deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potentially Suspicious Azure Front Door Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Isaac Dunham
Date: 2024-11-07
ATT&CK techniques: T1102.002, T1090.004
Log source: windows/network_connection

Description:
Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)


Detection logic:
{
  "selection": {
    "DestinationHostname|contains": "azurefd.net"
  },
  "filter_main_web_browsers": {
    "Image|endswith": [
      "brave.exe",
      "chrome.exe",
      "chromium.exe",
      "firefox.exe",
      "msedge.exe",
      "msedgewebview2.exe",
      "opera.exe",
      "vivaldi.exe"
    ]
  },
  "filter_main_common_talkers": {
    "Image|endswith": "searchapp.exe"
  },
  "filter_main_known_benign_domains": {
    "DestinationHostname|contains": [
      "afdxtest.z01.azurefd.net",
      "fp-afd.azurefd.net",
      "fp-afdx-bpdee4gtg6frejfd.z01.azurefd.net",
      "roxy.azurefd.net",
      "powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net",
      "storage-explorer-publishing-feapcgfgbzc2cjek.b01.azurefd.net",
      "graph.azurefd.net"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lots-project.com/site/2a2e617a[PII_REDACTED]2e6e6574
  - https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
  - https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
Sigma Detection Rule: Dfsvc.EXE Initiated Network Connection Over Uncommon Port
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-12
ATT&CK techniques: T1203
Log source: windows/network_connection

Description:
Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.

Detection logic:
{
  "selection": {
    "Image|contains": ":\\Windows\\Microsoft.NET\\",
    "Image|endswith": "\\dfsvc.exe",
    "Initiated": "true"
  },
  "filter_main_known_ports": {
    "DestinationPort": [
      80,
      443
    ]
  },
  "filter_optional_dns_ipv6": {
    "DestinationIsIpv6": "true",
    "DestinationPort": 53
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Sigma Detection Rule: HH.EXE Initiated HTTP Network Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-05
ATT&CK techniques: T1218.001
Log source: windows/network_connection

Description:
Detects a network connection initiated by the "hh.exe" process to HTTP destination ports, which could indicate the execution/download of remotely hosted .chm files.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\hh.exe",
    "Initiated": "true",
    "DestinationPort": [
      80,
      443
    ]
  },
  "condition": "selection"
}

References:
  - https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html
  - https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md
Sigma Detection Rule: Msiexec.EXE Initiated Network Connection Over HTTP
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-16
ATT&CK techniques: T1218.007
Log source: windows/network_connection

Description:
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443.
Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
Use this rule to hunt for potentially anomalous or suspicious communications.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\msiexec.exe",
    "DestinationPort": [
      80,
      443
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
Sigma Detection Rule: Network Connection Initiated By PowerShell Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-13
ATT&CK techniques: T1059.001
Log source: windows/network_connection

Description:
Detects a network connection that was initiated from a PowerShell process.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Initiated": "true"
  },
  "filter_main_local_ip": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "169.254.0.0/16",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "filter_main_msrange": {
    "DestinationIp|cidr": [
      "20.184.0.0/13",
      "51.103.210.0/23"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.youtube.com/watch?v=DLtJTxMWZ2o
Sigma Detection Rule: Network Connection Initiated From Users\Public Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2024-05-31
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|contains": ":\\Users\\Public\\"
  },
  "filter_optional_ibm": {
    "Image|contains": ":\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
Sigma Detection Rule: Dfsvc.EXE Network Connection To Non-Local IPs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-12
ATT&CK techniques: T1203
Log source: windows/network_connection

Description:
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs

Detection logic:
{
  "selection": {
    "Image|endswith": "\\dfsvc.exe",
    "Initiated": "true"
  },
  "filter_main_local_ip": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "169.254.0.0/16",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Sigma Detection Rule: Dllhost.EXE Initiated Network Connection To Non-Local IP Address
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: bartblaze
Date: 2020-07-13
ATT&CK techniques: T1218, T1559.001
Log source: windows/network_connection

Description:
Detects Dllhost.EXE initiating a network connection to a non-local IP address.
Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.
An initial baseline is recommended before deployment.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\dllhost.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "::1/128",
      "10.0.0.0/8",
      "127.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "fc00::/7",
      "fe80::/10"
    ]
  },
  "filter_main_msrange": {
    "DestinationIp|cidr": [
      "20.184.0.0/13",
      "20.192.0.0/10",
      "23.72.0.0/13",
      "51.10.0.0/15",
      "51.103.0.0/16",
      "51.104.0.0/15",
      "52.224.0.0/11",
      "150.171.0.0/19",
      "204.79.197.0/24"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://redcanary.com/blog/child-processes/
  - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
Sigma Detection Rule: Firewall Rule Modified In The Windows Firewall Exception List
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-02-19
ATT&CK techniques: T1686.003
Log source: windows/

Description:
Detects when a rule has been modified in the Windows firewall exception list

Detection logic:
{
  "selection": {
    "EventID": [
      2005,
      2073
    ]
  },
  "filter_optional_teams": {
    "ApplicationPath|endswith": "\\AppData\\local\\microsoft\\teams\\current\\teams.exe"
  },
  "filter_optional_keybase": {
    "ApplicationPath|endswith": "\\AppData\\Local\\Keybase\\keybase.exe"
  },
  "filter_optional_messenger": {
    "ApplicationPath|endswith": "\\AppData\\Local\\Programs\\Messenger\\Messenger.exe"
  },
  "filter_optional_opera": {
    "ApplicationPath|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\Programs\\Opera\\",
      "\\opera.exe"
    ]
  },
  "filter_optional_brave": {
    "ApplicationPath|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
Sigma Detection Rule: Scheduled Task Deletion
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: David Strassegger, Tim Shelton
Date: 2021-01-22
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects scheduled task deletion events. Scheduled tasks are likely to be deleted if not used for persistence. Malicious Software often creates tasks directly under the root node e.g. \TASKNAME

Detection logic:
{
  "selection": {
    "EventID": 4699
  },
  "filter_main_generic": {
    "TaskName": "\\Microsoft\\Windows\\RemovalTools\\MRT_ERROR_HB"
  },
  "filter_main_firefox": {
    "TaskName|contains": "\\Mozilla\\Firefox Default Browser Agent "
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/matthewdunwoody/status/[PII_REDACTED]82146562
  - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699
Sigma Detection Rule: Access To Browser Credential Files By Uncommon Applications - Security
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniel Koifman (@Koifsec), Nasreddine Bencherchali
Date: 2024-10-21
ATT&CK techniques: T1555.003
Log source: windows/

Description:
Detects file access requests to browser credential stores by uncommon processes. Could indicate potential attempt of credential stealing This rule requires heavy baselining before usage.


Detection logic:
{
  "selection_eid": {
    "EventID": 4663,
    "ObjectType": "File",
    "AccessMask": "0x1"
  },
  "selection_browser_chromium": {
    "ObjectName|contains": [
      "\\User Data\\Default\\Login Data",
      "\\User Data\\Local State",
      "\\User Data\\Default\\Network\\Cookies"
    ]
  },
  "selection_browser_firefox": {
    "FileName|endswith": [
      "\\cookies.sqlite",
      "\\places.sqlite",
      "release\\key3.db",
      "release\\key4.db",
      "release\\logins.json"
    ]
  },
  "filter_main_system": {
    "ProcessName": "System"
  },
  "filter_main_generic": {
    "ProcessName|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_defender": {
    "ProcessName|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\",
    "ProcessName|endswith": [
      "\\MpCopyAccelerator.exe",
      "\\MsMpEng.exe"
    ]
  },
  "condition": "selection_eid and 1 of selection_browser_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://ipurple.team/2024/09/10/browser-stored-credentials/
Sigma Detection Rule: Potential Remote WMI ActiveScriptEventConsumers Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-09-02
ATT&CK techniques: T1546.003
Log source: windows/

Description:
Detect potential adversaries leveraging WMI ActiveScriptEventConsumers remotely to move laterally in a network.
This event is best correlated and used as an enrichment to determine the potential lateral movement activity.


Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 3,
    "ProcessName|endswith": "scrcons.exe"
  },
  "filter_main_local_system": {
    "TargetLogonId": "0x3e7"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html
Sigma Detection Rule: Successful MSIX/AppX Package Installation
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-03
ATT&CK techniques: T1204.002
Log source: windows/

Description:
Detects successful MSIX/AppX package installations on Windows systems by monitoring EventID 854 in the Microsoft-Windows-AppXDeployment-Server/Operational log.
While most installations are legitimate, this can help identify unauthorized or suspicious package installations.
It is crucial to monitor such events as threat actors may exploit MSIX/AppX packages to deliver and execute malicious payloads.


Detection logic:
{
  "selection": {
    "EventID": 854
  },
  "condition": "selection"
}

References:
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
Sigma Detection Rule: New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2024-05-03
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Detects calls to the "New-NetFirewallRule" cmdlet from PowerShell in order to add a new firewall rule with an "Allow" action.


Detection logic:
{
  "selection_name": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\powershell_ise.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_args": {
    "CommandLine|contains|all": [
      "New-NetFirewallRule ",
      " -Action ",
      "allow"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
  - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
  - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
Sigma Detection Rule: Potentially Suspicious PowerShell Child Processes
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton
Date: 2022-04-26
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes spawned by PowerShell.
Use this rule to hunt for potential anomalies initiating from PowerShell scripts and commands.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Image|endswith": [
      "\\bash.exe",
      "\\bitsadmin.exe",
      "\\certutil.exe",
      "\\cscript.exe",
      "\\forfiles.exe",
      "\\hh.exe",
      "\\mshta.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\scrcons.exe",
      "\\scriptrunner.exe",
      "\\sh.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "filter_optional_amazon": {
    "ParentCommandLine|contains": "\\Program Files\\Amazon\\WorkspacesConfig\\Scripts\\",
    "CommandLine|contains": "\\Program Files\\Amazon\\WorkspacesConfig\\Scripts\\"
  },
  "filter_main_certutil_verify_store": {
    "Image|endswith": "\\certutil.exe",
    "CommandLine|contains": "-verifystore "
  },
  "filter_main_wmic": {
    "Image|endswith": "\\wmic.exe",
    "CommandLine|contains": [
      "qfe list",
      "diskdrive ",
      "csproduct ",
      "computersystem ",
      " os ",
      ""
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/ankit_anubhav/status/[PII_REDACTED]02620162
Sigma Detection Rule: CMD Shell Output Redirect
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-22
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Detects the use of the redirection character ">" to redirect information on the command line.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.


Detection logic:
{
  "selection_cmd": [
    {
      "OriginalFileName": "Cmd.Exe"
    },
    {
      "Image|endswith": "\\cmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": ">"
  },
  "filter_optional_idm_extension": {
    "CommandLine|contains": [
      "C:\\Program Files (x86)\\Internet Download Manager\\IDMMsgHost.exe",
      "chrome-extension://",
      "\\\\.\\pipe\\chrome.nativeMessaging"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://ss64.com/nt/syntax-redirection.html
Sigma Detection Rule: Suspicious New Instance Of An Office COM Object
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-13
Log source: windows/process_creation

Description:
Detects an svchost process spawning an instance of an office application. This happens when the initial word application creates an instance of one of the Office COM objects such as 'Word.Application', 'Excel.Application', etc.
This can be used by malicious actors to create malicious Office documents with macros on the fly. (See vba2clr project in the references)


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\svchost.exe",
    "Image|endswith": [
      "\\eqnedt32.exe",
      "\\excel.exe",
      "\\msaccess.exe",
      "\\mspub.exe",
      "\\powerpnt.exe",
      "\\visio.exe",
      "\\winword.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/office/troubleshoot/office-developer/automate-word-create-file-using-visual-basic
  - https://github.com/med0x2e/vba2clr
Sigma Detection Rule: Potential Proxy Execution Via Explorer.EXE From Shell Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
Date: 2020-10-05
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the creation of a child "explorer.exe" process from a shell like process such as "cmd.exe" or "powershell.exe".
Attackers can use "explorer.exe" for evading defense mechanisms by proxying the execution through the latter.
While this is often a legitimate action, this rule can be use to hunt for anomalies.
Muddy Waters threat actor was seeing using this technique.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Image|endswith": "\\explorer.exe",
    "CommandLine|contains": "explorer.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/CyberRaiju/status/[PII_REDACTED]22058752
  - https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/
Sigma Detection Rule: Arbitrary Command Execution Using WSL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-05
ATT&CK techniques: T1218, T1202
Log source: windows/process_creation

Description:
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wsl.exe"
    },
    {
      "OriginalFileName": "wsl.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -e ",
      " --exec",
      " --system",
      " --shell-type ",
      " /mnt/c",
      " --user root",
      " -u root",
      "--debug-shell"
    ]
  },
  "filter_main_kill": {
    "ParentImage|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      " -d ",
      " -e kill "
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
  - https://twitter.com/nas_bench/status/[PII_REDACTED]29808642
Sigma Detection Rule: File or Folder Permissions Modifications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-23
ATT&CK techniques: T1222.001
Log source: windows/process_creation

Description:
Detects a file or folder's permissions being modified or tampered with.

Detection logic:
{
  "selection_1": {
    "Image|endswith": [
      "\\cacls.exe",
      "\\icacls.exe",
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains": [
      "/grant",
      "/setowner",
      "/inheritance:r"
    ]
  },
  "selection_2": {
    "Image|endswith": "\\attrib.exe",
    "CommandLine|contains": "-r"
  },
  "selection_3": {
    "Image|endswith": "\\takeown.exe"
  },
  "filter_optional_dynatrace_1": {
    "CommandLine|endswith": "ICACLS C:\\ProgramData\\dynatrace\\gateway\\config\\connectivity.history /reset"
  },
  "filter_optional_dynatrace_2": {
    "CommandLine|contains|all": [
      "ICACLS C:\\ProgramData\\dynatrace\\gateway\\config\\config.properties /grant :r ",
      "S-1-5-19:F"
    ]
  },
  "filter_optional_vscode": {
    "CommandLine|contains": [
      "\\AppData\\Local\\Programs\\Microsoft VS Code",
      ":\\Program Files\\Microsoft VS Code"
    ]
  },
  "filter_optional_avira": {
    "CommandLine|contains": [
      ":\\Program Files (x86)\\Avira",
      ":\\Program Files\\Avira"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh750728(v=ws.11)
  - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91