deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Zip A Folder With PowerShell For Staging In Temp - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2021-07-20
ATT&CK techniques: T1074.001
Log source: windows/

Description:
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.


Detection logic:
{
  "selection": {
    "Data|contains": [
      "Compress-Archive -Path*-DestinationPath $env:TEMP",
      "Compress-Archive -Path*-DestinationPath*\\AppData\\Local\\Temp\\",
      "Compress-Archive -Path*-DestinationPath*:\\Windows\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: Delete Volume Shadow Copies Via WMI With PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: frack113
Date: 2021-06-03
ATT&CK techniques: T1490
Log source: windows/ps_classic_start

Description:
Shadow Copies deletion using operating systems utilities via PowerShell

Detection logic:
{
  "selection": {
    "Data|contains|all": [
      "Get-WmiObject",
      "Win32_ShadowCopy"
    ],
    "Data|contains": [
      "Delete()",
      "Remove-WmiObject"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
  - https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods
Sigma Detection Rule: PowerShell Downgrade Attack - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)
Date: 2017-03-22
ATT&CK techniques: T1059.001
Log source: windows/ps_classic_start

Description:
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Detection logic:
{
  "selection": {
    "Data|contains": "EngineVersion=2."
  },
  "filter_main": {
    "Data|contains": "HostVersion=2."
  },
  "condition": "selection and not filter_main"
}

References:
  - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
Sigma Detection Rule: Nslookup PowerShell Download Cradle
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam
Date: 2022-12-10
ATT&CK techniques: T1059.001
Log source: windows/ps_classic_start

Description:
Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

Detection logic:
{
  "selection": {
    "Data|contains|all": [
      "powershell",
      "nslookup",
      "[1]"
    ],
    "Data|contains": [
      "-q=txt http",
      "-querytype=txt http",
      "-type=txt http"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]32651264
Sigma Detection Rule: Use Get-NetTCPConnection
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-10
ATT&CK techniques: T1049
Log source: windows/ps_classic_start

Description:
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Detection logic:
{
  "selection": {
    "Data|contains": "Get-NetTCPConnection"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
Sigma Detection Rule: PowerShell Called from an Executable Version Mismatch
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sean Metcalf (source), Florian Roth (Nextron Systems)
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_classic_start

Description:
Detects PowerShell called from an executable by the version mismatch method

Detection logic:
{
  "selection_engine": {
    "Data|contains": [
      "EngineVersion=2.",
      "EngineVersion=4.",
      "EngineVersion=5."
    ]
  },
  "selection_host": {
    "Data|contains": "HostVersion=3."
  },
  "condition": "all of selection_*"
}

References:
  - https://adsecurity.org/?p=2921
Sigma Detection Rule: Suspicious Encoded Scripts in a WMI Consumer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-09-01
ATT&CK techniques: T1047, T1546.003
Log source: windows/wmi_event

Description:
Detects suspicious encoded payloads in WMI Event Consumers

Detection logic:
{
  "selection_destination": {
    "Destination|base64offset|contains": [
      "WriteProcessMemory",
      "This program cannot be run in DOS mode",
      "This program must be run under Win32"
    ]
  },
  "condition": "selection_destination"
}

References:
  - https://github.com/RiccardoAncarani/LiquidSnake
Sigma Detection Rule: Suspicious Scripting in a WMI Consumer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Date: 2019-04-15
ATT&CK techniques: T1059.005
Log source: windows/wmi_event

Description:
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

Detection logic:
{
  "selection_destination": [
    {
      "Destination|contains|all": [
        "new-object",
        "net.webclient",
        ".downloadstring"
      ]
    },
    {
      "Destination|contains|all": [
        "new-object",
        "net.webclient",
        ".downloadfile"
      ]
    },
    {
      "Destination|contains": [
        " iex(",
        " -nop ",
        " -noprofile ",
        " -decode ",
        " -enc ",
        "WScript.Shell",
        "System.Security.Cryptography.FromBase64Transform"
      ]
    }
  ],
  "condition": "selection_destination"
}

References:
  - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/
  - https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19
  - https://github.com/RiccardoAncarani/LiquidSnake
Sigma Detection Rule: WMI Event Subscription
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tom Ueltschi (@c_APT_ure)
Date: 2019-01-12
ATT&CK techniques: T1546.003
Log source: windows/wmi_event

Description:
Detects creation of WMI event subscription persistence method

Detection logic:
{
  "selection": {
    "EventID": [
      19,
      20,
      21
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-19-wmievent-wmieventfilter-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-20-wmievent-wmieventconsumer-activity-detected
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmievent-wmieventconsumertofilter-activity-detected
Sigma Detection Rule: Potential Persistence Via Disk Cleanup Handler - Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-21
Log source: windows/registry_add

Description:
Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence.
The disk cleanup manager is part of the operating system. It displays the dialog box […]
The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager's UI.
Although Windows comes with a number of disk cleanup handlers, they aren't designed to handle files produced by other applications.
Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler.
Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler.


Detection logic:
{
  "selection": {
    "EventType": "CreateKey",
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VolumeCaches\\"
  },
  "filter_main_default_keys": {
    "TargetObject|endswith": [
      "\\Active Setup Temp Folders",
      "\\BranchCache",
      "\\Content Indexer Cleaner",
      "\\D3D Shader Cache",
      "\\Delivery Optimization Files",
      "\\Device Driver Packages",
      "\\Diagnostic Data Viewer database files",
      "\\Downloaded Program Files",
      "\\DownloadsFolder",
      "\\Feedback Hub Archive log files",
      "\\Internet Cache Files",
      "\\Language Pack",
      "\\Microsoft Office Temp Files",
      "\\Offline Pages Files",
      "\\Old ChkDsk Files",
      "\\Previous Installations",
      "\\Recycle Bin",
      "\\RetailDemo Offline Content",
      "\\Setup Log Files",
      "\\System error memory dump files",
      "\\System error minidump files",
      "\\Temporary Files",
      "\\Temporary Setup Files",
      "\\Temporary Sync Files",
      "\\Thumbnail Cache",
      "\\Update Cleanup",
      "\\Upgrade Discarded Files",
      "\\User file versions",
      "\\Windows Defender",
      "\\Windows Error Reporting Files",
      "\\Windows ESD installation files",
      "\\Windows Upgrade Log Files"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://persistence-info.github.io/Data/diskcleanuphandler.html
  - https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
Sigma Detection Rule: Path To Screensaver Binary Modified
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bartlomiej Czyz @bczyz1, oscd.community
Date: 2020-10-11
ATT&CK techniques: T1546.002
Log source: windows/registry_event

Description:
Detects value modification of registry key containing path to binary used as screensaver.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Control Panel\\Desktop\\SCRNSAVE.EXE"
  },
  "filter": {
    "Image|endswith": [
      "\\rundll32.exe",
      "\\explorer.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
  - https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf
Sigma Detection Rule: Creation of a Local Hidden User Account by Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-05-03
ATT&CK techniques: T1136.001
Log source: windows/registry_event

Description:
Sysmon registry detection of a local hidden user account.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SAM\\SAM\\Domains\\Account\\Users\\Names\\",
    "TargetObject|endswith": "$\\(Default)",
    "Image|endswith": "\\lsass.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]85664538
Sigma Detection Rule: Atbroker Registry Change
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mateusz Wydra, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1218, T1547
Log source: windows/registry_event

Description:
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs",
      "Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\Configuration"
    ]
  },
  "filter_atbroker": {
    "Image": "C:\\Windows\\system32\\atbroker.exe",
    "TargetObject|contains": "\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\Configuration",
    "Details": "(Empty)"
  },
  "filter_uninstallers": {
    "Image|startswith": "C:\\Windows\\Installer\\MSI",
    "TargetObject|contains": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Accessibility\\ATs"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
  - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
Sigma Detection Rule: New DLL Added to AppInit_DLLs Registry Key
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, oscd.community, Tim Shelton
Date: 2019-10-25
ATT&CK techniques: T1546.010
Log source: windows/registry_event

Description:
DLLs that are specified in the AppInit_DLLs value in the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll

Detection logic:
{
  "selection": [
    {
      "TargetObject|endswith": [
        "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
        "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls"
      ]
    },
    {
      "NewName|endswith": [
        "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls",
        "\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\AppInit_Dlls"
      ]
    }
  ],
  "filter": {
    "Details": "(Empty)"
  },
  "condition": "selection and not filter"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/822dc4c5-b355-4df8-bd37-29c458997b8f.html
Sigma Detection Rule: CMSTP Execution Registry Event
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nik Seetharaman
Date: 2018-07-16
ATT&CK techniques: T1218.003
Log source: windows/registry_event

Description:
Detects various indicators of Microsoft Connection Manager Profile Installer execution

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\cmmgr32.exe"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
Sigma Detection Rule: Registry Entries For Azorult Malware
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Trent Liffick
Date: 2020-05-08
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Detects the presence of a registry key created during Azorult execution

Detection logic:
{
  "selection": {
    "EventID": [
      12,
      13
    ],
    "TargetObject|contains": "SYSTEM\\",
    "TargetObject|endswith": "\\services\\localNETService"
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a
Sigma Detection Rule: Windows Registry Trust Record Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Antonlovesdnb, Trent Liffick (@tliffick)
Date: 2020-02-19
ATT&CK techniques: T1566.001
Log source: windows/registry_event

Description:
Alerts on trust record modification within the registry, indicating usage of macros

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Security\\Trusted Documents\\TrustRecords"
  },
  "condition": "selection"
}

References:
  - https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
  - http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html
  - https://twitter.com/inversecos/status/[PII_REDACTED]21819397
Sigma Detection Rule: Windows Credential Editor Registry
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-12-31
ATT&CK techniques: T1003.001
Log source: windows/registry_event

Description:
Detects the use of Windows Credential Editor (WCE)

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Services\\WCESERVICE\\Start"
  },
  "condition": "selection"
}

References:
  - https://www.ampliasecurity.com/research/windows-credentials-editor/
Sigma Detection Rule: WINEKEY Registry Modification
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: omkar72
Date: 2020-10-30
ATT&CK techniques: T1547
Log source: windows/registry_event

Description:
Detects potential malicious modification of run keys by winekey or team9 backdoor

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Backup Mgr"
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Sigma Detection Rule: Suspicious Camera and Microphone Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Den Iuzvyk
Date: 2020-06-07
ATT&CK techniques: T1125, T1123
Log source: windows/registry_event

Description:
Detects Processes accessing the camera and microphone from suspicious folder

Detection logic:
{
  "selection_1": {
    "TargetObject|contains|all": [
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\",
      "\\NonPackaged"
    ]
  },
  "selection_2": {
    "TargetObject|contains": [
      "microphone",
      "webcam"
    ]
  },
  "selection_3": {
    "TargetObject|contains": [
      ":#Windows#Temp#",
      ":#$Recycle.bin#",
      ":#Temp#",
      ":#Users#Public#",
      ":#Users#Default#",
      ":#Users#Desktop#"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072
Sigma Detection Rule: Registry Persistence Mechanisms in Recycle Bin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-11-18
ATT&CK techniques: T1547
Log source: windows/registry_event

Description:
Detects persistence registry keys for Recycle Bin

Detection logic:
{
  "selection_create": {
    "EventType": "RenameKey",
    "NewName|contains": "\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\shell\\open"
  },
  "selection_set": {
    "EventType": "SetValue",
    "TargetObject|contains": "\\CLSID\\{645FF040-5081-101B-9F08-00AA002F954E}\\shell\\open\\command\\(Default)"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf
  - https://persistence-info.github.io/Data/recyclebin.html
  - https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
Sigma Detection Rule: New PortProxy Registry Entry Added
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2021-06-22
ATT&CK techniques: T1090
Log source: windows/registry_event

Description:
Detects the modification of the PortProxy registry key which is used for port forwarding.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Services\\PortProxy\\v4tov4\\tcp\\"
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  - https://adepts.of0x.cc/netsh-portproxy-code/
  - https://www.dfirnotes.net/portproxy_detection/
Sigma Detection Rule: Wdigest CredGuard Registry Modification
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2019-08-25
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Detects potential malicious modification of the property value of IsCredGuardEnabled from
HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to disable Cred Guard on a system.
This is usually used with UseLogonCredential to manipulate the caching credentials.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\IsCredGuardEnabled"
  },
  "condition": "selection"
}

References:
  - https://teamhydra.blog/2020/08/25/bypassing-credential-guard/
Sigma Detection Rule: Security Support Provider (SSP) Added to LSA Configuration
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: iwillkeepwatch
Date: 2019-01-18
ATT&CK techniques: T1547.005
Log source: windows/registry_event

Description:
Detects the addition of a SSP to the registry. Upon a reboot or API call, SSP DLLs gain access to encrypted and plaintext passwords stored in Windows.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "\\Control\\Lsa\\Security Packages",
      "\\Control\\Lsa\\OSConfig\\Security Packages"
    ]
  },
  "filter_main_msiexec": {
    "Image": [
      "C:\\Windows\\system32\\msiexec.exe",
      "C:\\Windows\\syswow64\\MsiExec.exe"
    ]
  },
  "filter_main_image_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://powersploit.readthedocs.io/en/latest/Persistence/Install-SSP/
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Install-SSP.ps1#L157
Sigma Detection Rule: Run Once Task Configuration in Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Avneet Singh @v3t0_, oscd.community
Date: 2020-11-15
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Rule to detect the configuration of Run Once registry key. Configured payload can be run by runonce.exe /AlternateShellStartup

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Active Setup\\Installed Components",
    "TargetObject|endswith": "\\StubPath"
  },
  "filter_optional_chrome": {
    "Details|contains|all": [
      "C:\\Program Files\\Google\\Chrome\\Application\\",
      "\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"
    ]
  },
  "filter_optional_edge": {
    "Details|contains": [
      "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\",
      "C:\\Program Files\\Microsoft\\Edge\\Application\\"
    ],
    "Details|endswith": "\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/pabraeken/status/[PII_REDACTED]05789697
  - https://lolbas-project.github.io/lolbas/Binaries/Runonce/
Sigma Detection Rule: UAC Bypass Via Wsreset
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Dmitry Uchakin
Date: 2020-10-07
ATT&CK techniques: T1548.002
Log source: windows/registry_event

Description:
Unfixed method for UAC bypass from Windows 10. WSReset.exe file associated with the Windows Store. It will run a binary file contained in a low-privilege registry.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command"
  },
  "condition": "selection"
}

References:
  - https://www.bleepingcomputer.com/news/security/trickbot-uses-a-new-windows-10-uac-bypass-to-launch-quietly
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset