deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Security Service Disabled Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), John Lambert (idea), elhoim
Date: 2021-07-14
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects execution of "reg.exe" to disable security services such as Windows Defender.

Detection logic:
{
  "selection_reg_add": {
    "CommandLine|contains|all": [
      "reg",
      "add"
    ]
  },
  "selection_cli_reg_start": {
    "CommandLine|contains|all": [
      "d 4",
      "v Start"
    ],
    "CommandLine|contains": [
      "\\AppIDSvc",
      "\\MsMpSvc",
      "\\NisSrv",
      "\\SecurityHealthService",
      "\\Sense",
      "\\UsoSvc",
      "\\WdBoot",
      "\\WdFilter",
      "\\WdNisDrv",
      "\\WdNisSvc",
      "\\WinDefend",
      "\\wscsvc",
      "\\wuauserv"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]41979392
  - https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a[PII_REDACTED]926d575e3c46f68cf7c68d/wor.ps1
  - https://vms.drweb.fr/virus/?i=24144899
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
Sigma Detection Rule: Potential Dropper Script Execution Via WScript/CScript/MSHTA
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems), Dave Johnson
Date: 2019-01-16
ATT&CK techniques: T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects wscript/cscript/mshta executions of scripts located in user directories

Detection logic:
{
  "selection_exec": {
    "Image|endswith": [
      "\\wscript.exe",
      "\\cscript.exe",
      "\\mshta.exe"
    ]
  },
  "selection_paths": {
    "CommandLine|contains": [
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Tmp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\Temp\\",
      "\\Start Menu\\Programs\\Startup\\",
      "\\Temporary Internet",
      "\\Windows\\Temp",
      "%LocalAppData%\\Temp\\",
      "%TEMP%",
      "%TMP%"
    ]
  },
  "selection_ext": {
    "CommandLine|contains": [
      ".hta",
      ".js",
      ".jse",
      ".vba",
      ".vbe",
      ".vbs",
      ".wsf",
      ".wsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://redcanary.com/blog/gootloader/
  - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
Sigma Detection Rule: Read Contents From Stdin Via Cmd.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-07
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detect the use of "<" to read and potentially execute a file via cmd.exe

Detection logic:
{
  "selection_cmd": [
    {
      "OriginalFileName": "Cmd.Exe"
    },
    {
      "Image|endswith": "\\cmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "<"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1059.003/T1059.003.md
  - https://web.archive.org/web/[PII_REDACTED]1156/https://www.x86matthew.com/view_post?id=ntdll_pipe
Sigma Detection Rule: Network Reconnaissance Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-07
ATT&CK techniques: T1087, T1082
Log source: windows/process_creation

Description:
Detects a set of suspicious network related commands often used in recon stages

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "nslookup",
      "_ldap._tcp.dc._msdcs."
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
Sigma Detection Rule: Remote Access Tool - NetSupport Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-09-25
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Description": "NetSupport Client Configurator"
    },
    {
      "Product": "NetSupport Remote Control"
    },
    {
      "Company": "NetSupport Ltd"
    },
    {
      "OriginalFileName": "PCICFGUI.EXE"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md
Sigma Detection Rule: Suspicious PowerShell Download and Execute Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-28
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "IEX ((New-Object Net.WebClient).DownloadString",
      "IEX (New-Object Net.WebClient).DownloadString",
      "IEX((New-Object Net.WebClient).DownloadString",
      "IEX(New-Object Net.WebClient).DownloadString",
      " -command (New-Object System.Net.WebClient).DownloadFile(",
      " -c (New-Object System.Net.WebClient).DownloadFile("
    ]
  },
  "condition": "selection"
}

References:
  - https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70
  - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
Sigma Detection Rule: Uncommon Extension Shim Database Installation Via Sdbinst.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-01
ATT&CK techniques: T1546.011
Log source: windows/process_creation

Description:
Detects installation of a potentially suspicious new shim with an uncommon extension using sdbinst.exe.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\sdbinst.exe"
    },
    {
      "OriginalFileName": "sdbinst.exe"
    }
  ],
  "filter_main_legit_ext": {
    "CommandLine|contains": ".sdb"
  },
  "filter_main_legit_extensions": [
    {
      "CommandLine|endswith": [
        " -c",
        " -f",
        " -mm",
        " -t"
      ]
    },
    {
      "CommandLine|contains": " -m -bg"
    }
  ],
  "filter_main_null": {
    "CommandLine": null
  },
  "filter_main_empty": {
    "CommandLine": ""
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
  - https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
Sigma Detection Rule: Windows Default Domain GPO Modification via GPME
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: TropChaud
Date: 2025-11-22
ATT&CK techniques: T1484.001
Log source: windows/process_creation

Description:
Detects the use of the Group Policy Management Editor (GPME) to modify Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may leverage GPME to make stealthy changes in these default GPOs to deploy malicious GPOs configurations across the domain without raising suspicion.


Detection logic:
{
  "selection_mmc": [
    {
      "Image|endswith": "\\mmc.exe"
    },
    {
      "OriginalFileName": "MMC.exe"
    }
  ],
  "selection_gpme": {
    "CommandLine|contains|all": [
      "gpme.msc",
      "gpobject:"
    ]
  },
  "selection_default_gpos": {
    "CommandLine|contains": [
      "31B2F340-016D-11D2-945F-00C04FB984F9",
      "6AC1786C-016F-11D2-945F-00C04FB984F9"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://adsecurity.org/?p=3377
  - https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
  - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
Sigma Detection Rule: New Root Certificate Installed Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, @redcanary, Zach Stanford @svch0st
Date: 2023-03-05
ATT&CK techniques: T1553.004
Log source: windows/process_creation

Description:
Detects execution of "certutil" with the "addstore" flag in order to install a new certificate on the system.
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli_add": {
    "CommandLine|contains|windash": "-addstore"
  },
  "selection_cli_store": {
    "CommandLine|contains": "root"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
Sigma Detection Rule: New Firewall Rule Added Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Markus Neis, Sander Wiebing
Date: 2019-01-29
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Detects the addition of a new rule to the Windows firewall via netsh

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " firewall ",
      " add "
    ]
  },
  "filter_optional_dropbox": {
    "CommandLine|contains": [
      "advfirewall firewall add rule name=Dropbox dir=in action=allow \"program=?:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe\" enable=yes profile=Any",
      "advfirewall firewall add rule name=Dropbox dir=in action=allow \"program=?:\\Program Files\\Dropbox\\Client\\Dropbox.exe\" enable=yes profile=Any"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
Sigma Detection Rule: Suspicious MSHTA Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Haag
Date: 2019-01-16
ATT&CK techniques: T1218.005
Log source: windows/process_creation

Description:
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\mshta.exe"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wscript.exe",
        "\\cscript.exe",
        "\\sh.exe",
        "\\bash.exe",
        "\\reg.exe",
        "\\regsvr32.exe",
        "\\bitsadmin.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE",
        "pwsh.dll",
        "wscript.exe",
        "cscript.exe",
        "Bash.exe",
        "reg.exe",
        "REGSVR32.EXE",
        "bitsadmin.exe"
      ]
    }
  ],
  "condition": "all of selection*"
}

References:
  - https://www.trustedsec.com/july-2015/malicious-htas/
Sigma Detection Rule: Compressed File Creation Via Tar.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), AdmU3
Date: 2023-12-19
ATT&CK techniques: T1560, T1560.001
Log source: windows/process_creation

Description:
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\tar.exe"
    },
    {
      "OriginalFileName": "bsdtar"
    }
  ],
  "selection_create": {
    "CommandLine|contains": [
      "-c",
      "-r",
      "-u"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://unit42.paloaltonetworks.com/chromeloader-malware/
  - https://lolbas-project.github.io/lolbas/Binaries/Tar/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
Sigma Detection Rule: Conhost.exe CommandLine Path Traversal
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-14
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

Detection logic:
{
  "selection": {
    "ParentCommandLine|contains": "conhost",
    "CommandLine|contains": "/../../"
  },
  "condition": "selection"
}

References:
  - https://pentestlab.blog/2020/07/06/indirect-command-execution/
Sigma Detection Rule: System File Execution Location Anomaly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2017-11-27
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\atbroker.exe",
      "\\audiodg.exe",
      "\\bcdedit.exe",
      "\\bitsadmin.exe",
      "\\certreq.exe",
      "\\certutil.exe",
      "\\cmstp.exe",
      "\\conhost.exe",
      "\\consent.exe",
      "\\cscript.exe",
      "\\csrss.exe",
      "\\dashost.exe",
      "\\defrag.exe",
      "\\dfrgui.exe",
      "\\dism.exe",
      "\\dllhost.exe",
      "\\dllhst3g.exe",
      "\\dwm.exe",
      "\\eventvwr.exe",
      "\\fsquirt.exe",
      "\\finger.exe",
      "\\logonui.exe",
      "\\LsaIso.exe",
      "\\lsass.exe",
      "\\lsm.exe",
      "\\msiexec.exe",
      "\\ntoskrnl.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\runonce.exe",
      "\\RuntimeBroker.exe",
      "\\schtasks.exe",
      "\\services.exe",
      "\\sihost.exe",
      "\\smartscreen.exe",
      "\\smss.exe",
      "\\spoolsv.exe",
      "\\svchost.exe",
      "\\taskhost.exe",
      "\\taskhostw.exe",
      "\\Taskmgr.exe",
      "\\userinit.exe",
      "\\werfault.exe",
      "\\werfaultsecure.exe",
      "\\wininit.exe",
      "\\winlogon.exe",
      "\\winver.exe",
      "\\wlanext.exe",
      "\\wscript.exe",
      "\\wsl.exe",
      "\\wsmprovhost.exe"
    ]
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\$WINDOWS.~BT\\",
      "C:\\$WinREAgent\\",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
    

References:
  - https://twitter.com/GelosSnake/status/[PII_REDACTED]26439170
  - https://asec.ahnlab.com/en/39828/
  - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
Sigma Detection Rule: Suspicious WindowsTerminal Child Processes
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-25
Log source: windows/process_creation

Description:
Detects suspicious children spawned via the Windows Terminal application which could be a sign of persistence via WindowsTerminal (see references section)

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\WindowsTerminal.exe",
      "\\wt.exe"
    ]
  },
  "selection_susp": [
    {
      "Image|endswith": [
        "\\rundll32.exe",
        "\\regsvr32.exe",
        "\\certutil.exe",
        "\\cscript.exe",
        "\\wscript.exe",
        "\\csc.exe"
      ]
    },
    {
      "Image|contains": [
        "C:\\Users\\Public\\",
        "\\Downloads\\",
        "\\Desktop\\",
        "\\AppData\\Local\\Temp\\",
        "\\Windows\\TEMP\\"
      ]
    },
    {
      "CommandLine|contains": [
        " iex ",
        " icm",
        "Invoke-",
        "Import-Module ",
        "ipmo ",
        "DownloadString(",
        " /c ",
        " /k ",
        " /r "
      ]
    }
  ],
  "filter_builtin_visual_studio_shell": {
    "CommandLine|contains|all": [
      "Import-Module",
      "Microsoft.VisualStudio.DevShell.dll",
      "Enter-VsDevShell"
    ]
  },
  "filter_open_settings": {
    "CommandLine|contains|all": [
      "\\AppData\\Local\\Packages\\Microsoft.WindowsTerminal_",
      "\\LocalState\\settings.json"
    ]
  },
  "filter_vsdevcmd": {
    "CommandLine|contains|all": [
      "C:\\Program Files\\Microsoft Visual Studio\\",
      "\\Common7\\Tools\\VsDevCmd.bat"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://persistence-info.github.io/Data/windowsterminalprofile.html
  - https://twitter.com/nas_bench/status/[PII_REDACTED]52686848
Sigma Detection Rule: Suspicious Execution of Systeminfo
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Detects usage of the "systeminfo" command to retrieve information

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\systeminfo.exe"
    },
    {
      "OriginalFileName": "sysinfo.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
Sigma Detection Rule: Potential Credential Dumping Via WER
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @pbssubhash , Nasreddine Bencherchali
Date: 2022-12-08
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects potential credential dumping via Windows Error Reporting LSASS Shtinkering technique which uses the Windows Error Reporting to dump lsass

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\Werfault.exe"
    },
    {
      "OriginalFileName": "WerFault.exe"
    }
  ],
  "selection_cli": {
    "ParentUser|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "CommandLine|contains|all": [
      " -u -p ",
      " -ip ",
      " -s "
    ]
  },
  "filter_lsass": {
    "ParentImage": "C:\\Windows\\System32\\lsass.exe"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
Sigma Detection Rule: Use NTFS Short Name in Command Line
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "~1.exe",
      "~1.bat",
      "~1.msi",
      "~1.vbe",
      "~1.vbs",
      "~1.dll",
      "~1.ps1",
      "~1.js",
      "~1.hta",
      "~2.exe",
      "~2.bat",
      "~2.msi",
      "~2.vbe",
      "~2.vbs",
      "~2.dll",
      "~2.ps1",
      "~2.js",
      "~2.hta"
    ]
  },
  "filter": [
    {
      "ParentImage|endswith": [
        "\\WebEx\\WebexHost.exe",
        "\\thor\\thor64.exe"
      ]
    },
    {
      "CommandLine|contains": "C:\\xampp\\vcredist\\VCREDI~1.EXE"
    }
  ],
  "condition": "selection and not filter"
}

References:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/jonasLyk/status/[PII_REDACTED]02921984
Sigma Detection Rule: Suspicious Windows Trace ETW Session Tamper Via Logman.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-02-11
ATT&CK techniques: T1685, T1685.005
Log source: windows/process_creation

Description:
Detects the execution of "logman" utility in order to disable or delete Windows trace sessions

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\logman.exe"
    },
    {
      "OriginalFileName": "Logman.exe"
    }
  ],
  "selection_action": {
    "CommandLine|contains": [
      "stop ",
      "delete "
    ]
  },
  "selection_service": {
    "CommandLine|contains": [
      "Circular Kernel Context Logger",
      "EventLog-",
      "SYSMON TRACE",
      "SysmonDnsEtwSession"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]32306183?s=21
  - https://ss64.com/nt/logman.html
Sigma Detection Rule: Potential Binary Impersonating Sysinternals Tools
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2021-12-20
ATT&CK techniques: T1218, T1202, T1036.005
Log source: windows/process_creation

Description:
Detects binaries that use the same name as legitimate sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.


Detection logic:
{
  "selection_exe": {
    "Image|endswith": [
      "\\accesschk.exe",
      "\\accesschk64.exe",
      "\\AccessEnum.exe",
      "\\ADExplorer.exe",
      "\\ADExplorer64.exe",
      "\\ADInsight.exe",
      "\\ADInsight64.exe",
      "\\adrestore.exe",
      "\\adrestore64.exe",
      "\\Autologon.exe",
      "\\Autologon64.exe",
      "\\Autoruns.exe",
      "\\Autoruns64.exe",
      "\\autorunsc.exe",
      "\\autorunsc64.exe",
      "\\Bginfo.exe",
      "\\Bginfo64.exe",
      "\\Cacheset.exe",
      "\\Cacheset64.exe",
      "\\Clockres.exe",
      "\\Clockres64.exe",
      "\\Contig.exe",
      "\\Contig64.exe",
      "\\Coreinfo.exe",
      "\\Coreinfo64.exe",
      "\\CPUSTRES.EXE",
      "\\CPUSTRES64.EXE",
      "\\ctrl2cap.exe",
      "\\Dbgview.exe",
      "\\dbgview64.exe",
      "\\Desktops.exe",
      "\\Desktops64.exe",
      "\\disk2vhd.exe",
      "\\disk2vhd64.exe",
      "\\diskext.exe",
      "\\diskext64.exe",
      "\\Diskmon.exe",
      "\\Diskmon64.exe",
      "\\DiskView.exe",
      "\\DiskView64.exe",
      "\\du.exe",
      "\\du64.exe",
      "\\efsdump.exe",
      "\\FindLinks.exe",
      "\\FindLinks64.exe",
      "\\handle.exe",
      "\\handle64.exe",
      "\\hex2dec.exe",
      "\\hex2dec64.exe",
      "\\junction.exe",
      "\\junction64.exe",
      "\\ldmdump.exe",
      "\\listdlls.exe",
      "\\listdlls64.exe",
      "\\livekd.exe",
      "\\livekd64.exe",
      "\\loadOrd.exe",
      "\\loadOrd64.exe",
      "\\loadOrdC.exe",
     

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite