deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Proxy Execution Via Wuauclt.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team
Date: 2020-10-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wuauclt.exe"
    },
    {
      "OriginalFileName": "wuauclt.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "UpdateDeploymentProvider",
      "RunHandlerComServer"
    ]
  },
  "filter_main_generic": {
    "CommandLine|contains": " /UpdateDeploymentProvider UpdateDeploymentProvider.dll "
  },
  "filter_main_wuaueng": {
    "CommandLine|contains": " wuaueng.dll "
  },
  "filter_main_uus": {
    "CommandLine|contains": [
      ":\\Windows\\UUS\\Packages\\Preview\\amd64\\updatedeploy.dll /ClassId",
      ":\\Windows\\UUS\\amd64\\UpdateDeploy.dll /ClassId"
    ]
  },
  "filter_main_winsxs": {
    "CommandLine|contains|all": [
      ":\\Windows\\WinSxS\\",
      "\\UpdateDeploy.dll /ClassId "
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://dtm.uk/wuauclt/
  - https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/
Sigma Detection Rule: VeeamBackup Database Credentials Dump Via Sqlcmd.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-20
ATT&CK techniques: T1005
Log source: windows/process_creation

Description:
Detects dump of credentials in VeeamBackup dbo

Detection logic:
{
  "selection_tools": {
    "Image|endswith": "\\sqlcmd.exe"
  },
  "selection_query": {
    "CommandLine|contains|all": [
      "SELECT",
      "TOP",
      "[VeeamBackup].[dbo].[Credentials]"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html
Sigma Detection Rule: Suspicious SysAidServer Child
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-26
ATT&CK techniques: T1210
Log source: windows/process_creation

Description:
Detects suspicious child processes of SysAidServer (as seen in MERCURY threat actor intrusions)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentCommandLine|contains": "SysAidServer"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
Sigma Detection Rule: PUA - AdvancedRun Suspicious Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-20
ATT&CK techniques: T1134.002
Log source: windows/process_creation

Description:
Detects the execution of AdvancedRun utility in the context of the TrustedInstaller, SYSTEM, Local Service or Network Service accounts

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "/EXEFilename",
      "/CommandLine"
    ]
  },
  "selection_runas": [
    {
      "CommandLine|contains": [
        " /RunAs 8 ",
        " /RunAs 4 ",
        " /RunAs 10 ",
        " /RunAs 11 "
      ]
    },
    {
      "CommandLine|endswith": [
        "/RunAs 8",
        "/RunAs 4",
        "/RunAs 10",
        "/RunAs 11"
      ]
    }
  ],
  "condition": "all of selection*"
}

References:
  - https://twitter.com/splinter_code/status/[PII_REDACTED]79603714
  - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  - https://www.elastic.co/security-labs/operation-bleeding-bear
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Sigma Detection Rule: Suspicious ZipExec Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-07
ATT&CK techniques: T1218, T1202
Log source: windows/process_creation

Description:
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.

Detection logic:
{
  "run": {
    "CommandLine|contains|all": [
      "/generic:Microsoft_Windows_Shell_ZipFolder:filename=",
      ".zip",
      "/pass:",
      "/user:"
    ]
  },
  "delete": {
    "CommandLine|contains|all": [
      "/delete",
      "Microsoft_Windows_Shell_ZipFolder:filename=",
      ".zip"
    ]
  },
  "condition": "run or delete"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]17839616
  - https://github.com/Tylous/ZipExec
Sigma Detection Rule: Loaded Module Enumeration Via Tasklist.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-02-12
ATT&CK techniques: T1003
Log source: windows/process_creation

Description:
Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe".
This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question.
In order to dump the process memory or perform other nefarious actions.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\tasklist.exe"
    },
    {
      "OriginalFileName": "tasklist.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains|windash": "-m"
  },
  "selection_module": {
    "CommandLine|contains": "rdpcorets.dll"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/
  - https://pentestlab.blog/tag/svchost/
Sigma Detection Rule: PUA - Kernel Driver Utility (KDU) Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
Date: 2026-01-02
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects execution of the Kernel Driver Utility (KDU) tool.
KDU can be used to bypass driver signature enforcement and load unsigned or malicious drivers into the Windows kernel.
Potentially allowing for privilege escalation, persistence, or evasion of security controls.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\kdu.exe",
        "\\hamakaze.exe"
      ]
    },
    {
      "OriginalFileName": "hamakaze.exe"
    }
  ],
  "selection_cli_suspicious": {
    "CommandLine|contains": [
      "-map ",
      "-prv ",
      "-dse ",
      "-ps "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/h4rmy/KDU
  - https://huntress.com/blog/esxi-vm-escape-exploit
Sigma Detection Rule: Potentially Suspicious Cabinet File Expansion
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bhabesh Raj, X__Junior (Nextron Systems)
Date: 2021-07-30
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks

Detection logic:
{
  "selection_cmd": {
    "Image|endswith": "\\expand.exe",
    "CommandLine|contains|windash": "-F:"
  },
  "selection_folders_1": {
    "CommandLine|contains": [
      ":\\Perflogs\\",
      ":\\ProgramData",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\Admin$\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\C$\\",
      "\\Temporary Internet"
    ]
  },
  "selection_folders_2": [
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    }
  ],
  "filter_optional_dell": {
    "ParentImage": "C:\\Program Files (x86)\\Dell\\UpdateService\\ServiceShell.exe",
    "CommandLine|contains": "C:\\ProgramData\\Dell\\UpdateService\\Temp\\"
  },
  "condition": "selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_*"
}

References:
  - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll
  - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/
Sigma Detection Rule: Rundll32 UNC Path Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-10
ATT&CK techniques: T1021.002, T1218.011
Log source: windows/process_creation

Description:
Detects rundll32 execution where the DLL is located on a remote location (share)

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine|contains": "rundll32"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " \\\\\\\\"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.cybereason.com/blog/rundll32-the-infamous-proxy-for-executing-malicious-code
Sigma Detection Rule: Remote Access Tool - AnyDesk Piped Password Via CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-28
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "/c ",
      "echo ",
      ".exe --set-password"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: PUA - Rclone Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group
Date: 2021-05-10
ATT&CK techniques: T1567.002
Log source: windows/process_creation

Description:
Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc

Detection logic:
{
  "selection_specific_options": {
    "CommandLine|contains|all": [
      "--config ",
      "--no-check-certificate ",
      " copy "
    ]
  },
  "selection_rclone_img": [
    {
      "Image|endswith": "\\rclone.exe"
    },
    {
      "Description": "Rsync for cloud storage"
    }
  ],
  "selection_rclone_cli": {
    "CommandLine|contains": [
      "pass",
      "user",
      "copy",
      "sync",
      "config",
      "lsd",
      "remote",
      "ls",
      "mega",
      "pcloud",
      "ftp",
      "ignore-existing",
      "auto-confirm",
      "transfers",
      "multi-thread-streams",
      "no-check-certificate "
    ]
  },
  "condition": "selection_specific_options or all of selection_rclone_*"
}

References:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
  - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone
  - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html
Sigma Detection Rule: Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
Log source: windows/process_creation

Description:
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths.


Detection logic:
{
  "selection_root": {
    "Image|endswith": "\\wusa.exe",
    "CommandLine|contains": "/extract:"
  },
  "selection_paths": {
    "CommandLine|contains": [
      ":\\PerfLogs\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\Appdata\\Local\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://www.echotrail.io/insights/search/wusa.exe/
Sigma Detection Rule: Enumeration for 3rd Party Creds From CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1552.002
Log source: windows/process_creation

Description:
Detects processes that query known 3rd party registry keys that holds credentials via commandline

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\\Software\\Aerofox\\Foxmail\\V3.1",
      "\\Software\\Aerofox\\FoxmailPreview",
      "\\Software\\DownloadManager\\Passwords",
      "\\Software\\FTPWare\\COREFTP\\Sites",
      "\\Software\\IncrediMail\\Identities",
      "\\Software\\Martin Prikryl\\WinSCP 2\\Sessions",
      "\\Software\\Mobatek\\MobaXterm\\",
      "\\Software\\OpenSSH\\Agent\\Keys",
      "\\Software\\OpenVPN-GUI\\configs",
      "\\Software\\ORL\\WinVNC3\\Password",
      "\\Software\\Qualcomm\\Eudora\\CommandLine",
      "\\Software\\RealVNC\\WinVNC4",
      "\\Software\\RimArts\\B2\\Settings",
      "\\Software\\SimonTatham\\PuTTY\\Sessions",
      "\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\",
      "\\Software\\Sota\\FFFTP",
      "\\Software\\TightVNC\\Server",
      "\\Software\\WOW6432Node\\Radmin\\v3.0\\Server\\Parameters\\Radmin"
    ]
  },
  "filter_main_other_rule": {
    "Image|endswith": "reg.exe",
    "CommandLine|contains": [
      "export",
      "save"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://isc.sans.edu/diary/More+Data+Exfiltration/25698
  - https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt
  - https://github.com/HyperSine/how-does-MobaXterm-encrypt-password
  - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry
Sigma Detection Rule: MpiExec Lolbin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary

Detection logic:
{
  "selection_binary": [
    {
      "Image|endswith": "\\mpiexec.exe"
    },
    {
      "Hashes|contains": "IMPHASH=d8b52ef6aaa3a81501bdfff9dbb96217"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      " /n 1 ",
      " -n 1 "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]03246867
  - https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps
Sigma Detection Rule: Arbitrary MSI Download Via Devinit.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      " -t msi-install ",
      " -i http"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]02679809
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devinit/
Sigma Detection Rule: New User Created Via Net.EXE With Never Expire Option
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
ATT&CK techniques: T1136.001
Log source: windows/process_creation

Description:
Detects creation of local users via the net.exe command with the option "never expire"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "user",
      "add",
      "expires:never"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Sigma Detection Rule: Suspicious Download From File-Sharing Website Via Bitsadmin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1197, T1036.003, T1105
Log source: windows/process_creation

Description:
Detects usage of bitsadmin downloading a file from a suspicious domain

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      " /transfer ",
      " /create ",
      " /addfile "
    ]
  },
  "selection_domain": {
    "CommandLine|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
Sigma Detection Rule: HackTool - Stracciatella Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2023-04-17
ATT&CK techniques: T1059, T1685
Log source: windows/process_creation

Description:
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Stracciatella.exe"
    },
    {
      "OriginalFileName": "Stracciatella.exe"
    },
    {
      "Description": "Stracciatella"
    },
    {
      "Hashes|contains": [
        "SHA256=9d25e61ec1527e2a69d7c2a4e3fe2fe15890710c198a66a9f25d99fdf6c7b956",
        "SHA256=fd16609bd9830c63b[PII_REDACTED]bb159b89c357d21942ddbb6b93add808d121a"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/mgeeky/Stracciatella
Sigma Detection Rule: Firewall Disabled via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Fatih Sirin
Date: 2019-11-01
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Detects netsh commands that turns off the Windows firewall

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "firewall",
      "set",
      "opmode",
      "disable"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "advfirewall",
      "set",
      "state",
      "off"
    ]
  },
  "condition": "selection_img and 1 of selection_cli_*"
}

References:
  - https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/
  - https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall
Sigma Detection Rule: PUA - Potential PE Metadata Tamper Using Rcedit
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski
Date: 2022-12-11
ATT&CK techniques: T1036.003, T1036, T1027.005, T1027
Log source: windows/process_creation

Description:
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\rcedit-x64.exe",
        "\\rcedit-x86.exe"
      ]
    },
    {
      "Description": "Edit resources of exe"
    },
    {
      "Product": "rcedit"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": "--set-"
  },
  "selection_attributes": {
    "CommandLine|contains": [
      "OriginalFileName",
      "CompanyName",
      "FileDescription",
      "ProductName",
      "ProductVersion",
      "LegalCopyright"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe
  - https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915
  - https://github.com/electron/rcedit
Sigma Detection Rule: Potential CommandLine Path Traversal Via Cmd.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: xknow @xknow_infosec, Tim Shelton
Date: 2020-06-11
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

Detection logic:
{
  "selection_img": [
    {
      "ParentImage|endswith": "\\cmd.exe"
    },
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "cmd.exe"
    }
  ],
  "selection_flags": [
    {
      "ParentCommandLine|contains": [
        "/c",
        "/k",
        "/r"
      ]
    },
    {
      "CommandLine|contains": [
        "/c",
        "/k",
        "/r"
      ]
    }
  ],
  "selection_path_traversal": [
    {
      "ParentCommandLine": "/../../"
    },
    {
      "CommandLine|contains": "/../../"
    }
  ],
  "filter_java": {
    "CommandLine|contains": "\\Tasktop\\keycloak\\bin\\/../../jre\\bin\\java"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
  - https://twitter.com/Oddvarmoe/status/[PII_REDACTED]49723905
Sigma Detection Rule: Certificate Exported Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-exportPFX "
  },
  "condition": "all of selection_*"
}

References:
  - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html