deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential SmadHook.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-01
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\SmadHook32c.dll",
      "\\SmadHook64c.dll"
    ]
  },
  "filter_main_legit_path": {
    "Image": [
      "C:\\Program Files (x86)\\SMADAV\\SmadavProtect32.exe",
      "C:\\Program Files (x86)\\SMADAV\\SmadavProtect64.exe",
      "C:\\Program Files\\SMADAV\\SmadavProtect32.exe",
      "C:\\Program Files\\SMADAV\\SmadavProtect64.exe"
    ],
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\SMADAV\\",
      "C:\\Program Files\\SMADAV\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/
  - https://www.qurium.org/alerts/targeted-malware-against-crph/
Sigma Detection Rule: DotNet CLR DLL Loaded By Scripting Applications
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: omkar72, oscd.community
Date: 2020-10-14
ATT&CK techniques: T1055
Log source: windows/image_load

Description:
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\cmstp.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\msxsl.exe",
      "\\regsvr32.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ],
    "ImageLoaded|endswith": [
      "\\clr.dll",
      "\\mscoree.dll",
      "\\mscorlib.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/tyranid/DotNetToJScript
  - https://thewover.github.io/Introducing-Donut/
  - https://web.archive.org/web/[PII_REDACTED]4538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
  - https://web.archive.org/web/[PII_REDACTED]2428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
Sigma Detection Rule: Load Of RstrtMgr.DLL By A Suspicious Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Luc Génaux
Date: 2023-11-28
ATT&CK techniques: T1486, T1685
Log source: windows/image_load

Description:
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.


Detection logic:
{
  "selection_img": [
    {
      "ImageLoaded|endswith": "\\RstrtMgr.dll"
    },
    {
      "OriginalFileName": "RstrtMgr.dll"
    }
  ],
  "selection_folders_1": {
    "Image|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      "\\Temporary Internet"
    ]
  },
  "selection_folders_2": [
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    }
  ],
  "condition": "selection_img and 1 of selection_folders_*"
}

References:
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
  - https://web.archive.org/web/[PII_REDACTED]3106/https://www.swascan.com/cactus-ransomware-malware-analysis/
  - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
Sigma Detection Rule: Potentially Suspicious Volume Shadow Copy Vsstrace.dll Load
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-02-17
ATT&CK techniques: T1490
Log source: windows/image_load

Description:
Detects the image load of VSS DLL by uncommon executables

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\vsstrace.dll"
  },
  "filter_main_windows": [
    {
      "Image": [
        "C:\\Windows\\explorer.exe",
        "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe"
      ]
    },
    {
      "Image|startswith": [
        "C:\\Windows\\System32\\",
        "C:\\Windows\\SysWOW64\\",
        "C:\\Windows\\Temp\\{",
        "C:\\Windows\\WinSxS\\",
        "C:\\ProgramData\\Package Cache\\{"
      ]
    }
  ],
  "filter_main_program_files": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_optional_recovery": {
    "Image|startswith": "C:\\$WinREAgent\\Scratch\\"
  },
  "filter_main_null_image": {
    "Image": null
  },
  "filter_optional_avira": {
    "Image|contains|all": [
      "\\temp\\is-",
      "\\avira_system_speedup.tmp"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/ORCx41/DeleteShadowCopies
Sigma Detection Rule: Suspicious WSMAN Provider Image Loads
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-06-24
ATT&CK techniques: T1059.001, T1021.003
Log source: windows/image_load

Description:
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Detection logic:
{
  "request_client": [
    {
      "ImageLoaded|endswith": [
        "\\WsmSvc.dll",
        "\\WsmAuto.dll",
        "\\Microsoft.WSMan.Management.ni.dll"
      ]
    },
    {
      "OriginalFileName": [
        "WsmSvc.dll",
        "WSMANAUTOMATION.DLL",
        "Microsoft.WSMan.Management.dll"
      ]
    }
  ],
  "respond_server": {
    "Image|endswith": "\\svchost.exe",
    "OriginalFileName": "WsmWmiPl.dll"
  },
  "filter_general": {
    "Image": [
      "C:\\Program Files (x86)\\PowerShell\\6\\pwsh.exe",
      "C:\\Program Files (x86)\\PowerShell\\7\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\6\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\sdiagnhost.exe",
      "C:\\Windows\\System32\\services.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_svchost": {
    "CommandLine|contains": [
      "svchost.exe -k netsvcs -p -s BITS",
      "svchost.exe -k GraphicsPerfSvcGroup -s GraphicsPerfSvc",
      "svchost.exe -k NetworkService -p -s Wecsvc",
      "svchost.exe -k netsvcs"
    ]
  },
  "filter_mscorsvw": {
    "Image|startswith": [
      "C:\\Windows\\Microsoft.NET\\Framework64\\v",
      "C:\\Windows\\Microsoft.NET\\Framework\\v",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm\\v",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm64\\v"
    ],
    "Image|endswith": "\\mscorsvw.exe"
  },
  "filt

References:
  - https://twitter.com/chadtilbury/status/[PII_REDACTED]70610688
  - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/
  - https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture
  - https://github.com/bohops/WSMan-WinRM
Sigma Detection Rule: Potential Python DLL SideLoading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-10-06
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of Python DLL files.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\python39.dll",
      "\\python310.dll",
      "\\python311.dll",
      "\\python312.dll"
    ]
  },
  "filter_main_default_install_paths": [
    {
      "ImageLoaded|startswith": [
        "C:\\Program Files\\Python3",
        "C:\\Program Files (x86)\\Python3"
      ]
    },
    {
      "ImageLoaded|contains": "\\AppData\\Local\\Programs\\Python\\Python3"
    }
  ],
  "filter_optional_visual_studio": {
    "ImageLoaded|startswith": "C:\\Program Files\\Microsoft Visual Studio\\"
  },
  "filter_optional_anaconda": {
    "ImageLoaded|startswith": "C:\\ProgramData\\Anaconda3\\"
  },
  "filter_optional_cpython": {
    "ImageLoaded|contains": [
      "\\cpython\\externals\\",
      "\\cpython\\PCbuild\\"
    ]
  },
  "filter_optional_pyinstaller": {
    "ImageLoaded|startswith": "C:\\Users",
    "ImageLoaded|contains": "\\AppData\\Local\\Temp\\_MEI"
  },
  "filter_main_legit_signature_details": {
    "Product": "Python",
    "Signed": "true",
    "Description": "Python",
    "Company": "Python Software Foundation"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.securonix.com/blog/seolurker-attack-campaign-uses-seo-poisoning-fake-google-ads-to-install-malware/
  - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
  - https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
Sigma Detection Rule: Potential DLL Sideloading Via ClassicExplorer32.dll
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-13
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software

Detection logic:
{
  "selection_classicexplorer": {
    "ImageLoaded|endswith": "\\ClassicExplorer32.dll"
  },
  "filter_classicexplorer": {
    "ImageLoaded|startswith": "C:\\Program Files\\Classic Shell\\"
  },
  "condition": "selection_classicexplorer and not filter_classicexplorer"
}

References:
  - https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets
  - https://app.any.run/tasks/6d8cabb0-dcda-44b6-8050-28d6ce281687/
Sigma Detection Rule: System Control Panel Item Loaded From Uncommon Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Anish Bogati
Date: 2024-01-09
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations that may indicate DLL sideloading or other abuse techniques.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\appwiz.cpl",
      "\\bthprops.cpl",
      "\\hdwwiz.cpl"
    ]
  },
  "filter_main_legit_location": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\Prefetch\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
  - https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/
  - https://github.com/mhaskar/FsquirtCPLPoC
  - https://securelist.com/sidewinder-apt/114089/
Sigma Detection Rule: Potential RjvPlatform.DLL Sideloading From Default Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-09
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.

Detection logic:
{
  "selection": {
    "Image": "C:\\Windows\\System32\\SystemResetPlatform\\SystemResetPlatform.exe",
    "ImageLoaded": "C:\\$SysReset\\Framework\\Stack\\RjvPlatform.dll"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]88330499
Sigma Detection Rule: Potential Libvlc.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior
Date: 2023-04-17
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\libvlc.dll"
  },
  "filter_main_vlc": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\VideoLAN\\VLC\\",
      "C:\\Program Files\\VideoLAN\\VLC\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trendmicro.com/en_us/research/23/c/earth-preta-updated-stealthy-strategies.html
  - https://hijacklibs.net/entries/3rd_party/vlc/libvlc.html
Sigma Detection Rule: Potential DLL Sideloading Via JsSchHlp
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-14
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\JSESPR.dll"
  },
  "filter": {
    "ImageLoaded|startswith": "C:\\Program Files\\Common Files\\Justsystem\\JsSchHlp\\"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/
  - http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp
Sigma Detection Rule: Potential RjvPlatform.DLL Sideloading From Non-Default Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-09
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\RjvPlatform.dll",
    "Image": "\\SystemResetPlatform.exe"
  },
  "filter_main_legit_path": {
    "Image|startswith": "C:\\Windows\\System32\\SystemResetPlatform\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]88330499
Sigma Detection Rule: Potential 7za.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: X__Junior
Date: 2023-06-09
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "7za.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\7za.dll"
  },
  "filter_main_legit_path": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\"
    ],
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d
Sigma Detection Rule: Potential DLL Sideloading Of MsCorSvc.DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Wietze Beukema
Date: 2024-07-11
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "mscorsvc.dll".

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\mscorsvc.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\Microsoft.NET\\Framework\\",
      "C:\\Windows\\Microsoft.NET\\Framework64\\",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm\\",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://hijacklibs.net/entries/microsoft/built-in/mscorsvc.html
Sigma Detection Rule: Potential RoboForm.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-14
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\roboform.dll",
      "\\roboform-x64.dll"
    ]
  },
  "filter_main_path": {
    "Image|startswith": [
      " C:\\Program Files (x86)\\Siber Systems\\AI RoboForm\\",
      " C:\\Program Files\\Siber Systems\\AI RoboForm\\"
    ],
    "Image|endswith": [
      "\\robotaskbaricon.exe",
      "\\robotaskbaricon-x64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/StopMalvertisin/status/[PII_REDACTED]48549888
  - https://twitter.com/t3ft3lb/status/[PII_REDACTED]30401024
  - https://www.roboform.com/
Sigma Detection Rule: Potential DLL Sideloading Of Non-Existent DLLs From System Folders
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), SBousseaden
Date: 2022-12-09
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts.
Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      ":\\Windows\\System32\\axeonoffhelper.dll",
      ":\\Windows\\System32\\cdpsgshims.dll",
      ":\\Windows\\System32\\oci.dll",
      ":\\Windows\\System32\\offdmpsvc.dll",
      ":\\Windows\\System32\\shellchromeapi.dll",
      ":\\Windows\\System32\\TSMSISrv.dll",
      ":\\Windows\\System32\\TSVIPSrv.dll",
      ":\\Windows\\System32\\wbem\\wbemcomn.dll",
      ":\\Windows\\System32\\WLBSCTRL.dll",
      ":\\Windows\\System32\\wow64log.dll",
      ":\\Windows\\System32\\WptsExtensions.dll"
    ]
  },
  "filter_main_ms_signed": {
    "Signed": "true",
    "SignatureStatus": "Valid",
    "Signature": "Microsoft Windows"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
  - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
  - https://decoded.avast.io/martinchlumecky/png-steganography/
  - https://github.com/Wh04m1001/SysmonEoP
  - https://itm4n.github.io/cdpsvc-dll-hijacking/
Sigma Detection Rule: Potential Chrome Frame Helper DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-08-17
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "chrome_frame_helper.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\chrome_frame_helper.dll"
  },
  "filter_main_path": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\Google\\Chrome\\Application\\",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\"
    ]
  },
  "filter_optional_user_path": {
    "ImageLoaded|contains": "\\AppData\\local\\Google\\Chrome\\Application\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://hijacklibs.net/entries/3rd_party/google/chrome_frame_helper.html
Sigma Detection Rule: Potential SolidPDFCreator.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-05-07
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "SolidPDFCreator.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\SolidPDFCreator.dll"
  },
  "filter_main_path": {
    "Image|endswith": "\\SolidPDFCreator.exe",
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\SolidDocuments\\SolidPDFCreator\\",
      "C:\\Program Files\\SolidDocuments\\SolidPDFCreator\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
Sigma Detection Rule: Potential AVKkid.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-08-03
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "AVKkid.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\AVKkid.dll"
  },
  "filter_main_legit_path": {
    "Image|contains": [
      "C:\\Program Files (x86)\\G DATA\\",
      "C:\\Program Files\\G DATA\\"
    ],
    "Image|endswith": "\\AVKKid.exe",
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\G DATA\\",
      "C:\\Program Files\\G DATA\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
Sigma Detection Rule: Potential Vivaldi_elf.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-08-03
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "vivaldi_elf.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\vivaldi_elf.dll"
  },
  "filter_main_legit_path": {
    "Image|endswith": "\\Vivaldi\\Application\\vivaldi.exe",
    "ImageLoaded|contains": "\\Vivaldi\\Application\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/
Sigma Detection Rule: WMIC Loading Scripting Libraries
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-17
ATT&CK techniques: T1220
Log source: windows/image_load

Description:
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\wmic.exe",
    "ImageLoaded|endswith": [
      "\\jscript.dll",
      "\\vbscript.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN[PII_REDACTED]00.html
  - https://twitter.com/dez_/status/[PII_REDACTED]11442944
  - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
Sigma Detection Rule: Potential Mfdetours.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-03
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\mfdetours.dll"
  },
  "filter_main_legit_path": {
    "ImageLoaded|contains": ":\\Program Files (x86)\\Windows Kits\\10\\bin\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research