deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PUA - PAExec Default Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-26
ATT&CK techniques: T1569.002
Log source: windows/pipe_created

Description:
Detects PAExec default named pipe

Detection logic:
{
  "selection": {
    "PipeName|startswith": "\\PAExec"
  },
  "condition": "selection"
}

References:
  - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Command%20and%20Control/C2-NamedPipe.md
  - https://github.com/poweradminllc/PAExec
Sigma Detection Rule: HackTool - EfsPotato Named Pipe Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1055
Log source: windows/pipe_created

Description:
Detects the pattern of a pipe name as used by the hack tool EfsPotato

Detection logic:
{
  "selection": {
    "PipeName|contains": [
      "\\pipe\\",
      "\\pipe\\srvsvc"
    ]
  },
  "filter_optional_ctx": {
    "PipeName|contains": "\\CtxShare"
  },
  "filter_optional_default": {
    "PipeName|startswith": "\\pipe\\"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]91193354?s=20
  - https://github.com/zcgonvh/EfsPotato
Sigma Detection Rule: PUA - CSExec Default Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-07
ATT&CK techniques: T1021.002, T1569.002
Log source: windows/pipe_created

Description:
Detects default CSExec pipe creation

Detection logic:
{
  "selection": {
    "PipeName|contains": "\\csexecsvc"
  },
  "condition": "selection"
}

References:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
  - https://github.com/malcomvetter/CSExec
Sigma Detection Rule: WMI Event Consumer Created Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-09-01
ATT&CK techniques: T1047
Log source: windows/pipe_created

Description:
Detects the WMI Event Consumer service scrcons.exe creating a named pipe

Detection logic:
{
  "selection": {
    "Image|endswith": "\\scrcons.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/RiccardoAncarani/LiquidSnake
Sigma Detection Rule: Remote Thread Created In KeePass.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Timon Hackenjos
Date: 2022-04-22
ATT&CK techniques: T1555.005
Log source: windows/create_remote_thread

Description:
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\KeePass.exe"
  },
  "condition": "selection"
}

References:
  - https://www.cisa.gov/uscert/ncas/alerts/aa20-259a
  - https://github.com/denandz/KeeFarce
  - https://github.com/GhostPack/KeeThief
Sigma Detection Rule: Potential Credential Dumping Attempt Via PowerShell Remote Thread
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
ATT&CK techniques: T1003.001
Log source: windows/create_remote_thread

Description:
Detects remote thread creation by PowerShell processes into "lsass.exe"

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetImage|endswith": "\\lsass.exe"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Remote Thread Creation In Mstsc.Exe From Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-28
Log source: windows/create_remote_thread

Description:
Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.


Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\mstsc.exe",
    "SourceImage|contains": [
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\PerfLogs\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/S12cybersecurity/RDPCredentialStealer/blob/1b8947cdd065a06c1b62e80967d3c7af895fcfed/APIHookInjectorBin/APIHookInjectorBin/Inject.h#L25
Sigma Detection Rule: Remote Thread Creation Via PowerShell In Uncommon Target
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-06-25
ATT&CK techniques: T1218.011, T1059.001
Log source: windows/create_remote_thread

Description:
Detects the creation of a remote thread from a Powershell process in an uncommon target process

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetImage|endswith": [
      "\\rundll32.exe",
      "\\regsvr32.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html
Sigma Detection Rule: Remote Thread Creation In Uncommon Target Image
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-16
ATT&CK techniques: T1055.003
Log source: windows/create_remote_thread

Description:
Detects uncommon target processes for remote thread creation

Detection logic:
{
  "selection": {
    "TargetImage|endswith": [
      "\\calc.exe",
      "\\calculator.exe",
      "\\mspaint.exe",
      "\\notepad.exe",
      "\\ping.exe",
      "\\sethc.exe",
      "\\spoolsv.exe",
      "\\wordpad.exe",
      "\\write.exe"
    ]
  },
  "filter_main_csrss": {
    "SourceImage": "C:\\Windows\\System32\\csrss.exe"
  },
  "filter_main_notepad": {
    "SourceImage": [
      "C:\\Windows\\System32\\explorer.exe",
      "C:\\Windows\\System32\\OpenWith.exe"
    ],
    "TargetImage": "C:\\Windows\\System32\\notepad.exe"
  },
  "filter_main_sethc": {
    "SourceImage": "C:\\Windows\\System32\\AtBroker.exe",
    "TargetImage": "C:\\Windows\\System32\\Sethc.exe"
  },
  "filter_optional_aurora_1": {
    "StartFunction": "EtwpNotificationThread"
  },
  "filter_optional_aurora_2": {
    "SourceImage|contains": "unknown process"
  },
  "filter_optional_vmtoolsd": {
    "SourceImage": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
    "StartFunction": "GetCommandLineW",
    "TargetImage": [
      "C:\\Windows\\System32\\notepad.exe",
      "C:\\Windows\\System32\\spoolsv.exe"
    ]
  },
  "filter_optional_xerox_pjems": {
    "SourceImage": "C:\\Program Files\\Xerox\\XeroxPrintExperience\\CommonFiles\\XeroxPrintJobEventManagerService.exe",
    "StartFunction": "LoadLibraryW",
    "TargetImage": "C:\\Windows\\System32\\spoolsv.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]2520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
Sigma Detection Rule: Rare Remote Thread Creation By Uncommon Source Image
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Perez Diego (@darkquassar), oscd.community
Date: 2019-10-27
ATT&CK techniques: T1055
Log source: windows/create_remote_thread

Description:
Detects uncommon processes creating remote threads.

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\bash.exe",
      "\\cscript.exe",
      "\\cvtres.exe",
      "\\defrag.exe",
      "\\dialer.exe",
      "\\dnx.exe",
      "\\esentutl.exe",
      "\\excel.exe",
      "\\expand.exe",
      "\\find.exe",
      "\\findstr.exe",
      "\\forfiles.exe",
      "\\gpupdate.exe",
      "\\hh.exe",
      "\\installutil.exe",
      "\\lync.exe",
      "\\makecab.exe",
      "\\mDNSResponder.exe",
      "\\monitoringhost.exe",
      "\\msbuild.exe",
      "\\mshta.exe",
      "\\mspaint.exe",
      "\\outlook.exe",
      "\\ping.exe",
      "\\provtool.exe",
      "\\python.exe",
      "\\regsvr32.exe",
      "\\robocopy.exe",
      "\\runonce.exe",
      "\\sapcimc.exe",
      "\\smartscreen.exe",
      "\\spoolsv.exe",
      "\\tstheme.exe",
      "\\userinit.exe",
      "\\vssadmin.exe",
      "\\vssvc.exe",
      "\\w3wp.exe",
      "\\winscp.exe",
      "\\winword.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "filter_main_conhost": {
    "SourceImage": [
      "C:\\Windows\\System32\\Defrag.exe",
      "C:\\Windows\\System32\\makecab.exe"
    ],
    "TargetImage": "C:\\Windows\\System32\\conhost.exe"
  },
  "filter_main_provtol_svchost": {
    "SourceImage": "C:\\Windows\\System32\\provtool.exe",
    "TargetImage": "C:\\Windows\\System32\\svchost.exe"
  },
  "filter_main_provtool_system": {
    "SourceImage": "C:\\Windows\\System32\\provtool.exe",
    "TargetImage": "System"
  },
  "filter_main_userinit": 

References:
  - Personal research, statistical analysis
  - https://lolbas-project.github.io
Sigma Detection Rule: Password Dumper Remote Thread in LSASS
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Thomas Patzke
Date: 2017-02-19
ATT&CK techniques: T1003.001
Log source: windows/create_remote_thread

Description:
Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.


Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "StartModule": ""
  },
  "condition": "selection"
}

References:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm
Sigma Detection Rule: HackTool - CACTUSTORCH Remote Thread Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @SBousseaden (detection), Thomas Patzke (rule)
Date: 2019-02-01
ATT&CK techniques: T1055.012, T1059.005, T1059.007, T1218.005
Log source: windows/create_remote_thread

Description:
Detects remote thread creation from CACTUSTORCH as described in references.

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\System32\\cscript.exe",
      "\\System32\\wscript.exe",
      "\\System32\\mshta.exe",
      "\\winword.exe",
      "\\excel.exe"
    ],
    "TargetImage|contains": "\\SysWOW64\\",
    "StartModule": null
  },
  "condition": "selection"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]17079552
  - https://github.com/mdsecactivebreach/CACTUSTORCH
Sigma Detection Rule: Remote Thread Creation By Uncommon Source Image
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Perez Diego (@darkquassar), oscd.community
Date: 2019-10-27
ATT&CK techniques: T1055
Log source: windows/create_remote_thread

Description:
Detects uncommon processes creating remote threads.

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\explorer.exe",
      "\\iexplore.exe",
      "\\msiexec.exe",
      "\\powerpnt.exe",
      "\\schtasks.exe",
      "\\winlogon.exe"
    ]
  },
  "filter_main_winlogon_1": {
    "SourceImage": "C:\\Windows\\System32\\winlogon.exe",
    "TargetImage": [
      "C:\\Windows\\System32\\services.exe",
      "C:\\Windows\\System32\\wininit.exe",
      "C:\\Windows\\System32\\csrss.exe",
      "C:\\Windows\\System32\\LogonUI.exe",
      "C:\\Windows\\System32\\wlrmdr.exe",
      "C:\\Windows\\System32\\AtBroker.exe",
      "C:\\Windows\\System32\\dwm.exe",
      "C:\\Windows\\System32\\fontdrvhost.exe",
      "C:\\Windows\\System32\\userinit.exe"
    ]
  },
  "filter_main_winlogon_2": {
    "SourceImage": "C:\\Windows\\System32\\winlogon.exe",
    "TargetParentProcessId": 4
  },
  "filter_main_schtasks_conhost": {
    "SourceImage": [
      "C:\\Windows\\System32\\schtasks.exe",
      "C:\\Windows\\SysWOW64\\schtasks.exe"
    ],
    "TargetImage": "C:\\Windows\\System32\\conhost.exe"
  },
  "filter_main_explorer": {
    "SourceImage": "C:\\Windows\\explorer.exe",
    "TargetImage|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_main_system": {
    "TargetImage": "System"
  },
  "filter_main_msiexec_1": {
    "SourceImage|endswith": "\\msiexec.exe",
    "TargetImage|contains": [
      "\\AppData\\Local\\",
      

References:
  - Personal research, statistical analysis
  - https://lolbas-project.github.io
Sigma Detection Rule: Remote Thread Creation Ttdinject.exe Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-05-16
ATT&CK techniques: T1127
Log source: windows/create_remote_thread

Description:
Detects a remote thread creation of Ttdinject.exe used as proxy

Detection logic:
{
  "selection": {
    "SourceImage|endswith": "\\ttdinject.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
Sigma Detection Rule: HackTool - Potential CobaltStrike Process Injection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community
Date: 2018-11-30
ATT&CK techniques: T1055.001
Log source: windows/create_remote_thread

Description:
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

Detection logic:
{
  "selection": {
    "StartAddress|endswith": [
      "0B80",
      "0C7C",
      "0C88"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f
  - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/
Sigma Detection Rule: Vulnerable HackSys Extreme Vulnerable Driver Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-18
ATT&CK techniques: T1543.003
Log source: windows/driver_load

Description:
Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors

Detection logic:
{
  "selection": [
    {
      "ImageLoaded|endswith": "\\HEVD.sys"
    },
    {
      "Hashes|contains": [
        "IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5",
        "IMPHASH=c46ea2e651fd5f7f716c8867c6d13594"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver
Sigma Detection Rule: Vulnerable Driver Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-18
ATT&CK techniques: T1543.003, T1068
Log source: windows/driver_load

Description:
Detects loading of known vulnerable drivers via their hash.

Detection logic:
{
  "selection": {
    "Hashes|contains": [
      "MD5=c996d7971c49252c582171d9380360f2",
      "MD5=da7e98b23b49b7293ee06713032c74f6",
      "MD5=[PII_REDACTED]d726000ea505abc39dbfe9",
      "MD5=649ff59b8e571c1fc6535b31662407aa",
      "MD5=4429f85e2415742c7cf8c9f54905c4b9",
      "MD5=a610cd4c762b5af8575285dafb9baa8f",
      "MD5=d5e76d125d624f8025d534f49e3c4162",
      "MD5=9c8fffef24fc480917236f9a20b80a47",
      "MD5=65b979bcab915c3922578fe77953d789",
      "MD5=598f8fb2317350e5f90b7bd16baf5738",
      "MD5=6691e873354f1914692df104718eebad",
      "MD5=[PII_REDACTED]caa80d35569eee8081838e",
      "MD5=7f9128654c3def08c28e0e13efff0fee",
      "MD5=ce952204558ea66ec1a9632dcbdde8bd",
      "MD5=0c0195c48b6b8582fa6f[PII_REDACTED]da",
      "MD5=370a4ca29a7cf1d6bc0744afc12b236c",
      "MD5=67e03f83c503c3f11843942df32efe5a",
      "MD5=8a70921638ff82bb924456deadcd20e6",
      "MD5=8a212a246b3c41f3ddce5888aaaaacd6",
      "MD5=a346417e9ae2c17a8fbf73302eeb611d",
      "MD5=d4f7c14e92b36c341c41ae93159407dd",
      "MD5=748cf64b95ca83abc35762ad2c25458f",
      "MD5=79ab228766c76cfdf42a[PII_REDACTED]1e",
      "MD5=ce67e51b8c0370d1bfe421b79fa8b656",
      "MD5=25190f667f31318dd9a2e36383d5709f",
      "MD5=1f263a57c5ef46c8577744ecb32c9548",
      "MD5=c6cfa2d6e4c443e673c2c12417ea3001",
      "MD5=cceb3a7e3bd0203c807168b393a65a74",
      "MD5=56b54823a79a53747cbe11f8c4db7b1e",
      "MD5=988dabdcf990b134b0ac1e00512c30c4",
      "MD5=09e77d71d626574e6142894caca6e6dd",
      "MD5=c832a4313ff08225824

References:
  - https://loldrivers.io/
Sigma Detection Rule: WinDivert Driver Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-30
ATT&CK techniques: T1599.001, T1557.001
Log source: windows/driver_load

Description:
Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows

Detection logic:
{
  "selection": [
    {
      "ImageLoaded|contains": [
        "\\WinDivert.sys",
        "\\WinDivert64.sys",
        "\\NordDivert.sys",
        "\\lingtiwfp.sys",
        "\\eswfp.sys"
      ]
    },
    {
      "Hashes|contains": [
        "IMPHASH=0604bb7cb4bb851e2168d5c7d9399087",
        "IMPHASH=2e5f0e649d97f32b03c09e4686d0574f",
        "IMPHASH=52f8aa269f69f0edad9e8fcdaedce276",
        "IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76",
        "IMPHASH=[PII_REDACTED]1babe8330adc81cd04a663",
        "IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b",
        "IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96",
        "IMPHASH=a1b2e245acd47e4a348e1a552a02859a",
        "IMPHASH=2a5f85fe4609461c[PII_REDACTED]fa9b0a",
        "IMPHASH=6b2c6f95233c2914d1d488ee27531acc",
        "IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342",
        "IMPHASH=d8a719865c448b1bd2ec241e46ac1c88",
        "IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38",
        "IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6",
        "IMPHASH=a74929edfc3289895e3f[PII_REDACTED]ae",
        "IMPHASH=a66b476c2d06c370f0a53b5537f2f11e",
        "IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4",
        "IMPHASH=c28cd6ccd83179e79dac132a553693d9"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://reqrypt.org/windivert-doc.html
  - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/
Sigma Detection Rule: Malicious Driver Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-18
ATT&CK techniques: T1543.003, T1068
Log source: windows/driver_load

Description:
Detects loading of known malicious drivers via their hash.

Detection logic:
{
  "selection": {
    "Hashes|contains": [
      "MD5=5be61a24f50eb4c94d98b8a82ef58dcf",
      "MD5=d70a80fc73dd43469934a7b1cc623c76",
      "MD5=3b71eab204a5f7ed77811e41fed73105",
      "MD5=528ce5ce19eb34f401ef024de7ddf222",
      "MD5=ae548418b491cd3f31618eb9e5730973",
      "MD5=72f53f[PII_REDACTED]7e0276c472be41e8",
      "MD5=508faa4647f305a97ed7167abc4d1330",
      "MD5=ed2b653d55c03f0bffa250372d682b75",
      "MD5=0d2ba47286f1c68e87622b3a16bf9d92",
      "MD5=3164bd6c12dd0fe1bdf3b833d56323b9",
      "MD5=70fd7209ce5c013a1f9e699b5cc86cdc",
      "MD5=c71be7b112059d2dc84c0f952e04e6cc",
      "MD5=acac842a46f3501fe407b1db1b247a0b",
      "MD5=01c2e4d[PII_REDACTED]083d6ce4e8910b7",
      "MD5=c8541a9cef64589593e999968a0385b9",
      "MD5=e172a38ade3aa0a2bc1bf9604a54a3b5",
      "MD5=6fcf56f6ca3210ec397e55f727353c4a",
      "MD5=2b80be31fbb11d4c1ef6d6a80b2e0c16",
      "MD5=07056573d464b0f5284f7e3acedd4a3f",
      "MD5=c7b7f1edb9bbef174e[PII_REDACTED]d85d",
      "MD5=d5918d735a23f746f0e83f724c4f26e5",
      "MD5=84763d8ca9fe5c3bff9667b2adf667de",
      "MD5=fb593b1f1f80d20fc7f4b818065c64b6",
      "MD5=909f3fc221acbe999483c87d9ead024a",
      "MD5=e29f6311ae87542b3d693c1f38e4e3ad",
      "MD5=aeb0801f22d71c7494e884d914446751",
      "MD5=3f11a94f1ac5efdd19767c6976da9ba4",
      "MD5=be[PII_REDACTED]e589080df02bb3ca6e6a",
      "MD5=0b311af53d2f4f77d30f1aed709db257",
      "MD5=d075d56dfce6b9b13484152b1ef40f93",
      "MD5=27384ec4c634701012a2962c30badad2",
      "MD5=5eb2c576597dd21a6b4

References:
  - https://loldrivers.io/
Sigma Detection Rule: Vulnerable Driver Load By Name
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-03
ATT&CK techniques: T1543.003, T1068
Log source: windows/driver_load

Description:
Detects the load of known vulnerable drivers via the file name of the drivers.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\panmonfltx64.sys",
      "\\dbutil.sys",
      "\\fairplaykd.sys",
      "\\nvaudio.sys",
      "\\superbmc.sys",
      "\\bsmi.sys",
      "\\smarteio64.sys",
      "\\bwrsh.sys",
      "\\agent64.sys",
      "\\asmmap64.sys",
      "\\dellbios.sys",
      "\\chaos-rootkit.sys",
      "\\wcpu.sys",
      "\\dh_kernel.sys",
      "\\sbiosio64.sys",
      "\\bw.sys",
      "\\asrdrv102.sys",
      "\\nt6.sys",
      "\\mhyprot3.sys",
      "\\winio64c.sys",
      "\\asupio64.sys",
      "\\blackbonedrv10.sys",
      "\\d.sys",
      "\\driver7-x86.sys",
      "\\sfdrvx32.sys",
      "\\enetechio64.sys",
      "\\gdrv.sys",
      "\\sysinfodetectorx64.sys",
      "\\fh-ethercat_dio.sys",
      "\\asromgdrv.sys",
      "\\my.sys",
      "\\dcprotect.sys",
      "\\irec.sys",
      "\\gedevdrv.sys",
      "\\winio32a.sys",
      "\\gvcidrv64.sys",
      "\\winio32.sys",
      "\\bs_hwmio64.sys",
      "\\nstr.sys",
      "\\inpoutx64.sys",
      "\\hw.sys",
      "\\winio64.sys",
      "\\hpportiox64.sys",
      "\\iobitunlocker.sys",
      "\\b1.sys",
      "\\aoddriver.sys",
      "\\elbycdio.sys",
      "\\protects.sys",
      "\\kprocesshacker.sys",
      "\\speedfan.sys",
      "\\radhwmgr.sys",
      "\\iscflashx64.sys",
      "\\black.sys",
      "\\b4.sys",
      "\\hwos2ec10x64.sys",
      "\\winflash64.sys",
      "\\corsairllaccess64.sys",
      "\\bs_i2cio.sys",
      "\\d3.sys",
      "\\windows-xp-64.sys",
  

References:
  - https://loldrivers.io/
Sigma Detection Rule: Vulnerable WinRing0 Driver Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-26
ATT&CK techniques: T1543.003
Log source: windows/driver_load

Description:
Detects the load of a signed WinRing0 driver often used by threat actors, crypto miners (XMRIG) or malware for privilege escalation

Detection logic:
{
  "selection": [
    {
      "Hashes|contains": "IMPHASH=D41FA95D4642DC981F10DE36F4DC8CD7"
    },
    {
      "ImageLoaded|endswith": [
        "\\WinRing0x64.sys",
        "\\WinRing0.sys",
        "\\WinRing0.dll",
        "\\WinRing0x64.dll",
        "\\winring00x64.sys"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/xmrig/xmrig/tree/master/bin/WinRing0
  - https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/