deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Mail Forwarding/Redirecting Activity In O365
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: RedCanary Team (idea), Harjot Singh @cyb3rjy0t
Date: 2023-10-11
ATT&CK techniques: T1114.003, T1564.008, T1020
Log source: m365/

Description:
Detects email forwarding or redirecting activity in O365 Audit logs.

Detection logic:
{
  "selection_updateinbox": {
    "Operation|contains": "UpdateInboxRules",
    "OperationProperties|contains": [
      "Forward",
      "Recipients"
    ]
  },
  "selection_setmailbox": {
    "Operation|contains": "Set-Mailbox",
    "Parameters|contains": [
      "ForwardingSmtpAddress",
      "ForwardingAddress"
    ]
  },
  "selection_setinbox": {
    "Operation|contains": [
      "New-InboxRule",
      "Set-InboxRule"
    ],
    "Parameters|contains": [
      "ForwardAsAttachmentTo",
      "ForwardingAddress",
      "ForwardingSmtpAddress",
      "ForwardTo",
      "RedirectTo",
      "RedirectToRecipients"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://redcanary.com/blog/email-forwarding-rules/
  - https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
Sigma Detection Rule: Inbox Rules Creation Or Update Activity in O365
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-01-09
ATT&CK techniques: T1564.008, T1114.003
Log source: m365/

Description:
Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.


Detection logic:
{
  "selection": {
    "Operation": [
      "New-InboxRule",
      "Set-InboxRule"
    ],
    "Parameters|contains": [
      "DeleteMessage",
      "MarkAsRead",
      "MoveToFolder",
      "SubjectOrBodyContainsWords"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
Sigma Detection Rule: Azure Sign-In With Axios User Agent
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-04-28
ATT&CK techniques: T1557
Log source: azure/

Description:
Detects sign-in attempts in Azure/Entra ID logs where the user agent contains "axios",
indicating potential use of automated credential harvesting or AiTM phishing infrastructure.
Axios is a Node.js HTTP client abused to intercept and replay stolen credentials and MFA tokens.
When triaging results, analysts should:
    - Check the sign-in risk level, MFA status, and conditional access results for signs of bypass.
    - Look for sign-ins from unusual locations or IPs, especially if the same IP targets multiple accounts.
    - Prioritize successful sign-ins over failed ones, as they may indicate a completed credential replay or AiTM attack.


Detection logic:
{
  "selection": {
    "userAgent|contains": "axios"
  },
  "condition": "selection"
}

References:
  - https://thehackernews.com/2025/09/axios-abuse-and-salty-2fa-kits-fuel.html
  - https://www.proofpoint.com/us/blog/threat-insight/http-client-tools-exploitation-account-takeover-attacks
Sigma Detection Rule: Okta Password Health Report Query
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-10-25
Log source: okta/

Description:
Detects all activities against the endpoint "/reports/password-health/*" which should only be accessed via OKTA Admin Console UI.
Use this rule to hunt for potential suspicious requests. Correlate this event with "admin console" login and alert on requests without any corresponding admin console login


Detection logic:
{
  "selection": {
    "debugContext.debugData.requestUri|contains": "/reports/password-health/"
  },
  "condition": "selection"
}

References:
  - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
Sigma Detection Rule: Low Reputation Effective Top-Level Domain (eTLD)
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Norbert Jaśniewicz (AlphaSOC)
Date: 2025-08-04
ATT&CK techniques: T1071.004
Log source: /dns

Description:
Detects DNS queries to domains within known low reputation eTLDs. This rule uses AlphaSOC's threat intelligence data and is updated on a monthly basis.

Detection logic:
{
  "selection": {
    "query|endswith": [
      ".duckdns.org",
      ".top",
      ".ddns.net",
      ".gl.at.ply.gg",
      ".portmap.io",
      ".icu",
      ".zapto.org",
      ".live",
      ".hopto.org",
      ".portmap.host",
      ".sbs",
      ".sytes.net",
      ".click",
      ".ydns.eu",
      ".site",
      ".cloud",
      ".no-ip.org",
      ".kozow.com",
      ".lat",
      ".pro"
    ]
  },
  "condition": "selection"
}

References:
  - https://feeds.alphasoc.net/bad-etlds.txt
Sigma Detection Rule: Potentially Suspicious Long Filename Pattern - Linux
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: @kostastsale
Date: 2025-11-22
ATT&CK techniques: T1059.004, T1027
Log source: linux/file_event

Description:
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell.
This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting.
Adjust the threshold of filename length as needed based on your environment.


Detection logic:
{
  "selection": {
    "TargetFilename|re": "[^/]{100,}$"
  },
  "filter_optional_known_good": {
    "TargetFilename|startswith": [
      "/run/systemd/units/invocation:systemd-fsck@",
      "/sys/firmware/",
      "/var/log/journal/"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
Sigma Detection Rule: Python Path Configuration File Creation - Linux
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2024-04-25
ATT&CK techniques: T1059.006
Log source: linux/file_event

Description:
Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.
Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.
Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).


Detection logic:
{
  "selection": {
    "TargetFilename|re": "(?i)/lib/python3\\.([5-9]|[0-9]{2})/site-packages/",
    "TargetFilename|endswith": ".pth"
  },
  "condition": "selection"
}

References:
  - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
  - https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
  - https://docs.python.org/3/library/site.html
Sigma Detection Rule: Process Discovery
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Ömer Günal, oscd.community, CheraaghiMilad
Date: 2020-10-06
ATT&CK techniques: T1057
Log source: linux/process_creation

Description:
Detects process discovery commands. Adversaries may attempt to get information about running processes on a system.
Information obtained could be used to gain an understanding of common software/applications running on systems within the network


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/atop",
      "/htop",
      "/pgrep",
      "/ps",
      "/pstree",
      "/top"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md
  - https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/
Sigma Detection Rule: Terminate Linux Process Via Kill
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tuan Le (NCSGroup)
Date: 2023-03-16
ATT&CK techniques: T1685
Log source: linux/process_creation

Description:
Detects usage of command line tools such as "kill", "pkill" or "killall" to terminate or signal a running process.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/kill",
      "/killall",
      "/pkill",
      "/xkill"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html
  - https://www.cyberciti.biz/faq/how-force-kill-process-linux/
  - https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
Sigma Detection Rule: Python Path Configuration File Creation - MacOS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2024-04-25
ATT&CK techniques: T1059.006
Log source: macos/file_event

Description:
Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.
Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.
Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).


Detection logic:
{
  "selection": {
    "TargetFilename|re": "(?i)/lib/python3\\.([5-9]|[0-9]{2})/site-packages/",
    "TargetFilename|endswith": ".pth"
  },
  "condition": "selection"
}

References:
  - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
  - https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
  - https://docs.python.org/3/library/site.html
Sigma Detection Rule: Clipboard Data Collection Via Pbpaste
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniel Cortez
Date: 2024-07-30
ATT&CK techniques: T1115
Log source: macos/process_creation

Description:
Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout).
The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands.
It can also be used in shell scripts that may require clipboard content as input.
Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information.
Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.


Detection logic:
{
  "selection": {
    "Image|endswith": "/pbpaste"
  },
  "condition": "selection"
}

References:
  - https://www.loobins.io/binaries/pbpaste/
  - https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b
  - https://media.defense.gov/2021/Jul/19/[PII_REDACTED]/-1/-1/1/CSA_CHINESE_STATE-SPONSORED_CYBER_TTPS.PDF
Sigma Detection Rule: .Class Extension URI Ending Request
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2021-12-21
Log source: /proxy

Description:
Detects requests to URI ending with the ".class" extension in proxy logs.
This could rules can be used to hunt for potential downloads of Java classes as seen for example in Log4shell exploitation attacks against Log4j.


Detection logic:
{
  "selection": {
    "c-uri|endswith": ".class"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0738/https://www.lunasec.io/docs/blog/log4j-zero-day/
Sigma Detection Rule: BITS Client BitsProxy DLL Loaded By Uncommon Process
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: UnicornOfHunt
Date: 2025-06-04
ATT&CK techniques: T1197
Log source: windows/image_load

Description:
Detects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used.
This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\BitsProxy.dll"
  },
  "filter_main_system": {
    "Image": [
      "C:\\Windows\\System32\\aitstatic.exe",
      "C:\\Windows\\System32\\bitsadmin.exe",
      "C:\\Windows\\System32\\desktopimgdownldr.exe",
      "C:\\Windows\\System32\\DeviceEnroller.exe",
      "C:\\Windows\\System32\\MDMAppInstaller.exe",
      "C:\\Windows\\System32\\ofdeploy.exe",
      "C:\\Windows\\System32\\RecoveryDrive.exe",
      "C:\\Windows\\System32\\Speech_OneCore\\common\\SpeechModelDownload.exe",
      "C:\\Windows\\SysWOW64\\bitsadmin.exe",
      "C:\\Windows\\SysWOW64\\OneDriveSetup.exe",
      "C:\\Windows\\SysWOW64\\Speech_OneCore\\Common\\SpeechModelDownload.exe"
    ]
  },
  "filter_optional_chrome": {
    "Image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/
Sigma Detection Rule: Microsoft Excel Add-In Loaded
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-12
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects Microsoft Excel loading an Add-In (.xll) file

Detection logic:
{
  "selection": {
    "Image|endswith": "\\excel.exe",
    "ImageLoaded|endswith": ".xll"
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
Sigma Detection Rule: WerFaultSecure Loading DbgCore or DbgHelp - EDR-Freeze
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-27
ATT&CK techniques: T1685
Log source: windows/image_load

Description:
Detects the loading of dbgcore.dll or dbghelp.dll by WerFaultSecure.exe, which has been observed in EDR-Freeze attacks to suspend processes and evade detection.
However, this behavior has also been observed during normal software installations, so further investigation is required to confirm malicious activity.
When threat hunting, look for this activity in conjunction with other suspicious processes starting, network connections, or file modifications that occur shortly after the DLL load.
Pay special attention to timing - if other malicious activities occur during or immediately after this library loading, it may indicate EDR evasion attempts.
Also correlate with any EDR/AV process suspension events or gaps in security monitoring during the timeframe.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\WerFaultSecure.exe",
    "ImageLoaded|endswith": [
      "\\dbgcore.dll",
      "\\dbghelp.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/TwoSevenOneT/EDR-Freeze
  - https://blog.axelarator.net/hunting-for-edr-freeze/
Sigma Detection Rule: WMI Module Loaded By Uncommon Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
ATT&CK techniques: T1047
Log source: windows/image_load

Description:
Detects WMI modules being loaded by an uncommon process

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\fastprox.dll",
      "\\wbemcomn.dll",
      "\\wbemprox.dll",
      "\\wbemsvc.dll",
      "\\WmiApRpl.dll",
      "\\wmiclnt.dll",
      "\\WMINet_Utils.dll",
      "\\wmiprov.dll",
      "\\wmiutils.dll"
    ]
  },
  "filter_main_generic": {
    "Image|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\explorer.exe",
      ":\\Windows\\Microsoft.NET\\Framework\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm64\\",
      ":\\Windows\\Microsoft.NET\\Framework64\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_other": {
    "Image|endswith": [
      "\\WindowsAzureGuestAgent.exe",
      "\\WaAppAgent.exe"
    ]
  },
  "filter_optional_thor": {
    "Image|endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ]
  },
  "filter_optional_defender": {
    "Image|endswith": "\\MsMpEng.exe"
  },
  "filter_optional_teams": {
    "Image|contains": [
      "\\Microsoft\\Teams\\current\\Teams.exe",
      "\\Microsoft\\Teams\\Update.exe"
    ]
  },
  "filter_optional_sysmon": {
    "Image|endswith": [
      ":\\Windows\\Sysmon.exe",
      ":\\Windows\\Sysmon64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190811-WMIModuleLoad/notebook.html
Sigma Detection Rule: Task Scheduler DLL Loaded By Application Located In Potentially Suspicious Location
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-09-02
ATT&CK techniques: T1053.005
Log source: windows/image_load

Description:
Detects the loading of the "taskschd.dll" module from a process that located in a potentially suspicious or uncommon directory.
The loading of this DLL might indicate that the application have the capability to create a scheduled task via the "Schedule.Service" COM object.
Investigation of the loading application and its behavior is required to determining if its malicious.


Detection logic:
{
  "selection_dll": [
    {
      "ImageLoaded|endswith": "\\taskschd.dll"
    },
    {
      "OriginalFileName": "taskschd.dll"
    }
  ],
  "selection_paths": {
    "Image|contains": [
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.logpoint.com/en/blog/shenanigans-of-scheduled-tasks/
  - https://x.com/Max_Mal_/status/[PII_REDACTED]84739829
Sigma Detection Rule: Dbghelp/Dbgcore DLL Loaded By Uncommon/Suspicious Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Perez Diego (@darkquassar), oscd.community, Ecco
Date: 2019-10-27
ATT&CK techniques: T1003.001
Log source: windows/image_load

Description:
Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process.
The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.


Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\dbghelp.dll",
      "\\dbgcore.dll"
    ],
    "Image|endswith": [
      "\\bash.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\dnx.exe",
      "\\excel.exe",
      "\\monitoringhost.exe",
      "\\msbuild.exe",
      "\\mshta.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\regsvcs.exe",
      "\\rundll32.exe",
      "\\sc.exe",
      "\\scriptrunner.exe",
      "\\winword.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "filter_main_tiworker": {
    "CommandLine|startswith": "C:\\WINDOWS\\WinSxS\\",
    "CommandLine|endswith": "\\TiWorker.exe -Embedding"
  },
  "filter_main_generic": {
    "Image|endswith": "\\svchost.exe",
    "CommandLine|endswith": [
      "-k LocalServiceNetworkRestricted",
      "-k WerSvcGroup"
    ]
  },
  "filter_main_rundll32": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      "/d srrstr.dll,ExecuteScheduledSPPCreation",
      "aepdu.dll,AePduRunUpdate",
      "shell32.dll,OpenAs_RunDL",
      "Windows.Storage.ApplicationData.dll,CleanupTemporaryState"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
  - https://www.pinvoke.net/default.aspx/dbghelp/MiniDumpWriteDump.html
  - https://medium.com/@fsx30/bypass-edrs-memory-protection-introduction-to-hooking-2efb21acffd6
Sigma Detection Rule: Microsoft Word Add-In Loaded
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Steffen Rogge (dr0pd34d)
Date: 2024-07-10
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\winword.exe",
    "ImageLoaded|endswith": ".wll"
  },
  "condition": "selection"
}

References:
  - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
  - https://nored0x.github.io/red-teaming/office-persistence/#what-is-a-wll-file
Sigma Detection Rule: Amsi.DLL Load By Uncommon Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2023-03-12
ATT&CK techniques: T1490
Log source: windows/image_load

Description:
Detects loading of Amsi.dll by uncommon processes

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\amsi.dll"
  },
  "filter_main_exact": {
    "Image|endswith": [
      ":\\Windows\\explorer.exe",
      ":\\Windows\\Sysmon64.exe"
    ]
  },
  "filter_main_generic": {
    "Image|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\WinSxS\\"
    ]
  },
  "filter_optional_defender": {
    "Image|contains": ":\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "Image|endswith": "\\MsMpEng.exe"
  },
  "filter_main_dotnet": {
    "Image|contains": [
      ":\\Windows\\Microsoft.NET\\Framework\\",
      ":\\Windows\\Microsoft.NET\\Framework64\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm64\\"
    ],
    "Image|endswith": "\\ngentask.exe"
  },
  "filter_main_null": {
    "Image": null
  },
  "filter_main_empty": {
    "Image": ""
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://infosecwriteups.com/amsi-bypass-new-way-2023-d506345944e9
  - https://github.com/TheD1rkMtr/AMSI_patch
  - https://github.com/surya-dev-singh/AmsiBypass-OpenSession
Sigma Detection Rule: System Drawing DLL Load
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1113
Log source: windows/image_load

Description:
Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\System.Drawing.ni.dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/16
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.1_3B4E5808-3C71-406A-B181-17B0CE3178C9.md