deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Disabling Windows Defender WMI Autologger Session via Reg.exe
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Matt Anderson (Huntress)
Date: 2025-07-09
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events.
By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events
from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_reg_path": {
    "CommandLine|contains": [
      "\\Control\\WMI\\Autologger\\DefenderApiLogger\\Start",
      "\\Control\\WMI\\Autologger\\DefenderAuditLogger\\Start"
    ]
  },
  "selection_reg_add": {
    "CommandLine|contains|all": [
      "add",
      "0"
    ]
  },
  "filter_main_enable": {
    "CommandLine|contains": "0x00000001"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
  - https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
  - https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
Sigma Detection Rule: Stop Windows Service Via Net.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-05
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects the stopping of a Windows service via the "net" utility.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " stop "
  },
  "condition": "all of selection_*"
}

References:
  - https://ss64.com/nt/net-service.html
Sigma Detection Rule: SQLite Chromium Profile Data DB Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: TropChaud
Date: 2022-12-19
ATT&CK techniques: T1539, T1555.003, T1005
Log source: windows/process_creation

Description:
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.

Detection logic:
{
  "selection_sql": [
    {
      "Product": "SQLite"
    },
    {
      "Image|endswith": [
        "\\sqlite.exe",
        "\\sqlite3.exe"
      ]
    }
  ],
  "selection_chromium": {
    "CommandLine|contains": [
      "\\User Data\\",
      "\\Opera Software\\",
      "\\ChromiumViewer\\"
    ]
  },
  "selection_data": {
    "CommandLine|contains": [
      "Login Data",
      "Cookies",
      "Web Data",
      "History",
      "Bookmarks"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c[PII_REDACTED]b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows
  - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
Sigma Detection Rule: Suspicious Scheduled Task Name As GUID
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-31
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects creation of a scheduled task with a GUID like name

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": "/Create "
  },
  "selection_tn": {
    "CommandLine|contains": [
      "/TN \"{",
      "/TN '{",
      "/TN {"
    ]
  },
  "selection_end": {
    "CommandLine|contains": [
      "}\"",
      "}'",
      "} "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Sigma Detection Rule: HackTool - LocalPotato Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-14
Log source: windows/process_creation

Description:
Detects the execution of the LocalPotato POC based on basic PE metadata information and default CLI examples

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\LocalPotato.exe"
  },
  "selection_cli": {
    "CommandLine|contains|all": [
      ".exe -i C:\\",
      "-o Windows\\"
    ]
  },
  "selection_hash_plain": {
    "Hashes|contains": [
      "IMPHASH=E1742EE971D6549E8D4D81115F88F1FC",
      "IMPHASH=DD82066EFBA94D7556EF582F247C8BB5"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.localpotato.com/localpotato_html/LocalPotato.html
  - https://github.com/decoder-it/LocalPotato
Sigma Detection Rule: VolumeShadowCopy Symlink Creation Via Mklink
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1003.002, T1003.003
Log source: windows/process_creation

Description:
Shadow Copies storage symbolic link creation using operating systems utilities

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "mklink",
      "HarddiskVolumeShadowCopy"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: Remote Access Tool - AnyDesk Silent Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ján Trenčanský
Date: 2021-08-06
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects AnyDesk Remote Desktop silent installation. Which can be used by attackers to gain remote access.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "--install",
      "--start-with-win",
      "--silent"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/TheDFIRReport/status/[PII_REDACTED]26816776?s=20
  - https://support.anydesk.com/Automatic_Deployment
Sigma Detection Rule: Remote File Download Via Findstr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-05
ATT&CK techniques: T1218, T1564.004, T1552.001, T1105
Log source: windows/process_creation

Description:
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.


Detection logic:
{
  "selection_findstr": [
    {
      "CommandLine|contains": "findstr"
    },
    {
      "Image|endswith": "findstr.exe"
    },
    {
      "OriginalFileName": "FINDSTR.EXE"
    }
  ],
  "selection_cli_download_1": {
    "CommandLine|contains|windash": " -v "
  },
  "selection_cli_download_2": {
    "CommandLine|contains|windash": " -l "
  },
  "selection_cli_download_3": {
    "CommandLine|contains": "\\\\\\\\"
  },
  "condition": "selection_findstr and all of selection_cli_download_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: Winrar Compressing Dump Files
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-04
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\rar.exe",
        "\\winrar.exe"
      ]
    },
    {
      "Description": "Command line RAR"
    }
  ],
  "selection_extension": {
    "CommandLine|contains": [
      ".dmp",
      ".dump",
      ".hdmp"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
Sigma Detection Rule: Arbitrary File Download Via IMEWDBLD.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-11-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of "IMEWDBLD.exe" to download arbitrary files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\IMEWDBLD.exe"
    },
    {
      "OriginalFileName": "imewdbld.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download
  - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/
Sigma Detection Rule: Application Removed Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-28
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects the removal or uninstallation of an application via "Wmic.EXE".

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "call",
      "uninstall"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-10---application-uninstall-using-wmic
Sigma Detection Rule: Potential PowerShell Command Line Obfuscation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp)
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects the PowerShell command lines with special characters

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_re": [
    {
      "CommandLine|re": "\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+.*\\+"
    },
    {
      "CommandLine|re": "\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{.*\\{"
    },
    {
      "CommandLine|re": "\\^.*\\^.*\\^.*\\^.*\\^"
    },
    {
      "CommandLine|re": "`.*`.*`.*`.*`"
    }
  ],
  "filter_optional_amazonSSM": {
    "ParentImage": "C:\\Program Files\\Amazon\\SSM\\ssm-document-worker.exe"
  },
  "filter_optional_defender_atp": {
    "CommandLine|contains": [
      "new EventSource(\"Microsoft.Windows.Sense.Client.Management\"",
      "public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle);"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64
Sigma Detection Rule: HackTool - PurpleSharp Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-06-18
ATT&CK techniques: T1587
Log source: windows/process_creation

Description:
Detects the execution of the PurpleSharp adversary simulation tool

Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\purplesharp"
    },
    {
      "OriginalFileName": "PurpleSharp.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "xyz123456.exe",
      "PurpleSharp"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/mvelazc0/PurpleSharp
Sigma Detection Rule: UtilityFunctions.ps1 Proxy Dll
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-28
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "UtilityFunctions.ps1",
      "RegSnapin "
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/
Sigma Detection Rule: Potential Password Spraying Attempt Using Dsacls.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects possible password spraying attempts using Dsacls

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dsacls.exe"
    },
    {
      "OriginalFileName": "DSACLS.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/user:",
      "/passwd:"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/using-dsacls-to-check-ad-object-permissions#password-spraying-anyone
  - https://ss64.com/nt/dsacls.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
Sigma Detection Rule: Disable Windows Defender AV Security Monitoring
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: ok @securonix invrep-de, oscd.community, frack113
Date: 2020-10-12
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects attackers attempting to disable Windows Defender using Powershell

Detection logic:
{
  "selection_pwsh_binary": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_pwsh_cli": {
    "CommandLine|contains": [
      "-DisableBehaviorMonitoring $true",
      "-DisableRuntimeMonitoring $true"
    ]
  },
  "selection_sc_binary": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_sc_tamper_cmd_stop": {
    "CommandLine|contains|all": [
      "stop",
      "WinDefend"
    ]
  },
  "selection_sc_tamper_cmd_delete": {
    "CommandLine|contains|all": [
      "delete",
      "WinDefend"
    ]
  },
  "selection_sc_tamper_cmd_disabled": {
    "CommandLine|contains|all": [
      "config",
      "WinDefend",
      "start=disabled"
    ]
  },
  "condition": "all of selection_pwsh_* or (selection_sc_binary and 1 of selection_sc_tamper_*)"
}

References:
  - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/
  - https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: PktMon.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1040
Log source: windows/process_creation

Description:
Detects execution of PktMon, a tool that captures network packets.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\pktmon.exe"
    },
    {
      "OriginalFileName": "PktMon.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/
Sigma Detection Rule: Potential Privilege Escalation Using Symlink Between Osk and Cmd
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-12-11
ATT&CK techniques: T1546.008
Log source: windows/process_creation

Description:
Detects the creation of a symbolic link between "cmd.exe" and the accessibility on-screen keyboard binary (osk.exe) using "mklink". This technique provides an elevated command prompt to the user from the login screen without the need to log in.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "mklink",
      "\\osk.exe",
      "\\cmd.exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1546.008/T1546.008.md
  - https://ss64.com/nt/mklink.html
Sigma Detection Rule: Potential Defense Evasion Via Rename Of Highly Relevant Binaries
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Matthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
Date: 2019-06-15
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Detection logic:
{
  "selection": [
    {
      "Description": "Execute processes remotely"
    },
    {
      "Product": "Sysinternals PsExec"
    },
    {
      "Description|startswith": [
        "Windows PowerShell",
        "pwsh"
      ]
    },
    {
      "OriginalFileName": [
        "certutil.exe",
        "cmstp.exe",
        "cscript.exe",
        "IE4UINIT.EXE",
        "finger.exe",
        "mshta.exe",
        "msiexec.exe",
        "msxsl.exe",
        "powershell_ise.exe",
        "powershell.exe",
        "psexec.c",
        "psexec.exe",
        "psexesvc.exe",
        "pwsh.dll",
        "reg.exe",
        "regsvr32.exe",
        "rundll32.exe",
        "WerMgr",
        "wmic.exe",
        "wscript.exe"
      ]
    }
  ],
  "filter": {
    "Image|endswith": [
      "\\certutil.exe",
      "\\cmstp.exe",
      "\\cscript.exe",
      "\\ie4uinit.exe",
      "\\finger.exe",
      "\\mshta.exe",
      "\\msiexec.exe",
      "\\msxsl.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\psexec.exe",
      "\\psexec64.exe",
      "\\PSEXESVC.exe",
      "\\pwsh.exe",
      "\\reg.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wermgr.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
  - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
  - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks
  - https://twitter.com/christophetd/status/[PII_REDACTED]20952320
  - https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/
Sigma Detection Rule: Suspicious Uninstall of Windows Defender Feature via PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: yxinmiracle
Date: 2025-08-22
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell_ISE.EXE",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_uninstall": {
    "CommandLine|contains": [
      "Uninstall-WindowsFeature",
      "Remove-WindowsFeature"
    ]
  },
  "selection_cli_defender_feature": {
    "CommandLine|contains": "Windows-Defender"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.windows.servermanager.migration/uninstall-windowsfeature
  - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
Sigma Detection Rule: PUA - AdFind.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-26
ATT&CK techniques: T1087.002
Log source: windows/process_creation

Description:
Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\AdFind.exe"
    },
    {
      "OriginalFileName": "AdFind.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=d144de8117df2beceaba2201ad304764",
        "IMPHASH=12ce1c0f3f5837ecc18a3782408fa975",
        "IMPHASH=bca5675746d13a1f246e2da3c2217492",
        "IMPHASH=4fbf3f084fbbb2470b80b2013134df35",
        "IMPHASH=49b639b4acbecc49d72a01f357aa4930",
        "IMPHASH=53e117a96057eaf19c41380d0e87f1c2",
        "IMPHASH=680dad9e300346e05a[PII_REDACTED]7201",
        "IMPHASH=21aa085d54992511b9f115355e468782"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
Sigma Detection Rule: Dllhost.EXE Execution Anomaly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-27
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\dllhost.exe",
    "CommandLine": [
      "dllhost.exe",
      "dllhost"
    ]
  },
  "filter_main_null": {
    "CommandLine": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://redcanary.com/blog/child-processes/
  - https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Script Event Consumer Spawning Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sittikorn S
Date: 2021-06-21
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects a suspicious child process of Script Event Consumer (scrcons.exe).

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\scrcons.exe",
    "Image|endswith": [
      "\\svchost.exe",
      "\\dllhost.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe",
      "\\cscript.exe",
      "\\schtasks.exe",
      "\\regsvr32.exe",
      "\\mshta.exe",
      "\\rundll32.exe",
      "\\msiexec.exe",
      "\\msbuild.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/child-processes/
  - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html