deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Execution Location Of Wermgr.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-14
Log source: windows/process_creation

Description:
Detects suspicious Windows Error Reporting manager (wermgr.exe) execution location.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\wermgr.exe"
  },
  "filter_main_legit_location": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
  - https://www.echotrail.io/insights/search/wermgr.exe
  - https://github.com/binderlabs/DirCreate2System
Sigma Detection Rule: PUA - NirCmd Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-24
ATT&CK techniques: T1569.002
Log source: windows/process_creation

Description:
Detects the use of NirCmd tool for command execution, which could be the result of legitimate administrative activity

Detection logic:
{
  "selection_org": [
    {
      "Image|endswith": "\\NirCmd.exe"
    },
    {
      "OriginalFileName": "NirCmd.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": [
      " execmd ",
      ".exe script ",
      ".exe shexec ",
      " runinteractive "
    ]
  },
  "combo_exec": {
    "CommandLine|contains": [
      " exec ",
      " exec2 "
    ]
  },
  "combo_exec_params": {
    "CommandLine|contains": [
      " show ",
      " hide "
    ]
  },
  "condition": "1 of selection_* or all of combo_*"
}

References:
  - https://www.nirsoft.net/utils/nircmd.html
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  - https://www.nirsoft.net/utils/nircmd2.html#using
Sigma Detection Rule: Invoke-Obfuscation Via Use Clip
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated Powershell via use Clip.exe in Scripts

Detection logic:
{
  "selection": {
    "CommandLine|re": "(?i)echo.*clip.*&&.*(?:Clipboard|i`?n`?v`?o`?k`?e`?)"
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Abused Debug Privilege by Arbitrary Parent Processes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Semanur Guneysu @semanurtg, oscd.community
Date: 2020-10-28
ATT&CK techniques: T1548
Log source: windows/process_creation

Description:
Detection of unusual child processes by different system processes

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\winlogon.exe",
      "\\services.exe",
      "\\lsass.exe",
      "\\csrss.exe",
      "\\smss.exe",
      "\\wininit.exe",
      "\\spoolsv.exe",
      "\\searchindexer.exe"
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\cmd.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "Cmd.Exe"
      ]
    }
  ],
  "filter": {
    "CommandLine|contains|all": [
      " route ",
      " ADD "
    ]
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal[PII_REDACTED]58/95/hunting-for-privilege-escalation-in-windows-environment-74-638.jpg
Sigma Detection Rule: PowerShell Script Change Permission Via Set-Acl
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-18
Log source: windows/process_creation

Description:
Detects PowerShell execution to set the ACL of a file or a folder

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    }
  ],
  "selection_cmdlet": {
    "CommandLine|contains|all": [
      "Set-Acl ",
      "-AclObject ",
      "-Path "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1505.005/T1505.005.md
Sigma Detection Rule: Suspicious HWP Sub Processes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-24
ATT&CK techniques: T1566.001, T1203, T1059.003
Log source: windows/process_creation

Description:
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\Hwp.exe",
    "Image|endswith": "\\gbb.exe"
  },
  "condition": "selection"
}

References:
  - https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/
  - https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db[PII_REDACTED]5a7644131f&block_redirect=1
  - https://twitter.com/cyberwar_15/status/[PII_REDACTED]54076416
  - https://blog.alyac.co.kr/1901
  - https://en.wikipedia.org/wiki/Hangul_(word_processor)
Sigma Detection Rule: Findstr GPP Passwords
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-27
ATT&CK techniques: T1552.006
Log source: windows/process_creation

Description:
Look for the encrypted cpassword value within Group Policy Preference files on the Domain Controller. This value can be decrypted with gpp-decrypt.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\find.exe",
        "\\findstr.exe"
      ]
    },
    {
      "OriginalFileName": [
        "FIND.EXE",
        "FINDSTR.EXE"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "cpassword",
      "\\sysvol\\",
      ".xml"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.006/T1552.006.md#atomic-test-1---gpp-passwords-findstr
Sigma Detection Rule: Wab/Wabmig Unusual Parent Or Child Processes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
Log source: windows/process_creation

Description:
Detects unusual parent or children of the wab.exe (Windows Contacts) and Wabmig.exe (Microsoft Address Book Import Tool) processes as seen being used with bumblebee activity

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\WmiPrvSE.exe",
      "\\svchost.exe",
      "\\dllhost.exe"
    ],
    "Image|endswith": [
      "\\wab.exe",
      "\\wabmig.exe"
    ]
  },
  "selection_child": {
    "ParentImage|endswith": [
      "\\wab.exe",
      "\\wabmig.exe"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: Execution of Suspicious File Type Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2021-12-09
Log source: windows/process_creation

Description:
Detects whether the image specified in a process creation event doesn't refer to an ".exe" (or other known executable extension) file. This can be caused by process ghosting or other unorthodox methods to start a process.
This rule might require some initial baselining to align with some third party tooling in the user environment.


Detection logic:
{
  "known_image_extension": {
    "Image|endswith": [
      ".bin",
      ".cgi",
      ".com",
      ".exe",
      ".scr",
      ".tmp"
    ]
  },
  "filter_main_image": {
    "Image": [
      "System",
      "Registry",
      "MemCompression",
      "vmmem"
    ]
  },
  "filter_main_msi_installers": {
    "Image|contains": ":\\Windows\\Installer\\MSI"
  },
  "filter_main_driver_store": {
    "Image|contains": ":\\Windows\\System32\\DriverStore\\FileRepository\\"
  },
  "filter_main_msi_rollbackfiles": {
    "Image|contains": ":\\Config.Msi\\",
    "Image|endswith": [
      ".rbf",
      ".rbs"
    ]
  },
  "filter_main_windows_temp": [
    {
      "ParentImage|contains": ":\\Windows\\Temp\\"
    },
    {
      "Image|contains": ":\\Windows\\Temp\\"
    }
  ],
  "filter_main_deleted": {
    "Image|contains": ":\\$Extend\\$Deleted\\"
  },
  "filter_main_empty": {
    "Image": [
      "-",
      ""
    ]
  },
  "filter_main_null": {
    "Image": null
  },
  "filter_optional_avira": {
    "ParentImage|contains": ":\\ProgramData\\Avira\\"
  },
  "filter_optional_nvidia": {
    "Image|contains": "NVIDIA\\NvBackend\\",
    "Image|endswith": ".dat"
  },
  "filter_optional_winpakpro": {
    "Image|contains": [
      ":\\Program Files (x86)\\WINPAKPRO\\",
      ":\\Program Files\\WINPAKPRO\\"
    ],
    "Image|endswith": ".ngn"
  },
  "filter_optional_myq_server": {
    "Image|endswith": [
      ":\\Program Files (x86)\\MyQ\\Server\\pcltool.dll",
      ":\\Program Files\\MyQ\\Server

References:
  - https://pentestlaboratories.com/2021/12/08/process-ghosting/
Sigma Detection Rule: Assembly Loading Via CL_LoadAssembly.ps1
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-21
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "LoadAssemblyFromPath ",
      "LoadAssemblyFromNS "
    ]
  },
  "condition": "selection"
}

References:
  - https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/
  - https://lolbas-project.github.io/lolbas/Scripts/CL_LoadAssembly/
Sigma Detection Rule: ShimCache Flush
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2021-02-01
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects actions that clear the local ShimCache and remove forensic evidence

Detection logic:
{
  "selection1a": {
    "CommandLine|contains|all": [
      "rundll32",
      "apphelp.dll"
    ]
  },
  "selection1b": {
    "CommandLine|contains": [
      "ShimFlushCache",
      "#250"
    ]
  },
  "selection2a": {
    "CommandLine|contains|all": [
      "rundll32",
      "kernel32.dll"
    ]
  },
  "selection2b": {
    "CommandLine|contains": [
      "BaseFlushAppcompatCache",
      "#46"
    ]
  },
  "condition": "( selection1a and selection1b ) or ( selection2a and selection2b )"
}

References:
  - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e
Sigma Detection Rule: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-12-05
Log source: windows/process_creation

Description:
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\ud83e\udd37\ud83c\udffc",
      "\ud83e\udd37\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83d\ude4e\ud83c\udffc\u200d\u2640\ufe0f",
      "\ud83d\ude4e\ud83c\udffc",
      "\ud83d\ude4e\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83d\ude4d\ud83c\udffc\u200d\u2640\ufe0f",
      "\ud83d\ude4d\ud83c\udffc",
      "\ud83d\ude4d\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83d\udc87\ud83c\udffc\u200d\u2640\ufe0f",
      "\ud83d\udc87\ud83c\udffc",
      "\ud83d\udc87\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83d\udc86\ud83c\udffc\u200d\u2640\ufe0f",
      "\ud83d\udc86\ud83c\udffc",
      "\ud83d\udc86\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83e\uddd6\ud83c\udffc\u200d\u2640\ufe0f",
      "\ud83e\uddd6\ud83c\udffc",
      "\ud83e\uddd6\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83d\udc83\ud83c\udffc",
      "\ud83d\udd7a\ud83c\udffc",
      "\ud83d\udd74\ud83c\udffc",
      "\ud83d\udc69\ud83c\udffc\u200d\ud83e\uddbd",
      "\ud83e\uddd1\ud83c\udffc\u200d\ud83e\uddbd",
      "\ud83d\udc68\ud83c\udffc\u200d\ud83e\uddbd",
      "\ud83d\udc69\ud83c\udffc\u200d\ud83e\uddbc",
      "\ud83e\uddd1\ud83c\udffc\u200d\ud83e\uddbc",
      "\ud83d\udc68\ud83c\udffc\u200d\ud83e\uddbc",
      "\ud83d\udeb6\ud83c\udffc\u200d\u2640\ufe0f",
      "\ud83d\udeb6\ud83c\udffc",
      "\ud83d\udeb6\ud83c\udffc\u200d\u2642\ufe0f",
      "\ud83d\udc69\ud83c\udffc\u200d\ud83e\uddaf",
      "\ud83e\uddd1\ud83c\udffc\u200d\ud83e\uddaf",
      "\ud83d\udc68

References:
  - Internal Research
Sigma Detection Rule: Suspicious Where Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-13
ATT&CK techniques: T1217
Log source: windows/process_creation

Description:
Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.


Detection logic:
{
  "where_exe": [
    {
      "Image|endswith": "\\where.exe"
    },
    {
      "OriginalFileName": "where.exe"
    }
  ],
  "where_opt": {
    "CommandLine|contains": [
      "places.sqlite",
      "cookies.sqlite",
      "formhistory.sqlite",
      "logins.json",
      "key4.db",
      "key3.db",
      "sessionstore.jsonlz4",
      "History",
      "Bookmarks",
      "Cookies",
      "Login Data"
    ]
  },
  "condition": "all of where_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
Sigma Detection Rule: Suspicious Child Process Of Veeam Dabatase
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/process_creation

Description:
Detects suspicious child processes of the Veeam service process. This could indicate potential RCE or SQL Injection.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\sqlservr.exe",
    "ParentCommandLine|contains": "VEEAMSQL"
  },
  "selection_child_1": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wsl.exe",
      "\\wt.exe"
    ],
    "CommandLine|contains": [
      "-ex ",
      "bypass",
      "cscript",
      "DownloadString",
      "http://",
      "https://",
      "mshta",
      "regsvr32",
      "rundll32",
      "wscript",
      "copy "
    ]
  },
  "selection_child_2": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe",
      "\\netstat.exe",
      "\\nltest.exe",
      "\\ping.exe",
      "\\tasklist.exe",
      "\\whoami.exe"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Sysmon Driver Unloaded Via Fltmc.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Kirill Kiryanov, oscd.community
Date: 2019-10-23
ATT&CK techniques: T1070, T1685, T1685.001
Log source: windows/process_creation

Description:
Detects possible Sysmon filter driver unloaded via fltmc.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\fltMC.exe"
    },
    {
      "OriginalFileName": "fltMC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "unload",
      "sysmon"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon
Sigma Detection Rule: HackTool - RemoteKrbRelay Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-27
ATT&CK techniques: T1558.003
Log source: windows/process_creation

Description:
Detects the use of RemoteKrbRelay, a Kerberos relaying tool via CommandLine flags and PE metadata.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\RemoteKrbRelay.exe"
    },
    {
      "OriginalFileName": "RemoteKrbRelay.exe"
    }
  ],
  "selection_cli_required": {
    "CommandLine|contains|all": [
      " -clsid ",
      " -target ",
      " -victim "
    ]
  },
  "selection_cli_attack_smb": {
    "CommandLine|contains|all": [
      "-smb ",
      "--smbkeyword "
    ],
    "CommandLine|contains": [
      "interactive",
      "secrets",
      "service-add"
    ]
  },
  "selection_cli_attack_rbcd_main": {
    "CommandLine|contains": "-rbcd "
  },
  "selection_cli_attack_rbcd_options": {
    "CommandLine|contains": [
      "-cn ",
      "--computername "
    ]
  },
  "selection_cli_attack_changepass": {
    "CommandLine|contains": "-chp ",
    "CommandLine|contains|all": [
      "-chpPass ",
      "-chpUser "
    ]
  },
  "selection_cli_attack_addgrpname": {
    "CommandLine|contains|all": [
      "-addgroupmember ",
      "-group ",
      "-groupuser "
    ]
  },
  "condition": "selection_img or selection_cli_required or all of selection_cli_attack_rbcd_* or selection_cli_attack_changepass or selection_cli_attack_addgrpname or selection_cli_attack_smb"
}

References:
  - https://github.com/CICADA8-Research/RemoteKrbRelay
Sigma Detection Rule: Renamed Gpg.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2023-08-09
ATT&CK techniques: T1486
Log source: windows/process_creation

Description:
Detects the execution of a renamed "gpg.exe". Often used by ransomware and loaders to decrypt/encrypt data.

Detection logic:
{
  "selection": {
    "OriginalFileName": "gpg.exe"
  },
  "filter_main_img": {
    "Image|endswith": [
      "\\gpg.exe",
      "\\gpg2.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://securelist.com/locked-out/68960/
Sigma Detection Rule: DNS Exfiltration and Tunneling Tools Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Daniil Yugoslavskiy, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1048.001, T1071.004, T1132.001
Log source: windows/process_creation

Description:
Well-known DNS Exfiltration tools execution

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\iodine.exe"
    },
    {
      "Image|contains": "\\dnscat2"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/iagox86/dnscat2
  - https://github.com/yarrick/iodine
Sigma Detection Rule: HackTool - CrackMapExec PowerShell Obfuscation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thomas Patzke
Date: 2020-05-22
ATT&CK techniques: T1059.001, T1027.005
Log source: windows/process_creation

Description:
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "join*split",
      "( $ShellId[1]+$ShellId[13]+'x')",
      "( $PSHome[*]+$PSHOME[*]+",
      "( $env:Public[13]+$env:Public[5]+'x')",
      "( $env:ComSpec[4,*,25]-Join'')",
      "[1,3]+'x'-Join'')"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/byt3bl33d3r/CrackMapExec
  - https://github.com/byt3bl33d3r/CrackMapExec/blob/0a49f75347b625e81ee6aa8c33d3970b5515ea9e/cme/helpers/powershell.py#L242
Sigma Detection Rule: Vulnerable Driver Blocklist Registry Tampering Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-26
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects tampering of the Vulnerable Driver Blocklist registry via command line tools such as PowerShell or REG.EXE.
The Vulnerable Driver Blocklist is a security feature that helps prevent the loading of known vulnerable drivers.
Disabling this feature may indicate an attempt to bypass security controls, often targeted by threat actors
to facilitate the installation of malicious or vulnerable drivers, particularly in scenarios involving Endpoint Detection and Response


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\reg.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "reg.exe"
      ]
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains": [
      "add ",
      "New-ItemProperty ",
      "Set-ItemProperty ",
      "si "
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "\\Control\\CI\\Config",
      "VulnerableDriverBlocklistEnable"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
Sigma Detection Rule: DLL Execution Via Register-cimprovider.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ivan Dyachkov, Yulia Fomina, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1574
Log source: windows/process_creation

Description:
Detects using register-cimprovider.exe to execute arbitrary dll file.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\register-cimprovider.exe",
    "CommandLine|contains|all": [
      "-path",
      "dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/PhilipTsukerman/status/[PII_REDACTED]06268161
  - https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/
Sigma Detection Rule: Suspicious Outlook Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Haag, Florian Roth (Nextron Systems), Markus Neis, Elastic, FPT.EagleEye Team
Date: 2022-02-28
ATT&CK techniques: T1204.002
Log source: windows/process_creation

Description:
Detects a suspicious process spawning from an Outlook process.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\OUTLOOK.EXE",
    "Image|endswith": [
      "\\AppVLP.exe",
      "\\bash.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\forfiles.exe",
      "\\hh.exe",
      "\\mftrace.exe",
      "\\msbuild.exe",
      "\\msdt.exe",
      "\\mshta.exe",
      "\\msiexec.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\schtasks.exe",
      "\\scrcons.exe",
      "\\scriptrunner.exe",
      "\\sh.exe",
      "\\svchost.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html