deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Service Installation in Suspicious Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-03-18
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects service installation in suspicious folder appdata

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains": [
      "\\AppData\\",
      "\\\\\\\\127.0.0.1",
      "\\\\\\\\localhost"
    ]
  },
  "filter_optional_zoom": {
    "ServiceName": "Zoom Sharing Service",
    "ImagePath|contains": ":\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - Internal Research
Sigma Detection Rule: Anydesk Remote Access Software Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-08-11
Log source: windows/

Description:
Detects the installation of the anydesk software service. Which could be an indication of anydesk abuse if you the software isn't already used.

Detection logic:
{
  "selection_provider": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ServiceName|contains|all": [
        "AnyDesk",
        "Service"
      ]
    },
    {
      "ImagePath|contains": "AnyDesk"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
Sigma Detection Rule: smbexec.py Service Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Omer Faruk Celik
Date: 2018-03-20
ATT&CK techniques: T1021.002, T1569.002
Log source: windows/

Description:
Detects the use of smbexec.py tool by detecting a specific service installation

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service_name": {
    "ServiceName": "BTOBTO"
  },
  "selection_service_image": {
    "ImagePath|contains": [
      ".bat & del ",
      "__output 2^>^&1 >"
    ]
  },
  "condition": "selection_eid and 1 of selection_service_*"
}

References:
  - https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/
  - https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296
  - https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60
Sigma Detection Rule: Invoke-Obfuscation Via Stdin - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via Stdin in Scripts

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "set",
      "&&"
    ],
    "ImagePath|contains": [
      "environment",
      "invoke",
      "input"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: New PDQDeploy Service - Client Side
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-22
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects PDQDeploy service installation on the target system.
When a package is deployed via PDQDeploy it installs a remote service on the target machine with the name "PDQDeployRunner-X" where "X" is an integer starting from 1


Detection logic:
{
  "selection_root": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ImagePath|contains": "PDQDeployRunner-"
    },
    {
      "ServiceName|startswith": "PDQDeployRunner-"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
Sigma Detection Rule: Moriya Rootkit - System
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj
Date: 2021-05-06
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": "ZzNetSvc"
  },
  "condition": "selection"
}

References:
  - https://securelist.com/operation-tunnelsnake-and-moriya-rootkit/101831
Sigma Detection Rule: PowerShell Scripts Installed as Services
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects powershell script installed as a Service

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains": [
      "powershell",
      "pwsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: CSExec Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-07
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects CSExec service installation and execution events

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ServiceName": "csexecsvc"
    },
    {
      "ImagePath|endswith": "\\csexecsvc.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/malcomvetter/CSExec
Sigma Detection Rule: Suspicious Service Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-03-18
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects suspicious service installation commands

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains": [
      " -nop ",
      " -sta ",
      " -w hidden ",
      ":\\Temp\\",
      ".downloadfile(",
      ".downloadstring(",
      "\\ADMIN$\\",
      "\\Perflogs\\",
      "&&"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: KrbRelayUp Service Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sittikorn S, Tim Shelton
Date: 2022-05-11
ATT&CK techniques: T1543
Log source: windows/

Description:
Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings)

Detection logic:
{
  "selection": {
    "EventID": 7045,
    "ServiceName": "KrbSCM"
  },
  "condition": "selection"
}

References:
  - https://github.com/Dec0ne/KrbRelayUp
Sigma Detection Rule: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via VAR++ LAUNCHER

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "&&set",
      "cmd",
      "/c",
      "-f"
    ],
    "ImagePath|contains": [
      "{0}",
      "{1}",
      "{2}",
      "{3}",
      "{4}",
      "{5}"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation COMPRESS OBFUSCATION - System
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "new-object",
      "text.encoding]::ascii",
      "readtoend"
    ],
    "ImagePath|contains": [
      ":system.io.compression.deflatestream",
      "system.io.streamreader"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Credential Dumping Tools Service Execution - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
Date: 2017-03-05
ATT&CK techniques: T1003.001, T1003.002, T1003.004, T1003.005, T1003.006, T1569.002
Log source: windows/

Description:
Detects well-known credential dumping tools execution via service execution events

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains": [
      "cachedump",
      "dumpsvc",
      "fgexec",
      "gsecdump",
      "mimidrv",
      "pwdump",
      "servpw"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: HackTool Service Registration or Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-21
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects installation or execution of services

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": [
      7045,
      7036
    ]
  },
  "selection_service_name": {
    "ServiceName|contains": [
      "cachedump",
      "DumpSvc",
      "gsecdump",
      "pwdump",
      "UACBypassedService",
      "WCE SERVICE",
      "WCESERVICE",
      "winexesvc"
    ]
  },
  "selection_service_image": {
    "ImagePath|contains": "bypass"
  },
  "condition": "selection_eid and 1 of selection_service_*"
}

References:
  - Internal Research
Sigma Detection Rule: Tap Driver Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1048
Log source: windows/

Description:
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains": "tap0901"
  },
  "condition": "selection"
}

References:
  - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
Sigma Detection Rule: Critical Hive In Suspicious Location Access Bits Cleared
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-15
ATT&CK techniques: T1003.002
Log source: windows/

Description:
Detects events from the Kernel-General ETW indicating that the access bits of a hive with a system like hive name located in the temp directory have been reset.
This occurs when an application tries to access a hive and the hive has not be recognized since the last 7 days (by default).
Registry hive dumping utilities such as QuarksPwDump were seen emitting this behavior.


Detection logic:
{
  "selection": {
    "EventID": 16,
    "Provider_Name": "Microsoft-Windows-Kernel-General",
    "HiveName|contains": [
      "\\Temp\\SAM",
      "\\Temp\\SECURITY"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/Misc-Research/blob/b20da2336de0f342d31ef4794959d28c8d3ba5ba/ETW/Microsoft-Windows-Kernel-General.md
Sigma Detection Rule: Backup Catalog Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)
Date: 2017-05-12
ATT&CK techniques: T1070.004
Log source: windows/

Description:
Detects backup catalog deletions

Detection logic:
{
  "selection": {
    "EventID": 524,
    "Provider_Name": "Microsoft-Windows-Backup"
  },
  "condition": "selection"
}

References:
  - https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f[PII_REDACTED]80439c6e5babe8e080e41aa?environmentId=100
Sigma Detection Rule: Relevant Anti-Virus Signature Keywords In Application Log
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2017-02-19
ATT&CK techniques: T1588
Log source: windows/

Description:
Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.


Detection logic:
{
  "keywords": [
    "Adfind",
    "ASP/BackDoor ",
    "ATK/",
    "Backdoor.ASP",
    "Backdoor.Cobalt",
    "Backdoor.JSP",
    "Backdoor.PHP",
    "Blackworm",
    "Brutel",
    "BruteR",
    "Chopper",
    "Cobalt",
    "COBEACON",
    "Cometer",
    "CRYPTES",
    "Cryptor",
    "Destructor",
    "DumpCreds",
    "Exploit.Script.CVE",
    "FastReverseProxy",
    "Filecoder",
    "GrandCrab ",
    "HackTool",
    "HKTL",
    "HTool-",
    "/HTool",
    ".HTool",
    "IISExchgSpawnCMD",
    "Impacket",
    "JSP/BackDoor ",
    "Keylogger",
    "Koadic",
    "Krypt",
    "Lazagne",
    "Metasploit",
    "Meterpreter",
    "MeteTool",
    "mikatz",
    "Mimikatz",
    "Mpreter",
    "MsfShell",
    "Nighthawk",
    "Packed.Generic.347",
    "PentestPowerShell",
    "Phobos",
    "PHP/BackDoor ",
    "Potato",
    "PowerSploit",
    "PowerSSH",
    "PshlSpy",
    "PSWTool",
    "PWCrack",
    "PWDump",
    "Ransom",
    "Rozena",
    "Ryzerlo",
    "Sbelt",
    "Seatbelt",
    "SecurityTool ",
    "SharpDump",
    "Shellcode",
    "Sliver",
    "Splinter",
    "Swrort",
    "Tescrypt",
    "TeslaCrypt",
    "TurtleLoader",
    "Valyria",
    "Webshell"
  ],
  "filter_optional_generic": [
    "anti_ransomware_service.exe",
    "Anti-Ransomware",
    "Crack",
    "cyber-protect-service.exe",
    "encryptor",
    "Keygen"
  ],
  "filter_optional_information": {
    "Level": 4
  },
  "filter_optional_restartmanager": {
    "Provider_Name": "Microsoft-Windows-RestartManager"
  }

References:
  - https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31
  - https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed
  - https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01
  - https://www.nextron-systems.com/?s=antivirus
Sigma Detection Rule: Atera Agent Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-09-01
ATT&CK techniques: T1219.002
Log source: windows/

Description:
Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators

Detection logic:
{
  "selection": {
    "EventID": 1033,
    "Provider_Name": "MsiInstaller",
    "Message|contains": "AteraAgent"
  },
  "condition": "selection"
}

References:
  - https://www.advintel.io/post/secret-backdoor-behind-conti-ransomware-operation-introducing-atera-agent
Sigma Detection Rule: Application Uninstalled
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-28
ATT&CK techniques: T1489
Log source: windows/

Description:
An application has been removed. Check if it is critical.

Detection logic:
{
  "selection": {
    "Provider_Name": "MsiInstaller",
    "EventID": [
      1034,
      11724
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/Microsoft-Windows-MsiServer.xml
  - https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
Sigma Detection Rule: MSI Installation From Web
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Stamatis Chatzimangou
Date: 2022-10-23
ATT&CK techniques: T1218, T1218.007
Log source: windows/

Description:
Detects installation of a remote msi file from web.

Detection logic:
{
  "selection": {
    "Provider_Name": "MsiInstaller",
    "EventID": [
      1040,
      1042
    ],
    "Data|contains": "://"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/_st0pp3r_/status/[PII_REDACTED]42802689
Sigma Detection Rule: MSI Installation From Suspicious Locations
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-31
Log source: windows/

Description:
Detects MSI package installation from suspicious locations

Detection logic:
{
  "selection": {
    "Provider_Name": "MsiInstaller",
    "EventID": [
      1040,
      1042
    ],
    "Data|contains": [
      ":\\Windows\\TEMP\\",
      "\\\\\\\\",
      "\\Desktop\\",
      "\\PerfLogs\\",
      "\\Users\\Public\\"
    ]
  },
  "filter_winget": {
    "Data|contains": "\\AppData\\Local\\Temp\\WinGet\\"
  },
  "filter_updhealthtools": {
    "Data|contains": "C:\\Windows\\TEMP\\UpdHealthTools.msi"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html
Sigma Detection Rule: Audit CVE Event
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Zach Mathis
Date: 2020-01-15
ATT&CK techniques: T1203, T1068, T1211, T1212, T1210, T1499.004
Log source: windows/

Description:
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.


Detection logic:
{
  "selection": {
    "Provider_Name": [
      "Microsoft-Windows-Audit-CVE",
      "Audit-CVE"
    ],
    "EventID": 1
  },
  "condition": "selection"
}

References:
  - https://twitter.com/VM_vivisector/status/[PII_REDACTED]30655232
  - https://twitter.com/DidierStevens/status/[PII_REDACTED]96924676
  - https://twitter.com/FlemmingRiis/status/[PII_REDACTED]82060800
  - https://www.youtube.com/watch?v=ebmW42YYveI
  - https://nullsec.us/windows-event-log-audit-cve/
Sigma Detection Rule: Microsoft Malware Protection Engine Crash - WER
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-09
ATT&CK techniques: T1211, T1685
Log source: windows/

Description:
This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Detection logic:
{
  "selection": {
    "Provider_Name": "Windows Error Reporting",
    "EventID": 1001,
    "Data|contains|all": [
      "MsMpEng.exe",
      "mpengine.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  - https://technet.microsoft.com/en-us/library/security/4022344
Sigma Detection Rule: Remote Access Tool - ScreenConnect Command Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ali Alwashali
Date: 2023-10-10
ATT&CK techniques: T1059.003
Log source: windows/

Description:
Detects command execution via ScreenConnect RMM

Detection logic:
{
  "selection": {
    "Provider_Name": "ScreenConnect",
    "EventID": 200,
    "Data|contains": "Executed command of length"
  },
  "condition": "selection"
}

References:
  - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling
  - https://github.com/SigmaHQ/sigma/pull/4467
Sigma Detection Rule: Remote Access Tool - ScreenConnect File Transfer
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ali Alwashali
Date: 2023-10-10
ATT&CK techniques: T1059.003
Log source: windows/

Description:
Detects file being transferred via ScreenConnect RMM

Detection logic:
{
  "selection": {
    "Provider_Name": "ScreenConnect",
    "EventID": 201,
    "Data|contains": "Transferred files with action"
  },
  "condition": "selection"
}

References:
  - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling
  - https://github.com/SigmaHQ/sigma/pull/4467
Sigma Detection Rule: Microsoft Malware Protection Engine Crash
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-09
ATT&CK techniques: T1211, T1685
Log source: windows/

Description:
This rule detects a suspicious crash of the Microsoft Malware Protection Engine

Detection logic:
{
  "selection": {
    "Provider_Name": "Application Error",
    "EventID": 1000,
    "Data|contains|all": [
      "MsMpEng.exe",
      "mpengine.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://bugs.chromium.org/p/project-zero/issues/detail?id=1252&desc=5
  - https://technet.microsoft.com/en-us/library/security/4022344
Sigma Detection Rule: LSASS Process Crashed - Application
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-07
ATT&CK techniques: T1003.001
Log source: windows/

Description:
Detects Windows error reporting events where the process that crashed is LSASS (Local Security Authority Subsystem Service).
This could be the cause of a provoked crash by techniques such as Lsass-Shtinkering to dump credentials.


Detection logic:
{
  "selection": {
    "Provider_Name": "Application Error",
    "EventID": 1000,
    "AppName": "lsass.exe",
    "ExceptionCode": "c0000001"
  },
  "condition": "selection"
}

References:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
Sigma Detection Rule: MSSQL SPProcoption Set
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-13
Log source: windows/

Description:
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started

Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 33205,
    "Data|contains|all": [
      "object_name:sp_procoption",
      "statement:EXEC"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
Sigma Detection Rule: MSSQL XPCmdshell Option Change
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
Log source: windows/

Description:
Detects when the MSSQL "xp_cmdshell" stored procedure setting is changed.


Detection logic:
{
  "selection": {
    "Provider_Name|contains": "MSSQL",
    "EventID": 15457,
    "Data|contains": "xp_cmdshell"
  },
  "condition": "selection"
}

References:
  - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/