deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Visual Studio NodejsTools PressAnyKey Renamed Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2023-04-11
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries

Detection logic:
{
  "selection": {
    "OriginalFileName": "Microsoft.NodejsTools.PressAnyKey.exe"
  },
  "filter_main_legit_name": {
    "Image|endswith": "\\Microsoft.NodejsTools.PressAnyKey.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]18854661
  - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5
Sigma Detection Rule: Remotely Hosted HTA File Executed Via Mshta.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-08
ATT&CK techniques: T1218.005
Log source: windows/process_creation

Description:
Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mshta.exe"
    },
    {
      "OriginalFileName": "MSHTA.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "http://",
      "https://",
      "ftp://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
Sigma Detection Rule: Raccine Uninstall
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-21
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects commands that indicate a Raccine removal from an end system. Raccine is a free ransomware protection tool.

Detection logic:
{
  "selection1": {
    "CommandLine|contains|all": [
      "taskkill ",
      "RaccineSettings.exe"
    ]
  },
  "selection2": {
    "CommandLine|contains|all": [
      "reg.exe",
      "delete",
      "Raccine Tray"
    ]
  },
  "selection3": {
    "CommandLine|contains|all": [
      "schtasks",
      "/DELETE",
      "Raccine Rules Updater"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/Neo23x0/Raccine
Sigma Detection Rule: Terminal Service Process Spawn
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-05-22
ATT&CK techniques: T1190, T1210
Log source: windows/process_creation

Description:
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)

Detection logic:
{
  "selection": {
    "ParentCommandLine|contains|all": [
      "\\svchost.exe",
      "termsvcs"
    ]
  },
  "filter_img": {
    "Image|endswith": [
      "\\rdpclip.exe",
      ":\\Windows\\System32\\csrss.exe",
      ":\\Windows\\System32\\wininit.exe",
      ":\\Windows\\System32\\winlogon.exe"
    ]
  },
  "filter_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/rdp-stands-for-really-do-patch-understanding-the-wormable-rdp-vulnerability-cve-2019-0708/
Sigma Detection Rule: Potential Persistence Via Microsoft Compatibility Appraiser
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-09-29
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects manual execution of the "Microsoft Compatibility Appraiser" task via schtasks.
In order to trigger persistence stored in the "\AppCompatFlags\TelemetryController" registry key.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "run ",
      "\\Application Experience\\Microsoft Compatibility Appraiser"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/
Sigma Detection Rule: Suspicious Microsoft OneNote Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
Date: 2022-10-21
ATT&CK techniques: T1566, T1566.001
Log source: windows/process_creation

Description:
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\onenote.exe"
  },
  "selection_opt_img": [
    {
      "OriginalFileName": [
        "bitsadmin.exe",
        "CertOC.exe",
        "CertUtil.exe",
        "Cmd.Exe",
        "CMSTP.EXE",
        "cscript.exe",
        "curl.exe",
        "HH.exe",
        "IEExec.exe",
        "InstallUtil.exe",
        "javaw.exe",
        "Microsoft.Workflow.Compiler.exe",
        "msdt.exe",
        "MSHTA.EXE",
        "msiexec.exe",
        "Msxsl.exe",
        "odbcconf.exe",
        "pcalua.exe",
        "PowerShell.EXE",
        "RegAsm.exe",
        "RegSvcs.exe",
        "REGSVR32.exe",
        "RUNDLL32.exe",
        "schtasks.exe",
        "ScriptRunner.exe",
        "wmic.exe",
        "WorkFolders.exe",
        "wscript.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\AppVLP.exe",
        "\\bash.exe",
        "\\bitsadmin.exe",
        "\\certoc.exe",
        "\\certutil.exe",
        "\\cmd.exe",
        "\\cmstp.exe",
        "\\control.exe",
        "\\cscript.exe",
        "\\curl.exe",
        "\\forfiles.exe",
        "\\hh.exe",
        "\\ieexec.exe",
        "\\installutil.exe",
        "\\javaw.exe",
        "\\mftrace.exe",
        "\\Microsoft.Workflow.Compiler.exe",
        "\\msbuild.exe",
        "\\msdt.exe",
        "\\mshta.exe",
        "\\msidb.exe",
        "\\msiexec.exe",
        "\\msxsl.exe",
        "\\odbcconf.exe",
        "\\pcalua.exe",
        "\\powershell.exe",
        "\\pw

References:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-e34e43eb[PII_REDACTED]ddf488b2bf3b545bd9aae81af3e6f6c7949f9652abdf18
  - https://micahbabinski.medium.com/detecting-onenote-one-malware-delivery-407e9321ecf0
Sigma Detection Rule: Filter Driver Unloaded Via Fltmc.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-13
ATT&CK techniques: T1070, T1685, T1685.001
Log source: windows/process_creation

Description:
Detect filter driver unloading activity via fltmc.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\fltMC.exe"
    },
    {
      "OriginalFileName": "fltMC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "unload"
  },
  "filter_optional_avira": {
    "ParentImage|contains": [
      "\\AppData\\Local\\Temp\\",
      ":\\Windows\\Temp\\"
    ],
    "ParentImage|endswith": "\\endpoint-protection-installer-x64.tmp",
    "CommandLine|endswith": [
      "unload rtp_filesystem_filter",
      "unload rtp_filter"
    ]
  },
  "filter_optional_manageengine": {
    "ParentImage": "C:\\Program Files (x86)\\ManageEngine\\uems_agent\\bin\\dcfaservice64.exe",
    "CommandLine|endswith": "unload DFMFilter"
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
  - https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom
Sigma Detection Rule: PUA - System Informer Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-05-08
ATT&CK techniques: T1082, T1564, T1543
Log source: windows/process_creation

Description:
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SystemInformer.exe"
    },
    {
      "OriginalFileName": "SystemInformer.exe"
    },
    {
      "Description": "System Informer"
    },
    {
      "Product": "System Informer"
    },
    {
      "Hashes|contains": [
        "MD5=19426363A37C03C3ED6FEDF57B6696EC",
        "SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC",
        "SHA256=8EE9D84DE[PII_REDACTED]7A63C686822388A3338497CDDB660D5D69CF68B68F287",
        "IMPHASH=B68908ADAEB5D662F87F2528AF318F12"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/winsiderss/systeminformer
Sigma Detection Rule: Process Execution From A Potentially Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton
Date: 2019-01-16
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects a potentially suspicious execution from an uncommon folder.

Detection logic:
{
  "selection": {
    "Image|contains": [
      ":\\Perflogs\\",
      ":\\Users\\All Users\\",
      ":\\Users\\Default\\",
      ":\\Users\\NetworkService\\",
      ":\\Windows\\addins\\",
      ":\\Windows\\debug\\",
      ":\\Windows\\Fonts\\",
      ":\\Windows\\Help\\",
      ":\\Windows\\IME\\",
      ":\\Windows\\Media\\",
      ":\\Windows\\repair\\",
      ":\\Windows\\security\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      "$Recycle.bin",
      "\\config\\systemprofile\\",
      "\\Intel\\Logs\\",
      "\\RSA\\MachineKeys\\"
    ]
  },
  "filter_optional_ibm": {
    "Image|startswith": "C:\\Users\\Public\\IBM\\ClientSolutions\\Start_Programs\\"
  },
  "filter_optional_citrix": {
    "Image|startswith": "C:\\Windows\\SysWOW64\\config\\systemprofile\\Citrix\\UpdaterBinaries\\",
    "Image|endswith": "\\CitrixReceiverUpdater.exe"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt
  - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses
  - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/
  - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md
Sigma Detection Rule: Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)
Date: 2023-10-09
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"


Detection logic:
{
  "selection": {
    "CommandLine|contains": "::$index_allocation"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/pfiatde/status/[PII_REDACTED]88738305
  - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
  - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
  - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
Sigma Detection Rule: Diskshadow Script Mode - Execution From Potential Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-15
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "diskshadow.exe"
    },
    {
      "Image|endswith": "\\diskshadow.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-s "
  },
  "selection_paths": {
    "CommandLine|contains": [
      ":\\Temp\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\",
      "\\AppData\\Roaming\\",
      "\\ProgramData\\",
      "\\Users\\Public\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
  - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
Sigma Detection Rule: Arbitrary Shell Command Execution Via Settingcontent-Ms
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-03-13
ATT&CK techniques: T1204, T1566.001
Log source: windows/process_creation

Description:
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.

Detection logic:
{
  "selection": {
    "CommandLine|contains": ".SettingContent-ms"
  },
  "filter": {
    "CommandLine|contains": "immersivecontrolpanel"
  },
  "condition": "selection and not filter"
}

References:
  - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
Sigma Detection Rule: PUA - Seatbelt Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-18
ATT&CK techniques: T1526, T1087, T1083
Log source: windows/process_creation

Description:
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\Seatbelt.exe"
    },
    {
      "OriginalFileName": "Seatbelt.exe"
    },
    {
      "Description": "Seatbelt"
    },
    {
      "CommandLine|contains": [
        " DpapiMasterKeys",
        " InterestingProcesses",
        " InterestingFiles",
        " CertificateThumbprints",
        " ChromiumBookmarks",
        " ChromiumHistory",
        " ChromiumPresence",
        " CloudCredentials",
        " CredEnum",
        " CredGuard",
        " FirefoxHistory",
        " ProcessCreationEvents"
      ]
    }
  ],
  "selection_group_list": {
    "CommandLine|contains": [
      " -group=misc",
      " -group=remote",
      " -group=chromium",
      " -group=slack",
      " -group=system",
      " -group=user",
      " -group=all"
    ]
  },
  "selection_group_output": {
    "CommandLine|contains": " -outputfile="
  },
  "condition": "selection_img or all of selection_group_*"
}

References:
  - https://github.com/GhostPack/Seatbelt
  - https://www.bluetangle.dev/2022/08/fastening-seatbelt-on-threat-hunting.html
Sigma Detection Rule: File With Suspicious Extension Downloaded Via Bitsadmin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1197, T1036.003, T1105
Log source: windows/process_creation

Description:
Detects usage of bitsadmin downloading a file with a suspicious extension

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      " /transfer ",
      " /create ",
      " /addfile "
    ]
  },
  "selection_extension": {
    "CommandLine|contains": [
      ".7z",
      ".asax",
      ".ashx",
      ".asmx",
      ".asp",
      ".aspx",
      ".bat",
      ".cfm",
      ".cgi",
      ".chm",
      ".cmd",
      ".dll",
      ".gif",
      ".jpeg",
      ".jpg",
      ".jsp",
      ".jspx",
      ".log",
      ".png",
      ".ps1",
      ".psm1",
      ".rar",
      ".scf",
      ".sct",
      ".txt",
      ".vbe",
      ".vbs",
      ".war",
      ".wsf",
      ".wsh",
      ".xll",
      ".zip"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
Sigma Detection Rule: Computer Password Change Via Ksetup.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-06
Log source: windows/process_creation

Description:
Detects password change for the computer's domain account or host principal via "ksetup.exe"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ksetup.exe"
    },
    {
      "OriginalFileName": "ksetup.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " /setcomputerpassword "
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Oddvarmoe/status/[PII_REDACTED]05513729
  - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
Sigma Detection Rule: Renamed ProcDump Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2019-11-18
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed ProcDump executable.
This often done by attackers or malware in order to evade defensive mechanisms.


Detection logic:
{
  "selection_ofn": {
    "OriginalFileName": "procdump"
  },
  "selection_cli_dump_flag": {
    "CommandLine|contains|windash": [
      " -ma ",
      " -mp "
    ]
  },
  "selection_cli_eula_flag": {
    "CommandLine|contains|windash": " /accepteula"
  },
  "filter_main_known_names": {
    "Image|endswith": [
      "\\procdump.exe",
      "\\procdump64.exe"
    ]
  },
  "condition": "(selection_ofn or all of selection_cli_*) and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
Sigma Detection Rule: Potentially Suspicious Execution Of Regasm/Regsvcs With Uncommon Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-13
ATT&CK techniques: T1218.009
Log source: windows/process_creation

Description:
Detects potentially suspicious execution of the Regasm/Regsvcs utilities with an uncommon extension.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\Regsvcs.exe",
        "\\Regasm.exe"
      ]
    },
    {
      "OriginalFileName": [
        "RegSvcs.exe",
        "RegAsm.exe"
      ]
    }
  ],
  "selection_extension": {
    "CommandLine|contains": [
      ".dat",
      ".gif",
      ".jpeg",
      ".jpg",
      ".png",
      ".txt"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.fortiguard.com/threat-signal-report/4718?s=09
  - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
Sigma Detection Rule: Potential Homoglyph Attack Using Lookalike Characters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski, @micahbabinski
Date: 2023-05-07
ATT&CK techniques: T1036, T1036.003
Log source: windows/process_creation

Description:
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.


Detection logic:
{
  "selection_upper": {
    "CommandLine|contains": [
      "\u0410",
      "\u0412",
      "\u0415",
      "\u041a",
      "\u041c",
      "\u041d",
      "\u041e",
      "\u0420",
      "\u0421",
      "\u0422",
      "\u0425",
      "\u0405",
      "\u0406",
      "\u0408",
      "\u04ae",
      "\u04c0",
      "\u050c",
      "\u051a",
      "\u051c",
      "\u0391",
      "\u0392",
      "\u0395",
      "\u0396",
      "\u0397",
      "\u0399",
      "\u039a",
      "\u039c",
      "\u039d",
      "\u039f",
      "\u03a1",
      "\u03a4",
      "\u03a5",
      "\u03a7"
    ]
  },
  "selection_lower": {
    "CommandLine|contains": [
      "\u0430",
      "\u0435",
      "\u043e",
      "\u0440",
      "\u0441",
      "\u0445",
      "\u0455",
      "\u0456",
      "\u04cf",
      "\u0458",
      "\u04bb",
      "\u0501",
      "\u051b",
      "\u051d",
      "\u03bf"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
  - http://www.irongeek.com/homoglyph-attack-generator.php
Sigma Detection Rule: Suspicious Recursive Takeown
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-30
ATT&CK techniques: T1222.001
Log source: windows/process_creation

Description:
Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders

Detection logic:
{
  "selection": {
    "Image|endswith": "\\takeown.exe",
    "CommandLine|contains|all": [
      "/f ",
      "/r"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility
Sigma Detection Rule: Scheduled Task Creation with Curl and PowerShell Execution Combo
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
ATT&CK techniques: T1053.005, T1218, T1105
Log source: windows/process_creation

Description:
Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.
This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|windash": " /create "
  },
  "selection_curl": {
    "CommandLine|contains|all": [
      "curl ",
      "http",
      "-o"
    ]
  },
  "selection_powershell": {
    "CommandLine|contains": "powershell"
  },
  "condition": "all of selection_*"
}

References:
  - https://tria.ge/241015-l98snsyeje/behavioral2