deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Dropping Of Password Filter DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-10-29
ATT&CK techniques: T1556.002
Log source: windows/process_creation

Description:
Detects dropping of dll files in system32 that may be used to retrieve user credentials from LSASS

Detection logic:
{
  "selection_cmdline": {
    "CommandLine|contains|all": [
      "HKLM\\SYSTEM\\CurrentControlSet\\Control\\Lsa",
      "scecli\\0*",
      "reg add"
    ]
  },
  "condition": "selection_cmdline"
}

References:
  - https://pentestlab.blog/2020/02/10/credential-access-password-filter-dll/
  - https://github.com/3gstudent/PasswordFilter/tree/master/PasswordFilter
Sigma Detection Rule: Potential Process Execution Proxy Via CL_Invocation.ps1
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), oscd.community, Natalia Shornikova
Date: 2020-10-14
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"

Detection logic:
{
  "selection": {
    "CommandLine|contains": "SyncInvoke "
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/
  - https://twitter.com/bohops/status/[PII_REDACTED]12327424
Sigma Detection Rule: Interesting Service Enumeration Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-02-12
ATT&CK techniques: T1003
Log source: windows/process_creation

Description:
Detects the enumeration and query of interesting and in some cases sensitive services on the system via "sc.exe".
Attackers often try to enumerate the services currently running on a system in order to find different attack vectors.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "query"
  },
  "selection_cmd": {
    "CommandLine|contains": "termservice"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
  - https://pentestlab.blog/tag/svchost/
Sigma Detection Rule: System Network Connections Discovery Via Net.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-10
ATT&CK techniques: T1049
Log source: windows/process_creation

Description:
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": [
    {
      "CommandLine|endswith": [
        " use",
        " sessions"
      ]
    },
    {
      "CommandLine|contains": [
        " use ",
        " sessions "
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
Sigma Detection Rule: HackTool - SafetyKatz Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-20
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the execution of the hacktool SafetyKatz via PE information and default Image name

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SafetyKatz.exe"
    },
    {
      "OriginalFileName": "SafetyKatz.exe"
    },
    {
      "Description": "SafetyKatz"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/GhostPack/SafetyKatz
Sigma Detection Rule: WMIC Remote Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-14
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects the execution of WMIC to query information on a remote system

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "/node:"
  },
  "filter_main_localhost": {
    "CommandLine|contains": [
      "localhost",
      "127.0.0.1"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
Sigma Detection Rule: Nltest.EXE Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Arun Chauhan
Date: 2023-02-03
ATT&CK techniques: T1016, T1018, T1482
Log source: windows/process_creation

Description:
Detects nltest commands that can be used for information discovery

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\nltest.exe"
    },
    {
      "OriginalFileName": "nltestrk.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm
Sigma Detection Rule: Import LDAP Data Interchange Format File Via Ldifde.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @gott_cyber
Date: 2022-09-02
ATT&CK techniques: T1218, T1105
Log source: windows/process_creation

Description:
Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ldifde.exe"
    },
    {
      "OriginalFileName": "ldifde.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "-i",
      "-f"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]26580736
  - https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
Sigma Detection Rule: Process Creation Using Sysnative Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2022-08-23
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains": ":\\Windows\\Sysnative\\"
    },
    {
      "Image|contains": ":\\Windows\\Sysnative\\"
    }
  ],
  "filter_main_ngen": {
    "Image|contains": [
      "C:\\Windows\\Microsoft.NET\\Framework64\\v",
      "C:\\Windows\\Microsoft.NET\\Framework\\v",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm\\v",
      "C:\\Windows\\Microsoft.NET\\FrameworkArm64\\v"
    ],
    "Image|endswith": "\\ngen.exe",
    "CommandLine|contains": "install"
  },
  "filter_optional_xampp": {
    "CommandLine|contains|all": [
      "\"C:\\Windows\\sysnative\\cmd.exe\"",
      "\\xampp\\",
      "\\catalina_start.bat"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
Sigma Detection Rule: Potential Provlaunch.EXE Binary Proxy Execution Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
Date: 2023-08-08
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\provlaunch.exe"
  },
  "filter_main_covered_children": [
    {
      "Image|endswith": [
        "\\calc.exe",
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\notepad.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "Image|contains": [
        ":\\PerfLogs\\",
        ":\\Temp\\",
        ":\\Users\\Public\\",
        "\\AppData\\Temp\\",
        "\\Windows\\System32\\Tasks\\",
        "\\Windows\\Tasks\\",
        "\\Windows\\Temp\\"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]62153472
Sigma Detection Rule: Suspicious Rundll32 Activity Invoking Sys File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-05
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects suspicious process related to rundll32 based on command line that includes a *.sys file as seen being used by UNC2452

Detection logic:
{
  "selection1": {
    "CommandLine|contains": "rundll32.exe"
  },
  "selection2": {
    "CommandLine|contains": [
      ".sys,",
      ".sys "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
Sigma Detection Rule: Password Set to Never Expire via WMI
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Daniel Koifman (KoifSec)
Date: 2025-07-30
ATT&CK techniques: T1047, T1098
Log source: windows/process_creation

Description:
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "useraccount",
      " set ",
      "passwordexpires",
      "false"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.huntress.com/blog/the-unwanted-guest
Sigma Detection Rule: HackTool - SharPersist Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-15
ATT&CK techniques: T1053
Log source: windows/process_creation

Description:
Detects the execution of the hacktool SharPersist - used to deploy various different kinds of persistence mechanisms

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SharPersist.exe"
    },
    {
      "Product": "SharPersist"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains": [
      " -t schtask -c ",
      " -t startupfolder -c "
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      " -t reg -c ",
      " -m add"
    ]
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      " -t service -c ",
      " -m add"
    ]
  },
  "selection_cli_4": {
    "CommandLine|contains|all": [
      " -t schtask -c ",
      " -m add"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.mandiant.com/resources/blog/sharpersist-windows-persistence-toolkit
  - https://github.com/mandiant/SharPersist
Sigma Detection Rule: Suspicious Reconnaissance Activity Using Get-LocalGroupMember Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-10
ATT&CK techniques: T1087.001
Log source: windows/process_creation

Description:
Detects suspicious reconnaissance command line activity on Windows systems using the PowerShell Get-LocalGroupMember Cmdlet

Detection logic:
{
  "selection_cmdlet": {
    "CommandLine|contains": "Get-LocalGroupMember "
  },
  "selection_group": {
    "CommandLine|contains": [
      "domain admins",
      " administrator",
      " administrateur",
      "enterprise admins",
      "Exchange Trusted Subsystem",
      "Remote Desktop Users",
      "Utilisateurs du Bureau \u00e0 distance",
      "Usuarios de escritorio remoto"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: PUA - Adidnsdump Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1018
Log source: windows/process_creation

Description:
This tool enables enumeration and exporting of all DNS records in the zone for recon purposes of internal networks Python 3 and python.exe must be installed,
Usee to Query/modify DNS records for Active Directory integrated DNS via LDAP


Detection logic:
{
  "selection": {
    "Image|endswith": "\\python.exe",
    "CommandLine|contains": "adidnsdump"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-9---remote-system-discovery---adidnsdump
Sigma Detection Rule: Potential File Overwrite Via Sysinternals SDelete
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-06-03
ATT&CK techniques: T1485
Log source: windows/process_creation

Description:
Detects the use of SDelete to erase a file not the free space

Detection logic:
{
  "selection": {
    "OriginalFileName": "sdelete.exe"
  },
  "filter": {
    "CommandLine|contains": [
      " -h",
      " -c",
      " -z",
      " /\\?"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md
Sigma Detection Rule: PUA - Process Hacker Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-10
ATT&CK techniques: T1622, T1564, T1543
Log source: windows/process_creation

Description:
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.


Detection logic:
{
  "selection": [
    {
      "Image|contains": "\\ProcessHacker_"
    },
    {
      "Image|endswith": "\\ProcessHacker.exe"
    },
    {
      "OriginalFileName": [
        "ProcessHacker.exe",
        "Process Hacker"
      ]
    },
    {
      "Description": "Process Hacker"
    },
    {
      "Product": "Process Hacker"
    },
    {
      "Hashes|contains": [
        "MD5=68F9B52895F4D34E74112F3129B3B00D",
        "MD5=B365AF317AE730A67C936F21432B9C71",
        "SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D",
        "SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E",
        "SHA256=D4A0FE56316A2C45B9BA9AC[PII_REDACTED]A3EDC7ACF9E4DF64D326A0FF273E80F",
        "SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4",
        "IMPHASH=3695333C60DEDECDCAFF1590409AA462",
        "IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://processhacker.sourceforge.io/
  - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/
Sigma Detection Rule: System Information Discovery via Registry Queries
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: lazarg
Date: 2025-06-12
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Detects attempts to query system information directly from the Windows Registry.

Detection logic:
{
  "selection_cmd_reg": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains": "query",
    "CommandLine|contains|windash": "-v"
  },
  "selection_cmd_powershell": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      "Get-ItemPropertyValue",
      "gpv"
    ]
  },
  "selection_keys": {
    "CommandLine|contains": [
      "\\SOFTWARE\\Microsoft\\Windows Defender",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
      "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall",
      "\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation",
      "\\SYSTEM\\CurrentControlSet\\Services"
    ]
  },
  "condition": "1 of selection_cmd_* and selection_keys"
}

References:
  - https://cert.gov.ua/article/6277849
  - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
  - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
Sigma Detection Rule: HackTool - SharpMove Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Luca Di Bartolomeo (CrimpSec)
Date: 2024-01-29
ATT&CK techniques: T1021.002
Log source: windows/process_creation

Description:
Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SharpMove.exe"
    },
    {
      "OriginalFileName": "SharpMove.exe"
    }
  ],
  "selection_cli_computer": {
    "CommandLine|contains": "computername="
  },
  "selection_cli_actions": {
    "CommandLine|contains": [
      "action=create",
      "action=dcom",
      "action=executevbs",
      "action=hijackdcom",
      "action=modschtask",
      "action=modsvc",
      "action=query",
      "action=scm",
      "action=startservice",
      "action=taskscheduler"
    ]
  },
  "condition": "selection_img or all of selection_cli_*"
}

References:
  - https://github.com/0xthirteen/SharpMove/
  - https://pentestlab.blog/tag/sharpmove/
Sigma Detection Rule: Launch-VsDevShell.PS1 Proxy Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1216.001
Log source: windows/process_creation

Description:
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.

Detection logic:
{
  "selection_script": {
    "CommandLine|contains": "Launch-VsDevShell.ps1"
  },
  "selection_flags": {
    "CommandLine|contains": [
      "VsWherePath ",
      "VsInstallationPath "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]39255040
Sigma Detection Rule: Firewall Rule Deleted Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-14
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Detects the removal of a port or application rule in the Windows Firewall configuration using netsh

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "firewall",
      "delete "
    ]
  },
  "filter_optional_dropbox": {
    "ParentImage|endswith": "\\Dropbox.exe",
    "CommandLine|contains": "name=Dropbox"
  },
  "filter_optional_avast": {
    "ParentImage|endswith": "\\instup.exe",
    "CommandLine|contains": "advfirewall firewall delete rule name=\"Avast Antivirus Admin Client\""
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/
Sigma Detection Rule: Renamed NirCmd.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2024-03-11
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

Detection logic:
{
  "selection": {
    "OriginalFileName": "NirCmd.exe"
  },
  "filter_main_img": {
    "Image|endswith": [
      "\\nircmd.exe",
      "\\nircmdc.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
  - https://www.nirsoft.net/utils/nircmd.html
Sigma Detection Rule: HackTool - Impacket Tools Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-24
ATT&CK techniques: T1557.001
Log source: windows/process_creation

Description:
Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Detection logic:
{
  "selection": [
    {
      "Image|contains": [
        "\\goldenPac",
        "\\karmaSMB",
        "\\kintercept",
        "\\ntlmrelayx",
        "\\rpcdump",
        "\\samrdump",
        "\\secretsdump",
        "\\smbexec",
        "\\smbrelayx",
        "\\wmiexec",
        "\\wmipersist"
      ]
    },
    {
      "Image|endswith": [
        "\\atexec_windows.exe",
        "\\dcomexec_windows.exe",
        "\\dpapi_windows.exe",
        "\\findDelegation_windows.exe",
        "\\GetADUsers_windows.exe",
        "\\GetNPUsers_windows.exe",
        "\\getPac_windows.exe",
        "\\getST_windows.exe",
        "\\getTGT_windows.exe",
        "\\GetUserSPNs_windows.exe",
        "\\ifmap_windows.exe",
        "\\mimikatz_windows.exe",
        "\\netview_windows.exe",
        "\\nmapAnswerMachine_windows.exe",
        "\\opdump_windows.exe",
        "\\psexec_windows.exe",
        "\\rdp_check_windows.exe",
        "\\sambaPipe_windows.exe",
        "\\smbclient_windows.exe",
        "\\smbserver_windows.exe",
        "\\sniff_windows.exe",
        "\\sniffer_windows.exe",
        "\\split_windows.exe",
        "\\ticketer_windows.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries
Sigma Detection Rule: Suspicious Diantz Download and Compress Into a CAB File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-26
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Download and compress a remote file and store it in a cab file on local machine.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "diantz.exe",
      " \\\\\\\\",
      ".cab"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Diantz/
Sigma Detection Rule: Potential Credential Dumping Via LSASS Process Clone
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Samir Bousseaden
Date: 2021-11-27
ATT&CK techniques: T1003, T1003.001
Log source: windows/process_creation

Description:
Detects a suspicious LSASS process process clone that could be a sign of credential dumping activity

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\Windows\\System32\\lsass.exe",
    "Image|endswith": "\\Windows\\System32\\lsass.exe"
  },
  "condition": "selection"
}

References:
  - https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]54951689
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]94691073?s=20