deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Turla Group Lateral Movement
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Markus Neis
Date: 2017-11-07
ATT&CK techniques: T1059, T1021.002, T1083, T1135
Log source: windows/process_creation

Description:
Detects automated lateral movement by Turla group

Detection logic:
{
  "selection": {
    "CommandLine": [
      "net use \\\\\\\\%DomainController%\\C$ \"P@ssw0rd\" *",
      "dir c:\\\\*.doc* /s",
      "dir %TEMP%\\\\*.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/the-epic-turla-operation/65545/
Sigma Detection Rule: ZxShell Malware
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
Date: 2017-07-20
ATT&CK techniques: T1059.003, T1218.011
Log source: windows/process_creation

Description:
Detects a ZxShell start by the called and well-known function name

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      "zxFunction",
      "RemoteDiskXXXXX"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/5d2a4cde9fa7c2fdbf39b2e2ffd23378d0c50701a3095d1e91e3cf922d7b0b16?environmentId=100
  - https://pub-7cb8ac806c1b4c4383e585c474a24719.r2.dev/116309e7121bc8b0e66e4166c06f7b818e1d3629.pdf
Sigma Detection Rule: CVE-2010-5278 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Subhash Popuri (@pbssubhash)
Date: 2021-08-25
ATT&CK techniques: T1190
Log source: /webserver

Description:
MODx manager - Local File Inclusion:Directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl, and possibly earlier,
when magic_quotes_gpc is disabled, allows remote attackers to read arbitrary files via a .. (dot dot) in the class_key parameter.


Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "/manager/controllers/default/resource/tvs.php?class_key=../../../../../../../../../../windows/win.ini%00"
  },
  "condition": "selection"
}

References:
  - https://github.com/projectdiscovery/nuclei-templates
Sigma Detection Rule: Exploit for CVE-2015-1641
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2018-02-22
ATT&CK techniques: T1036.005
Log source: windows/process_creation

Description:
Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\WINWORD.EXE",
    "Image|endswith": "\\MicroScMgmt.exe"
  },
  "condition": "selection"
}

References:
  - https://www.virustotal.com/en/file/[PII_REDACTED]b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8/analysis/
  - https://www.hybrid-analysis.com/sample/[PII_REDACTED]b744c4e846ba8ae726883cb15268a539f3bb21758a466e47021ae8?environmentId=100
Sigma Detection Rule: Elise Backdoor Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2018-01-31
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detects Elise backdoor activity used by APT32

Detection logic:
{
  "selection_other_svchost": {
    "Image|endswith": "\\Microsoft\\Network\\svchost.exe"
  },
  "selection_other_del": {
    "CommandLine|contains|all": [
      "\\Windows\\Caches\\NavShExt.dll",
      "/c del"
    ]
  },
  "selection_dll_path": {
    "CommandLine|endswith": [
      "\\AppData\\Roaming\\MICROS~1\\Windows\\Caches\\NavShExt.dll",
      "\\AppData\\Roaming\\Microsoft\\Windows\\Caches\\NavShExt.dll"
    ]
  },
  "selection_dll_function": {
    "CommandLine|contains": ",Setting"
  },
  "condition": "1 of selection_other_* or all of selection_dll_*"
}

References:
  - https://community.rsa.com/community/products/netwitness/blog/2018/02/13/lotus-blossom-continues-asean-targeting
  - https://web.archive.org/web/[PII_REDACTED]3912/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf
Sigma Detection Rule: Oracle WebLogic Exploit
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-07-22
ATT&CK techniques: T1190, T1505.003
Log source: /webserver

Description:
Detects access to a webshell dropped into a keystore folder on the WebLogic server

Detection logic:
{
  "selection": {
    "cs-uri-query": "*/config/keystore/*.js*"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/pyn3rd/status/[PII_REDACTED]67223296
  - https://github.com/LandGrey/CVE-2018-2894
Sigma Detection Rule: Fortinet CVE-2018-13379 Exploitation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj
Date: 2020-12-08
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects CVE-2018-13379 exploitation attempt against Fortinet SSL VPNs

Detection logic:
{
  "selection": {
    "cs-uri-query|contains|all": [
      "lang=/../../",
      "/dev/cmdb/sslvpn_websession"
    ]
  },
  "condition": "selection"
}

References:
  - https://devco.re/blog/2019/08/09/attacking-ssl-vpn-part-2-breaking-the-Fortigate-ssl-vpn/
Sigma Detection Rule: SSHD Error Message CVE-2018-15473
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-08-24
ATT&CK techniques: T1589
Log source: linux/

Description:
Detects exploitation attempt using public exploit code for CVE-2018-15473

Detection logic:
{
  "keywords": [
    "error: buffer_get_ret: trying to get more bytes 1907 than in buffer 308 [preauth]"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/Rhynorater/CVE-2018-15473-Exploit
Sigma Detection Rule: Sofacy Trojan Loader Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2018-03-01
ATT&CK techniques: T1059.003, T1218.011
Log source: windows/process_creation

Description:
Detects Trojan loader activity as used by APT28

Detection logic:
{
  "selection_path": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      "%LOCALAPPDATA%",
      "\\AppData\\Local\\"
    ]
  },
  "selection_extensions": [
    {
      "CommandLine|contains": ".dat\","
    },
    {
      "CommandLine|endswith": [
        ".dll #1",
        ".dll\" #1",
        ".dll\",#1"
      ]
    }
  ],
  "filter_main_exclude_temp": {
    "CommandLine|contains": "\\AppData\\Local\\Temp\\"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/
  - https://www.hybrid-analysis.com/sample/ff808d0a12676bfac88fd26f955154f8884f2bb7c534b9936510fd6296c543e8?environmentId=110
  - https://twitter.com/ClearskySec/status/[PII_REDACTED]55369472
Sigma Detection Rule: Potential MuddyWater APT Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-10
Log source: windows/process_creation

Description:
Detects potential Muddywater APT activity

Detection logic:
{
  "selection_mshta": {
    "CommandLine|contains|all": [
      "vbscript:Close(Execute(\"CreateObject(",
      "powershell",
      "-w 1 -exec Bypass",
      "\\ProgramData\\"
    ]
  },
  "selection_survey": {
    "CommandLine|contains|all": [
      "Win32_OperatingSystem",
      "Win32_NetworkAdapterConfiguration",
      "root\\SecurityCenter2",
      "[System.Net.DNS]"
    ]
  },
  "selection_pwsh_backdoor": {
    "CommandLine|contains|all": [
      "[Convert]::ToBase64String",
      "[System.Text.Encoding]::UTF8.GetString]",
      "GetResponse().GetResponseStream()",
      "[System.Net.HttpWebRequest]::Create(",
      "-bxor "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.mandiant.com/resources/blog/iranian-threat-group-updates-ttps-in-spear-phishing-campaign
Sigma Detection Rule: OceanLotus Registry Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: megan201296, Jonhnathan Ribeiro
Date: 2019-04-14
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Detects registry keys created in OceanLotus (also known as APT32) attacks

Detection logic:
{
  "selection_clsid": {
    "TargetObject|contains": "\\SOFTWARE\\Classes\\CLSID\\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\\Model"
  },
  "selection_hkcu": {
    "TargetObject|contains": [
      "Classes\\AppXc52346ec40fb4061ad96be0e6cb7d16a\\",
      "Classes\\AppX3bbba44c6cae4d[PII_REDACTED]472171e2\\",
      "Classes\\CLSID\\{E3517E26-8E93-458D-A6DF-8030BC80528B}\\",
      "Classes\\CLSID\\{E08A0F4B-1F65-4D4D-9A09-BD4625B9C5A1}\\Model"
    ]
  },
  "selection_appx_1": {
    "TargetObject|contains": "\\SOFTWARE\\App\\"
  },
  "selection_appx_2": {
    "TargetObject|contains": [
      "AppXbf13d4ea2945444d8b13e2121cb6b663\\",
      "AppX70162486c7554f7f80f481985d67586d\\",
      "AppX37cc7fdccd644b4f85f4b22d5a3f105a\\"
    ],
    "TargetObject|endswith": [
      "Application",
      "DefaultIcon"
    ]
  },
  "condition": "selection_clsid or selection_hkcu or all of selection_appx_*"
}

References:
  - https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/
  - https://github.com/eset/malware-ioc/tree/master/oceanlotus
Sigma Detection Rule: TropicTrooper Campaign November 2018
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: @41thexplorer, Microsoft Defender ATP
Date: 2019-11-12
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

Detection logic:
{
  "selection": {
    "CommandLine|contains": "abCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCc"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/
Sigma Detection Rule: APT29 2018 Phishing Campaign File Indicators
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: @41thexplorer
Date: 2018-11-20
ATT&CK techniques: T1218.011
Log source: windows/file_event

Description:
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "ds7002.lnk",
      "ds7002.pdf",
      "ds7002.zip"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/DrunkBinary/status/[PII_REDACTED]80886529
  - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
Sigma Detection Rule: APT29 2018 Phishing Campaign CommandLine Indicators
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems), @41thexplorer
Date: 2018-11-20
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects indicators of APT 29 (Cozy Bear) phishing-campaign as reported by mandiant

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains": "-noni -ep bypass $"
    },
    {
      "CommandLine|contains|all": [
        "cyzfc.dat,",
        "PointFunctionCall"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://twitter.com/DrunkBinary/status/[PII_REDACTED]80886529
  - https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/
  - https://www.mandiant.com/resources/blog/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign
Sigma Detection Rule: Defrag Deactivation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
Date: 2019-03-04
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Detection logic:
{
  "selection": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": [
      "/delete",
      "/change"
    ],
    "CommandLine|contains|all": [
      "/TN",
      "\\Microsoft\\Windows\\Defrag\\ScheduledDefrag"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/apt-slingshot/84312/
Sigma Detection Rule: Defrag Deactivation - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Bartlomiej Czyz (@bczyz1)
Date: 2019-03-04
ATT&CK techniques: T1053
Log source: windows/

Description:
Detects the deactivation and disabling of the Scheduled defragmentation task as seen by Slingshot APT group

Detection logic:
{
  "selection": {
    "EventID": 4701,
    "TaskName": "\\Microsoft\\Windows\\Defrag\\ScheduledDefrag"
  },
  "condition": "selection"
}

References:
  - https://securelist.com/apt-slingshot/84312/
Sigma Detection Rule: APT27 - Emissary Panda Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-09-03
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27

Detection logic:
{
  "selection_sllauncher": {
    "ParentImage|endswith": "\\sllauncher.exe",
    "Image|endswith": "\\svchost.exe"
  },
  "selection_svchost": {
    "ParentImage|contains": "\\AppData\\Roaming\\",
    "Image|endswith": "\\svchost.exe",
    "CommandLine|contains": "-k"
  },
  "condition": "1 of selection_*"
}

References:
  - https://app.any.run/tasks/579e7587-f09d-4aae-8b07[PII_REDACTED]65
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]31132929
  - https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/
Sigma Detection Rule: OilRig APT Schedule Task Persistence - Security
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2018-03-23
ATT&CK techniques: T1053.005, T1543.003, T1112, T1071.004
Log source: windows/

Description:
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Detection logic:
{
  "selection_service": {
    "EventID": 4698,
    "TaskName": [
      "SC Scheduled Scan",
      "UpdatMachine"
    ]
  },
  "condition": "selection_service"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf
Sigma Detection Rule: OilRig APT Registry Persistence
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2018-03-23
ATT&CK techniques: T1053.005, T1543.003, T1112, T1071.004
Log source: windows/registry_event

Description:
Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UMe",
      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\UT"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf
Sigma Detection Rule: OilRig APT Schedule Task Persistence - System
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2018-03-23
ATT&CK techniques: T1053.005, T1543.003, T1112, T1071.004
Log source: windows/

Description:
Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": [
      "SC Scheduled Scan",
      "UpdatMachine"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf
Sigma Detection Rule: OilRig APT Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2018-03-23
ATT&CK techniques: T1053.005, T1543.003, T1112, T1071.004
Log source: windows/process_creation

Description:
Detects OilRig activity as reported by Nyotron in their March 2018 report

Detection logic:
{
  "selection_schtasks": {
    "CommandLine|contains|all": [
      "SC Scheduled Scan",
      "\\microsoft\\Taskbar\\autoit3.exe"
    ]
  },
  "selection_temp": {
    "Image|contains": "\\Windows\\Temp\\DB\\",
    "Image|endswith": ".exe"
  },
  "selection_service": {
    "Image": "C:\\Windows\\system32\\Service.exe",
    "CommandLine|contains": [
      "i",
      "u"
    ]
  },
  "selection_autoit": {
    "ParentImage|endswith": "\\local\\microsoft\\Taskbar\\autoit3.exe",
    "CommandLine|contains|all": [
      "nslookup.exe",
      "-q=TXT"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4442/https://nyotron.com/wp-content/uploads/2018/03/Nyotron-OilRig-Malware-Report-March-2018C.pdf
Sigma Detection Rule: Potential Snatch Ransomware Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2020-08-26
ATT&CK techniques: T1204
Log source: windows/process_creation

Description:
Detects specific process characteristics of Snatch ransomware word document droppers

Detection logic:
{
  "selection": [
    {
      "CommandLine|re": "shutdown\\s+/r /f /t 00"
    },
    {
      "CommandLine|re": "net\\s+stop SuperBackupMan"
    }
  ],
  "condition": "selection"
}

References:
  - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
Sigma Detection Rule: Potential Emotet Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2019-09-30
ATT&CK techniques: T1059.001, T1027
Log source: windows/process_creation

Description:
Detects all Emotet like process executions that are not covered by the more generic rules

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      " -e* PAA",
      "JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ",
      "QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA",
      "kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA",
      "IgAoACcAKgAnACkAOwAkA",
      "IAKAAnACoAJwApADsAJA",
      "iACgAJwAqACcAKQA7ACQA",
      "JABGAGwAeAByAGgAYwBmAGQ",
      "PQAkAGUAbgB2ADoAdABlAG0AcAArACgA",
      "0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA",
      "9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA"
    ]
  },
  "filter": {
    "CommandLine|contains": [
      "fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ",
      "wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA",
      "8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
  - https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
  - https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
  - https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/
Sigma Detection Rule: Chafer Malware URL Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-01-31
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects HTTP request used by Chafer malware to receive data from its C2.

Detection logic:
{
  "selection": {
    "c-uri|contains": "/asp.asp\\?ui="
  },
  "condition": "selection"
}

References:
  - https://securelist.com/chafer-used-remexi-malware/89538/
Sigma Detection Rule: Potential Baby Shark Malware Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-02-24
ATT&CK techniques: T1012, T1059.003, T1059.001, T1218.005
Log source: windows/process_creation

Description:
Detects activity that could be related to Baby Shark malware

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains|all": [
        "powershell.exe mshta.exe http",
        ".hta"
      ]
    },
    {
      "CommandLine|contains": [
        "reg query \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\"",
        "cmd.exe /c taskkill /im cmd.exe",
        "(New-Object System.Net.WebClient).UploadFile('http"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
Sigma Detection Rule: Potential QBot Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2019-10-01
ATT&CK techniques: T1059.005
Log source: windows/process_creation

Description:
Detects potential QBot activity by looking for process executions used previously by QBot

Detection logic:
{
  "selection1": {
    "ParentImage|endswith": "\\WinRAR.exe",
    "Image|endswith": "\\wscript.exe"
  },
  "selection2": {
    "CommandLine|contains": " /c ping.exe -n 6 127.0.0.1 & type "
  },
  "selection3": {
    "CommandLine|contains|all": [
      "regsvr32.exe",
      "C:\\ProgramData",
      ".tmp"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/killamjr/status/[PII_REDACTED]32315648
  - https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/
Sigma Detection Rule: Potential Ryuk Ransomware Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-12-16
ATT&CK techniques: T1547.001
Log source: windows/process_creation

Description:
Detects Ryuk ransomware activity

Detection logic:
{
  "selection_reg": {
    "CommandLine|contains|all": [
      "Microsoft\\Windows\\CurrentVersion\\Run",
      "C:\\users\\Public\\"
    ]
  },
  "selection_del": {
    "CommandLine|contains|all": [
      "del /s /f /q c:\\",
      "\\*.bac",
      "\\*.bak",
      "\\*.bkf"
    ]
  },
  "selection_net": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains|all": [
      " stop ",
      " /y"
    ],
    "CommandLine|contains": [
      "samss",
      "audioendpointbuilder",
      "unistoresvc_",
      "AcrSch2Svc"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
  - https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/