0x4d5a)
        and
        (
            file_type contains "office" or
            tags      contains "office" or
            $docx_magic at 0 or
            $ole_magic  at 0
        )
        and
        (
            positives > 0 or
            all of ($activex*) or
            any of ($suspicious*)
        )
}
YARA Detection Rule: macro_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$ole_marker     = {D0 CF 11 E0 A1 B1 1A E1}
        $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
        $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}

Detection condition:
new_file and (tags contains "macros" or ($ole_marker at 0 and 1 of ($macro_sheet_h*)))

Full rule:
rule macro_hunter
{
    strings:
        $ole_marker     = {D0 CF 11 E0 A1 B1 1A E1}
        $macro_sheet_h1 = {85 00 ?? ?? ?? ?? ?? ?? 01 01}
        $macro_sheet_h2 = {85 00 ?? ?? ?? ?? ?? ?? 02 01}
    condition:
        new_file and (tags contains "macros" or ($ole_marker at 0 and 1 of ($macro_sheet_h*)))
}
YARA Detection Rule: xsl_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$xml = "<?xml" nocase
    		$re1 = "<msxsl:script"
    		$js1 = "JavaScript" nocase
    		$js2 = "JScript"    nocase

Detection condition:
new_file and $xml in (0 .. 100) and $re1 and (any of ($js*))

Full rule:
rule xsl_hunter
{
		strings:
			  $xml = "<?xml" nocase
    		$re1 = "<msxsl:script"
    		$js1 = "JavaScript" nocase
    		$js2 = "JScript"    nocase
		condition:
			new_file and $xml in (0 .. 100) and $re1 and (any of ($js*))
}
YARA Detection Rule: slk_hunter
Repository: InQuest/yara-rules

Detection condition:
/* trigger = 'ID;P' */
        new_file and (uint32be(0x0) == 0x49443b50)

Full rule:
rule slk_hunter
{
    condition:
        /* trigger = 'ID;P' */
        new_file and (uint32be(0x0) == 0x49443b50)
}
YARA Detection Rule: pdfjs_hunter
Repository: InQuest/yara-rules

Pattern signatures:
$pdf_header = "%PDF"

Detection condition:
new_file and
        (
            file_type contains "pdf" or
            $pdf_header in (0..1024)
        )
        and tags contains "js-embedded"

Full rule:
rule pdfjs_hunter
{
    strings:
        $pdf_header = "%PDF"
    condition:
        new_file and
        (
            file_type contains "pdf" or
            $pdf_header in (0..1024)
        )
        and tags contains "js-embedded"
}
YARA Detection Rule: maljar_hunter
Repository: InQuest/yara-rules

Detection condition:
new_file and positives > 0 and
        (
            tags      contains "jar"   or
            tags      contains "class" or
            file_type contains "jar"   or
            file_type contains "class"
        )

Full rule:
rule maljar_hunter
{
    condition:
        new_file and positives > 0 and
        (
            tags      contains "jar"   or
            tags      contains "class" or
            file_type contains "jar"   or
            file_type contains "class"
        )
}
Sigma Detection Rule: WannaCry Ransomware Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
Date: 2019-01-16
ATT&CK techniques: T1210, T1083, T1222.001, T1486, T1490
Log source: windows/process_creation

Description:
Detects WannaCry ransomware activity

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\tasksche.exe",
        "\\mssecsvc.exe",
        "\\taskdl.exe",
        "\\taskhsvc.exe",
        "\\taskse.exe",
        "\\111.exe",
        "\\lhdfrgui.exe",
        "\\linuxnew.exe",
        "\\wannacry.exe"
      ]
    },
    {
      "Image|contains": "WanaDecryptor"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": "@Please_Read_Me@.txt"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f[PII_REDACTED]80439c6e5babe8e080e41aa?environmentId=100
  - https://x.com/nas_bench/status/[PII_REDACTED]84425963
Sigma Detection Rule: Malware Shellcode in Verclsid Target Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: John Lambert (tech), Florian Roth (Nextron Systems)
Date: 2017-03-04
ATT&CK techniques: T1055
Log source: windows/process_access

Description:
Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

Detection logic:
{
  "selection_target": {
    "TargetImage|endswith": "\\verclsid.exe",
    "GrantedAccess": "0x1FFFFF"
  },
  "selection_calltrace_1": {
    "CallTrace|contains|all": [
      "|UNKNOWN(",
      "VBE7.DLL"
    ]
  },
  "selection_calltrace_2": {
    "SourceImage|contains": "\\Microsoft Office\\",
    "CallTrace|contains": "|UNKNOWN"
  },
  "condition": "selection_target and 1 of selection_calltrace_*"
}

References:
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]39534080
Sigma Detection Rule: CosmicDuke Service Installation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)
Date: 2017-03-27
ATT&CK techniques: T1543.003, T1569.002
Log source: windows/

Description:
Detects the installation of a service named "javamtsup" on the system.
The CosmicDuke info stealer uses Windows services typically named "javamtsup" for persistence.


Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceName": "javamtsup"
  },
  "condition": "selection"
}

References:
  - https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf
Sigma Detection Rule: Potential PlugX Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-06-12
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location

Detection logic:
{
  "selection_cammute": {
    "Image|endswith": "\\CamMute.exe"
  },
  "filter_cammute": {
    "Image|contains": [
      "\\Lenovo\\Communication Utility\\",
      "\\Lenovo\\Communications Utility\\"
    ]
  },
  "selection_chrome_frame": {
    "Image|endswith": "\\chrome_frame_helper.exe"
  },
  "filter_chrome_frame": {
    "Image|contains": "\\Google\\Chrome\\application\\"
  },
  "selection_devemu": {
    "Image|endswith": "\\dvcemumanager.exe"
  },
  "filter_devemu": {
    "Image|contains": "\\Microsoft Device Emulator\\"
  },
  "selection_gadget": {
    "Image|endswith": "\\Gadget.exe"
  },
  "filter_gadget": {
    "Image|contains": "\\Windows Media Player\\"
  },
  "selection_hcc": {
    "Image|endswith": "\\hcc.exe"
  },
  "filter_hcc": {
    "Image|contains": "\\HTML Help Workshop\\"
  },
  "selection_hkcmd": {
    "Image|endswith": "\\hkcmd.exe"
  },
  "filter_hkcmd": {
    "Image|contains": [
      "\\System32\\",
      "\\SysNative\\",
      "\\SysWow64\\"
    ]
  },
  "selection_mc": {
    "Image|endswith": "\\Mc.exe"
  },
  "filter_mc": {
    "Image|contains": [
      "\\Microsoft Visual Studio",
      "\\Microsoft SDK",
      "\\Windows Kit"
    ]
  },
  "selection_msmpeng": {
    "Image|endswith": "\\MsMpEng.exe"
  },
  "filter_msmpeng": {
    "Image|contains": [
      "\\Microsoft Security Client\\",
      "\\Windows Defender\\",
      "\\AntiMalware\\"
    ]
  },
  "selection_msseces": {
    "Image|endswith": "\\msseces.exe"
  },
  "filter_msseces": {
    "

References:
  - http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
  - https://countuponsecurity.com/2017/06/07/threat-hunting-in-the-enterprise-with-appcompatprocessor/
Sigma Detection Rule: Adwind RAT / JRAT
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
Date: 2017-11-10
ATT&CK techniques: T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects javaw.exe in AppData folder as used by Adwind / JRAT

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains|all": [
        "\\AppData\\Roaming\\Oracle",
        "\\java",
        ".exe "
      ]
    },
    {
      "CommandLine|contains|all": [
        "cscript.exe",
        "Retrive",
        ".vbs "
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
  - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf