deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Invoke-Obfuscation STDIN+ Launcher - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated use of stdin to execute PowerShell

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "cmd",
      "powershell"
    ]
  },
  "selection2": {
    "ServiceFileName|contains": [
      "${input}",
      "noexit"
    ]
  },
  "selection3": {
    "ServiceFileName|contains": [
      " /c ",
      " /r "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Access To ADMIN$ Network Share
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-04
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Detects access to ADMIN$ network share

Detection logic:
{
  "selection": {
    "EventID": 5140,
    "ShareName": "Admin$"
  },
  "filter_main_computer_account": {
    "SubjectUserName|endswith": "$"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
Sigma Detection Rule: Windows Pcap Drivers
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cian Heasley
Date: 2020-06-10
ATT&CK techniques: T1040
Log source: windows/

Description:
Detects Windows Pcap driver installation based on a list of associated .sys files.

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains": [
      "pcap",
      "npcap",
      "npf",
      "nm3",
      "ndiscap",
      "nmnt",
      "windivert",
      "USBPcap",
      "pktmon"
    ]
  },
  "condition": "selection"
}

References:
  - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more
Sigma Detection Rule: Service Registry Key Read Access Request
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
Date: 2023-09-28
ATT&CK techniques: T1574.011
Log source: windows/

Description:
Detects "read access" requests on the services registry key.
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.


Detection logic:
{
  "selection": {
    "EventID": 4663,
    "ObjectName|contains|all": [
      "\\SYSTEM\\",
      "ControlSet\\Services\\"
    ],
    "AccessList|contains": "%%1538"
  },
  "condition": "selection"
}

References:
  - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
Sigma Detection Rule: Password Protected ZIP File Opened (Suspicious Filenames)
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-09
ATT&CK techniques: T1027, T1105, T1036
Log source: windows/

Description:
Detects the extraction of password protected ZIP archives with suspicious file names. See the filename variable for more details on which file has been opened.

Detection logic:
{
  "selection": {
    "EventID": 5379,
    "TargetName|contains": "Microsoft_Windows_Shell_ZipFolder:filename"
  },
  "selection_filename": {
    "TargetName|contains": [
      "invoice",
      "new order",
      "rechnung",
      "factura",
      "delivery",
      "purchase",
      "order",
      "payment"
    ]
  },
  "condition": "selection and selection_filename"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]13379841
Sigma Detection Rule: HybridConnectionManager Service Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
ATT&CK techniques: T1554
Log source: windows/

Description:
Rule to detect the Hybrid Connection Manager service installation.

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceName": "HybridConnectionManager",
    "ServiceFileName|contains": "HybridConnectionManager"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Cyb3rWard0g/status/[PII_REDACTED]69286662
Sigma Detection Rule: SysKey Registry Keys Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-12
ATT&CK techniques: T1012
Log source: windows/

Description:
Detects handle requests and access operations to specific registry keys to calculate the SysKey

Detection logic:
{
  "selection": {
    "EventID": [
      4656,
      4663
    ],
    "ObjectType": "key",
    "ObjectName|endswith": [
      "lsa\\JD",
      "lsa\\GBG",
      "lsa\\Skew1",
      "lsa\\Data"
    ]
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190625-RegKeyAccessSyskey/notebook.html
Sigma Detection Rule: Powerview Add-DomainObjectAcl DCSync AD Extend Right
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
Date: 2019-04-03
ATT&CK techniques: T1098
Log source: windows/

Description:
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

Detection logic:
{
  "selection": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": "ntSecurityDescriptor",
    "AttributeValue|contains": [
      "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
      "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
      "89e95b76-444d-4c62-991a-0facbeda640c"
    ]
  },
  "filter_main_dns_object_class": {
    "ObjectClass": [
      "dnsNode",
      "dnsZoneScope",
      "dnsZone"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/menasec1/status/[PII_REDACTED]37903104
  - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf
Sigma Detection Rule: Potential Secure Deletion with SDelete
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Thomas Patzke
Date: 2017-06-14
ATT&CK techniques: T1070.004, T1027.005, T1485, T1553.002
Log source: windows/

Description:
Detects files that have extensions commonly seen while SDelete is used to wipe files.

Detection logic:
{
  "selection": {
    "EventID": [
      4656,
      4663,
      4658
    ],
    "ObjectName|endswith": [
      ".AAA",
      ".ZZZ"
    ]
  },
  "condition": "selection"
}

References:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete
Sigma Detection Rule: Device Installation Blocked
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-10-14
ATT&CK techniques: T1200
Log source: windows/

Description:
Detects an installation of a device that is forbidden by the system policy

Detection logic:
{
  "selection": {
    "EventID": 6423
  },
  "condition": "selection"
}

References:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
Sigma Detection Rule: Invoke-Obfuscation VAR+ Launcher - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated use of Environment Variables to execute PowerShell

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "cmd",
      "\"set",
      "-f"
    ],
    "ServiceFileName|contains": [
      "/c",
      "/r"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: AD Privileged Users or Groups Reconnaissance
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1087.002
Log source: windows/

Description:
Detect priv users or groups recon based on 4661 eventid and known privileged users or groups SIDs

Detection logic:
{
  "selection": {
    "EventID": 4661,
    "ObjectType": [
      "SAM_USER",
      "SAM_GROUP"
    ]
  },
  "selection_object": [
    {
      "ObjectName|endswith": [
        "-512",
        "-502",
        "-500",
        "-505",
        "-519",
        "-520",
        "-544",
        "-551",
        "-555"
      ]
    },
    {
      "ObjectName|contains": "admin"
    }
  ],
  "filter": {
    "SubjectUserName|endswith": "$"
  },
  "condition": "selection and selection_object and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
Sigma Detection Rule: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via VAR++ LAUNCHER

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "&&set",
      "cmd",
      "/c",
      "-f"
    ],
    "ServiceFileName|contains": [
      "{0}",
      "{1}",
      "{2}",
      "{3}",
      "{4}",
      "{5}"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Account Tampering - Suspicious Failed Logon Reasons
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-02-19
ATT&CK techniques: T1078
Log source: windows/

Description:
This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.

Detection logic:
{
  "selection_eid": {
    "EventID": [
      4625,
      4776
    ]
  },
  "selection_status": [
    {
      "Status": [
        "0xC0000072",
        "0xC000006F",
        "0xC0000070",
        "0xC0000413",
        "0xC000018C",
        "0xC000015B"
      ]
    },
    {
      "SubStatus": [
        "0xC0000072",
        "0xC000006F",
        "0xC0000070",
        "0xC0000413",
        "0xC000018C",
        "0xC000015B"
      ]
    }
  ],
  "filter": {
    "SubjectUserSid": "S-1-0-0"
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]40710913
Sigma Detection Rule: NetNTLM Downgrade Attack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), wagga
Date: 2018-03-20
ATT&CK techniques: T1685, T1112
Log source: windows/

Description:
Detects NetNTLM downgrade attack

Detection logic:
{
  "selection": {
    "EventID": 4657,
    "ObjectName|contains|all": [
      "\\REGISTRY\\MACHINE\\SYSTEM",
      "ControlSet",
      "\\Control\\Lsa"
    ],
    "ObjectValueName": [
      "LmCompatibilityLevel",
      "NtlmMinClientSec",
      "RestrictSendingNTLMTraffic"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
Sigma Detection Rule: Service Installed By Unusual Client - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch (Nextron Systems), Elastic (idea)
Date: 2022-09-15
ATT&CK techniques: T1543
Log source: windows/

Description:
Detects a service installed by a client which has PID 0 or whose parent has PID 0

Detection logic:
{
  "selection_eid": {
    "EventID": 4697
  },
  "selection_pid": [
    {
      "ClientProcessId": 0
    },
    {
      "ParentProcessId": 0
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
  - https://www.x86matthew.com/view_post?id=create_svc_rpc
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]01166596
Sigma Detection Rule: DCERPC SMB Spoolss Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: OTR (Open Threat Research)
Date: 2018-11-28
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$",
    "RelativeTargetName": "spoolss"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
  - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
  - https://twitter.com/_dirkjan/status/[PII_REDACTED]03588608
Sigma Detection Rule: Azure AD Health Monitoring Agent Registry Keys Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-08-26
ATT&CK techniques: T1012
Log source: windows/

Description:
This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent.
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent.


Detection logic:
{
  "selection": {
    "EventID": [
      4656,
      4663
    ],
    "ObjectType": "Key",
    "ObjectName": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Microsoft Online\\Reporting\\MonitoringAgent"
  },
  "filter": {
    "ProcessName|contains": [
      "Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe",
      "Microsoft.Identity.Health.Adfs.InsightsService.exe",
      "Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe",
      "Microsoft.Identity.Health.Adfs.PshSurrogate.exe",
      "Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/OTRF/Set-AuditRule/blob/c3dec[PII_REDACTED]714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml
Sigma Detection Rule: Password Dumper Activity on LSASS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: sigma
Date: 2017-02-12
ATT&CK techniques: T1003.001
Log source: windows/

Description:
Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN

Detection logic:
{
  "selection": {
    "EventID": 4656,
    "ProcessName|endswith": "\\lsass.exe",
    "AccessMask": "0x705",
    "ObjectType": "SAM_DOMAIN"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/jackcr/status/[PII_REDACTED]33968128
Sigma Detection Rule: Remote Task Creation via ATSVC Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1053.002
Log source: windows/

Description:
Detects remote task creation via at.exe or API interacting with ATSVC namedpipe

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$",
    "RelativeTargetName": "atsvc",
    "AccessList|contains": "WriteData"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html
Sigma Detection Rule: ADCS Certificate Template Configuration Vulnerability with Risky EKU
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Orlinum , BlueDefenZer
Date: 2021-11-17
Log source: windows/

Description:
Detects certificate creation with template allowing risk permission subject and risky EKU

Detection logic:
{
  "selection10": {
    "EventID": 4898,
    "TemplateContent|contains": [
      "1.3.6.1.5.5.7.3.2",
      "1.3.6.1.5.2.3.4",
      "1.3.6.1.4.1.311.20.2.2",
      "2.5.29.37.0"
    ]
  },
  "selection11": {
    "TemplateContent|contains": "CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
  },
  "selection20": {
    "EventID": 4899,
    "NewTemplateContent|contains": [
      "1.3.6.1.5.5.7.3.2",
      "1.3.6.1.5.2.3.4",
      "1.3.6.1.4.1.311.20.2.2",
      "2.5.29.37.0"
    ]
  },
  "selection21": {
    "NewTemplateContent|contains": "CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT"
  },
  "condition": "(selection10 and selection11) or (selection20 and selection21)"
}

References:
  - https://www.specterops.io/assets/resources/Certified_Pre-Owned.pdf
Sigma Detection Rule: LSASS Access From Non System Account
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-06-20
ATT&CK techniques: T1003.001
Log source: windows/

Description:
Detects potential mimikatz-like tools accessing LSASS from non system account

Detection logic:
{
  "selection": {
    "EventID": [
      4663,
      4656
    ],
    "AccessMask": [
      "0x100000",
      "0x1010",
      "0x1400",
      "0x1410",
      "0x1418",
      "0x1438",
      "0x143a",
      "0x1f0fff",
      "0x1f1fff",
      "0x1f2fff",
      "0x1f3fff",
      "0x40",
      "143a",
      "1f0fff",
      "1f1fff",
      "1f2fff",
      "1f3fff"
    ],
    "ObjectType": "Process",
    "ObjectName|endswith": "\\lsass.exe"
  },
  "filter_main_service_account": {
    "SubjectUserName|endswith": "$"
  },
  "filter_main_generic": {
    "ProcessName|contains": [
      ":\\Program Files\\",
      ":\\Program Files (x86)\\"
    ]
  },
  "filter_main_wmiprvse": {
    "ProcessName": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
    "AccessMask": "0x1410"
  },
  "filter_optional_steam": {
    "ProcessName|contains": "\\SteamLibrary\\steamapps\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/170105-LSASSMemoryReadAccess/notebook.html
Sigma Detection Rule: Possible PetitPotam Coerce Authentication Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mauricio Velazco, Michael Haag
Date: 2021-09-02
ATT&CK techniques: T1187
Log source: windows/

Description:
Detect PetitPotam coerced authentication activity.

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName|startswith": "\\\\\\\\",
    "ShareName|endswith": "\\IPC$",
    "RelativeTargetName": "lsarpc",
    "SubjectUserName": "ANONYMOUS LOGON"
  },
  "condition": "selection"
}

References:
  - https://github.com/topotam/PetitPotam
  - https://github.com/splunk/security_content/blob/0dd6de32de2118b2818550df9e65255f4109a56d/detections/endpoint/petitpotam_network_share_access_request.yml
Sigma Detection Rule: Windows Event Auditing Disabled
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: @neu5ron, Nasreddine Bencherchali (Nextron Systems)
Date: 2017-11-19
ATT&CK techniques: T1685.001
Log source: windows/

Description:
Detects scenarios where system auditing (i.e.: Windows event log auditing) is disabled.
This may be used in a scenario where an entity would want to bypass local logging to evade detection when Windows event logging is enabled and reviewed.
Also, it is recommended to turn off "Local Group Policy Object Processing" via GPO, which will make sure that Active Directory GPOs take precedence over local/edited computer policies via something such as "gpedit.msc".
Please note, that disabling "Local Group Policy Object Processing" may cause an issue in scenarios of one off specific GPO modifications - however, it is recommended to perform these modifications in Active Directory anyways.


Detection logic:
{
  "selection": {
    "EventID": 4719,
    "AuditPolicyChanges|contains": [
      "%%8448",
      "%%8450"
    ]
  },
  "filter_main_guid": {
    "SubcategoryGuid": [
      "{0CCE9210-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9211-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9212-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9215-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9217-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE921B-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE922B-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE922F-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9230-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9235-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9236-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9237-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE923F-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9240-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9242-69AE-11D9-BED3[PII_REDACTED]30}"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
Sigma Detection Rule: Windows Defender Exclusion Registry Key - Write Access Requested
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @BarryShooshooga, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-26
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects write access requests to the Windows Defender exclusions registry keys. This could be an indication of an attacker trying to request a handle or access the object to write new exclusions in order to bypass security.


Detection logic:
{
  "selection": {
    "AccessList|contains": [
      "%%4417",
      "%%4418"
    ],
    "EventID": [
      4656,
      4663
    ],
    "ObjectName|contains": "\\Microsoft\\Windows Defender\\Exclusions\\"
  },
  "condition": "selection"
}

References:
  - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
Sigma Detection Rule: Reconnaissance Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jack Croock (method), Jonhnathan Ribeiro (improvements), oscd.community
Date: 2017-03-07
ATT&CK techniques: T1087.002, T1069.002
Log source: windows/

Description:
Detects activity as "net user administrator /domain" and "net group domain admins /domain"

Detection logic:
{
  "selection": {
    "EventID": 4661,
    "AccessMask": "0x2d",
    "ObjectType": [
      "SAM_USER",
      "SAM_GROUP"
    ],
    "ObjectName|startswith": "S-1-5-21-",
    "ObjectName|endswith": [
      "-500",
      "-512"
    ]
  },
  "condition": "selection"
}

References:
  - https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
Sigma Detection Rule: Unauthorized System Time Modification
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: @neu5ron
Date: 2019-02-05
ATT&CK techniques: T1070.006
Log source: windows/

Description:
Detect scenarios where a potentially unauthorized application or user is modifying the system time.

Detection logic:
{
  "selection": {
    "EventID": 4616
  },
  "filter_main_svchost": {
    "ProcessName": "C:\\Windows\\System32\\svchost.exe",
    "SubjectUserSid": "S-1-5-19"
  },
  "filter_optional_vmtools": {
    "ProcessName": [
      "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe",
      "C:\\Program Files (x86)\\VMware\\VMware Tools\\vmtoolsd.exe",
      "C:\\Windows\\System32\\VBoxService.exe",
      "C:\\Windows\\System32\\oobe\\msoobe.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)
  - Live environment caused by malware
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616