deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Suspicious Execution From GUID Like Folder Names
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-01
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks.
Use this rule to hunt for potentially suspicious activity stemming from uncommon folders.


Detection logic:
{
  "selection_folder": {
    "CommandLine|contains": [
      "\\AppData\\Roaming\\",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "selection_guid": {
    "CommandLine|contains|all": [
      "\\{",
      "}\\"
    ]
  },
  "filter_main_image_guid": {
    "Image|contains|all": [
      "\\{",
      "}\\"
    ]
  },
  "filter_main_null": {
    "Image": null
  },
  "filter_main_driver_inst": {
    "Image": "C:\\Windows\\System32\\drvinst.exe"
  },
  "filter_main_msiexec": {
    "Image": [
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe"
    ]
  },
  "condition": "all of selection_* and not 1 of filter*"
}

References:
  - https://twitter.com/Kostastsale/status/[PII_REDACTED]04986369
Sigma Detection Rule: Winscp Execution From Non Standard Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: frack113
Date: 2025-10-12
ATT&CK techniques: T1048
Log source: windows/process_creation

Description:
Detects the execution of Winscp from an a non standard folder. This could indicate the execution of Winscp portable.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\WinSCP.exe"
    },
    {
      "OriginalFileName": "winscp.exe"
    }
  ],
  "filter_main_location": {
    "Image|startswith": "C:\\Program Files (x86)\\WinSCP\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
Sigma Detection Rule: Net.EXE Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)
Date: 2019-01-16
ATT&CK techniques: T1007, T1049, T1018, T1135, T1201, T1069.001, T1069.002, T1087.001, T1087.002, T1021.002
Log source: windows/process_creation

Description:
Detects execution of "Net.EXE".

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " accounts",
      " group",
      " localgroup",
      " share",
      " start",
      " stop ",
      " user",
      " view"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
  - https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html
  - https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html
  - https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a[PII_REDACTED]8ce61.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe
Sigma Detection Rule: Process Terminated Via Taskkill
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, MalGamy (Nextron Systems), Nasreddine Bencherchali
Date: 2021-12-26
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects execution of "taskkill.exe" in order to stop a service or a process. Look for suspicious parents executing this command in order to hunt for potential malicious activity.
Attackers might leverage this in order to conduct data destruction or data encrypted for impact on the data stores of services like Exchange and SQL Server.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\taskkill.exe"
    },
    {
      "OriginalFileName": "taskkill.exe"
    }
  ],
  "selection_cli_force": [
    {
      "CommandLine|contains|windash": " /f "
    },
    {
      "CommandLine|endswith|windash": " /f"
    }
  ],
  "selection_cli_filter_process": {
    "CommandLine|contains|windash": [
      " /im ",
      " /pid "
    ]
  },
  "filter_main_installers": {
    "ParentImage|contains": [
      "\\AppData\\Local\\Temp\\",
      ":\\Windows\\Temp"
    ],
    "ParentImage|endswith": ".tmp"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1489/T1489.md#atomic-test-3---windows---stop-service-by-killing-process
  - https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
Sigma Detection Rule: Potential Password Reconnaissance Via Findstr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Josh Nickels
Date: 2023-05-18
ATT&CK techniques: T1552.001
Log source: windows/process_creation

Description:
Detects command line usage of "findstr" to search for the "passwords" keyword in a variety of different languages

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\findstr.exe"
    },
    {
      "OriginalFileName": "FINDSTR.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "contrase\u00f1a",
      "has\u0142o",
      "heslo",
      "parola",
      "passe",
      "passw",
      "senha",
      "senord",
      "\u5bc6\u78bc"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://steflan-security.com/windows-privilege-escalation-credential-harvesting/
  - https://adsecurity.org/?p=2288
Sigma Detection Rule: CodePage Modification Via MODE.COM
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-01-19
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects a CodePage modification using the "mode.com" utility.
This behavior has been used by threat actors behind Dharma ransomware.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mode.com"
    },
    {
      "OriginalFileName": "MODE.COM"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " con ",
      " cp ",
      " select="
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
  - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
  - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
Sigma Detection Rule: File Download Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-05
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects file download using curl.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "selection_remote": {
    "CommandLine|contains": [
      " -O",
      "--remote-name",
      "--output"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0046/https://twitter.com/reegun21/status/[PII_REDACTED]09790464
Sigma Detection Rule: Set Files as System Files Using Attrib.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-02-04
ATT&CK techniques: T1564.001
Log source: windows/process_creation

Description:
Detects the execution of "attrib" with the "+s" flag to mark files as system files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\attrib.exe"
    },
    {
      "OriginalFileName": "ATTRIB.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " +s "
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-3---create-windows-system-file-with-attrib
  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
  - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
Sigma Detection Rule: Import New Module Via PowerShell CommandLine
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-09
Log source: windows/process_creation

Description:
Detects usage of the "Import-Module" cmdlet in order to add new Cmdlets to the current PowerShell session

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cmdlet": {
    "CommandLine|contains": [
      "Import-Module ",
      "ipmo "
    ]
  },
  "filter_main_vsstudio": {
    "ParentImage|contains": [
      ":\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_",
      ":\\Windows\\System32\\cmd.exe"
    ],
    "CommandLine|contains|all": [
      ":\\Program Files\\Microsoft Visual Studio\\",
      "Tools\\Microsoft.VisualStudio.DevShell.dll"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-7.3
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-5.1
Sigma Detection Rule: Curl.EXE Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-05
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects a curl process start on Windows, which could indicates a file download from a remote location or a simple web request to a remote server

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0046/https://twitter.com/reegun21/status/[PII_REDACTED]09790464
Sigma Detection Rule: Potential File Override/Append Via SET Command
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), MahirAli Khan (in/mahiralikhan)
Date: 2024-08-22
Log source: windows/process_creation

Description:
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign.
Attackers used this technique along with an append redirection operator ">>" in order to update the content of a file indirectly.
Ex: cmd /c >> example.txt set /p="test data". This will append "test data" to contents of "example.txt".
The typical use case of the "set /p=" command is to prompt the user for input.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "/c set /p=",
      "\"set /p=",
      ">>*set /p="
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
  - https://ss64.com/nt/set.html
Sigma Detection Rule: Cab File Extraction Via Wusa.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-04
Log source: windows/process_creation

Description:
Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract cab using the "/extract" argument that is no longer supported.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\wusa.exe",
    "CommandLine|contains": "/extract:"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
Sigma Detection Rule: Remote Access Tool - Cmd.EXE Execution via AnyViewer
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2024-08-03
Log source: windows/process_creation

Description:
Detects execution of "cmd.exe" via the AnyViewer RMM agent on a remote management sessions.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\AVCore.exe",
    "ParentCommandLine|contains": "AVCore.exe\" -d",
    "Image|endswith": "\\cmd.exe"
  },
  "condition": "selection"
}

References:
  - https://www.anyviewer.com/help/remote-technical-support.html
Sigma Detection Rule: Tunneling Tool Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1041, T1572, T1071.001
Log source: windows/process_creation

Description:
Detects the execution of well known tools that can be abused for data exfiltration and tunneling.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\httptunnel.exe",
      "\\plink.exe",
      "\\socat.exe",
      "\\stunnel.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
Sigma Detection Rule: Potentially Suspicious Compression Tool Parameters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Samir Bousseaden
Date: 2019-10-15
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects potentially suspicious command line arguments of common data compression tools

Detection logic:
{
  "selection": {
    "OriginalFileName": [
      "7z*.exe",
      "*rar.exe",
      "*Command*Line*RAR*"
    ],
    "CommandLine|contains": [
      " -p",
      " -ta",
      " -tb",
      " -sdel",
      " -dw",
      " -hp"
    ]
  },
  "filter_main_generic": {
    "ParentImage|contains": [
      ":\\Program Files\\",
      ":\\Program Files (x86)\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]12535811
Sigma Detection Rule: FTP Connection Open Attempt Via Winscp CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: frack113
Date: 2025-10-12
ATT&CK techniques: T1048
Log source: windows/process_creation

Description:
Detects the execution of Winscp with the "-command" and the "open" flags in order to open an FTP connection. Akira ransomware was seen using this technique in order to exfiltrate data.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WinSCP.exe"
    },
    {
      "OriginalFileName": "winscp.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|windash": "-command",
    "CommandLine|contains|all": [
      "open ",
      "ftp://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
Sigma Detection Rule: Unusually Long PowerShell CommandLine
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects unusually long PowerShell command lines with a length of 1000 characters or more

Detection logic:
{
  "selection_powershell": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Description": "Windows Powershell"
    },
    {
      "Product": "PowerShell Core 6"
    }
  ],
  "selection_length": {
    "CommandLine|re": ".{1000,}"
  },
  "condition": "all of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Password Protected Compressed File Extraction Via 7Zip
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-10
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects usage of 7zip utilities (7z.exe, 7za.exe and 7zr.exe) to extract password protected zip files.

Detection logic:
{
  "selection_img": [
    {
      "Description|contains": "7-Zip"
    },
    {
      "Image|endswith": [
        "\\7z.exe",
        "\\7zr.exe",
        "\\7za.exe"
      ]
    },
    {
      "OriginalFileName": [
        "7z.exe",
        "7za.exe"
      ]
    }
  ],
  "selection_password": {
    "CommandLine|contains|all": [
      " -p",
      " x ",
      " -o"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/
Sigma Detection Rule: Rundll32.EXE Calling DllRegisterServer Export Function Explicitly
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-10-17
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path.


Detection logic:
{
  "selection_image": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cmdline": {
    "CommandLine|contains": "DllRegisterServer"
  },
  "filter_main_legit_paths": {
    "CommandLine|contains": [
      ":\\Program Files (x86)",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/[PII_REDACTED]2563db982cd038cf77cbc5ef4c7003e3edee86e2b0f99e675ed4ed/behavior
  - https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver
Sigma Detection Rule: Elevated System Shell Spawned
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2023-11-23
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.


Detection logic:
{
  "selection_shell": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\powershell_ise.exe",
        "\\pwsh.exe",
        "\\cmd.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "powershell_ise.EXE",
        "pwsh.dll",
        "Cmd.Exe"
      ]
    }
  ],
  "selection_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "LogonId": "0x3e7"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/Wh04m1001/SysmonEoP
Sigma Detection Rule: HTML File Opened From Download Folder
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Joseph Kamau
Date: 2025-12-05
ATT&CK techniques: T1598.002, T1566.001
Log source: windows/process_creation

Description:
Detects web browser process opening an HTML file from a user's Downloads folder.
This behavior is could be associated with phishing attacks where threat actors send HTML attachments to users.
When a user opens such an attachment, it can lead to the execution of malicious scripts or the download of malware.
During investigation, analyze the HTML file for embedded scripts or links, check for any subsequent downloads or process executions, and investigate the source of the email or message containing the attachment.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\firefox.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ],
    "CommandLine|contains|all": [
      ":\\users\\",
      "\\Downloads\\",
      ".htm"
    ]
  },
  "condition": "selection"
}

References:
  - https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
  - https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
Sigma Detection Rule: Manual Execution of Script Inside of a Compressed File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2023-02-15
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries.

From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios.
    1. Compressed file opened using 7zip.
    2. Compressed file opened using WinRar.
    3. Compressed file opened using native windows File Explorer capabilities.

When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."


Detection logic:
{
  "selection_parent_7zip": {
    "ParentImage|endswith": "\\7z*.exe",
    "CommandLine|contains": "\\AppData\\local\\temp\\7z*\\"
  },
  "selection_parent_winrar": {
    "ParentImage|endswith": "\\winrar.exe",
    "CommandLine|contains": "\\AppData\\local\\temp\\rar*\\"
  },
  "selection_parent_explorer": {
    "ParentImage|endswith": "\\explorer.exe",
    "CommandLine|contains": [
      "\\AppData\\local\\temp\\*.rar\\",
      "\\AppData\\local\\temp\\*.zip\\"
    ]
  },
  "selection_child": {
    "Image|endswith": [
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "CommandLine|endswith": [
      ".hta",
      ".js",
      ".jse",
      ".ps1",
      ".vbe",
      ".vbs",
      ".wsf",
      ".wsh"
    ]
  },
  "condition": "1 of selection_parent_* and selection_child"
}

References:
  - https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
  - https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
Sigma Detection Rule: Diskshadow Child Process Spawned
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Harjot Singh @cyb3rjy0t
Date: 2023-09-15
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\diskshadow.exe"
  },
  "filter_main_werfault": {
    "Image|endswith": ":\\Windows\\System32\\WerFault.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow