deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Ping/Del Command Combination
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ilya Krestinichev
Date: 2022-11-03
ATT&CK techniques: T1070.004
Log source: windows/process_creation

Description:
Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

Detection logic:
{
  "selection_count": {
    "CommandLine|contains|windash": " -n "
  },
  "selection_nul": {
    "CommandLine|contains": "Nul"
  },
  "selection_del_param": {
    "CommandLine|contains|windash": [
      " -f ",
      " -q "
    ]
  },
  "selection_all": {
    "CommandLine|contains|all": [
      "ping",
      "del "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
  - https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware
Sigma Detection Rule: Potential Data Stealing Via Chromium Headless Debugging
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-23
ATT&CK techniques: T1185, T1564.003
Log source: windows/process_creation

Description:
Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "--remote-debugging-",
      "--user-data-dir",
      "--headless"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/defaultnamehere/cookie_crimes/
  - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password
  - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/
  - https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/
Sigma Detection Rule: ConvertTo-SecureString Cmdlet Usage Via CommandLine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Date: 2020-10-11
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "ConvertTo-SecureString"
  },
  "condition": "all of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples
Sigma Detection Rule: Potential Arbitrary File Download Using Office Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
Date: 2022-05-17
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects potential arbitrary file download using a Microsoft Office application

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\EXCEL.EXE",
        "\\POWERPNT.EXE",
        "\\WINWORD.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Excel.exe",
        "POWERPNT.EXE",
        "WinWord.exe"
      ]
    }
  ],
  "selection_http": {
    "CommandLine|contains": [
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/
  - https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191
Sigma Detection Rule: Renamed AutoHotkey.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali
Date: 2023-02-07
Log source: windows/process_creation

Description:
Detects execution of a renamed autohotkey.exe binary based on PE metadata fields

Detection logic:
{
  "selection": [
    {
      "Product|contains": "AutoHotkey"
    },
    {
      "Description|contains": "AutoHotkey"
    },
    {
      "OriginalFileName": [
        "AutoHotkey.exe",
        "AutoHotkey.rc"
      ]
    }
  ],
  "filter": [
    {
      "Image|endswith": [
        "\\AutoHotkey.exe",
        "\\AutoHotkey32.exe",
        "\\AutoHotkey32_UIA.exe",
        "\\AutoHotkey64.exe",
        "\\AutoHotkey64_UIA.exe",
        "\\AutoHotkeyA32.exe",
        "\\AutoHotkeyA32_UIA.exe",
        "\\AutoHotkeyU32.exe",
        "\\AutoHotkeyU32_UIA.exe",
        "\\AutoHotkeyU64.exe",
        "\\AutoHotkeyU64_UIA.exe"
      ]
    },
    {
      "Image|contains": "\\AutoHotkey"
    }
  ],
  "condition": "selection and not filter"
}

References:
  - https://www.autohotkey.com/download/
  - https://thedfirreport.com/2023/02/06/collect-exfiltrate-sleep-repeat/
Sigma Detection Rule: Suspicious File Characteristics Due to Missing Fields
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Markus Neis, Sander Wiebing
Date: 2018-11-22
ATT&CK techniques: T1059.006
Log source: windows/process_creation

Description:
Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

Detection logic:
{
  "selection1": {
    "Description": "\\?",
    "FileVersion": "\\?"
  },
  "selection2": {
    "Description": "\\?",
    "Product": "\\?"
  },
  "selection3": {
    "Description": "\\?",
    "Company": "\\?"
  },
  "folder": {
    "Image|contains": "\\Downloads\\"
  },
  "condition": "(selection1 or selection2 or selection3) and folder"
}

References:
  - https://securelist.com/muddywater/88059/
  - https://www.virustotal.com/#/file/276a765a10f98cda1a38d3a31e7483585ca3722ecad19d784441293acf1b7beb/detection
Sigma Detection Rule: Suspicious Speech Runtime Binary Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: andrewdanis
Date: 2025-10-23
ATT&CK techniques: T1021.003, T1218
Log source: windows/process_creation

Description:
Detects suspicious Speech Runtime Binary Execution by monitoring its child processes.
Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\SpeechRuntime.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/rtecCyberSec/SpeechRuntimeMove
Sigma Detection Rule: Suspicious JavaScript Execution Via Mshta.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1218.005
Log source: windows/process_creation

Description:
Detects execution of javascript code using "mshta.exe".

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mshta.exe"
    },
    {
      "OriginalFileName": "MSHTA.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "javascript"
  },
  "condition": "all of selection_*"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/6bc283c4-21f2-4aed-a05c-a9a3ffa95dd4.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md
Sigma Detection Rule: Xwizard.EXE Execution From Non-Default Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-09-20
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects the execution of Xwizard tool from a non-default directory.
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\xwizard.exe"
    },
    {
      "OriginalFileName": "xwizard.exe"
    }
  ],
  "filter_main_legit_location": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
  - http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
Sigma Detection Rule: Windows Kernel Debugger Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/process_creation

Description:
Detects execution of the Windows Kernel Debugger "kd.exe".

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\kd.exe"
    },
    {
      "OriginalFileName": "kd.exe"
    }
  ],
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - Windows Credential Editor (WCE) Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-12-31
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the use of Windows Credential Editor (WCE), a popular post-exploitation tool used to extract plaintext passwords, hash, PIN code and Kerberos tickets from memory.
It is often used by threat actors for credential dumping and lateral movement within compromised networks.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\WCE.exe",
      "\\WCE64.exe"
    ]
  },
  "selection_hash": {
    "Hashes|contains": [
      "IMPHASH=136F0A8572C058A96436C82E541E4C41",
      "IMPHASH=589657C64DDE88533186C39F82FA1F50",
      "IMPHASH=6BFE09EFCB4FFDE061EBDBAFC4DB84CF",
      "IMPHASH=7D490037BF450877E6D0287BDCFF8D2E",
      "IMPHASH=8AB93B061287C79F3088C5BC7E7D97ED",
      "IMPHASH=A53A02B997935FD8EEDCB5F7ABAB9B9F",
      "IMPHASH=BA434A7A729EEC20E136CA4C32D6C740",
      "IMPHASH=BD1D1547DA13C0FCB6C15E86217D5EB8",
      "IMPHASH=E96A73C7BF33A464C510EDE582318BF2"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.ampliasecurity.com/research/windows-credentials-editor/
Sigma Detection Rule: UAC Bypass Using Disk Cleanup
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using scheduled tasks and variable expansion of cleanmgr.exe (UACMe 34)

Detection logic:
{
  "selection": {
    "CommandLine|endswith": "\"\\system32\\cleanmgr.exe /autoclean /d C:",
    "ParentCommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Devtoolslauncher.exe Executes Specified Binary
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Beyu Denis, oscd.community (rule), @_felamos (idea)
Date: 2019-10-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
The Devtoolslauncher.exe executes other binary

Detection logic:
{
  "selection": {
    "Image|endswith": "\\devtoolslauncher.exe",
    "CommandLine|contains": "LaunchForDeploy"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/
  - https://twitter.com/_felamos/status/[PII_REDACTED]41797632
Sigma Detection Rule: Suspicious Control Panel DLL Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-04-15
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects suspicious Rundll32 execution from control.exe as used by Equation Group and Exploit Kits

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\System32\\control.exe"
  },
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "filter": {
    "CommandLine|contains": "Shell32.dll"
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://twitter.com/rikvduijn/status/[PII_REDACTED]20662017
  - https://twitter.com/felixw3000/status/[PII_REDACTED]28025088
Sigma Detection Rule: Forfiles.EXE Child Process Masquerading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Anish Bogati
Date: 2024-01-05
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.


Detection logic:
{
  "selection": {
    "ParentCommandLine|endswith": [
      ".exe",
      ".exe\""
    ],
    "Image|endswith": "\\cmd.exe",
    "CommandLine|startswith": "/c echo \""
  },
  "filter_main_parent_not_sys": {
    "ParentImage|contains": [
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ],
    "ParentImage|endswith": "\\forfiles.exe",
    "Image|contains": [
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ],
    "Image|endswith": "\\cmd.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
Sigma Detection Rule: Renamed AdFind Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-21
ATT&CK techniques: T1018, T1087.002, T1482, T1069.002
Log source: windows/process_creation

Description:
Detects the use of a renamed Adfind.exe. AdFind continues to be seen across majority of breaches. It is used to domain trust discovery to plan out subsequent steps in the attack chain.

Detection logic:
{
  "selection_1": {
    "CommandLine|contains": [
      "domainlist",
      "trustdmp",
      "dcmodes",
      "adinfo",
      " dclist ",
      "computer_pwdnotreqd",
      "objectcategory=",
      "-subnets -f",
      "name=\"Domain Admins\"",
      "-sc u:",
      "domainncs",
      "dompol",
      " oudmp ",
      "subnetdmp",
      "gpodmp",
      "fspdmp",
      "users_noexpire",
      "computers_active",
      "computers_pwdnotreqd"
    ]
  },
  "selection_2": {
    "Hashes|contains": [
      "IMPHASH=BCA5675746D13A1F246E2DA3C2217492",
      "IMPHASH=53E117A96057EAF19C41380D0E87F1C2",
      "IMPHASH=d144de8117df2beceaba2201ad304764",
      "IMPHASH=12ce1c0f3f5837ecc18a3782408fa975",
      "IMPHASH=4fbf3f084fbbb2470b80b2013134df35",
      "IMPHASH=49b639b4acbecc49d72a01f357aa4930",
      "IMPHASH=680dad9e300346e05a[PII_REDACTED]7201",
      "IMPHASH=21aa085d54992511b9f115355e468782"
    ]
  },
  "selection_3": {
    "OriginalFileName": "AdFind.exe"
  },
  "filter": {
    "Image|endswith": "\\AdFind.exe"
  },
  "condition": "1 of selection* and not filter"
}

References:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://thedfirreport.com/2020/05/08/adfind-recon/
  - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
Sigma Detection Rule: Potential Tampering With RDP Related Registry Keys Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport
Date: 2022-02-12
ATT&CK techniques: T1021.001, T1112
Log source: windows/process_creation

Description:
Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values

Detection logic:
{
  "selection_main_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_main_cli": {
    "CommandLine|contains|all": [
      " add ",
      "\\CurrentControlSet\\Control\\Terminal Server",
      "REG_DWORD",
      " /f"
    ]
  },
  "selection_values_1": {
    "CommandLine|contains|all": [
      "Licensing Core",
      "EnableConcurrentSessions"
    ]
  },
  "selection_values_2": {
    "CommandLine|contains": [
      "AllowTSConnections",
      "fDenyTSConnections",
      "fEnableWinStation",
      "fSingleSessionPerUser",
      "IdleWinStationPoolCount",
      "MaxInstanceCount",
      "SecurityLayer",
      "TSAdvertise",
      "TSAppCompat",
      "TSEnabled",
      "TSUserEnabled",
      "WinStations\\RDP-Tcp"
    ]
  },
  "filter_main_values_tls": {
    "CommandLine|contains|all": [
      "SecurityLayer",
      "02"
    ]
  },
  "condition": "all of selection_main_* and 1 of selection_values_* and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
  - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/
  - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/
  - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
Sigma Detection Rule: New Remote Desktop Connection Initiated Via Mstsc.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1021.001
Log source: windows/process_creation

Description:
Detects the usage of "mstsc.exe" with the "/v" flag to initiate a connection to a remote server.
Adversaries may use valid accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mstsc.exe"
    },
    {
      "OriginalFileName": "mstsc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " /v:"
  },
  "filter_optional_wsl": {
    "ParentImage": "C:\\Windows\\System32\\lxss\\wslhost.exe",
    "CommandLine|contains": "C:\\ProgramData\\Microsoft\\WSL\\wslg.rdp"
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mstsc
Sigma Detection Rule: LSASS Process Reconnaissance Via Findstr.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1552.006
Log source: windows/process_creation

Description:
Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID

Detection logic:
{
  "selection_findstr_img": [
    {
      "Image|endswith": [
        "\\find.exe",
        "\\findstr.exe"
      ]
    },
    {
      "OriginalFileName": [
        "FIND.EXE",
        "FINDSTR.EXE"
      ]
    }
  ],
  "selection_findstr_cli": {
    "CommandLine|contains": "lsass"
  },
  "selection_special": {
    "CommandLine|contains|windash": [
      " /i \"lsass",
      " /i lsass.exe",
      "findstr \"lsass",
      "findstr lsass",
      "findstr.exe \"lsass",
      "findstr.exe lsass"
    ]
  },
  "condition": "all of selection_findstr_* or selection_special"
}

References:
  - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
Sigma Detection Rule: Whoami.EXE Execution From Privileged Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov
Date: 2022-01-28
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects the execution of "whoami.exe" by privileged accounts that are often abused by threat actors

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "whoami.exe"
    },
    {
      "Image|endswith": "\\whoami.exe"
    }
  ],
  "selection_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI",
      "TrustedInstaller"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://web.archive.org/web/[PII_REDACTED]4836/https://nsudo.m2team.org/en-us/
Sigma Detection Rule: Potential LethalHTA Technique Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis
Date: 2018-06-07
ATT&CK techniques: T1218.005
Log source: windows/process_creation

Description:
Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\svchost.exe",
    "Image|endswith": "\\mshta.exe"
  },
  "condition": "selection"
}

References:
  - https://codewhitesec.blogspot.com/2018/07/lethalhta.html
Sigma Detection Rule: Suspicious ArcSOC.exe Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Micah Babinski
Date: 2025-11-25
ATT&CK techniques: T1059, T1203
Log source: windows/process_creation

Description:
Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe.
ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS
Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding
service endpoint and remotely execute code from the ArcSOC.exe process.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\ArcSOC.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "filter_main_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine": "cmd.exe /c \"ver\""
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
  - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
Sigma Detection Rule: Potential Command Line Path Traversal Evasion Attempt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-10-26
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects potential evasion or obfuscation attempts using bogus path traversal via the commandline

Detection logic:
{
  "selection_1": {
    "Image|contains": "\\Windows\\",
    "CommandLine|contains": [
      "\\..\\Windows\\",
      "\\..\\System32\\",
      "\\..\\..\\"
    ]
  },
  "selection_2": {
    "CommandLine|contains": ".exe\\..\\"
  },
  "filter_optional_google_drive": {
    "CommandLine|contains": "\\Google\\Drive\\googledrivesync.exe\\..\\"
  },
  "filter_optional_citrix": {
    "CommandLine|contains": "\\Citrix\\Virtual Smart Card\\Citrix.Authentication.VirtualSmartcard.Launcher.exe\\..\\"
  },
  "condition": "1 of selection_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/hexacorn/status/[PII_REDACTED]35320323
  - https://twitter.com/Gal_B1t/status/[PII_REDACTED]78345217