deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PowerShell Scripts Installed as Services - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Natalia Shornikova
Date: 2020-10-06
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects powershell script installed as a Service

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains": [
      "powershell",
      "pwsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Credential Dumping Tools Service Execution - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
Date: 2017-03-05
ATT&CK techniques: T1003.001, T1003.002, T1003.004, T1003.005, T1003.006, T1569.002
Log source: windows/

Description:
Detects well-known credential dumping tools execution via service execution events

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains": [
      "cachedump",
      "dumpsvc",
      "fgexec",
      "gsecdump",
      "mimidrv",
      "pwdump",
      "servpw"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: Suspicious Remote Logon with Explicit Credentials
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Tim Shelton
Date: 2020-10-05
ATT&CK techniques: T1078
Log source: windows/

Description:
Detects suspicious processes logging on with explicit credentials

Detection logic:
{
  "selection": {
    "EventID": 4648,
    "ProcessName|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\winrs.exe",
      "\\wmic.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\reg.exe"
    ]
  },
  "filter1": {
    "TargetServerName": "localhost"
  },
  "filter2": {
    "SubjectUserName|endswith": "$",
    "TargetUserName|endswith": "$"
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
Sigma Detection Rule: Possible Impacket SecretDump Remote Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, wagga
Date: 2019-04-03
ATT&CK techniques: T1003.002, T1003.004, T1003.003
Log source: windows/

Description:
Detect AD credential dumping using impacket secretdump HKTL

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\ADMIN$",
    "RelativeTargetName|contains|all": [
      "SYSTEM32\\",
      ".tmp"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
Sigma Detection Rule: SCM Database Privileged Operation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Date: 2019-08-15
ATT&CK techniques: T1548
Log source: windows/

Description:
Detects non-system users performing privileged operation os the SCM database

Detection logic:
{
  "selection": {
    "EventID": 4674,
    "ObjectType": "SC_MANAGER OBJECT",
    "ObjectName": "servicesactive",
    "PrivilegeList": "SeTakeOwnershipPrivilege"
  },
  "filter": {
    "SubjectLogonId": "0x3e4",
    "ProcessName|endswith": ":\\Windows\\System32\\services.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
Sigma Detection Rule: Suspicious Kerberos RC4 Ticket Encryption
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-02-06
ATT&CK techniques: T1558.003
Log source: windows/

Description:
Detects service ticket requests using RC4 encryption type

Detection logic:
{
  "selection": {
    "EventID": 4769,
    "TicketOptions": "0x40810000",
    "TicketEncryptionType": "0x17"
  },
  "reduction": {
    "ServiceName|endswith": "$"
  },
  "condition": "selection and not reduction"
}

References:
  - https://adsecurity.org/?p=3458
  - https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity
Sigma Detection Rule: User Added to Local Administrator Group
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2017-03-14
ATT&CK techniques: T1078, T1098
Log source: windows/

Description:
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity

Detection logic:
{
  "selection_eid": {
    "EventID": 4732
  },
  "selection_group": [
    {
      "TargetUserName|startswith": "Administr"
    },
    {
      "TargetSid": "S-1-5-32-544"
    }
  ],
  "filter_main_computer_accounts": {
    "SubjectUserName|endswith": "$"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
Sigma Detection Rule: Mimikatz DC Sync
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Benjamin Delpy, Florian Roth (Nextron Systems), Scott Dermott, Sorina Ionescu
Date: 2018-06-03
ATT&CK techniques: T1003.006
Log source: windows/

Description:
Detects Mimikatz DC sync security events

Detection logic:
{
  "selection": {
    "EventID": 4662,
    "Properties|contains": [
      "Replicating Directory Changes All",
      "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
      "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
      "9923a32a-3607-11d2-b9be-0000f87a36b2",
      "89e95b76-444d-4c62-991a-0facbeda640c"
    ],
    "AccessMask": "0x100"
  },
  "filter1": {
    "SubjectDomainName": "Window Manager"
  },
  "filter2": {
    "SubjectUserName|startswith": [
      "NT AUT",
      "MSOL_"
    ]
  },
  "filter3": {
    "SubjectUserName|endswith": "$"
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://twitter.com/gentilkiwi/status/[PII_REDACTED]25413376
  - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
  - https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662
Sigma Detection Rule: Password Protected ZIP File Opened
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-09
ATT&CK techniques: T1027
Log source: windows/

Description:
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Detection logic:
{
  "selection": {
    "EventID": 5379,
    "TargetName|contains": "Microsoft_Windows_Shell_ZipFolder:filename"
  },
  "filter": {
    "TargetName|contains": "\\Temporary Internet Files\\Content.Outlook"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]13379841
Sigma Detection Rule: Password Protected ZIP File Opened (Email Attachment)
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-09
ATT&CK techniques: T1027, T1566.001
Log source: windows/

Description:
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.

Detection logic:
{
  "selection": {
    "EventID": 5379,
    "TargetName|contains|all": [
      "Microsoft_Windows_Shell_ZipFolder:filename",
      "\\Temporary Internet Files\\Content.Outlook"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]13379841
Sigma Detection Rule: Group Policy Abuse for Privilege Addition
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Elastic, Josh Nickels, Marius Rothenbücher
Date: 2024-09-04
ATT&CK techniques: T1484.001
Log source: windows/

Description:
Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins.


Detection logic:
{
  "selection": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": "gPCMachineExtensionNames",
    "AttributeValue|contains": [
      "827D319E-6EAC-11D2-A4EA-00C04F79F83A",
      "803E14A0-B4FB-11D0-A0D0-00A0C90F574B"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275
Sigma Detection Rule: Suspicious Teams Application Related ObjectAcess Event
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @SerkinValery
Date: 2022-09-16
ATT&CK techniques: T1528
Log source: windows/

Description:
Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.

Detection logic:
{
  "selection": {
    "EventID": 4663,
    "ObjectName|contains": [
      "\\Microsoft\\Teams\\Cookies",
      "\\Microsoft\\Teams\\Local Storage\\leveldb"
    ]
  },
  "filter": {
    "ProcessName|contains": "\\Microsoft\\Teams\\current\\Teams.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens
Sigma Detection Rule: DCOM InternetExplorer.Application Iertutil DLL Hijack - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
Date: 2020-10-12
ATT&CK techniques: T1021.002, T1021.003
Log source: windows/

Description:
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "RelativeTargetName|endswith": "\\Internet Explorer\\iertutil.dll"
  },
  "filter": {
    "SubjectUserName|endswith": "$"
  },
  "condition": "selection and not filter"
}

References:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
Sigma Detection Rule: Important Scheduled Task Deleted/Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-05
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities

Detection logic:
{
  "selection": {
    "EventID": [
      4699,
      4701
    ],
    "TaskName|contains": [
      "\\Windows\\SystemRestore\\SR",
      "\\Windows\\Windows Defender\\",
      "\\Windows\\BitLocker",
      "\\Windows\\WindowsBackup\\",
      "\\Windows\\WindowsUpdate\\",
      "\\Windows\\UpdateOrchestrator\\Schedule",
      "\\Windows\\ExploitGuard"
    ]
  },
  "filter_main_defender_update": {
    "EventID": 4699,
    "SubjectUserName|endswith": "$",
    "TaskName|contains": "\\Windows\\Windows Defender\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701
Sigma Detection Rule: Add or Remove Computer from DC
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-10-14
ATT&CK techniques: T1207
Log source: windows/

Description:
Detects the creation or removal of a computer. Can be used to detect attacks such as DCShadow via the creation of a new SPN.

Detection logic:
{
  "selection": {
    "EventID": [
      4741,
      4743
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743
Sigma Detection Rule: Uncommon Outbound Kerberos Connection - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1558.003
Log source: windows/

Description:
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.


Detection logic:
{
  "selection": {
    "EventID": 5156,
    "DestPort": 88
  },
  "filter_main_lsass": {
    "Application|startswith": [
      "\\device\\harddiskvolume",
      "C:"
    ],
    "Application|endswith": "\\Windows\\System32\\lsass.exe"
  },
  "filter_optional_chrome": {
    "Application|startswith": [
      "\\device\\harddiskvolume",
      "C:"
    ],
    "Application|endswith": [
      "\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
      "\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_firefox": {
    "Application|startswith": [
      "\\device\\harddiskvolume",
      "C:"
    ],
    "Application|endswith": [
      "\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
      "\\Program Files\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_optional_tomcat": {
    "Application|endswith": "\\tomcat\\bin\\tomcat8.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/GhostPack/Rubeus
Sigma Detection Rule: WCE wceaux.dll Access
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Thomas Patzke
Date: 2017-06-14
ATT&CK techniques: T1003
Log source: windows/

Description:
Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host

Detection logic:
{
  "selection": {
    "EventID": [
      4656,
      4663
    ],
    "ObjectName|endswith": "\\wceaux.dll"
  },
  "condition": "selection"
}

References:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
Sigma Detection Rule: Invoke-Obfuscation Via Use MSHTA - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via use MSHTA in Scripts

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "mshta",
      "vbscript:createobject",
      ".run",
      "window.close"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Security Eventlog Cleared
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-01-10
ATT&CK techniques: T1685.005
Log source: windows/

Description:
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Detection logic:
{
  "selection_517": {
    "EventID": 517,
    "Provider_Name": "Security"
  },
  "selection_1102": {
    "EventID": 1102,
    "Provider_Name": "Microsoft-Windows-Eventlog"
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/deviouspolack/status/[PII_REDACTED]60209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/SecurityEventLogCleared.yaml
Sigma Detection Rule: WMI Persistence - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
Date: 2017-08-22
ATT&CK techniques: T1546.003
Log source: windows/

Description:
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Detection logic:
{
  "selection": {
    "EventID": 4662,
    "ObjectType": "WMI Namespace",
    "ObjectName|contains": "subscription"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/mattifestation/status/[PII_REDACTED]48539397
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Sigma Detection Rule: SAM Registry Hive Handle Request
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-12
ATT&CK techniques: T1012, T1552.002
Log source: windows/

Description:
Detects handles requested to SAM registry hive

Detection logic:
{
  "selection": {
    "EventID": 4656,
    "ObjectType": "Key",
    "ObjectName|endswith": "\\SAM"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html
Sigma Detection Rule: Invoke-Obfuscation Via Use Clip - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via use Clip.exe in Scripts

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains": "(Clipboard|i"
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Windows Network Access Suspicious desktop.ini Action
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Shelton (HAWK.IO)
Date: 2021-12-06
ATT&CK techniques: T1547.009
Log source: windows/

Description:
Detects unusual processes accessing desktop.ini remotely over network share, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ObjectType": "File",
    "RelativeTargetName|endswith": "\\desktop.ini",
    "AccessList|contains": [
      "WriteData",
      "DELETE",
      "WriteDAC",
      "AppendData",
      "AddSubdirectory"
    ]
  },
  "condition": "selection"
}

References:
  - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
Sigma Detection Rule: Suspicious Scheduled Task Update
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-05
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects update to a scheduled task event that contain suspicious keywords.

Detection logic:
{
  "selection_eid": {
    "EventID": 4702
  },
  "selection_paths": {
    "TaskContentNew|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\Users\\Public\\",
      "\\WINDOWS\\Temp\\",
      "C:\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Temporary Internet",
      "C:\\ProgramData\\",
      "C:\\Perflogs\\"
    ]
  },
  "selection_commands": {
    "TaskContentNew|contains": [
      "regsvr32",
      "rundll32",
      "cmd.exe</Command>",
      "cmd</Command>",
      "<Arguments>/c ",
      "<Arguments>/k ",
      "<Arguments>/r ",
      "powershell",
      "pwsh",
      "mshta",
      "wscript",
      "cscript",
      "certutil",
      "bitsadmin",
      "bash.exe",
      "bash ",
      "scrcons",
      "wmic ",
      "wmic.exe",
      "forfiles",
      "scriptrunner",
      "hh.exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698
Sigma Detection Rule: Kerberos Manipulation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-02-10
ATT&CK techniques: T1212
Log source: windows/

Description:
Detects failed Kerberos TGT issue operation. This can be a sign of manipulations of TGT messages by an attacker.

Detection logic:
{
  "selection": {
    "EventID": [
      675,
      4768,
      4769,
      4771
    ],
    "Status": [
      "0x9",
      "0xA",
      "0xB",
      "0xF",
      "0x10",
      "0x11",
      "0x13",
      "0x14",
      "0x1A",
      "0x1F",
      "0x21",
      "0x22",
      "0x23",
      "0x24",
      "0x26",
      "0x27",
      "0x28",
      "0x29",
      "0x2C",
      "0x2D",
      "0x2E",
      "0x2F",
      "0x31",
      "0x32",
      "0x3E",
      "0x3F",
      "0x40",
      "0x41",
      "0x43",
      "0x44"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
Sigma Detection Rule: Metasploit SMB Authentication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Chakib Gzenayi (@Chak092), Hosni Mribah
Date: 2020-05-06
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Alerts on Metasploit host's authentications on the domain.

Detection logic:
{
  "selection1": {
    "EventID": [
      4625,
      4624
    ],
    "LogonType": 3,
    "AuthenticationPackageName": "NTLM",
    "WorkstationName|re": "^[A-Za-z0-9]{16}$"
  },
  "selection2": {
    "EventID": 4776,
    "Workstation|re": "^[A-Za-z0-9]{16}$"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/lib/rex/proto/smb/client.rb
Sigma Detection Rule: Suspicious Windows ANONYMOUS LOGON Local Account Created
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: James Pemberton / @4A616D6573
Date: 2019-10-31
ATT&CK techniques: T1136.001, T1136.002
Log source: windows/

Description:
Detects the creation of suspicious accounts similar to ANONYMOUS LOGON, such as using additional spaces. Created as an covering detection for exclusion of Logon Type 3 from ANONYMOUS LOGON accounts.

Detection logic:
{
  "selection": {
    "EventID": 4720,
    "SamAccountName|contains|all": [
      "ANONYMOUS",
      "LOGON"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]82829824
Sigma Detection Rule: Suspicious PsExec Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1021.002
Log source: windows/

Description:
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

Detection logic:
{
  "selection1": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$",
    "RelativeTargetName|endswith": [
      "-stdin",
      "-stdout",
      "-stderr"
    ]
  },
  "filter": {
    "RelativeTargetName|startswith": "PSEXESVC"
  },
  "condition": "selection1 and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
Sigma Detection Rule: A New Trust Was Created To A Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Thomas Patzke
Date: 2019-12-03
ATT&CK techniques: T1098
Log source: windows/

Description:
Addition of domains is seldom and should be verified for legitimacy.

Detection logic:
{
  "selection": {
    "EventID": 4706
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706