deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: REGISTER_APP.VBS Proxy Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\register_app.vbs",
      "-register"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/sblmsrsn/status/[PII_REDACTED]83160325?s=20
Sigma Detection Rule: Renamed Remote Utilities RAT (RURAT) Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-19
Log source: windows/process_creation

Description:
Detects execution of renamed Remote Utilities (RURAT) via Product PE header field

Detection logic:
{
  "selection": {
    "Product": "Remote Utilities"
  },
  "filter": {
    "Image|endswith": [
      "\\rutserv.exe",
      "\\rfusclient.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: MMC Spawning Windows Shell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Karneades, Swisscom CSIRT
Date: 2019-08-05
ATT&CK techniques: T1021.003
Log source: windows/process_creation

Description:
Detects a Windows command line executable started from MMC

Detection logic:
{
  "selection1": {
    "ParentImage|endswith": "\\mmc.exe"
  },
  "selection2": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wscript.exe",
        "\\cscript.exe",
        "\\sh.exe",
        "\\bash.exe",
        "\\reg.exe",
        "\\regsvr32.exe"
      ]
    },
    {
      "Image|contains": "\\BITSADMIN"
    }
  ],
  "condition": "all of selection*"
}

References:
  - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
Sigma Detection Rule: Arbitrary File Download Via PresentationHost.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\presentationhost.exe"
    },
    {
      "OriginalFileName": "PresentationHost.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "http://",
      "https://",
      "ftp://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/239/files
Sigma Detection Rule: Kavremover Dropped Binary LOLBIN Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-01
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.

Detection logic:
{
  "selection": {
    "CommandLine|contains": " run run-cmd "
  },
  "filter_main_legit_parents": {
    "ParentImage|endswith": [
      "\\cleanapi.exe",
      "\\kavremover.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea
Sigma Detection Rule: Modify Group Policy Settings
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1484.001
Log source: windows/process_creation

Description:
Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Detection logic:
{
  "selection_reg": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_path": {
    "CommandLine|contains": "\\SOFTWARE\\Policies\\Microsoft\\Windows\\System"
  },
  "selection_key": {
    "CommandLine|contains": [
      "GroupPolicyRefreshTimeDC",
      "GroupPolicyRefreshTimeOffsetDC",
      "GroupPolicyRefreshTime",
      "GroupPolicyRefreshTimeOffset",
      "EnableSmartScreen",
      "ShellSmartScreenLevel"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1484.001/T1484.001.md
Sigma Detection Rule: QuickAssist Execution
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Muhammad Faisal (@faisalusuf)
Date: 2024-12-19
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\QuickAssist.exe"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
  - https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity[PII_REDACTED]116445701-xxjZ/
  - https://x.com/cyb3rops/status/[PII_REDACTED]65245506
  - https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
Sigma Detection Rule: Potential Reconnaissance For Cached Credentials Via Cmdkey.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: jmallette, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1003.005
Log source: windows/process_creation

Description:
Detects usage of cmdkey to look for cached credentials on the system

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmdkey.exe"
    },
    {
      "OriginalFileName": "cmdkey.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -l"
  },
  "condition": "all of selection*"
}

References:
  - https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation
  - https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey
Sigma Detection Rule: Browser Execution In Headless Mode
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-12
ATT&CK techniques: T1105, T1564.003
Log source: windows/process_creation

Description:
Detects execution of Chromium based browser in headless mode

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ],
    "CommandLine|contains": "--headless"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]81436672?s=12
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
Sigma Detection Rule: PowerShell Web Access Feature Enabled Via DISM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Haag
Date: 2024-09-03
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the use of DISM to enable the PowerShell Web Access feature, which could be used for remote access and potential abuse

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dism.exe"
    },
    {
      "OriginalFileName": "DISM.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "WindowsPowerShellWebAccess",
      "/online",
      "/enable-feature"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
  - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
Sigma Detection Rule: Winrs Local Command Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Liran Ravich, Nasreddine Bencherchali
Date: 2025-10-22
ATT&CK techniques: T1021.006, T1218
Log source: windows/process_creation

Description:
Detects the execution of Winrs.exe where it is used to execute commands locally.
Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\winrs.exe"
    },
    {
      "OriginalFileName": "winrs.exe"
    }
  ],
  "selection_local_ip": {
    "CommandLine|contains|windash": [
      "/r:localhost",
      "/r:127.0.0.1",
      "/r:[::1]",
      "/remote:localhost",
      "/remote:127.0.0.1",
      "/remote:[::1]"
    ]
  },
  "filter_main_remote": {
    "CommandLine|contains|windash": [
      "/r:",
      "/remote:"
    ]
  },
  "condition": "all of selection_* or (selection_img and not 1 of filter_main_*)"
}

References:
  - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
Sigma Detection Rule: Execution via WorkFolders.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Maxime Thiebaut (@0xThiebaut)
Date: 2021-10-21
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects using WorkFolders.exe to execute an arbitrary control.exe

Detection logic:
{
  "selection": {
    "Image|endswith": "\\control.exe",
    "ParentImage|endswith": "\\WorkFolders.exe"
  },
  "filter": {
    "Image": "C:\\Windows\\System32\\control.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/elliotkillick/status/[PII_REDACTED]72227588
Sigma Detection Rule: Windows AMSI Related Registry Tampering Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-25
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects tampering of AMSI (Anti-Malware Scan Interface) related registry values via command line tools such as reg.exe or PowerShell.
AMSI provides a generic interface for applications and services to integrate with antimalware products.
Adversaries may disable AMSI to evade detection of malicious scripts and code execution.


Detection logic:
{
  "selection_key": {
    "CommandLine|contains|all": [
      "\\Software\\Microsoft\\Windows Script\\Settings",
      "AmsiEnable"
    ]
  },
  "selection_reg_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_reg_cmd": {
    "CommandLine|contains": "add"
  },
  "selection_powershell_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_powershell_cmd": {
    "CommandLine|contains": [
      "Set-ItemProperty",
      "New-ItemProperty",
      "sp "
    ]
  },
  "condition": "selection_key and (all of selection_powershell_* or all of selection_reg_*)"
}

References:
  - https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md
  - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
  - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
Sigma Detection Rule: Potential RDP Tunneling Via SSH
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-12
ATT&CK techniques: T1572
Log source: windows/process_creation

Description:
Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Detection logic:
{
  "selection": {
    "Image|endswith": "\\ssh.exe",
    "CommandLine|contains": ":3389"
  },
  "condition": "selection"
}

References:
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Windows Admin Share Mount Via Net.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga
Date: 2020-10-05
ATT&CK techniques: T1021.002
Log source: windows/process_creation

Description:
Detects when an admin share is mounted using net.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " use ",
      " \\\\\\\\*\\\\*$"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
Sigma Detection Rule: File Recovery From Backup Via Wbadmin.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-05-10
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects the recovery of files from backups via "wbadmin.exe".
Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " recovery",
      "recoveryTarget",
      "itemtype:File"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
Sigma Detection Rule: Renamed MegaSync Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sittikorn S
Date: 2021-06-22
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.

Detection logic:
{
  "selection": {
    "OriginalFileName": "megasync.exe"
  },
  "filter": {
    "Image|endswith": "\\megasync.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://redcanary.com/blog/rclone-mega-extortion/
Sigma Detection Rule: Registry Manipulation via WMI Stdregprov
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Daniel Koifman (KoifSec)
Date: 2025-07-30
ATT&CK techniques: T1047, T1112, T1012
Log source: windows/process_creation

Description:
Detects the usage of wmic.exe to manipulate Windows registry via the WMI StdRegProv class.
This behaviour could be potentially suspicious because it uses an alternative method to modify registry keys instead of legitimate registry tools like reg.exe or regedit.exe.
Attackers specifically choose this technique to evade detection and bypass security monitoring focused on traditional registry modification commands.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "call",
      "stdregprov"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
  - https://trustedsec.com/blog/command-line-underdog-wmic-in-action
  - https://trustedsec.com/blog/wmi-for-script-kiddies
Sigma Detection Rule: Suspicious Serv-U Process Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-14
ATT&CK techniques: T1555
Log source: windows/process_creation

Description:
Detects a suspicious process pattern which could be a sign of an exploited Serv-U service

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\Serv-U.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe",
      "\\cscript.exe",
      "\\sh.exe",
      "\\bash.exe",
      "\\schtasks.exe",
      "\\regsvr32.exe",
      "\\wmic.exe",
      "\\mshta.exe",
      "\\rundll32.exe",
      "\\msiexec.exe",
      "\\forfiles.exe",
      "\\scriptrunner.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
Sigma Detection Rule: DirLister Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-08-20
ATT&CK techniques: T1083
Log source: windows/process_creation

Description:
Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "DirLister.exe"
    },
    {
      "Image|endswith": "\\DirLister.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1083/T1083.md
  - https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/
Sigma Detection Rule: Uncommon Child Processes Of SndVol.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-09
Log source: windows/process_creation

Description:
Detects potentially uncommon child processes of SndVol.exe (the Windows volume mixer)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\SndVol.exe"
  },
  "filter_main_rundll32": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": " shell32.dll,Control_RunDLL "
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/Max_Mal_/status/[PII_REDACTED]56353792
Sigma Detection Rule: Curl Download And Execute Combination
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sreeman, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-01-13
ATT&CK techniques: T1218, T1105
Log source: windows/process_creation

Description:
Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.

Detection logic:
{
  "selection": {
    "CommandLine|contains|windash": " -c ",
    "CommandLine|contains|all": [
      "curl ",
      "http",
      "-o",
      "&"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983
Sigma Detection Rule: Suspicious Service Binary Directory
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-09
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects a service binary running in a suspicious directory

Detection logic:
{
  "selection": {
    "Image|contains": [
      "\\Users\\Public\\",
      "\\$Recycle.bin",
      "\\Users\\All Users\\",
      "\\Users\\Default\\",
      "\\Users\\Contacts\\",
      "\\Users\\Searches\\",
      "C:\\Perflogs\\",
      "\\config\\systemprofile\\",
      "\\Windows\\Fonts\\",
      "\\Windows\\IME\\",
      "\\Windows\\addins\\"
    ],
    "ParentImage|endswith": [
      "\\services.exe",
      "\\svchost.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/
Sigma Detection Rule: Suspicious Execution of InstallUtil Without Log
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-23
Log source: windows/process_creation

Description:
Uses the .NET InstallUtil.exe application in order to execute image without log

Detection logic:
{
  "selection": {
    "Image|endswith": "\\InstallUtil.exe",
    "Image|contains": "Microsoft.NET\\Framework",
    "CommandLine|contains|all": [
      "/logfile= ",
      "/LogToConsole=false"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/
  - https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
Sigma Detection Rule: Potentially Suspicious Child Processes Spawned by ConHost
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
ATT&CK techniques: T1202, T1218
Log source: windows/process_creation

Description:
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\conhost.exe"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "cmd.exe",
        "cscript.exe",
        "mshta.exe",
        "powershell_ise.exe",
        "powershell.exe",
        "pwsh.dll",
        "regsvr32.exe",
        "wscript.exe"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://tria.ge/241015-l98snsyeje/behavioral2
Sigma Detection Rule: File Download And Execution Via IEExec.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-16
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects execution of the IEExec utility to download and execute files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\IEExec.exe"
    },
    {
      "OriginalFileName": "IEExec.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/