deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: X__Junior
Date: 2025-01-20
ATT&CK techniques: T1059
Log source: windows/image_load

Description:
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

Detection logic:
{
  "selection_dll": {
    "ImageLoaded|endswith": "\\clfs.sys"
  },
  "selection_folders_1": {
    "Image|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      "\\Temporary Internet",
      "\\Windows\\Temp\\"
    ]
  },
  "selection_folders_2": [
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "condition": "selection_dll and 1 of selection_folders_*"
}

References:
  - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
  - https://x.com/Threatlabz/status/[PII_REDACTED]60976155
Sigma Detection Rule: Aruba Network Service Potential DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-22
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking

Detection logic:
{
  "selection": {
    "Image|endswith": "\\arubanetsvc.exe",
    "ImageLoaded|endswith": [
      "\\wtsapi32.dll",
      "\\msvcr100.dll",
      "\\msvcp100.dll",
      "\\dbghelp.dll",
      "\\dbgcore.dll",
      "\\wininet.dll",
      "\\iphlpapi.dll",
      "\\version.dll",
      "\\cryptsp.dll",
      "\\cryptbase.dll",
      "\\wldp.dll",
      "\\profapi.dll",
      "\\sspicli.dll",
      "\\winsta.dll",
      "\\dpapi.dll"
    ]
  },
  "filter": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/wdormann/status/[PII_REDACTED]92545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09
Sigma Detection Rule: Potential appverifUI.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-20
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "appverifUI.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\appverifUI.dll"
  },
  "filter_main_legit_path": {
    "Image": [
      "C:\\Windows\\SysWOW64\\appverif.exe",
      "C:\\Windows\\System32\\appverif.exe"
    ],
    "ImageLoaded|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
Sigma Detection Rule: CLR DLL Loaded Via Office Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Antonlovesdnb
Date: 2020-02-19
ATT&CK techniques: T1204.002
Log source: windows/image_load

Description:
Detects CLR DLL being loaded by an Office Product

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\excel.exe",
      "\\mspub.exe",
      "\\outlook.exe",
      "\\onenote.exe",
      "\\onenoteim.exe",
      "\\powerpnt.exe",
      "\\winword.exe"
    ],
    "ImageLoaded|contains": "\\clr.dll"
  },
  "condition": "selection"
}

References:
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
Sigma Detection Rule: Potential Antivirus Software DLL Sideloading
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)
Date: 2022-08-17
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc

Detection logic:
{
  "selection_bitdefender": {
    "ImageLoaded|endswith": "\\log.dll"
  },
  "filter_log_dll_bitdefender": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\Bitdefender Antivirus Free\\",
      "C:\\Program Files (x86)\\Bitdefender Antivirus Free\\"
    ]
  },
  "filter_log_dll_dell_sar": {
    "Image": "C:\\Program Files\\Dell\\SARemediation\\audit\\TelemetryUtility.exe",
    "ImageLoaded": [
      "C:\\Program Files\\Dell\\SARemediation\\plugin\\log.dll",
      "C:\\Program Files\\Dell\\SARemediation\\audit\\log.dll"
    ]
  },
  "filter_log_dll_canon": {
    "ImageLoaded|startswith": "C:\\Program Files\\Canon\\MyPrinter\\"
  },
  "filter_log_dll_avast": {
    "ImageLoaded": [
      "C:\\Program Files\\AVAST Software\\Avast\\log.dll",
      "C:\\Program Files (x86)\\AVAST Software\\Avast\\log.dll"
    ]
  },
  "filter_log_dll_avg": {
    "ImageLoaded": [
      "C:\\Program Files\\AVG\\Antivirus\\log.dll",
      "C:\\Program Files (x86)\\AVG\\Antivirus\\log.dll"
    ]
  },
  "selection_fsecure": {
    "ImageLoaded|endswith": "\\qrt.dll"
  },
  "filter_fsecure": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\F-Secure\\Anti-Virus\\",
      "C:\\Program Files (x86)\\F-Secure\\Anti-Virus\\"
    ]
  },
  "selection_mcafee": {
    "ImageLoaded|endswith": [
      "\\ashldres.dll",
      "\\lockdown.dll",
      "\\vsodscpl.dll"
    ]
  },
  "filter_mcafee": {
    "ImageLoaded|startswith": [
      "C:\\Program Files\\McAfee\\",
      "C:\\Program Files (x86)\\

References:
  - https://hijacklibs.net/
Sigma Detection Rule: Python Image Load By Non-Python Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Patrick St. John, OTR (Open Threat Research)
Date: 2020-05-03
ATT&CK techniques: T1027.002
Log source: windows/image_load

Description:
Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code.
Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables.
Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures.


Detection logic:
{
  "selection": {
    "Description": "Python Core"
  },
  "filter_main_generic": [
    {
      "Image|contains": "Python"
    },
    {
      "Image|startswith": [
        "C:\\Program Files\\",
        "C:\\Program Files (x86)\\",
        "C:\\ProgramData\\Anaconda3\\"
      ]
    }
  ],
  "filter_optional_null_image": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.py2exe.org/
  - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/
Sigma Detection Rule: Load Of RstrtMgr.DLL By An Uncommon Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Luc Génaux
Date: 2023-11-28
ATT&CK techniques: T1486, T1685
Log source: windows/image_load

Description:
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.


Detection logic:
{
  "selection": [
    {
      "ImageLoaded|endswith": "\\RstrtMgr.dll"
    },
    {
      "OriginalFileName": "RstrtMgr.dll"
    }
  ],
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\$WINDOWS.~BT\\'",
      "C:\\$WinREAgent\\'",
      "C:\\Program Files (x86)\\'",
      "C:\\Program Files\\'",
      "C:\\ProgramData\\'",
      "C:\\Windows\\explorer.exe'",
      "C:\\Windows\\SoftwareDistribution\\'",
      "C:\\Windows\\SysNative\\'",
      "C:\\Windows\\System32\\'",
      "C:\\Windows\\SysWOW64\\'",
      "C:\\Windows\\WinSxS\\'",
      "C:\\WUDownloadCache\\'"
    ]
  },
  "filter_main_user_software_installations": {
    "Image|startswith": "C:\\Users\\'",
    "Image|contains|all": [
      "\\AppData\\Local\\Temp\\is-",
      ".tmp\\"
    ],
    "Image|endswith": ".tmp"
  },
  "filter_main_admin_software_installations": {
    "Image|startswith": "C:\\Windows\\Temp\\'"
  },
  "filter_optional_onedrive": {
    "Image|startswith": "C:\\Users\\",
    "Image|endswith": "\\AppData\\Local\\Microsoft\\OneDrive\\OneDriveStandaloneUpdater.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
  - https://www.crowdstrike.com/blog/windows-restart-manager-part-2/
  - https://web.archive.org/web/[PII_REDACTED]3106/https://www.swascan.com/cactus-ransomware-malware-analysis/
  - https://taiwan.postsen.com/business/88601/Hamas-hackers-use-data-destruction-software-BiBi-which-consumes-a-lot-of-processor-resources-to-wipe-Windows-computer-data--iThome.html
Sigma Detection Rule: Fax Service DLL Search Order Hijack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: NVISO
Date: 2020-05-04
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\fxssvc.exe",
    "ImageLoaded|endswith": "ualapi.dll"
  },
  "filter": {
    "ImageLoaded|startswith": "C:\\Windows\\WinSxS\\"
  },
  "condition": "selection and not filter"
}

References:
  - https://windows-internals.com/faxing-your-way-to-system/
Sigma Detection Rule: Potential DLL Sideloading Of Libcurl.DLL Via GUP.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location

Detection logic:
{
  "selection": {
    "Image|endswith": "\\gup.exe",
    "ImageLoaded|endswith": "\\libcurl.dll"
  },
  "filter_main_notepad_plusplus": {
    "Image|endswith": "\\Notepad++\\updater\\GUP.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Time Travel Debugging Utility Usage - Image
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
Date: 2020-10-06
ATT&CK techniques: T1218, T1003.001
Log source: windows/image_load

Description:
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\ttdrecord.dll",
      "\\ttdwriter.dll",
      "\\ttdloader.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  - https://twitter.com/mattifestation/status/[PII_REDACTED]83025666
  - https://twitter.com/oulusoyum/status/[PII_REDACTED]69655553
Sigma Detection Rule: Potential Edputil.DLL Sideloading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-09
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "edputil.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\edputil.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://alternativeto.net/news/2023/5/cybercriminals-use-wordpad-vulnerability-to-spread-qbot-malware/
Sigma Detection Rule: Potential DLL Sideloading Of DbgModel.DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Gary Lobermier
Date: 2024-07-11
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential DLL sideloading of "DbgModel.dll"

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": "\\dbgmodel.dll"
  },
  "filter_main_generic": {
    "ImageLoaded|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_optional_windbg": {
    "ImageLoaded|startswith": "C:\\Program Files\\WindowsApps\\Microsoft.WinDbg_"
  },
  "filter_optional_windows_kits": {
    "ImageLoaded|startswith": [
      "C:\\Program Files (x86)\\Windows Kits\\",
      "C:\\Program Files\\Windows Kits\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://hijacklibs.net/entries/microsoft/built-in/dbgmodel.html
Sigma Detection Rule: Potential Process Hollowing Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S
Date: 2022-01-25
ATT&CK techniques: T1055.012
Log source: windows/process_tampering

Description:
Detects when a memory process image does not match the disk image, indicative of process hollowing.

Detection logic:
{
  "selection": {
    "Type": "Image is replaced"
  },
  "filter_main_generic": {
    "Image|contains": [
      ":\\Program Files (x86)",
      ":\\Program Files\\",
      ":\\Windows\\System32\\wbem\\WMIADAP.exe",
      ":\\Windows\\SysWOW64\\wbem\\WMIADAP.exe"
    ]
  },
  "filter_optional_opera": {
    "Image|contains": "\\AppData\\Local\\Programs\\Opera\\",
    "Image|endswith": "\\opera.exe"
  },
  "filter_optional_edge": {
    "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/SecurePeacock/status/[PII_REDACTED]90332423?s=20
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/
Sigma Detection Rule: Sysmon Configuration Error
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-06-04
ATT&CK techniques: T1564
Log source: windows/sysmon_error

Description:
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages

Detection logic:
{
  "selection_error": {
    "Description|contains": [
      "Failed to open service configuration with error",
      "Failed to connect to the driver to update configuration"
    ]
  },
  "filter_generic_english": {
    "Description|contains|all": [
      "Failed to open service configuration with error",
      "Last error: The media is write protected."
    ]
  },
  "filter_by_errorcode": {
    "Description|contains": [
      "Failed to open service configuration with error 19",
      "Failed to open service configuration with error 93"
    ]
  },
  "condition": "selection_error and not 1 of filter*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
Sigma Detection Rule: Sysmon Configuration Modification
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-06-04
ATT&CK techniques: T1564
Log source: windows/sysmon_status

Description:
Detects when an attacker tries to hide from Sysmon by disabling or stopping it

Detection logic:
{
  "selection_stop": {
    "State": "Stopped"
  },
  "selection_conf": [
    "Sysmon config state changed"
  ],
  "filter": {
    "State": "Started"
  },
  "condition": "1 of selection_* and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://talesfrominfosec.blogspot.com/2017/12/killing-sysmon-silently.html
Sigma Detection Rule: Sysmon Blocked Executable
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-16
Log source: windows/

Description:
Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy

Detection logic:
{
  "selection": {
    "EventID": 27
  },
  "condition": "selection"
}

References:
  - https://medium.com/@olafhartong/sysmon-14-0-fileblockexecutable-13d7ba3dff3e
Sigma Detection Rule: Sysmon Blocked File Shredding
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-07-20
Log source: windows/

Description:
Triggers on any Sysmon "FileBlockShredding" event, which indicates a violation of the configured shredding policy.

Detection logic:
{
  "selection": {
    "EventID": 28
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Sigma Detection Rule: Sysmon Configuration Change
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-12
Log source: windows/

Description:
Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration

Detection logic:
{
  "selection": {
    "EventID": 16
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Sigma Detection Rule: Sysmon File Executable Creation Detected
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-07-20
Log source: windows/

Description:
Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.

Detection logic:
{
  "selection": {
    "EventID": 29
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
  - https://medium.com/@olafhartong/sysmon-15-0-file-executable-detected-40fd64349f36
Sigma Detection Rule: DNS Query To Ufile.io
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: yatinwad, TheDFIRReport
Date: 2022-06-23
ATT&CK techniques: T1567.002
Log source: windows/dns_query

Description:
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Detection logic:
{
  "selection": {
    "QueryName|contains": "ufile.io"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
Sigma Detection Rule: DNS Query by Finger Utility
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-19
ATT&CK techniques: T1071.004, T1059.003
Log source: windows/dns_query

Description:
Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\finger.exe"
  },
  "condition": "selection"
}

References:
  - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
Sigma Detection Rule: DNS Query To MEGA Hosting Website
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Aaron Greetham (@beardofbinary) - NCC Group
Date: 2021-05-26
ATT&CK techniques: T1567.002
Log source: windows/dns_query

Description:
Detects DNS queries for subdomains related to MEGA sharing website

Detection logic:
{
  "selection": {
    "QueryName|contains": "userstorage.mega.co.nz"
  },
  "condition": "selection"
}

References:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
Sigma Detection Rule: DNS Query Request By Regsvr32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Dmitriy Lifanov, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1559.001, T1218.010
Log source: windows/dns_query

Description:
Detects DNS queries initiated by "Regsvr32.exe"

Detection logic:
{
  "selection": {
    "Image|endswith": "\\regsvr32.exe"
  },
  "condition": "selection"
}

References:
  - https://pentestlab.blog/2017/05/11/applocker-bypass-regsvr32/
  - https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/
Sigma Detection Rule: DNS Query Request By QuickAssist.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-12-19
ATT&CK techniques: T1071.001, T1210
Log source: windows/dns_query

Description:
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\QuickAssist.exe",
    "QueryName|endswith": "remoteassistance.support.services.microsoft.com"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
  - https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity[PII_REDACTED]116445701-xxjZ/
  - https://x.com/cyb3rops/status/[PII_REDACTED]65245506
  - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
Sigma Detection Rule: DNS Query To Visual Studio Code Tunnels Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: citron_ninja
Date: 2023-10-25
ATT&CK techniques: T1071.001
Log source: windows/dns_query

Description:
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "QueryName|endswith": ".tunnels.api.visualstudio.com"
  },
  "condition": "selection"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://cydefops.com/vscode-data-exfiltration
Sigma Detection Rule: DNS Server Discovery Via LDAP Query
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-08-20
ATT&CK techniques: T1482
Log source: windows/dns_query

Description:
Detects DNS server discovery via LDAP query requests from uncommon applications

Detection logic:
{
  "selection": {
    "QueryName|startswith": "_ldap."
  },
  "filter_main_generic": {
    "Image|contains": [
      ":\\Program Files\\",
      ":\\Program Files (x86)\\",
      ":\\Windows\\"
    ]
  },
  "filter_main_defender": {
    "Image|contains": ":\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "Image|endswith": "\\MsMpEng.exe"
  },
  "filter_main_unknown": {
    "Image": "<unknown process>"
  },
  "filter_optional_azure": {
    "Image|startswith": "C:\\WindowsAzure\\GuestAgent"
  },
  "filter_main_null": {
    "Image": null
  },
  "filter_optional_browsers": {
    "Image|endswith": [
      "\\chrome.exe",
      "\\firefox.exe",
      "\\opera.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/980f3f83fd81f37c1ca9c02dccfd1c3d9f9d0841/atomics/T1016/T1016.md#atomic-test-9---dns-server-discovery-using-nslookup
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/7fcdce70-5205-44d6-9c3a-260e616a2f04