deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Process Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects the execution of "wmic" with the "process" flag, which adversary might use to list processes running on the compromised host or list installed software hotfixes and patches.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "process"
  },
  "filter_main_creation": {
    "CommandLine|contains|all": [
      "call",
      "create"
    ]
  },
  "condition": "all of selection* and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
Sigma Detection Rule: Sticky Key Like Backdoor Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
Date: 2018-03-15
ATT&CK techniques: T1546.008
Log source: windows/process_creation

Description:
Detects the usage and installation of a backdoor that uses an option to register a malicious debugger for built-in tools that are accessible in the login screen

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\winlogon.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe",
      "\\wt.exe"
    ],
    "CommandLine|contains": [
      "sethc.exe",
      "utilman.exe",
      "osk.exe",
      "Magnify.exe",
      "Narrator.exe",
      "DisplaySwitch.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
Sigma Detection Rule: Abuse of Service Permissions to Hide Services Via Set-Service
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
ATT&CK techniques: T1574.011
Log source: windows/process_creation

Description:
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\pwsh.exe"
    },
    {
      "OriginalFileName": "pwsh.dll"
    }
  ],
  "selection_sddl": {
    "CommandLine|contains|all": [
      "Set-Service ",
      "DCLCWPDTSD"
    ]
  },
  "selection_cmdlet": {
    "CommandLine|contains": [
      "-SecurityDescriptorSddl ",
      "-sd "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]96828672
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
Sigma Detection Rule: Windows Shell/Scripting Processes Spawning Suspicious Programs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton
Date: 2018-04-06
ATT&CK techniques: T1059.005, T1059.001, T1218
Log source: windows/process_creation

Description:
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\rundll32.exe",
      "\\cscript.exe",
      "\\wscript.exe",
      "\\wmiprvse.exe",
      "\\regsvr32.exe"
    ],
    "Image|endswith": [
      "\\schtasks.exe",
      "\\nslookup.exe",
      "\\certutil.exe",
      "\\bitsadmin.exe",
      "\\mshta.exe"
    ]
  },
  "filter_ccmcache": {
    "CurrentDirectory|contains": "\\ccmcache\\"
  },
  "filter_amazon": {
    "ParentCommandLine|contains": [
      "\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\setup-scheduledtask.ps1",
      "\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\set-selfhealing.ps1",
      "\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\check-workspacehealth.ps1",
      "\\nessus_"
    ]
  },
  "filter_nessus": {
    "CommandLine|contains": "\\nessus_"
  },
  "filter_sccm_install": {
    "ParentImage|endswith": "\\mshta.exe",
    "Image|endswith": "\\mshta.exe",
    "ParentCommandLine|contains|all": [
      "C:\\MEM_Configmgr_",
      "\\splash.hta",
      "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"
    ],
    "CommandLine|contains|all": [
      "C:\\MEM_Configmgr_",
      "\\SMSSETUP\\BIN\\",
      "\\autorun.hta",
      "{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
Sigma Detection Rule: Non Interactive PowerShell Process Spawned
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)
Date: 2019-09-12
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "filter_main_generic": {
    "ParentImage|endswith": [
      ":\\Windows\\explorer.exe",
      ":\\Windows\\System32\\CompatTelRunner.exe",
      ":\\Windows\\SysWOW64\\explorer.exe"
    ]
  },
  "filter_main_windows_update": {
    "ParentImage": ":\\$WINDOWS.~BT\\Sources\\SetupHost.exe"
  },
  "filter_optional_vscode": {
    "ParentImage|endswith": "\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
    "ParentCommandLine|contains": " --ms-enable-electron-run-as-node "
  },
  "filter_optional_terminal": {
    "ParentImage|contains": ":\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal_",
    "ParentImage|endswith": "\\WindowsTerminal.exe"
  },
  "filter_optional_defender": {
    "ParentImage|endswith": ":\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]2237/https://threathunterplaybook.com/notebooks/windows/02_execution/WIN[PII_REDACTED]10.html
Sigma Detection Rule: HackTool - Empire PowerShell Launch Parameters
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-04-20
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious powershell command line parameters used in Empire

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      " -NoP -sta -NonI -W Hidden -Enc ",
      " -noP -sta -w 1 -enc ",
      " -NoP -NonI -W Hidden -enc ",
      " -noP -sta -w 1 -enc",
      " -enc  SQB",
      " -nop -exec bypass -EncodedCommand "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64
Sigma Detection Rule: Domain Trust Discovery Via Dsquery
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72
Date: 2019-10-24
ATT&CK techniques: T1482
Log source: windows/process_creation

Description:
Detects execution of "dsquery.exe" for domain trust discovery

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dsquery.exe"
    },
    {
      "OriginalFileName": "dsquery.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "trustedDomain"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md
  - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843
Sigma Detection Rule: Potential Product Class Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2023-02-14
ATT&CK techniques: T1047, T1082
Log source: windows/process_creation

Description:
Detects the execution of WMIC in order to get a list of firewall, antivirus and antispywware products.
Adversaries often enumerate security products installed on a system to identify security controls and potential ways to evade detection or disable protection mechanisms.
This information helps them plan their next attack steps and choose appropriate techniques to bypass security measures.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "AntiVirusProduct",
      "AntiSpywareProduct",
      "FirewallProduct"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md
  - https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1
  - https://www.trendmicro.com/en_us/research/25/c/socgholishs-intrusion-techniques-facilitate-distribution-of-rans.html
Sigma Detection Rule: Visual Basic Command Line Compiler Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
Date: 2020-10-07
ATT&CK techniques: T1027.004
Log source: windows/process_creation

Description:
Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\vbc.exe",
    "Image|endswith": "\\cvtres.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Vbc/
Sigma Detection Rule: Write Protect For Storage Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2021-06-11
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects applications trying to modify the registry in order to disable any write-protect property for storage devices.
This could be a precursor to a ransomware attack and has been an observed technique used by cypherpunk group.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\System\\CurrentControlSet\\Control",
      "Write Protection",
      "0",
      "storage"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.manageengine.com/products/desktop-central/os-imaging-deployment/media-is-write-protected.html
Sigma Detection Rule: Suspicious Cabinet File Execution Via Msdt.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113
Date: 2022-06-21
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\msdt.exe"
    },
    {
      "OriginalFileName": "msdt.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|windash": " -cab "
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]37781506
  - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff[PII_REDACTED]545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0
  - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
Sigma Detection Rule: Usage Of Web Request Commands And Cmdlets
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger
Date: 2019-10-24
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "[System.Net.WebRequest]::create",
      "curl ",
      "Invoke-RestMethod",
      "Invoke-WebRequest",
      " irm ",
      "iwr ",
      "Resume-BitsTransfer",
      "Start-BitsTransfer",
      "wget ",
      "WinHttp.WinHttpRequest"
    ]
  },
  "condition": "selection"
}

References:
  - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
  - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
  - https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps
Sigma Detection Rule: HackTool - Bloodhound/Sharphound Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-12-20
ATT&CK techniques: T1087.001, T1087.002, T1482, T1069.001, T1069.002, T1059.001
Log source: windows/process_creation

Description:
Detects command line parameters used by Bloodhound and Sharphound hack tools

Detection logic:
{
  "selection_img": [
    {
      "Product|contains": "SharpHound"
    },
    {
      "Description|contains": "SharpHound"
    },
    {
      "Company|contains": [
        "SpecterOps",
        "evil corp"
      ]
    },
    {
      "Image|contains": [
        "\\Bloodhound.exe",
        "\\SharpHound.exe"
      ]
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains": [
      " -CollectionMethod All ",
      " --CollectionMethods Session ",
      " --Loop --Loopduration ",
      " --PortScanTimeout ",
      ".exe -c All -d ",
      "Invoke-Bloodhound",
      "Get-BloodHoundData"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      " -JsonFolder ",
      " -ZipFileName "
    ]
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      " DCOnly ",
      " --NoSaveCache "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/BloodHoundAD/BloodHound
  - https://github.com/BloodHoundAD/SharpHound
Sigma Detection Rule: Add SafeBoot Keys Via Reg Utility
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-02
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects execution of "reg.exe" commands with the "add" or "copy" flags on safe boot registry keys. Often used by attacker to allow the ransomware to work in safe mode as some security products do not

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_safeboot": {
    "CommandLine|contains": "\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot"
  },
  "selection_flag": {
    "CommandLine|contains": [
      " copy ",
      " add "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
Sigma Detection Rule: Remote Access Tool - GoToAssist Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Description": "GoTo Opener"
    },
    {
      "Product": "GoTo Opener"
    },
    {
      "Company": "LogMeIn, Inc."
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
Sigma Detection Rule: Shell Process Spawned by Java.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali
Date: 2021-12-17
Log source: windows/process_creation

Description:
Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\java.exe",
    "Image|endswith": [
      "\\bash.exe",
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_main_build": {
    "ParentImage|contains": "build",
    "CommandLine|contains": "build"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0738/https://www.lunasec.io/docs/blog/log4j-zero-day/
Sigma Detection Rule: Arbitrary File Download Via MSOHTMED.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of "MSOHTMED" to download arbitrary files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\MSOHTMED.exe"
    },
    {
      "OriginalFileName": "MsoHtmEd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "ftp://",
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files
Sigma Detection Rule: AspNetCompiler Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-24
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.

Detection logic:
{
  "selection": {
    "Image|contains": [
      ":\\Windows\\Microsoft.NET\\Framework\\",
      ":\\Windows\\Microsoft.NET\\Framework64\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm64\\"
    ],
    "Image|endswith": "\\aspnet_compiler.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
Sigma Detection Rule: Remote Access Tool - ScreenConnect Installation Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-02-11
ATT&CK techniques: T1133
Log source: windows/process_creation

Description:
Detects ScreenConnect program starts that establish a remote access to a system.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "e=Access&",
      "y=Guest&",
      "&p=",
      "&c=",
      "&k="
    ]
  },
  "condition": "selection"
}

References:
  - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
Sigma Detection Rule: Potential Fake Instance Of Hxtsr.EXE Executed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-04-17
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe


Detection logic:
{
  "selection": {
    "Image|endswith": "\\hxtsr.exe"
  },
  "filter_main_hxtsr": {
    "Image|contains": ":\\program files\\windowsapps\\microsoft.windowscommunicationsapps_",
    "Image|endswith": "\\hxtsr.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Child Process Of Manage Engine ServiceDesk
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-01-18
ATT&CK techniques: T1102
Log source: windows/process_creation

Description:
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service

Detection logic:
{
  "selection": {
    "ParentImage|contains|all": [
      "\\ManageEngine\\ServiceDesk\\",
      "\\java.exe"
    ],
    "Image|endswith": [
      "\\AppVLP.exe",
      "\\bash.exe",
      "\\bitsadmin.exe",
      "\\calc.exe",
      "\\certutil.exe",
      "\\cscript.exe",
      "\\curl.exe",
      "\\forfiles.exe",
      "\\mftrace.exe",
      "\\mshta.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\notepad.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\query.exe",
      "\\reg.exe",
      "\\schtasks.exe",
      "\\scrcons.exe",
      "\\sh.exe",
      "\\systeminfo.exe",
      "\\whoami.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "filter_main_net": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains": " stop"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/
  - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py
  - https://blog.viettelcybersecurity.com/saml-show-stopper/
Sigma Detection Rule: Suspicious CertReq Command to Download
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Christian Burkard (Nextron Systems)
Date: 2021-11-24
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects a suspicious CertReq execution downloading a file.
This behavior is often used by attackers to download additional payloads or configuration files.
Certreq is a built-in Windows utility used to request and retrieve certificates from a certification authority (CA). However, it can be abused by threat actors for malicious purposes.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certreq.exe"
    },
    {
      "OriginalFileName": "CertReq.exe"
    }
  ],
  "selection_cli_flag_post": {
    "CommandLine|contains|windash": "-Post"
  },
  "selection_cli_flag_config": {
    "CommandLine|contains|windash": "-config"
  },
  "selection_cli_http": {
    "CommandLine|contains": "http"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Certreq/