deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: New DMSA Service Account Created in Specific OUs
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-24
ATT&CK techniques: T1078.002, T1098
Log source: windows/process_creation

Description:
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\powershell_ise.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell.exe",
        "pwsh.dll",
        "powershell_ise.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "New-ADServiceAccount",
      "-CreateDelegatedServiceAccount",
      "-path"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
Sigma Detection Rule: Hiding Files with Attrib.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sami Ruohonen
Date: 2019-01-16
ATT&CK techniques: T1564.001
Log source: windows/process_creation

Description:
Detects usage of attrib.exe to hide files from users.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\attrib.exe"
    },
    {
      "OriginalFileName": "ATTRIB.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " +h "
  },
  "filter_main_msiexec": {
    "CommandLine|contains": "\\desktop.ini "
  },
  "filter_optional_intel": {
    "ParentImage|endswith": "\\cmd.exe",
    "CommandLine": "+R +H +S +A \\\\\\*.cui",
    "ParentCommandLine": "C:\\\\WINDOWS\\\\system32\\\\\\*.bat"
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
  - https://www.uptycs.com/blog/lolbins-are-no-laughing-matter
Sigma Detection Rule: Ruby Inline Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ruby.exe"
    },
    {
      "OriginalFileName": "ruby.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -e"
  },
  "condition": "all of selection_*"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
Sigma Detection Rule: IIS Native-Code Module Command Line Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-12-11
ATT&CK techniques: T1505.003
Log source: windows/process_creation

Description:
Detects suspicious IIS native-code module installations via command line

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\appcmd.exe"
    },
    {
      "OriginalFileName": "appcmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "install",
      "module"
    ],
    "CommandLine|contains|windash": "-name:"
  },
  "filter_iis_setup": {
    "ParentImage": "C:\\Windows\\System32\\inetsrv\\iissetup.exe"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
Sigma Detection Rule: Suspicious Process Patterns NTDS.DIT Exfil
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-11
ATT&CK techniques: T1003.003
Log source: windows/process_creation

Description:
Detects suspicious process patterns used in NTDS.DIT exfiltration

Detection logic:
{
  "selection_tool": [
    {
      "Image|endswith": [
        "\\NTDSDump.exe",
        "\\NTDSDumpEx.exe"
      ]
    },
    {
      "CommandLine|contains|all": [
        "ntds.dit",
        "system.hiv"
      ]
    },
    {
      "CommandLine|contains": "NTDSgrab.ps1"
    }
  ],
  "selection_oneliner_1": {
    "CommandLine|contains|all": [
      "ac i ntds",
      "create full"
    ]
  },
  "selection_onliner_2": {
    "CommandLine|contains|all": [
      "/c copy ",
      "\\windows\\ntds\\ntds.dit"
    ]
  },
  "selection_onliner_3": {
    "CommandLine|contains|all": [
      "activate instance ntds",
      "create full"
    ]
  },
  "selection_powershell": {
    "CommandLine|contains|all": [
      "powershell",
      "ntds.dit"
    ]
  },
  "set1_selection_ntds_dit": {
    "CommandLine|contains": "ntds.dit"
  },
  "set1_selection_image_folder": [
    {
      "ParentImage|contains": [
        "\\apache",
        "\\tomcat",
        "\\AppData\\",
        "\\Temp\\",
        "\\Public\\",
        "\\PerfLogs\\"
      ]
    },
    {
      "Image|contains": [
        "\\apache",
        "\\tomcat",
        "\\AppData\\",
        "\\Temp\\",
        "\\Public\\",
        "\\PerfLogs\\"
      ]
    }
  ],
  "condition": "1 of selection* or all of set1*"
}

References:
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  - https://pentestlab.blog/tag/ntds-dit/
  - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1
  - https://github.com/zcgonvh/NTDSDumpEx
Sigma Detection Rule: Suspicious HH.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Maxim Pavlunin
Date: 2020-04-01
ATT&CK techniques: T1047, T1059.001, T1059.003, T1059.005, T1059.007, T1218, T1218.001, T1218.010, T1218.011, T1566, T1566.001
Log source: windows/process_creation

Description:
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "HH.exe"
    },
    {
      "Image|endswith": "\\hh.exe"
    }
  ],
  "selection_paths": {
    "CommandLine|contains": [
      ".application",
      "\\AppData\\Local\\Temp\\",
      "\\Content.Outlook\\",
      "\\Downloads\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff[PII_REDACTED]4026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
Sigma Detection Rule: Sdclt Child Processes
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
A General detection for sdclt spawning new processes. This could be an indicator of sdclt being used for bypass UAC techniques.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\sdclt.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/6
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md
Sigma Detection Rule: Suspicious LNK Command-Line Padding with Whitespace Characters
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-03-19
ATT&CK techniques: T1204.002
Log source: windows/process_creation

Description:
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.


Detection logic:
{
  "selection_img": [
    {
      "ParentImage|endswith": "\\explorer.exe"
    },
    {
      "ParentCommandLine|contains": ".lnk"
    }
  ],
  "selection_cmd": [
    {
      "CommandLine|contains": [
        "                 ",
        "\\u0009",
        "\\u000A",
        "\\u0011",
        "\\u0012",
        "\\u0013",
        "\\u000B",
        "\\u000C",
        "\\u000D"
      ]
    },
    {
      "CommandLine|re": "\\n\\n\\n\\n\\n\\n"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415
  - https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html
  - https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
Sigma Detection Rule: Potential Persistence Via Logon Scripts - CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tom Ueltschi (@c_APT_ure)
Date: 2019-01-12
ATT&CK techniques: T1037.001
Log source: windows/process_creation

Description:
Detects the addition of a new LogonScript to the registry value "UserInitMprLogonScript" for potential persistence

Detection logic:
{
  "selection": {
    "CommandLine|contains": "UserInitMprLogonScript"
  },
  "condition": "selection"
}

References:
  - https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html
Sigma Detection Rule: Chopper Webshell Process Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), MSTI (query)
Date: 2022-10-01
ATT&CK techniques: T1505.003, T1018, T1033, T1087
Log source: windows/process_creation

Description:
Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells

Detection logic:
{
  "selection_origin": [
    {
      "Image|endswith": "\\w3wp.exe"
    },
    {
      "ParentImage|endswith": "\\w3wp.exe"
    }
  ],
  "selection_cmdline": {
    "CommandLine|contains": [
      "&ipconfig&echo",
      "&quser&echo",
      "&whoami&echo",
      "&c:&echo",
      "&cd&echo",
      "&dir&echo",
      "&echo [E]",
      "&echo [S]"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
Sigma Detection Rule: COM Object Execution via Xwizard.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-07
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument.
This utility can be abused in order to run custom COM object created in the registry.


Detection logic:
{
  "selection": {
    "CommandLine": "RunWizard",
    "CommandLine|re": "\\{[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}\\}"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Xwizard/
  - https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html
  - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
Sigma Detection Rule: Suspicious Velociraptor Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-29
ATT&CK techniques: T1219
Log source: windows/process_creation

Description:
Detects the suspicious use of the Velociraptor DFIR tool to execute other tools or download additional payloads, as seen in a campaign where it was abused for remote access and to stage further attacks.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\Velociraptor.exe"
  },
  "selection_child_vscode_tunnel": {
    "CommandLine|contains|all": [
      "code.exe",
      "tunnel",
      "--accept-server-license-terms"
    ]
  },
  "selection_child_msiexec": {
    "CommandLine|contains|all": [
      "msiexec",
      "/i",
      "http"
    ]
  },
  "selection_child_powershell": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      "Invoke-WebRequest ",
      "IWR ",
      ".DownloadFile",
      ".DownloadString"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
Sigma Detection Rule: PowerShell Base64 Encoded Invoke Keyword
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t
Date: 2022-05-20
ATT&CK techniques: T1059.001, T1027
Log source: windows/process_creation

Description:
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_enc": {
    "CommandLine|contains": " -e"
  },
  "selection_cli_invoke": {
    "CommandLine|contains": [
      "SQBuAHYAbwBrAGUALQ",
      "kAbgB2AG8AawBlAC0A",
      "JAG4AdgBvAGsAZQAtA",
      "SW52b2tlL",
      "ludm9rZS",
      "JbnZva2Ut"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
Sigma Detection Rule: Taskmgr as LOCAL_SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-03-18
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM

Detection logic:
{
  "selection": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "Image|endswith": "\\taskmgr.exe"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Hacktool Execution - PE Metadata
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-27
ATT&CK techniques: T1588.002, T1003
Log source: windows/process_creation

Description:
Detects the execution of different Windows based hacktools via PE metadata (company, product, etc.) even if the files have been renamed

Detection logic:
{
  "selection": {
    "Company": "Cube0x0"
  },
  "condition": "selection"
}

References:
  - https://github.com/cube0x0
  - https://www.virustotal.com/gui/search/metadata%253ACube0x0/files
Sigma Detection Rule: Potential WinAPI Calls Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-06
ATT&CK techniques: T1106
Log source: windows/process_creation

Description:
Detects the use of WinAPI Functions via the commandline. As seen used by threat actors via the tool winapiexec

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "AddSecurityPackage",
      "AdjustTokenPrivileges",
      "Advapi32",
      "CloseHandle",
      "CreateProcessWithToken",
      "CreatePseudoConsole",
      "CreateRemoteThread",
      "CreateThread",
      "CreateUserThread",
      "DangerousGetHandle",
      "DuplicateTokenEx",
      "EnumerateSecurityPackages",
      "FreeHGlobal",
      "FreeLibrary",
      "GetDelegateForFunctionPointer",
      "GetLogonSessionData",
      "GetModuleHandle",
      "GetProcAddress",
      "GetProcessHandle",
      "GetTokenInformation",
      "ImpersonateLoggedOnUser",
      "kernel32",
      "LoadLibrary",
      "memcpy",
      "MiniDumpWriteDump",
      "ntdll",
      "OpenDesktop",
      "OpenProcess",
      "OpenProcessToken",
      "OpenThreadToken",
      "OpenWindowStation",
      "PtrToString",
      "QueueUserApc",
      "ReadProcessMemory",
      "RevertToSelf",
      "RtlCreateUserThread",
      "secur32",
      "SetThreadToken",
      "VirtualAlloc",
      "VirtualFree",
      "VirtualProtect",
      "WaitForSingleObject",
      "WriteInt32",
      "WriteProcessMemory",
      "ZeroFreeGlobalAllocUnicode"
    ]
  },
  "filter_optional_mpcmdrun": {
    "Image|endswith": "\\MpCmdRun.exe",
    "CommandLine|contains": "GetLoadLibraryWAddress32"
  },
  "filter_optional_compatTelRunner": {
    "ParentImage|endswith": "\\CompatTelRunner.exe",
    "CommandLine|contains": [
      "FreeHGlobal",
      "PtrToString",
      "kernel32

References:
  - https://twitter.com/m417z/status/[PII_REDACTED]88007425
Sigma Detection Rule: DSInternals Suspicious PowerShell Cmdlets
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri
Date: 2024-06-26
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files.
The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Add-ADDBSidHistory",
      "Add-ADNgcKey",
      "Add-ADReplNgcKey",
      "ConvertFrom-ADManagedPasswordBlob",
      "ConvertFrom-GPPrefPassword",
      "ConvertFrom-ManagedPasswordBlob",
      "ConvertFrom-UnattendXmlPassword",
      "ConvertFrom-UnicodePassword",
      "ConvertTo-AADHash",
      "ConvertTo-GPPrefPassword",
      "ConvertTo-KerberosKey",
      "ConvertTo-LMHash",
      "ConvertTo-MsoPasswordHash",
      "ConvertTo-NTHash",
      "ConvertTo-OrgIdHash",
      "ConvertTo-UnicodePassword",
      "Disable-ADDBAccount",
      "Enable-ADDBAccount",
      "Get-ADDBAccount",
      "Get-ADDBBackupKey",
      "Get-ADDBDomainController",
      "Get-ADDBGroupManagedServiceAccount",
      "Get-ADDBKdsRootKey",
      "Get-ADDBSchemaAttribute",
      "Get-ADDBServiceAccount",
      "Get-ADDefaultPasswordPolicy",
      "Get-ADKeyCredential",
      "Get-ADPasswordPolicy",
      "Get-ADReplAccount",
      "Get-ADReplBackupKey",
      "Get-ADReplicationAccount",
      "Get-ADSIAccount",
      "Get-AzureADUserEx",
      "Get-BootKey",
      "Get-KeyCredential",
      "Get-LsaBackupKey",
      "Get-LsaPolicy",
      "Get-SamPasswordPolicy",
      "Get-SysKey",
      "Get-SystemKey",
      "New-ADDBRestoreFromMediaScript",
      "New-ADKeyCredential",
      "New-ADNgcKey",
      "New-NTHashSet",
      "Remove-ADDBObject",
      "Save-DPAPIBlob",
      "Set-ADAccountPasswordHash",
      "Set-ADDBAccountPassword",
      "Set-A

References:
  - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.PowerShell/DSInternals.psd1
Sigma Detection Rule: Suspicious Key Manager Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-21
ATT&CK techniques: T1555.004
Log source: windows/process_creation

Description:
Detects the invocation of the Stored User Names and Passwords dialogue (Key Manager)

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "keymgr",
      "KRShowKeyMgr"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/NinjaParanoid/status/[PII_REDACTED]63659777
Sigma Detection Rule: Reg Add Suspicious Paths
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1112, T1685
Log source: windows/process_creation

Description:
Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys

Detection logic:
{
  "selection_reg": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_path": {
    "CommandLine|contains": [
      "\\AppDataLow\\Software\\Microsoft\\",
      "\\Policies\\Microsoft\\Windows\\OOBE",
      "\\Policies\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
      "\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon",
      "\\CurrentControlSet\\Control\\SecurityProviders\\WDigest",
      "\\Microsoft\\Windows Defender\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1112/T1112.md
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1562.001/T1562.001.md
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Suspicious PowerShell Encoded Command Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-24
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.Exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      " -e ",
      " -en ",
      " -enc ",
      " -enco"
    ]
  },
  "selection_encoded": {
    "CommandLine|contains": [
      " JAB",
      " SUVYI",
      " SQBFAFgA",
      " aWV4I",
      " IAB",
      " PAA",
      " aQBlAHgA"
    ]
  },
  "filter_gcworker": {
    "ParentImage|contains": [
      "C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\",
      "\\gc_worker.exe"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/
Sigma Detection Rule: Suspicious Extrac32 Alternate Data Stream Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-26
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Extract data from cab file and hide it in an alternate data stream

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "extrac32.exe",
      ".cab"
    ],
    "CommandLine|re": ":[^\\\\]"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/