deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Calculator Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-02-09
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.


Detection logic:
{
  "selection_1": {
    "CommandLine|contains": "\\calc.exe "
  },
  "selection_2": {
    "Image|endswith": "\\calc.exe"
  },
  "filter_main_known_locations": {
    "Image|contains": [
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection_1 or ( selection_2 and not filter_main_known_locations )"
}

References:
  - https://twitter.com/ItsReallyNick/status/[PII_REDACTED]86312448
Sigma Detection Rule: Rundll32 Execution Without Parameters
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bartlomiej Czyz, Relativity
Date: 2021-01-31
ATT&CK techniques: T1021.002, T1570, T1569.002
Log source: windows/process_creation

Description:
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module

Detection logic:
{
  "selection": {
    "CommandLine": [
      "rundll32.exe",
      "rundll32"
    ]
  },
  "condition": "selection"
}

References:
  - https://bczyz1.github.io/2021/01/30/psexec.html
Sigma Detection Rule: HackTool - SharpEvtMute Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-07
ATT&CK techniques: T1685.001
Log source: windows/process_creation

Description:
Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SharpEvtMute.exe"
    },
    {
      "Description": "SharpEvtMute"
    },
    {
      "CommandLine|contains": [
        "--Filter \"rule ",
        "--Encoded --Filter \\\""
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/bats3c/EvtMute
Sigma Detection Rule: HTML Help HH.EXE Suspicious Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-04-01
ATT&CK techniques: T1047, T1059.001, T1059.003, T1059.005, T1059.007, T1218, T1218.001, T1218.010, T1218.011, T1566, T1566.001
Log source: windows/process_creation

Description:
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\hh.exe",
    "Image|endswith": [
      "\\CertReq.exe",
      "\\CertUtil.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\installutil.exe",
      "\\MSbuild.exe",
      "\\MSHTA.EXE",
      "\\msiexec.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff[PII_REDACTED]4026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
Sigma Detection Rule: Replace.exe Usage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-06
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects the use of Replace.exe which can be used to replace file with another file

Detection logic:
{
  "selection": {
    "Image|endswith": "\\replace.exe"
  },
  "argument": {
    "CommandLine|contains|windash": "-a"
  },
  "condition": "selection and argument"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Replace/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/replace
Sigma Detection Rule: HackTool - CrackMapExec Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-25
ATT&CK techniques: T1047, T1053, T1059.003, T1059.001, T1110, T1201
Log source: windows/process_creation

Description:
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Detection logic:
{
  "selection_binary": {
    "Image|endswith": "\\crackmapexec.exe"
  },
  "selection_special": {
    "CommandLine|contains": " -M pe_inject "
  },
  "selection_execute": {
    "CommandLine|contains|all": [
      " --local-auth",
      " -u ",
      " -x "
    ]
  },
  "selection_hash": {
    "CommandLine|contains|all": [
      " --local-auth",
      " -u ",
      " -p ",
      " -H 'NTHASH'"
    ]
  },
  "selection_module_mssql": {
    "CommandLine|contains|all": [
      " mssql ",
      " -u ",
      " -p ",
      " -M ",
      " -d "
    ]
  },
  "selection_module_smb1": {
    "CommandLine|contains|all": [
      " smb ",
      " -u ",
      " -H ",
      " -M ",
      " -o "
    ]
  },
  "selection_module_smb2": {
    "CommandLine|contains|all": [
      " smb ",
      " -u ",
      " -p ",
      " --local-auth"
    ]
  },
  "part_localauth_1": {
    "CommandLine|contains|all": [
      " --local-auth",
      " -u ",
      " -p "
    ]
  },
  "part_localauth_2": {
    "CommandLine|contains|all": [
      " 10.",
      " 192.168.",
      "/24 "
    ]
  },
  "condition": "1 of selection_* or all of part_localauth*"
}

References:
  - https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local
  - https://www.mandiant.com/resources/telegram-malware-iranian-espionage
  - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz
  - https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject
Sigma Detection Rule: Potential Obfuscated Ordinal Call Via Rundll32
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2023-05-17
ATT&CK techniques: T1027.010
Log source: windows/process_creation

Description:
Detects execution of "rundll32" with potential obfuscated ordinal calls

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine|contains": "rundll32"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "#+",
      "#-",
      "#0",
      "#655",
      "#656"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research
  - https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
Sigma Detection Rule: LOLBAS Data Exfiltration by DataSvcUtil.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ialle Teixeira @teixeira0xfffff, Austin Songer @austinsonger
Date: 2021-09-30
ATT&CK techniques: T1567
Log source: windows/process_creation

Description:
Detects when a user performs data exfiltration by using DataSvcUtil.exe

Detection logic:
{
  "selection_cli": {
    "CommandLine|contains": [
      "/in:",
      "/out:",
      "/uri:"
    ]
  },
  "selection_img": [
    {
      "Image|endswith": "\\DataSvcUtil.exe"
    },
    {
      "OriginalFileName": "DataSvcUtil.exe"
    }
  ],
  "condition": "all of selection*"
}

References:
  - https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services
  - https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/
Sigma Detection Rule: IE ZoneMap Setting Downgraded To MyComputer Zone For HTTP Protocols Via CLI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-05
Log source: windows/process_creation

Description:
Detects changes to Internet Explorer's (IE / Windows Internet properties) ZoneMap configuration of the "HTTP" and "HTTPS" protocols to point to the "My Computer" zone. This allows downloaded files from the Internet to be granted the same level of trust as files stored locally.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\ProtocolDefaults",
      "http",
      " 0"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/M_haggis/status/[PII_REDACTED]54725107
  - https://twitter.com/JAMESWT_MHT/status/[PII_REDACTED]61391247
  - https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
  - https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content
Sigma Detection Rule: Procdump Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-16
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects usage of the SysInternals Procdump utility

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\procdump.exe",
      "\\procdump64.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
Sigma Detection Rule: Suspicious Reg Add BitLocker
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-11-15
ATT&CK techniques: T1486
Log source: windows/process_creation

Description:
Detects suspicious addition to BitLocker related registry keys via the reg.exe utility

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "REG",
      "ADD",
      "\\SOFTWARE\\Policies\\Microsoft\\FVE",
      "/v",
      "/f"
    ],
    "CommandLine|contains": [
      "EnableBDEWithNoTPM",
      "UseAdvancedStartup",
      "UseTPM",
      "UseTPMKey",
      "UseTPMKeyPIN",
      "RecoveryKeyMessageSource",
      "UseTPMPIN",
      "RecoveryKeyMessage"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
Sigma Detection Rule: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-16
ATT&CK techniques: T1518.001
Log source: windows/process_creation

Description:
Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\find.exe",
        "\\findstr.exe"
      ]
    },
    {
      "OriginalFileName": [
        "FIND.EXE",
        "FINDSTR.EXE"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " 385201"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service
Sigma Detection Rule: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth (Nextron Systems), Josh Nickels
Date: 2024-09-02
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects potential commandline obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "OriginalFileName": [
      "Cmd.EXE",
      "cscript.exe",
      "PowerShell.EXE",
      "PowerShell_ISE.EXE",
      "pwsh.dll",
      "wscript.exe"
    ]
  },
  "selection_special_chars": {
    "CommandLine|contains": [
      "\u02e3",
      "\u02ea",
      "\u02e2",
      "\u2215",
      "\u2044",
      "\u2015",
      "\u2014",
      "\u00a0",
      "\u00af",
      "\u00ae",
      "\u00b6",
      "\u2800"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http
Sigma Detection Rule: Suspicious File Download From File Sharing Domain Via Wget.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
Log source: windows/process_creation

Description:
Detects potentially suspicious file downloads from file sharing domains using wget.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wget.exe"
    },
    {
      "OriginalFileName": "wget.exe"
    }
  ],
  "selection_websites": {
    "CommandLine|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_flag": [
    {
      "CommandLine|re": "\\s-O\\s"
    },
    {
      "CommandLine|contains": "--output-document"
    }
  ],
  "selection_ext": {
    "CommandLine|endswith": [
      ".ps1",
      ".ps1'",
      ".ps1\"",
      ".dat",
      ".dat'",
      ".dat\"",
      ".msi",
      ".msi'",
      ".msi\"",
      ".bat",
      ".bat'",
      ".bat\"",
      ".exe",
      ".exe'",
      ".exe\"",
      ".vbs",
      ".vbs'",
      ".vbs\"",
      ".vbe",
      ".vbe'",
      ".vbe\"",
      ".hta",
      

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
Sigma Detection Rule: ETW Logging Tamper In .NET Processes Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects changes to environment variables related to ETW logging via the CommandLine.
This could indicate potential adversaries stopping ETW providers recording loaded .NET assemblies.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "COMPlus_ETWEnabled",
      "COMPlus_ETWFlags"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/_xpn_/status/[PII_REDACTED]28378368
  - https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr
  - https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables
  - https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38
  - https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39
Sigma Detection Rule: Execute Pcwrun.EXE To Leverage Follina
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability

Detection logic:
{
  "selection": {
    "Image|endswith": "\\pcwrun.exe",
    "CommandLine|contains": "../"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]62519040
Sigma Detection Rule: Fsutil Drive Enumeration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2022-03-29
ATT&CK techniques: T1120
Log source: windows/process_creation

Description:
Attackers may leverage fsutil to enumerated connected drives.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\fsutil.exe"
    },
    {
      "OriginalFileName": "fsutil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "drives"
  },
  "condition": "all of selection_*"
}

References:
  - Turla has used fsutil fsinfo drives to list connected drives.
  - https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml
Sigma Detection Rule: Chromium Browser Instance Executed With Custom Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Aedan Russell, frack113, X__Junior (Nextron Systems)
Date: 2022-06-19
ATT&CK techniques: T1176.001
Log source: windows/process_creation

Description:
Detects a Chromium based browser process with the 'load-extension' flag to start a instance with a custom extension

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ],
    "CommandLine|contains": "--load-extension="
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/chromeloader/
  - https://emkc.org/s/RJjuLa
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
Sigma Detection Rule: Regedit as Trusted Installer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-27
ATT&CK techniques: T1548
Log source: windows/process_creation

Description:
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe

Detection logic:
{
  "selection": {
    "Image|endswith": "\\regedit.exe",
    "ParentImage|endswith": [
      "\\TrustedInstaller.exe",
      "\\ProcessHacker.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/1kwpeter/status/[PII_REDACTED]55765504
Sigma Detection Rule: Sdiagnhost Calling Suspicious Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nextron Systems, @Kostastsale
Date: 2022-06-01
ATT&CK techniques: T1036, T1218
Log source: windows/process_creation

Description:
Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\sdiagnhost.exe",
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\cmd.exe",
      "\\mshta.exe",
      "\\cscript.exe",
      "\\wscript.exe",
      "\\taskkill.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\calc.exe"
    ]
  },
  "filter_main_cmd_bits": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": "bits"
  },
  "filter_main_powershell_noprofile": {
    "Image|endswith": "\\powershell.exe",
    "CommandLine|endswith": [
      "-noprofile -",
      "-noprofile"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/nao_sec/status/[PII_REDACTED]79401984
  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/
  - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/
Sigma Detection Rule: Windows EventLog Autologger Session Registry Modification Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-25
ATT&CK techniques: T1685.001
Log source: windows/process_creation

Description:
Detects attempts to disable Windows EventLog autologger sessions via registry modification.
The AutoLogger event tracing session records events that occur early in the operating system boot process.
Applications and device drivers can use the AutoLogger session to capture traces before the user logs in.
Adversaries may disable these sessions to evade detection and prevent security monitoring of early boot activities and system events.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\reg.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "reg.exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_action": {
    "CommandLine|contains": [
      "add ",
      "Set-ItemProperty",
      "New-ItemProperty",
      "si "
    ]
  },
  "selection_cli_base": {
    "CommandLine|contains": "\\Control\\WMI\\Autologger\\"
  },
  "selection_cli_key": {
    "CommandLine|contains": [
      "Start",
      "Enabled"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
  - https://ptylu.github.io/content/report/report.html?report=25
  - https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Sigma Detection Rule: Data Copied To Clipboard Via Clip.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-07-27
ATT&CK techniques: T1115
Log source: windows/process_creation

Description:
Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\clip.exe"
    },
    {
      "OriginalFileName": "clip.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md