deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Powercfg Execution To Change Lock Screen Timeout
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-11-18
Log source: windows/process_creation

Description:
Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout

Detection logic:
{
  "selection_power": [
    {
      "Image|endswith": "\\powercfg.exe"
    },
    {
      "OriginalFileName": "PowerCfg.exe"
    }
  ],
  "selection_standby": [
    {
      "CommandLine|contains|all": [
        "/setacvalueindex ",
        "SCHEME_CURRENT",
        "SUB_VIDEO",
        "VIDEOCONLOCK"
      ]
    },
    {
      "CommandLine|contains|all": [
        "-change ",
        "-standby-timeout-"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options
Sigma Detection Rule: Arbitrary File Download Via MSEDGE_PROXY.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-11-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of "msedge_proxy.exe" to download arbitrary files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\msedge_proxy.exe"
    },
    {
      "OriginalFileName": "msedge_proxy.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/msedge_proxy/
Sigma Detection Rule: PowerShell Base64 Encoded IEX Cmdlet
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-08-23
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects usage of a base64 encoded "IEX" cmdlet in a process command line

Detection logic:
{
  "selection": [
    {
      "CommandLine|base64offset|contains": [
        "IEX ([",
        "iex ([",
        "iex (New",
        "IEX (New",
        "IEX([",
        "iex([",
        "iex(New",
        "IEX(New",
        "IEX(('",
        "iex(('"
      ]
    },
    {
      "CommandLine|contains": [
        "SQBFAFgAIAAoAFsA",
        "kARQBYACAAKABbA",
        "JAEUAWAAgACgAWw",
        "aQBlAHgAIAAoAFsA",
        "kAZQB4ACAAKABbA",
        "pAGUAeAAgACgAWw",
        "aQBlAHgAIAAoAE4AZQB3A",
        "kAZQB4ACAAKABOAGUAdw",
        "pAGUAeAAgACgATgBlAHcA",
        "SQBFAFgAIAAoAE4AZQB3A",
        "kARQBYACAAKABOAGUAdw",
        "JAEUAWAAgACgATgBlAHcA"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: UAC Bypass Using NTFS Reparse Point - Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Detection logic:
{
  "selection1": {
    "CommandLine|startswith": "\"C:\\Windows\\system32\\wusa.exe\"  /quiet C:\\Users\\",
    "CommandLine|endswith": "\\AppData\\Local\\Temp\\update.msu",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "selection2": {
    "ParentCommandLine": "\"C:\\Windows\\system32\\dism.exe\" /online /quiet /norestart /add-package /packagepath:\"C:\\Windows\\system32\\pe386\" /ignorecheck",
    "IntegrityLevel": [
      "High",
      "System"
    ],
    "CommandLine|contains|all": [
      "C:\\Users\\",
      "\\AppData\\Local\\Temp\\",
      "\\dismhost.exe {"
    ],
    "Image|endswith": "\\DismHost.exe"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Regsvr32 Execution From Potential Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-26
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
Sigma Detection Rule: Potential Suspicious Registry File Imported Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-01
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " import "
  },
  "selection_paths": {
    "CommandLine|contains": [
      "C:\\Users\\",
      "%temp%",
      "%tmp%",
      "%appdata%",
      "\\AppData\\Local\\Temp\\",
      "C:\\Windows\\Temp\\",
      "C:\\ProgramData\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import
Sigma Detection Rule: Powershell Defender Exclusion
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-04-29
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects requests to exclude files, folders or processes from Antivirus scanning using PowerShell cmdlets

Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "Add-MpPreference ",
      "Set-MpPreference "
    ]
  },
  "selection2": {
    "CommandLine|contains": [
      " -ExclusionPath ",
      " -ExclusionExtension ",
      " -ExclusionProcess ",
      " -ExclusionIpAddress "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://twitter.com/AdamTheAnalyst/status/[PII_REDACTED]19590403
Sigma Detection Rule: Suspicious Schtasks Schedule Types
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects scheduled task creations or modification on a suspicious schedule type

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_time": {
    "CommandLine|contains": [
      " ONLOGON ",
      " ONSTART ",
      " ONCE ",
      " ONIDLE "
    ]
  },
  "filter_privs": {
    "CommandLine|contains": [
      "NT AUT",
      " SYSTEM",
      "HIGHEST"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Sigma Detection Rule: PowerShell Script Run in AppData
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2019-01-09
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "powershell.exe",
      "\\powershell",
      "\\pwsh",
      "pwsh.exe"
    ]
  },
  "selection2": {
    "CommandLine|contains|all": [
      "/c ",
      "\\AppData\\"
    ],
    "CommandLine|contains": [
      "Local\\",
      "Roaming\\"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]81288706
  - https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03
Sigma Detection Rule: Base64 MZ Header In CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
Log source: windows/process_creation

Description:
Detects encoded base64 MZ header in the commandline

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "TVqQAAMAAAAEAAAA",
      "TVpQAAIAAAAEAA8A",
      "TVqAAAEAAAAEABAA",
      "TVoAAAAAAAAAAAAA",
      "TVpTAQEAAAAEAAAA"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Sigma Detection Rule: HackTool - EDRSilencer Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @gott_cyber
Date: 2024-01-02
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the execution of EDRSilencer, a tool that leverages Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server based on PE metadata information.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\EDRSilencer.exe"
    },
    {
      "OriginalFileName": "EDRSilencer.exe"
    },
    {
      "Description|contains": "EDRSilencer"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/netero1010/EDRSilencer
Sigma Detection Rule: Suspicious Splwow64 Without Params
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects suspicious Splwow64.exe process without any command line parameters

Detection logic:
{
  "selection": {
    "Image|endswith": "\\splwow64.exe",
    "CommandLine|endswith": "splwow64.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]29891590?s=12
Sigma Detection Rule: Exports Critical Registry Keys To a File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Oddvar Moe, Sander Wiebing, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1012
Log source: windows/process_creation

Description:
Detects the export of a crital Registry key to a file.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regedit.exe"
    },
    {
      "OriginalFileName": "REGEDIT.EXE"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains|windash": " -E "
  },
  "selection_cli_2": {
    "CommandLine|contains": [
      "hklm",
      "hkey_local_machine"
    ]
  },
  "selection_cli_3": {
    "CommandLine|endswith": [
      "\\system",
      "\\sam",
      "\\security"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: Execute From Alternate Data Streams
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-09-01
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

Detection logic:
{
  "selection_stream": {
    "CommandLine|contains": "txt:"
  },
  "selection_tools_type": {
    "CommandLine|contains|all": [
      "type ",
      " > "
    ]
  },
  "selection_tools_makecab": {
    "CommandLine|contains|all": [
      "makecab ",
      ".cab"
    ]
  },
  "selection_tools_reg": {
    "CommandLine|contains|all": [
      "reg ",
      " export "
    ]
  },
  "selection_tools_regedit": {
    "CommandLine|contains|all": [
      "regedit ",
      " /E "
    ]
  },
  "selection_tools_esentutl": {
    "CommandLine|contains|all": [
      "esentutl ",
      " /y ",
      " /d ",
      " /o "
    ]
  },
  "condition": "selection_stream and (1 of selection_tools_*)"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
Sigma Detection Rule: Windows Credential Guard Registry Tampering Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-26
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell.
Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags.
Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\reg.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "reg.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "add ",
      "New-ItemProperty ",
      "Set-ItemProperty ",
      "si ",
      "delete ",
      "del ",
      "Remove-ItemProperty ",
      "rp "
    ]
  },
  "selection_key_base": {
    "CommandLine|contains": [
      "\\Control\\DeviceGuard",
      "\\Control\\LSA",
      "Software\\Policies\\Microsoft\\Windows\\DeviceGuard"
    ]
  },
  "selection_key_specific": {
    "CommandLine|contains": [
      "EnableVirtualizationBasedSecurity",
      "RequirePlatformSecurityFeatures",
      "LsaCfgFlags"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://woshub.com/disable-credential-guard-windows/
  - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard
Sigma Detection Rule: Weak or Abused Passwords In CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-14
Log source: windows/process_creation

Description:
Detects weak passwords or often abused passwords (seen used by threat actors) via the CLI.
An example would be a threat actor creating a new user via the net command and providing the password inline


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "123456789",
      "123123qwE",
      "Asd123.aaaa",
      "Decryptme",
      "P@ssw0rd!",
      "Pass8080",
      "password123",
      "test@202"
    ]
  },
  "condition": "selection"
}

References:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
  - https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Sigma Detection Rule: File Deletion Via Del
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-15
ATT&CK techniques: T1070.004
Log source: windows/process_creation

Description:
Detects execution of the builtin "del"/"erase" commands in order to delete files.
Adversaries may delete files left behind by the actions of their intrusion activity.
Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how.
Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_del": {
    "CommandLine|contains": [
      "del ",
      "erase "
    ]
  },
  "selection_flags": {
    "CommandLine|contains|windash": [
      " -f",
      " -s",
      " -q"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
Sigma Detection Rule: Notepad Password Files Discovery
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: The DFIR Report
Date: 2025-02-21
ATT&CK techniques: T1083
Log source: windows/process_creation

Description:
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\explorer.exe",
    "Image|endswith": "\\notepad.exe",
    "CommandLine|endswith": [
      "password*.txt",
      "password*.csv",
      "password*.doc",
      "password*.xls"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
  - https://intel.thedfirreport.com/eventReports/view/57
Sigma Detection Rule: Odbcconf.EXE Suspicious DLL Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" where the path of the DLL being registered is located in a potentially suspicious location.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      ":\\PerfLogs\\",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Registration\\CRMLog",
      ":\\Windows\\System32\\com\\dmp\\",
      ":\\Windows\\System32\\FxsTmp\\",
      ":\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\",
      ":\\Windows\\System32\\spool\\drivers\\color\\",
      ":\\Windows\\System32\\spool\\PRINTERS\\",
      ":\\Windows\\System32\\spool\\SERVERS\\",
      ":\\Windows\\System32\\Tasks_Migrated\\",
      ":\\Windows\\System32\\Tasks\\Microsoft\\Windows\\SyncCenter\\",
      ":\\Windows\\SysWOW64\\com\\dmp\\",
      ":\\Windows\\SysWOW64\\FxsTmp\\",
      ":\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\",
      ":\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\SyncCenter\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      ":\\Windows\\Tracing\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
  - https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/
Sigma Detection Rule: RDP Enable or Disable via Win32_TerminalServiceSetting WMI Class
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Daniel Koifman (KoifSec), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-15
ATT&CK techniques: T1021.001, T1047
Log source: windows/process_creation

Description:
Detects enabling or disabling of Remote Desktop Protocol (RDP) using alternate methods such as WMIC or PowerShell.
In PowerShell one-liner commands, the "SetAllowTSConnections" method of the "Win32_TerminalServiceSetting" class may be used to enable or disable RDP.
In WMIC, the "rdtoggle" alias or "Win32_TerminalServiceSetting" class may be used for the same purpose.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\wmic.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "wmic.exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_method": {
    "CommandLine|contains": [
      "rdtoggle",
      "Win32_TerminalServiceSetting"
    ]
  },
  "selection_cli_property": {
    "CommandLine|contains": "SetAllowTSConnections"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
  - https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
  - https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468
Sigma Detection Rule: HackTool - Empire PowerShell UAC Bypass
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Ecco
Date: 2019-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects some Empire PowerShell UAC bypass methods

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      " -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update)",
      " -NoP -NonI -c $x=$((gp HKCU:Software\\Microsoft\\Windows Update).Update);"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64
Sigma Detection Rule: Unusual Parent Process For Cmd.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-21
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects suspicious parent process for cmd.exe

Detection logic:
{
  "selection": {
    "Image|endswith": "\\cmd.exe",
    "ParentImage|endswith": [
      "\\csrss.exe",
      "\\ctfmon.exe",
      "\\dllhost.exe",
      "\\epad.exe",
      "\\FlashPlayerUpdateService.exe",
      "\\GoogleUpdate.exe",
      "\\jucheck.exe",
      "\\jusched.exe",
      "\\LogonUI.exe",
      "\\lsass.exe",
      "\\regsvr32.exe",
      "\\SearchIndexer.exe",
      "\\SearchProtocolHost.exe",
      "\\SIHClient.exe",
      "\\sihost.exe",
      "\\slui.exe",
      "\\spoolsv.exe",
      "\\sppsvc.exe",
      "\\taskhostw.exe",
      "\\unsecapp.exe",
      "\\WerFault.exe",
      "\\wermgr.exe",
      "\\wlanext.exe",
      "\\WUDFHost.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/current/unusual-parent-process-for-cmd.exe.html