deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: HackTool - Mimikatz Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton
Date: 2019-10-22
ATT&CK techniques: T1003.001, T1003.002, T1003.004, T1003.005, T1003.006
Log source: windows/process_creation

Description:
Detection well-known mimikatz command line arguments

Detection logic:
{
  "selection_tools_name": {
    "CommandLine|contains": [
      "DumpCreds",
      "mimikatz"
    ]
  },
  "selection_function_names": {
    "CommandLine|contains": [
      "::aadcookie",
      "::detours",
      "::memssp",
      "::mflt",
      "::ncroutemon",
      "::ngcsign",
      "::printnightmare",
      "::skeleton",
      "::preshutdown",
      "::mstsc",
      "::multirdp"
    ]
  },
  "selection_module_names": {
    "CommandLine|contains": [
      "rpc::",
      "token::",
      "crypto::",
      "dpapi::",
      "sekurlsa::",
      "kerberos::",
      "lsadump::",
      "privilege::",
      "process::",
      "vault::"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://tools.thehacker.recipes/mimikatz/modules
Sigma Detection Rule: HackTool - SharpLdapWhoami Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-29
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects SharpLdapWhoami, a whoami alternative that queries the LDAP service on a domain controller

Detection logic:
{
  "selection_name": {
    "Image|endswith": "\\SharpLdapWhoami.exe"
  },
  "selection_pe": [
    {
      "OriginalFileName|contains": "SharpLdapWhoami"
    },
    {
      "Product": "SharpLdapWhoami"
    }
  ],
  "selection_flags1": {
    "CommandLine|endswith": [
      " /method:ntlm",
      " /method:kerb",
      " /method:nego",
      " /m:nego",
      " /m:ntlm",
      " /m:kerb"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/bugch3ck/SharpLdapWhoami
Sigma Detection Rule: Suspicious Manipulation Of Default Accounts Via Net.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-01
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_user_option": {
    "CommandLine|contains": " user "
  },
  "selection_username": {
    "CommandLine|contains": [
      " J\u00e4rjestelm\u00e4nvalvoja ",
      " Rendszergazda ",
      " \u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 ",
      " Administrateur ",
      " Administrador ",
      " Administrat\u00f6r ",
      " Administrator ",
      " guest ",
      " DefaultAccount ",
      " \"J\u00e4rjestelm\u00e4nvalvoja\" ",
      " \"Rendszergazda\" ",
      " \"\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\" ",
      " \"Administrateur\" ",
      " \"Administrador\" ",
      " \"Administrat\u00f6r\" ",
      " \"Administrator\" ",
      " \"guest\" ",
      " \"DefaultAccount\" ",
      " 'J\u00e4rjestelm\u00e4nvalvoja' ",
      " 'Rendszergazda' ",
      " '\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440' ",
      " 'Administrateur' ",
      " 'Administrador' ",
      " 'Administrat\u00f6r' ",
      " 'Administrator' ",
      " 'guest' ",
      " 'DefaultAccount' "
    ]
  },
  "filter": {
    "CommandLine|contains|all": [
      "guest",
      "/active no"
    ]
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
  - https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Sigma Detection Rule: Mstsc.EXE Execution With Local RDP File
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock @securepeacock
Date: 2023-04-18
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects potential RDP connection via Mstsc using a local ".rdp" file

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mstsc.exe"
    },
    {
      "OriginalFileName": "mstsc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      ".rdp",
      ".rdp\""
    ]
  },
  "filter_optional_wsl": {
    "ParentImage": "C:\\Windows\\System32\\lxss\\wslhost.exe",
    "CommandLine|contains": "C:\\ProgramData\\Microsoft\\WSL\\wslg.rdp"
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/[PII_REDACTED]4748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
Sigma Detection Rule: HackTool - HollowReaper Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-01
ATT&CK techniques: T1055.012
Log source: windows/process_creation

Description:
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing.
It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\HollowReaper.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/vari-sh/RedTeamGrimoire/tree/b5e7635d34db6e1f0398d8847e8f293186e947c5/HollowReaper
Sigma Detection Rule: Cloudflared Portable Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-20
ATT&CK techniques: T1090.001
Log source: windows/process_creation

Description:
Detects the execution of the "cloudflared" binary from a non standard location.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\cloudflared.exe"
  },
  "filter_main_admin_location": {
    "Image|contains": [
      ":\\Program Files (x86)\\cloudflared\\",
      ":\\Program Files\\cloudflared\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
  - https://github.com/cloudflare/cloudflared
  - https://www.intrinsec.com/akira_ransomware/
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - https://github.com/cloudflare/cloudflared/releases
Sigma Detection Rule: Dumping of Sensitive Hives Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Endgame, JHasenbusch, Daniil Yugoslavskiy, oscd.community, frack113
Date: 2019-10-22
ATT&CK techniques: T1003.002, T1003.004, T1003.005
Log source: windows/process_creation

Description:
Detects the usage of "reg.exe" in order to dump sensitive registry hives. This includes SAM, SYSTEM and SECURITY hives.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_cli_flag": {
    "CommandLine|contains": [
      " save ",
      " export ",
      " \u02e2ave ",
      " e\u02e3port "
    ]
  },
  "selection_cli_hklm": {
    "CommandLine|contains": [
      "hklm",
      "hk\u02eam",
      "hkey_local_machine",
      "hkey_\u02eaocal_machine",
      "hkey_loca\u02ea_machine",
      "hkey_\u02eaoca\u02ea_machine"
    ]
  },
  "selection_cli_hive": {
    "CommandLine|contains": [
      "\\system",
      "\\sam",
      "\\security",
      "\\\u02e2ystem",
      "\\sy\u02e2tem",
      "\\\u02e2y\u02e2tem",
      "\\\u02e2am",
      "\\\u02e2ecurity"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md
  - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
Sigma Detection Rule: UEFI Persistence Via Wpbbin - ProcessCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-18
ATT&CK techniques: T1542.001
Log source: windows/process_creation

Description:
Detects execution of the binary "wpbbin" which is used as part of the UEFI based persistence method described in the reference section

Detection logic:
{
  "selection": {
    "Image": "C:\\Windows\\System32\\wpbbin.exe"
  },
  "condition": "selection"
}

References:
  - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
  - https://persistence-info.github.io/Data/wpbbin.html
Sigma Detection Rule: Suspicious Kerberos Ticket Request via CLI
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-18
ATT&CK techniques: T1558.003
Log source: windows/process_creation

Description:
Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class.
Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to
perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse
techniques like silver ticket attacks.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell.exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "System.IdentityModel.Tokens.KerberosRequestorSecurityToken",
      ".GetRequest()"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell
  - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
Sigma Detection Rule: PowerShell SAM Copy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-29
ATT&CK techniques: T1003.002
Log source: windows/process_creation

Description:
Detects suspicious PowerShell scripts accessing SAM hives

Detection logic:
{
  "selection_1": {
    "CommandLine|contains|all": [
      "\\HarddiskVolumeShadowCopy",
      "System32\\config\\sam"
    ]
  },
  "selection_2": {
    "CommandLine|contains": [
      "Copy-Item",
      "cp $_.",
      "cpi $_.",
      "copy $_.",
      ".File]::Copy("
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/splinter_code/status/[PII_REDACTED]50769408
Sigma Detection Rule: Hardware Model Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-02-14
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "csproduct"
  },
  "condition": "all of selection_*"
}

References:
  - https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/
  - https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks
Sigma Detection Rule: Disable Important Scheduled Task
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems), X__Junior
Date: 2021-12-26
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects when adversaries stop services or processes by disabling their respective scheduled tasks in order to conduct data destructive activities

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_disable": {
    "CommandLine|contains|windash": "/disable"
  },
  "selection_cli_task": {
    "CommandLine|contains": [
      "\\Windows\\BitLocker",
      "\\Windows\\ExploitGuard",
      "\\Windows\\ExploitGuard\\ExploitGuard MDM policy Refresh",
      "\\Windows\\SystemRestore\\SR",
      "\\Windows\\UpdateOrchestrator\\",
      "\\Windows\\Windows Defender\\",
      "\\Windows\\WindowsBackup\\",
      "\\Windows\\WindowsUpdate\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task
  - https://twitter.com/MichalKoczwara/status/[PII_REDACTED]16498688
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
Sigma Detection Rule: HackTool - KrbRelay Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-27
ATT&CK techniques: T1558.003
Log source: windows/process_creation

Description:
Detects the use of KrbRelay, a Kerberos relaying tool

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\KrbRelay.exe"
    },
    {
      "OriginalFileName": "KrbRelay.exe"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains|all": [
      " -spn ",
      " -clsid ",
      " -rbcd "
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "shadowcred",
      "clsid",
      "spn"
    ]
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      "spn ",
      "session ",
      "clsid "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/cube0x0/KrbRelay
Sigma Detection Rule: New Port Forwarding Rule Added Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel
Date: 2019-01-29
ATT&CK techniques: T1090
Log source: windows/process_creation

Description:
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "interface",
      "portproxy",
      "add",
      "v4tov4"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "i ",
      "p ",
      "a ",
      "v "
    ]
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      "connectp",
      "listena",
      "c="
    ]
  },
  "condition": "selection_img and 1 of selection_cli_*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  - https://adepts.of0x.cc/netsh-portproxy-code/
  - https://www.dfirnotes.net/portproxy_detection/
Sigma Detection Rule: Suspicious Greedy Compression Using Rar.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-12-15
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

Detection logic:
{
  "selection_opt_1": [
    {
      "Image|endswith": "\\rar.exe"
    },
    {
      "Description": "Command line RAR"
    }
  ],
  "selection_opt_2": {
    "CommandLine|contains": [
      ".exe a ",
      " a -m"
    ]
  },
  "selection_cli_flags": {
    "CommandLine|contains|all": [
      " -hp",
      " -r "
    ]
  },
  "selection_cli_folders": {
    "CommandLine|contains": [
      " ?:\\\\\\*.",
      " ?:\\\\\\\\\\*.",
      " ?:\\$Recycle.bin\\",
      " ?:\\PerfLogs\\",
      " ?:\\Temp",
      " ?:\\Users\\Public\\",
      " ?:\\Windows\\",
      " %public%"
    ]
  },
  "condition": "1 of selection_opt_* and all of selection_cli_*"
}

References:
  - https://decoded.avast.io/martinchlumecky/png-steganography
Sigma Detection Rule: Execution Of Non-Existing File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2021-12-09
Log source: windows/process_creation

Description:
Checks whether the image specified in a process creation event is not a full, absolute path (caused by process ghosting or other unorthodox methods to start a process)

Detection logic:
{
  "image_absolute_path": {
    "Image|contains": "\\"
  },
  "filter_null": {
    "Image": null
  },
  "filter_empty": {
    "Image": [
      "-",
      ""
    ]
  },
  "filter_4688": [
    {
      "Image": [
        "System",
        "Registry",
        "MemCompression",
        "vmmem"
      ]
    },
    {
      "CommandLine": [
        "Registry",
        "MemCompression",
        "vmmem"
      ]
    }
  ],
  "condition": "not image_absolute_path and not 1 of filter*"
}

References:
  - https://pentestlaboratories.com/2021/12/08/process-ghosting/
Sigma Detection Rule: Always Install Elevated Windows Installer
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
Date: 2020-10-13
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects Windows Installer service (msiexec.exe) trying to install MSI packages with SYSTEM privilege

Detection logic:
{
  "selection_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "selection_image_1": {
    "Image|contains|all": [
      "\\Windows\\Installer\\",
      "msi"
    ],
    "Image|endswith": "tmp"
  },
  "selection_image_2": {
    "Image|endswith": "\\msiexec.exe",
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "filter_installer": {
    "ParentImage": "C:\\Windows\\System32\\services.exe"
  },
  "filter_repair": [
    {
      "CommandLine|endswith": "\\system32\\msiexec.exe /V"
    },
    {
      "ParentCommandLine|endswith": "\\system32\\msiexec.exe /V"
    }
  ],
  "filter_sophos": {
    "ParentImage|startswith": "C:\\ProgramData\\Sophos\\"
  },
  "filter_avira": {
    "ParentImage|startswith": "C:\\ProgramData\\Avira\\"
  },
  "filter_avast": {
    "ParentImage|startswith": [
      "C:\\Program Files\\Avast Software\\",
      "C:\\Program Files (x86)\\Avast Software\\"
    ]
  },
  "filter_google_update": {
    "ParentImage|startswith": [
      "C:\\Program Files\\Google\\Update\\",
      "C:\\Program Files (x86)\\Google\\Update\\"
    ]
  },
  "condition": "1 of selection_image_* and selection_user and not 1 of filter_*"
}

References:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal[PII_REDACTED]58/95/hunting-for-privilege-escalation-in-windows-environment-48-638.jpg
Sigma Detection Rule: Potential Data Exfiltration Activity Via CommandLine Tools
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-02
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects the use of various CLI utilities exfiltrating data via web requests

Detection logic:
{
  "selection_iwr": {
    "Image|endswith": [
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\cmd.exe"
    ],
    "CommandLine|contains": [
      "curl ",
      "Invoke-RestMethod",
      "Invoke-WebRequest",
      "irm ",
      "iwr ",
      "wget "
    ],
    "CommandLine|contains|all": [
      " -ur",
      " -me",
      " -b",
      " POST "
    ]
  },
  "selection_curl": {
    "Image|endswith": "\\curl.exe",
    "CommandLine|contains": "--ur"
  },
  "selection_curl_data": {
    "CommandLine|contains": [
      " -d ",
      " --data "
    ]
  },
  "selection_wget": {
    "Image|endswith": "\\wget.exe",
    "CommandLine|contains": [
      "--post-data",
      "--post-file"
    ]
  },
  "payloads": [
    {
      "CommandLine|re": [
        "net\\s+view",
        "sc\\s+query"
      ]
    },
    {
      "CommandLine|contains": [
        "Get-Content",
        "GetBytes",
        "hostname",
        "ifconfig",
        "ipconfig",
        "netstat",
        "nltest",
        "qprocess",
        "systeminfo",
        "tasklist",
        "ToBase64String",
        "whoami"
      ]
    },
    {
      "CommandLine|contains|all": [
        "type ",
        " > ",
        " C:\\"
      ]
    }
  ],
  "condition": "(selection_iwr or all of selection_curl* or selection_wget) and payloads"
}

References:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
Sigma Detection Rule: Detection of PowerShell Execution via Sqlps.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Agro (@agro_sev) oscd.community
Date: 2020-10-10
ATT&CK techniques: T1059.001, T1127
Log source: windows/process_creation

Description:
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\sqlps.exe"
  },
  "selection_image": [
    {
      "Image|endswith": "\\sqlps.exe"
    },
    {
      "OriginalFileName": "sqlps.exe"
    }
  ],
  "filter_image": {
    "ParentImage|endswith": "\\sqlagent.exe"
  },
  "condition": "selection_parent or (selection_image and not filter_image)"
}

References:
  - https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/
  - https://twitter.com/bryon_/status/[PII_REDACTED]87075072