deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: TeamViewer Remote Session
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-30
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
Detects the creation of log files during a TeamViewer remote session

Detection logic:
{
  "selection1": {
    "TargetFilename|endswith": [
      "\\TeamViewer\\RemotePrinting\\tvprint.db",
      "\\TeamViewer\\TVNetwork.log"
    ]
  },
  "selection2": {
    "TargetFilename|contains|all": [
      "\\TeamViewer",
      "_Logfile.log"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://www.teamviewer.com/en-us/
Sigma Detection Rule: UAC Bypass Using Windows Media Player - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Detection logic:
{
  "selection1": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|endswith": "\\AppData\\Local\\Temp\\OskSupport.dll"
  },
  "selection2": {
    "Image": "C:\\Windows\\system32\\DllHost.exe",
    "TargetFilename": "C:\\Program Files\\Windows Media Player\\osk.exe"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Uncommon File Creation By Mysql Daemon Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseph Kamau
Date: 2024-05-27
Log source: windows/file_event

Description:
Detects the creation of files with scripting or executable extensions by Mysql daemon.
Which could be an indicator of "User Defined Functions" abuse to download malware.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\mysqld.exe",
      "\\mysqld-nt.exe"
    ],
    "TargetFilename|endswith": [
      ".bat",
      ".dat",
      ".dll",
      ".exe",
      ".ps1",
      ".psm1",
      ".vbe",
      ".vbs"
    ]
  },
  "condition": "selection"
}

References:
  - https://asec.ahnlab.com/en/58878/
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-mysql-malware-infection-via-user-defined-functions-udf/
Sigma Detection Rule: EVTX Created In Uncommon Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: D3F7A5105
Date: 2023-01-02
ATT&CK techniques: T1685.001
Log source: windows/file_event

Description:
Detects the creation of new files with the ".evtx" extension in non-common or non-standard location.
This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within.
Note that backup software and legitimate administrator might perform similar actions during troubleshooting.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".evtx"
  },
  "filter_main_path": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\winevt\\Logs\\"
  },
  "filter_main_baseimage": {
    "TargetFilename|startswith": "C:\\ProgramData\\Microsoft\\Windows\\Containers\\BaseImages\\",
    "TargetFilename|endswith": "\\Windows\\System32\\winevt\\Logs\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/eventlog/eventlog-key
Sigma Detection Rule: NTDS.DIT Creation By Uncommon Parent Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-11
ATT&CK techniques: T1003.003
Log source: windows/file_event

Description:
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon parent process or directory

Detection logic:
{
  "selection_file": {
    "TargetFilename|endswith": "\\ntds.dit"
  },
  "selection_process_parent": {
    "ParentImage|endswith": [
      "\\cscript.exe",
      "\\httpd.exe",
      "\\nginx.exe",
      "\\php-cgi.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\w3wp.exe",
      "\\wscript.exe"
    ]
  },
  "selection_process_parent_path": {
    "ParentImage|contains": [
      "\\apache",
      "\\tomcat",
      "\\AppData\\",
      "\\Temp\\",
      "\\Public\\",
      "\\PerfLogs\\"
    ]
  },
  "condition": "selection_file and 1 of selection_process_*"
}

References:
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  - https://pentestlab.blog/tag/ntds-dit/
  - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
Sigma Detection Rule: Suspicious Startup Folder Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-08-10
ATT&CK techniques: T1204.002, T1547.001
Log source: windows/file_event

Description:
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors.
These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers.
This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Windows\\Start Menu\\Programs\\Startup\\",
    "TargetFilename|endswith": [
      ".bat",
      ".cmd",
      ".dll",
      ".hta",
      ".jar",
      ".js",
      ".jse",
      ".msi",
      ".ps1",
      ".psd1",
      ".psm1",
      ".scr",
      ".url",
      ".vba",
      ".vbe",
      ".vbs",
      ".wsf"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/last-byte/PersistenceSniper
  - https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
  - https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md
Sigma Detection Rule: Suspicious Binaries and Scripts in Public Folder
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: The DFIR Report
Date: 2025-01-23
ATT&CK techniques: T1204
Log source: windows/file_event

Description:
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": ":\\Users\\Public\\",
    "TargetFilename|endswith": [
      ".bat",
      ".dll",
      ".exe",
      ".hta",
      ".js",
      ".ps1",
      ".vbe",
      ".vbs"
    ]
  },
  "condition": "selection"
}

References:
  - https://intel.thedfirreport.com/events/view/30032
  - https://intel.thedfirreport.com/eventReports/view/70
  - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
Sigma Detection Rule: LiveKD Kernel Memory Dump File Created
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-16
Log source: windows/file_event

Description:
Detects the creation of a file that has the same name as the default LiveKD kernel memory dump.

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\Windows\\livekd.dmp"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Get-Variable.exe Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-04-23
ATT&CK techniques: T1546, T1027
Log source: windows/file_event

Description:
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "Local\\Microsoft\\WindowsApps\\Get-Variable.exe"
  },
  "condition": "selection"
}

References:
  - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
  - https://www.joesandbox.com/analysis/465533/0/html
Sigma Detection Rule: WerFault LSASS Process Memory Dump
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-27
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects WerFault creating a dump file with a name that indicates that the dump file could be an LSASS process memory, which contains user credentials

Detection logic:
{
  "selection": {
    "Image": "C:\\WINDOWS\\system32\\WerFault.exe",
    "TargetFilename|contains": [
      "\\lsass",
      "lsass.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/helpsystems/nanodump
Sigma Detection Rule: ADSI-Cache File Creation By Uncommon Tool
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: xknow @xknow_infosec, Tim Shelton
Date: 2019-03-24
ATT&CK techniques: T1001.003
Log source: windows/file_event

Description:
Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Local\\Microsoft\\Windows\\SchCache\\",
    "TargetFilename|endswith": ".sch"
  },
  "filter_main_generic": [
    {
      "Image|endswith": [
        ":\\Program Files\\Cylance\\Desktop\\CylanceSvc.exe",
        ":\\Windows\\CCM\\CcmExec.exe",
        ":\\windows\\system32\\dllhost.exe",
        ":\\Windows\\system32\\dsac.exe",
        ":\\Windows\\system32\\efsui.exe",
        ":\\windows\\system32\\mmc.exe",
        ":\\windows\\system32\\svchost.exe",
        ":\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        ":\\windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"
      ]
    },
    {
      "Image|contains": [
        ":\\Windows\\ccmsetup\\autoupgrade\\ccmsetup",
        ":\\Program Files\\SentinelOne\\Sentinel Agent"
      ]
    }
  ],
  "filter_main_office": {
    "Image|contains|all": [
      ":\\Program Files\\",
      "\\Microsoft Office"
    ],
    "Image|endswith": "\\OUTLOOK.EXE"
  },
  "filter_optional_ldapwhoami": {
    "Image|endswith": "\\LANDesk\\LDCLient\\ldapwhoami.exe"
  },
  "filter_optional_citrix": {
    "Image|endswith": ":\\Program Files\\Citrix\\Receiver StoreFront\\Services\\DefaultDomainServices\\Citrix.DeliveryServices.DomainServices.ServiceHost.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
  - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
  - https://github.com/fox-it/LDAPFragger
Sigma Detection Rule: Potential Winnti Dropper Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Alexander Rausch
Date: 2020-06-24
ATT&CK techniques: T1027
Log source: windows/file_event

Description:
Detects files dropped by Winnti as described in RedMimicry Winnti playbook

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\gthread-3.6.dll",
      "\\sigcmm-2.4.dll",
      "\\Windows\\Temp\\tmp.bat"
    ]
  },
  "condition": "selection"
}

References:
  - https://redmimicry.com/posts/redmimicry-winnti/#dropper
Sigma Detection Rule: Suspicious MSExchangeMailboxReplication ASPX Write
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-25
ATT&CK techniques: T1190, T1505.003
Log source: windows/file_event

Description:
Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation

Detection logic:
{
  "selection": {
    "Image|endswith": "\\MSExchangeMailboxReplication.exe",
    "TargetFilename|endswith": [
      ".aspx",
      ".asp"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/blackbyte-ransomware/
Sigma Detection Rule: Suspicious Interactive PowerShell as SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-07
ATT&CK techniques: T1059.001
Log source: windows/file_event

Description:
Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Detection logic:
{
  "selection": {
    "TargetFilename": [
      "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt",
      "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Windows\\PowerShell\\StartupProfileData-Interactive"
    ]
  },
  "condition": "selection"
}

References:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PowerSploit_Invoke-Mimikatz.htm
Sigma Detection Rule: Suspicious File Created by ArcSOC.exe
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Micah Babinski
Date: 2025-11-25
ATT&CK techniques: T1127, T1105, T1133
Log source: windows/file_event

Description:
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\ArcSOC.exe",
    "TargetFilename|endswith": [
      ".ahk",
      ".aspx",
      ".au3",
      ".bat",
      ".cmd",
      ".dll",
      ".exe",
      ".hta",
      ".js",
      ".ps1",
      ".py",
      ".vbe",
      ".vbs",
      ".wsf"
    ]
  },
  "condition": "selection"
}

References:
  - https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
  - https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
Sigma Detection Rule: Potential Homoglyph Attack Using Lookalike Characters in Filename
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski, @micahbabinski
Date: 2023-05-08
ATT&CK techniques: T1036, T1036.003
Log source: windows/file_event

Description:
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.


Detection logic:
{
  "selection_upper": {
    "TargetFilename|contains": [
      "\u0410",
      "\u0412",
      "\u0415",
      "\u041a",
      "\u041c",
      "\u041d",
      "\u041e",
      "\u0420",
      "\u0421",
      "\u0422",
      "\u0425",
      "\u0405",
      "\u0406",
      "\u0408",
      "\u04ae",
      "\u04c0",
      "\u050c",
      "\u051a",
      "\u051c",
      "\u0391",
      "\u0392",
      "\u0395",
      "\u0396",
      "\u0397",
      "\u0399",
      "\u039a",
      "\u039c",
      "\u039d",
      "\u039f",
      "\u03a1",
      "\u03a4",
      "\u03a5",
      "\u03a7"
    ]
  },
  "selection_lower": {
    "TargetFilename|contains": [
      "\u0430",
      "\u0435",
      "\u043e",
      "\u0440",
      "\u0441",
      "\u0445",
      "\u0455",
      "\u0456",
      "\u04cf",
      "\u0458",
      "\u04bb",
      "\u0501",
      "\u051b",
      "\u051d",
      "\u03bf"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish
  - http://www.irongeek.com/homoglyph-attack-generator.php
Sigma Detection Rule: DLL Search Order Hijackig Via Additional Space in Path
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-30
ATT&CK techniques: T1574.001
Log source: windows/file_event

Description:
Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...)
but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack


Detection logic:
{
  "selection": {
    "TargetFilename|startswith": [
      "C:\\Windows \\",
      "C:\\Program Files \\",
      "C:\\Program Files (x86) \\"
    ],
    "TargetFilename|endswith": ".dll"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]64292864
  - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows
Sigma Detection Rule: ISO or Image Mount Indicator in Recent Files
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-11
ATT&CK techniques: T1566.001
Log source: windows/file_event

Description:
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ".iso.lnk",
      ".img.lnk",
      ".vhd.lnk",
      ".vhdx.lnk"
    ],
    "TargetFilename|contains": "\\Microsoft\\Windows\\Recent\\"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/
  - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
  - https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/
  - https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/
Sigma Detection Rule: GatherNetworkInfo.VBS Reconnaissance Script Output
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
Log source: windows/file_event

Description:
Detects creation of files which are the results of executing the built-in reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs".

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\config",
    "TargetFilename|endswith": [
      "\\Hotfixinfo.txt",
      "\\netiostate.txt",
      "\\sysportslog.txt",
      "\\VmSwitchLog.evtx"
    ]
  },
  "condition": "selection"
}

References:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
Sigma Detection Rule: UAC Bypass Using Consent and Comctl32 - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\consent.exe.@",
    "TargetFilename|endswith": "\\comctl32.dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious File Drop by Exchange
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-04
ATT&CK techniques: T1190, T1505.003
Log source: windows/file_event

Description:
Detects suspicious file type dropped by an Exchange component in IIS

Detection logic:
{
  "selection": {
    "Image|endswith": "\\w3wp.exe",
    "CommandLine|contains": "MSExchange"
  },
  "selection_types": {
    "TargetFilename|endswith": [
      ".aspx",
      ".asp",
      ".ashx",
      ".ps1",
      ".bat",
      ".exe",
      ".dll",
      ".vbs"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
  - https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html
  - https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html
Sigma Detection Rule: VHD Image Download Via Browser
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2021-10-25
ATT&CK techniques: T1587.001
Log source: windows/file_event

Description:
Detects creation of ".vhd"/".vhdx" files by browser processes.
Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\firefox.exe",
      "\\iexplore.exe",
      "\\maxthon.exe",
      "\\MicrosoftEdge.exe",
      "\\msedge.exe",
      "\\msedgewebview2.exe",
      "\\opera.exe",
      "\\safari.exe",
      "\\seamonkey.exe",
      "\\vivaldi.exe",
      "\\whale.exe"
    ],
    "TargetFilename|contains": ".vhd"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/intelligence-insights-october-2021/
  - https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
  - https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Sigma Detection Rule: Creation Of Non-Existent System DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), fornotes
Date: 2022-12-01
ATT&CK techniques: T1574.001
Log source: windows/file_event

Description:
Detects creation of specific system DLL files that are  usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes.
Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.
Thus, the creation of such DLLs may indicate preparation for phantom DLL hijacking attacks.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ":\\Windows\\System32\\axeonoffhelper.dll",
      ":\\Windows\\System32\\cdpsgshims.dll",
      ":\\Windows\\System32\\oci.dll",
      ":\\Windows\\System32\\offdmpsvc.dll",
      ":\\Windows\\System32\\shellchromeapi.dll",
      ":\\Windows\\System32\\TSMSISrv.dll",
      ":\\Windows\\System32\\TSVIPSrv.dll",
      ":\\Windows\\System32\\wbem\\wbemcomn.dll",
      ":\\Windows\\System32\\WLBSCTRL.dll",
      ":\\Windows\\System32\\wow64log.dll",
      ":\\Windows\\System32\\WptsExtensions.dll",
      "\\SprintCSP.dll"
    ]
  },
  "condition": "selection"
}

References:
  - http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html
  - https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/
  - https://decoded.avast.io/martinchlumecky/png-steganography/
  - https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc
  - https://github.com/Wh04m1001/SysmonEoP
Sigma Detection Rule: Dynamic CSharp Compile Artefact
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-09
ATT&CK techniques: T1027.004
Log source: windows/file_event

Description:
When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".cmdline"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.004/T1027.004.md#atomic-test-2---dynamic-c-compile