deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: HackTool - Covenant PowerShell Launcher
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2020-06-04
ATT&CK techniques: T1059.001, T1564.003
Log source: windows/process_creation

Description:
Detects suspicious command lines used in Covenant luanchers

Detection logic:
{
  "selection_1": {
    "CommandLine|contains|all": [
      "-Sta",
      "-Nop",
      "-Window",
      "Hidden"
    ],
    "CommandLine|contains": [
      "-Command",
      "-EncodedCommand"
    ]
  },
  "selection_2": {
    "CommandLine|contains": [
      "sv o (New-Object IO.MemorySteam);sv d ",
      "mshta file.hta",
      "GruntHTTP",
      "-EncodedCommand cwB2ACAAbwAgA"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://posts.specterops.io/covenant-v0-5-eee0507b85ba
Sigma Detection Rule: Schedule Task Creation From Env Variable Or Potentially Suspicious Path Via Schtasks.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-21
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects Schtask creations that point to a suspicious folder or an environment variable often used by malware

Detection logic:
{
  "selection_1_create": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|windash": " /create "
  },
  "selection_1_all_folders": {
    "CommandLine|contains": [
      ":\\Perflogs",
      ":\\Users\\All Users\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public",
      ":\\Windows\\Temp",
      "\\AppData\\Local\\",
      "\\AppData\\Roaming\\",
      "%AppData%",
      "%Public%"
    ]
  },
  "selection_2_parent": {
    "ParentCommandLine|endswith": "\\svchost.exe -k netsvcs -p -s Schedule"
  },
  "selection_2_some_folders": {
    "CommandLine|contains": [
      ":\\Perflogs",
      ":\\Windows\\Temp",
      "\\Users\\Public",
      "%Public%"
    ]
  },
  "filter_optional_other": [
    {
      "ParentCommandLine|contains": "unattended.ini"
    },
    {
      "CommandLine|contains": "update_task.xml"
    }
  ],
  "filter_optional_team_viewer": {
    "CommandLine|contains": "/Create /TN TVInstallRestore /TR"
  },
  "filter_optional_avira_install": {
    "CommandLine|contains|all": [
      "/Create /Xml ",
      "\\Temp\\.CR.",
      "\\Avira_Security_Installation.xml"
    ]
  },
  "filter_optional_avira_other": {
    "CommandLine|contains|all": [
      "/Create /F /TN",
      "/Xml ",
      "\\Temp\\",
      "Avira_"
    ],
    "CommandLine|contains": [
      ".tmp\\UpdateFallbackTask.xml",
      ".tmp\\WatchdogServiceControlManagerTimeout.xml",
      ".tmp\\SystrayAutostart.xml",
      ".tmp\\MaintenanceTask.xml"
    ]
  },
  "filter_optional_klite_c

References:
  - https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/
  - https://www.joesandbox.com/analysis/514608/0/html#324415FF7D[PII_REDACTED]BAD48A052F85DF04
  - https://blog.talosintelligence.com/gophish-powerrat-dcrat/
Sigma Detection Rule: Uncommon Child Process Of Appvlp.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-03-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects uncommon child processes of Appvlp.EXE
Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands.
Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder
or to mark a file as a system file.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\appvlp.exe"
  },
  "filter_main_generic": {
    "Image|endswith": [
      ":\\Windows\\SysWOW64\\rundll32.exe",
      ":\\Windows\\System32\\rundll32.exe"
    ]
  },
  "filter_optional_office_msoasb": {
    "Image|contains": ":\\Program Files\\Microsoft Office",
    "Image|endswith": "\\msoasb.exe"
  },
  "filter_optional_office_skype": {
    "Image|contains|all": [
      ":\\Program Files\\Microsoft Office",
      "\\SkypeSrv\\"
    ],
    "Image|endswith": "\\SKYPESERVER.EXE"
  },
  "filter_optional_office_msouc": {
    "Image|contains": ":\\Program Files\\Microsoft Office",
    "Image|endswith": "\\MSOUC.EXE"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/
Sigma Detection Rule: Files Added To An Archive Using Rar.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, E.M. Anhaus, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rar.exe",
    "CommandLine|contains": " a "
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/1ec33c93-3d0b-4a28-8014-dbdaae5c60ae.html
Sigma Detection Rule: Rundll32 Spawned Via Explorer.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: CD_ROM_
Date: 2022-05-21
Log source: windows/process_creation

Description:
Detects execution of "rundll32.exe" with a parent process of Explorer.exe. This has been observed by variants of Raspberry Robin, as first reported by Red Canary.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\explorer.exe"
  },
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "filter_main_generic": [
    {
      "CommandLine|contains": " C:\\Windows\\System32\\"
    },
    {
      "CommandLine|endswith": " -localserver 22d8c27b-47a1-48d1-ad08-7da7abd79617"
    }
  ],
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://redcanary.com/blog/raspberry-robin/
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: Firewall Rule Update Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-18
Log source: windows/process_creation

Description:
Detects execution of netsh with the "advfirewall" and the "set" option in order to set new values for properties of a existing rule

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " firewall ",
      " set "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://ss64.com/nt/netsh.html
Sigma Detection Rule: Diskshadow Script Mode - Uncommon Script Extension Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-15
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension.
Initial baselining of the allowed extension list is required.


Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "diskshadow.exe"
    },
    {
      "Image|endswith": "\\diskshadow.exe"
    }
  ],
  "selection_flag": {
    "CommandLine|contains|windash": "-s "
  },
  "filter_main_ext": {
    "CommandLine|contains": ".txt"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
  - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
Sigma Detection Rule: LOLBIN Execution From Abnormal Drive
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman
Date: 2022-01-25
Log source: windows/process_creation

Description:
Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\calc.exe",
        "\\certutil.exe",
        "\\cmstp.exe",
        "\\cscript.exe",
        "\\installutil.exe",
        "\\mshta.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "CALC.EXE",
        "CertUtil.exe",
        "CMSTP.EXE",
        "cscript.exe",
        "installutil.exe",
        "MSHTA.EXE",
        "REGSVR32.EXE",
        "RUNDLL32.EXE",
        "wscript.exe"
      ]
    }
  ],
  "filter_main_currentdirectory": {
    "CurrentDirectory|contains": "C:\\"
  },
  "filter_main_empty": {
    "CurrentDirectory": ""
  },
  "filter_main_null": {
    "CurrentDirectory": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://www.scythe.io/library/threat-emulation-qakbot
  - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/
Sigma Detection Rule: Suspicious Child Process of AspNetCompiler
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-14
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of "aspnet_compiler.exe".

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\aspnet_compiler.exe"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\calc.exe",
        "\\notepad.exe"
      ]
    },
    {
      "Image|contains": [
        "\\Users\\Public\\",
        "\\AppData\\Local\\Temp\\",
        "\\AppData\\Local\\Roaming\\",
        ":\\Temp\\",
        ":\\Windows\\Temp\\",
        ":\\Windows\\System32\\Tasks\\",
        ":\\Windows\\Tasks\\"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
Sigma Detection Rule: PUA - Memory Dump Mount Via MemProcFS
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-27
ATT&CK techniques: T1003, T1003.001, T1003.004, T1003.002
Log source: windows/process_creation

Description:
Detects execution of MemProcFS a memory forensics tool with the '-device' parameter.
MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures.
Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials.
MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\MemProcFS.exe"
    },
    {
      "OriginalFileName": "MemProcFS.exe"
    },
    {
      "Description": "MemProcFS"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "-device"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/ufrisk/MemProcFS
  - https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html#
  - https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps
Sigma Detection Rule: Cloudflared Tunnel Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-17
ATT&CK techniques: T1102, T1090, T1572
Log source: windows/process_creation

Description:
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      " tunnel ",
      " run "
    ],
    "CommandLine|contains": [
      "-config ",
      "-credentials-contents ",
      "-credentials-file ",
      "-token "
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.reconinfosec.com/emergence-of-akira-ransomware-group
  - https://github.com/cloudflare/cloudflared
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
Sigma Detection Rule: HackTool - KrbRelayUp Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-26
ATT&CK techniques: T1558.003, T1550.003
Log source: windows/process_creation

Description:
Detects KrbRelayUp used to perform a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\KrbRelayUp.exe"
    },
    {
      "OriginalFileName": "KrbRelayUp.exe"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains|all": [
      " relay ",
      " -Domain ",
      " -ComputerName "
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      " krbscm ",
      " -sc "
    ]
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      " spawn ",
      " -d ",
      " -cn ",
      " -cp "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/Dec0ne/KrbRelayUp
Sigma Detection Rule: Arbitrary File Download Via ConfigSecurityPolicy.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-26
ATT&CK techniques: T1567
Log source: windows/process_creation

Description:
Detects the execution of "ConfigSecurityPolicy.EXE", a binary part of Windows Defender used to manage settings in Windows Defender.
Users can configure different pilot collections for each of the co-management workloads.
It can be abused by attackers in order to upload or download files.


Detection logic:
{
  "selection_img": [
    {
      "CommandLine|contains": "ConfigSecurityPolicy.exe"
    },
    {
      "Image|endswith": "\\ConfigSecurityPolicy.exe"
    },
    {
      "OriginalFileName": "ConfigSecurityPolicy.exe"
    }
  ],
  "selection_url": {
    "CommandLine|contains": [
      "ftp://",
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/ConfigSecurityPolicy/
Sigma Detection Rule: Arbitrary File Download Via GfxDownloadWrapper.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\GfxDownloadWrapper.exe",
    "CommandLine|contains": [
      "http://",
      "https://"
    ]
  },
  "filter_main_known_urls": {
    "CommandLine|contains": "https://gameplayapi.intel.com/"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/HonorableMentions/GfxDownloadWrapper/
Sigma Detection Rule: Github Self-Hosted Runner Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniel Koifman (KoifSec)
Date: 2025-11-29
ATT&CK techniques: T1102.002, T1071
Log source: windows/process_creation

Description:
Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.


Detection logic:
{
  "selection_worker_img": [
    {
      "Image|endswith": "\\Runner.Worker.exe"
    },
    {
      "OriginalFileName": "Runner.Worker.dll"
    }
  ],
  "selection_worker_cli": {
    "CommandLine|contains": "spawnclient"
  },
  "selection_listener_img": [
    {
      "Image|endswith": "\\Runner.Listener.exe"
    },
    {
      "OriginalFileName": "Runner.Listener.dll"
    }
  ],
  "selection_listener_cli": {
    "CommandLine|contains": [
      "run",
      "configure"
    ]
  },
  "condition": "all of selection_worker_* or all of selection_listener_*"
}

References:
  - https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
  - https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
Sigma Detection Rule: Schtasks Creation Or Modification With SYSTEM Privileges
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-28
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects the creation or update of a scheduled task to run with "NT AUTHORITY\SYSTEM" privileges

Detection logic:
{
  "selection_root": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": [
      " /change ",
      " /create "
    ]
  },
  "selection_run": {
    "CommandLine|contains": "/ru "
  },
  "selection_user": {
    "CommandLine|contains": [
      "NT AUT",
      " SYSTEM "
    ]
  },
  "filter_optional_teamviewer": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      "/TN TVInstallRestore",
      "\\TeamViewer_.exe"
    ]
  },
  "filter_optional_office": {
    "CommandLine|contains|all": [
      "Subscription Heartbeat",
      "\\HeartbeatConfig.xml",
      "\\Microsoft Shared\\OFFICE"
    ]
  },
  "filter_optional_avira": {
    "CommandLine|contains": [
      "/Create /F /RU System /SC WEEKLY /TN AviraSystemSpeedupVerify /TR ",
      ":\\Program Files (x86)\\Avira\\System Speedup\\setup\\avira_speedup_setup.exe",
      "/VERIFY /VERYSILENT /NOSTART /NODOTNET /NORESTART\" /RL HIGHEST"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
Sigma Detection Rule: TrustedPath UAC Bypass Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-27
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects indicators of a UAC bypass method by mocking directories

Detection logic:
{
  "selection": {
    "Image|contains": [
      "C:\\Windows \\System32\\",
      "C:\\Windows \\SysWOW64\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e
  - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows
  - https://github.com/netero1010/TrustedPath-UACBypass-BOF
  - https://x.com/Wietze/status/[PII_REDACTED]52421843
Sigma Detection Rule: Suspicious Processes Spawned by WinRM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Hunkeler (@Karneades), Markus Neis
Date: 2021-05-20
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects suspicious processes including shells spawnd from WinRM host process

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\wsmprovhost.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\sh.exe",
      "\\bash.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wsl.exe",
      "\\schtasks.exe",
      "\\certutil.exe",
      "\\whoami.exe",
      "\\bitsadmin.exe"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Arbitrary File Download Via MSPUB.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\MSPUB.exe"
    },
    {
      "OriginalFileName": "MSPUB.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "ftp://",
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files
Sigma Detection Rule: Certificate Exported Via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-18
ATT&CK techniques: T1552.004, T1059.001
Log source: windows/process_creation

Description:
Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Export-PfxCertificate ",
      "Export-Certificate "
    ]
  },
  "condition": "selection"
}

References:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
  - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
Sigma Detection Rule: Potential DLL Injection Via AccCheckConsole
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-06
Log source: windows/process_creation

Description:
Detects the execution "AccCheckConsole" a command-line tool for verifying the accessibility implementation of an application's UI.
One of the tests that this checker can run are called "verification routine", which tests for things like Consistency, Navigation, etc.
The tool allows a user to provide a DLL that can contain a custom "verification routine". An attacker can build such DLLs and pass it via the CLI, which would then be loaded in the context of the "AccCheckConsole" utility.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\AccCheckConsole.exe"
    },
    {
      "OriginalFileName": "AccCheckConsole.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -hwnd",
      " -process ",
      " -window "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gist.github.com/bohops/[PII_REDACTED]c8acf837aedda5f0e7f340
  - https://twitter.com/bohops/status/[PII_REDACTED]17680899?s=12
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/