deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Thread Created In Shell Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Splunk Research Team
Date: 2024-07-29
ATT&CK techniques: T1055
Log source: windows/create_remote_thread

Description:
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE".
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.


Detection logic:
{
  "selection": {
    "TargetImage|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_main_system": {
    "SourceImage|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\"
    ]
  },
  "filter_optional_defender": {
    "SourceImage|endswith": "\\MsMpEng.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://research.splunk.com/endpoint/10399c1e-f51e-11eb-b920-acde48001122/
  - https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
Sigma Detection Rule: Remote Thread Creation Via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1059.001
Log source: windows/create_remote_thread

Description:
Detects the creation of a remote thread from a Powershell process to another process

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_main_compattelrunner": {
    "SourceParentImage|endswith": ":\\Windows\\System32\\CompatTelRunner.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Access To .Reg/.Hive Files By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2023-09-15
ATT&CK techniques: T1112
Log source: windows/file_access

Description:
Detects file access requests to files ending with either the ".hive"/".reg" extension, usually associated with Windows Registry backups.

Detection logic:
{
  "selection": {
    "FileName|endswith": [
      ".hive",
      ".reg"
    ]
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/tccontre/Reg-Restore-Persistence-Mole
Sigma Detection Rule: Unattend.XML File Access Attempt
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2024-07-22
ATT&CK techniques: T1552.001
Log source: windows/file_access

Description:
Detects attempts to access the "unattend.xml" file, where credentials might be stored.
This file is used during the unattended windows install process.


Detection logic:
{
  "selection": {
    "FileName|endswith": "\\Panther\\unattend.xml"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Sigma Detection Rule: Access To Windows Outlook Mail Files By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2024-05-10
ATT&CK techniques: T1070.008
Log source: windows/file_access

Description:
Detects file access requests to Windows Outlook Mail by uncommon processes.
Could indicate potential attempt of credential stealing.
Requires heavy baselining before usage


Detection logic:
{
  "selection_unistore": {
    "FileName|contains": "\\AppData\\Local\\Comms\\Unistore\\data"
  },
  "selection_unistoredb": {
    "FileName|endswith": "\\AppData\\Local\\Comms\\UnistoreDB\\store.vol"
  },
  "filter_main_system": {
    "Image": "System"
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_defender": {
    "Image|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\",
    "Image|endswith": [
      "\\MpCopyAccelerator.exe",
      "\\MsMpEng.exe"
    ]
  },
  "filter_optional_thor": {
    "Image|endswith": [
      "\\thor64.exe",
      "\\thor.exe"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://darkdefender.medium.com/windows-10-mail-app-forensics-39025f5418d2
  - https://github.com/redcanaryco/atomic-red-team/blob/58496ee3306e6e42a7054d36a94e6eb561ee3081/atomics/T1070.008/T1070.008.md#atomic-test-4---copy-and-modify-mailbox-data-on-windows
Sigma Detection Rule: Access To Chromium Browsers Sensitive Files By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: X__Junior (Nextron Systems)
Date: 2024-07-29
ATT&CK techniques: T1003
Log source: windows/file_access

Description:
Detects file access requests to chromium based browser sensitive files by uncommon processes.
Could indicate potential attempt of stealing sensitive information.


Detection logic:
{
  "selection": {
    "FileName|contains": [
      "\\User Data\\Default\\Cookies",
      "\\User Data\\Default\\History",
      "\\User Data\\Default\\Network\\Cookies",
      "\\User Data\\Default\\Web Data"
    ]
  },
  "filter_main_system": {
    "Image": "System"
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_defender": {
    "Image|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\",
    "Image|endswith": [
      "\\MpCopyAccelerator.exe",
      "\\MsMpEng.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Internal Research
Sigma Detection Rule: Access To Sysvol Policies Share By Uncommon Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-12-21
ATT&CK techniques: T1552.006
Log source: windows/file_access

Description:
Detects file access requests to the Windows Sysvol Policies Share by uncommon processes

Detection logic:
{
  "selection": {
    "FileName|startswith": "\\\\",
    "FileName|contains|all": [
      "\\sysvol\\",
      "\\Policies\\"
    ]
  },
  "filter_main_generic": {
    "Image|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\explorer.exe",
      ":\\Windows\\system32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/vletoux/pingcastle
Sigma Detection Rule: Access To Browser Credential Files By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, X__Junior (Nextron Systems)
Date: 2022-04-09
ATT&CK techniques: T1003
Log source: windows/file_access

Description:
Detects file access requests to browser credential stores by uncommon processes.
Could indicate potential attempt of credential stealing.
Requires heavy baselining before usage


Detection logic:
{
  "selection_ie": {
    "FileName|endswith": "\\Appdata\\Local\\Microsoft\\Windows\\WebCache\\WebCacheV01.dat"
  },
  "selection_firefox": {
    "FileName|endswith": [
      "\\cookies.sqlite",
      "\\places.sqlite",
      "release\\key3.db",
      "release\\key4.db",
      "release\\logins.json"
    ]
  },
  "selection_chromium": {
    "FileName|contains": [
      "\\User Data\\Default\\Login Data",
      "\\User Data\\Local State"
    ]
  },
  "filter_main_system": {
    "Image": "System"
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_defender": {
    "Image|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\",
    "Image|endswith": [
      "\\MpCopyAccelerator.exe",
      "\\MsMpEng.exe"
    ]
  },
  "filter_optional_thor": {
    "Image|endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users
  - https://github.com/lclevy/firepwd
Sigma Detection Rule: ADS Zone.Identifier Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2023-09-04
ATT&CK techniques: T1070.004
Log source: windows/file_delete

Description:
Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ":Zone.Identifier"
  },
  "condition": "selection"
}

References:
  - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/
Sigma Detection Rule: Non-DLL Extension File Renamed With DLL Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-19
ATT&CK techniques: T1036.008
Log source: windows/file_rename

Description:
Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".dll"
  },
  "filter_main_dll": {
    "SourceFilename|endswith": ".dll"
  },
  "filter_main_installers": {
    "SourceFilename|endswith": ".tmp"
  },
  "filter_main_empty_source": {
    "SourceFilename": ""
  },
  "filter_main_null_source": {
    "SourceFilename": null
  },
  "filter_main_tiworker": {
    "Image|contains": ":\\Windows\\WinSxS\\",
    "Image|endswith": "\\TiWorker.exe"
  },
  "filter_main_upgrade": [
    {
      "Image|endswith": ":\\Windows\\System32\\wuauclt.exe"
    },
    {
      "TargetFilename|contains": ":\\$WINDOWS.~BT\\Sources\\"
    }
  ],
  "filter_main_generic": {
    "Image|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\"
    ]
  },
  "filter_optional_squirrel": {
    "SourceFilename|contains": "\\SquirrelTemp\\temp"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/ffforward/status/[PII_REDACTED]39912960
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036/T1036.md#atomic-test-1---system-file-copied-to-unusual-location
Sigma Detection Rule: File Creation Date Changed to Another Year
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1070.006
Log source: windows/file_change

Description:
Detects when the file creation time is changed to a year before 2020.
Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system.
Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity.
In order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly.
Hunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories.
Correlate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.


Detection logic:
{
  "selection": {
    "PreviousCreationUtcTime|startswith": "202"
  },
  "filter_main_creation_time": {
    "CreationUtcTime|startswith": "202"
  },
  "filter_main_program_files": [
    {
      "TargetFilename|startswith": [
        "C:\\Program Files\\",
        "C:\\Program Files (x86)\\"
      ]
    },
    {
      "Image|startswith": [
        "C:\\Program Files\\",
        "C:\\Program Files (x86)\\"
      ]
    }
  ],
  "filter_optional_updates": [
    {
      "Image": [
        "C:\\Windows\\system32\\ProvTool.exe",
        "C:\\Windows\\System32\\usocoreworker.exe",
        "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe"
      ]
    },
    {
      "TargetFilename|startswith": "C:\\ProgramData\\USOPrivate\\UpdateStore\\"
    },
    {
      "TargetFilename|endswith": [
        ".tmp",
        ".temp"
      ]
    }
  ],
  "filter_optional_cab": {
    "Image|startswith": "C:\\WINDOWS\\System32\\",
    "Image|endswith": [
      "\\TiWorker.exe",
      "\\svchost.exe",
      "\\sihclient.exe"
    ],
    "TargetFilename|endswith": ".cab"
  },
  "filter_optional_msiexec": {
    "Image": "C:\\Windows\\system32\\msiexec.exe"
  },
  "filter_optional_vcredist": {
    "Image|startswith": "C:\\Windows\\Temp\\",
    "Image|endswith": "\\VCREDI~1.EXE"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.inversecos.com/2022/04/defence-evasion-technique-timestomping.html
Sigma Detection Rule: Scheduled Task Created - FileCreation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
Date: 2023-09-27
ATT&CK techniques: T1053.005
Log source: windows/file_event

Description:
Detects the creation of a scheduled task via file creation.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\SysWOW64\\Tasks\\",
      ":\\Windows\\Tasks\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
  - https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
Sigma Detection Rule: PFX File Creation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1552.004
Log source: windows/file_event

Description:
Detects the creation of PFX files (Personal Information Exchange format).
PFX files contain private keys and certificates bundled together, making them valuable targets for attackers seeking to:

    - Exfiltrate digital certificates for impersonation or signing malicious code
    - Establish persistent access through certificate-based authentication
    - Bypass security controls that rely on certificate validation

Analysts should investigate PFX file creation events by examining which process created the PFX file and its parent process chain, as well as unusual locations outside standard certificate stores or development environments.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".pfx"
  },
  "filter_optional_onedrive": {
    "Image": [
      "C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe",
      "C:\\Program Files (x86)\\Microsoft OneDrive\\OneDrive.exe"
    ],
    "TargetFilename|endswith": "\\OneDrive\\CodeSigning.pfx"
  },
  "filter_optional_visual_studio": {
    "TargetFilename|startswith": [
      "C:\\Program Files (x86)\\Microsoft Visual Studio\\",
      "C:\\Program Files\\Microsoft Visual Studio\\"
    ]
  },
  "filter_optional_cmake": {
    "TargetFilename|startswith": "C:\\Program Files\\CMake\\"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/14
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/6.B.1_6392C9F1-D975-4F75-8A70-433DEDD7F622.md
Sigma Detection Rule: Suspicious Creation TXT File in User Desktop
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-26
ATT&CK techniques: T1486
Log source: windows/file_event

Description:
Detects creation of .txt files in user desktop folders via cmd.exe. This behavior may indicate ransomware deploying ransom notes, but can also occur during legitimate administrative tasks.
Analysts should investigate for suspicious filenames (e.g., "RANSOM", "DECRYPT", "READ_ME"), bulk file creation patterns, or concurrent encryption activity to determine if this is part of a ransomware attack.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\cmd.exe",
    "TargetFilename|contains|all": [
      "\\Users\\",
      "\\Desktop\\"
    ],
    "TargetFilename|endswith": ".txt"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1486/T1486.md#atomic-test-5---purelocker-ransom-note
Sigma Detection Rule: Creation of an Executable by an Executable
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-09
ATT&CK techniques: T1587.001
Log source: windows/file_event

Description:
Detects the creation of an executable by another executable.

Detection logic:
{
  "selection": {
    "Image|endswith": ".exe",
    "TargetFilename|endswith": ".exe"
  },
  "filter_main_generic_1": {
    "Image|endswith": [
      ":\\Windows\\System32\\msiexec.exe",
      ":\\Windows\\system32\\cleanmgr.exe",
      ":\\Windows\\explorer.exe",
      ":\\WINDOWS\\system32\\dxgiadaptercache.exe",
      ":\\WINDOWS\\system32\\Dism.exe",
      ":\\Windows\\System32\\wuauclt.exe"
    ]
  },
  "filter_main_update": {
    "Image|endswith": ":\\WINDOWS\\system32\\svchost.exe",
    "TargetFilename|contains": ":\\Windows\\SoftwareDistribution\\Download\\"
  },
  "filter_main_upgrade": {
    "Image|endswith": ":\\Windows\\system32\\svchost.exe",
    "TargetFilename|contains|all": [
      ":\\WUDownloadCache\\",
      "\\WindowsUpdateBox.exe"
    ]
  },
  "filter_main_windows_update_box": {
    "Image|contains": ":\\WINDOWS\\SoftwareDistribution\\Download\\",
    "Image|endswith": "\\WindowsUpdateBox.Exe",
    "TargetFilename|contains": ":\\$WINDOWS.~BT\\Sources\\"
  },
  "filter_main_tiworker": {
    "Image|contains": ":\\Windows\\WinSxS\\",
    "Image|endswith": "\\TiWorker.exe"
  },
  "filter_main_programfiles": [
    {
      "Image|contains": [
        ":\\Program Files\\",
        ":\\Program Files (x86)\\"
      ]
    },
    {
      "TargetFilename|contains": [
        ":\\Program Files\\",
        ":\\Program Files (x86)\\"
      ]
    }
  ],
  "filter_main_defender": {
    "Image|contains": [
      ":\\ProgramData\\Microsoft\\Windows Defender\\",
      ":\\P

References:
  - Internal Research
Sigma Detection Rule: WDAC Policy File Creation In CodeIntegrity Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Andreas Braathen (mnemonic.io)
Date: 2025-01-30
ATT&CK techniques: T1685
Log source: windows/file_event

Description:
Attackers can craft a custom Windows Defender Application Control (WDAC) policy that blocks Endpoint Detection and Response (EDR) components while allowing their own malicious code. The policy is placed in the privileged Windows Code Integrity folder (C:\Windows\System32\CodeIntegrity\). Upon reboot, the policy prevents EDR drivers from loading, effectively bypassing security measures and may further enable undetected lateral movement within an Active Directory environment.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": ":\\Windows\\System32\\CodeIntegrity\\",
    "TargetFilename|endswith": [
      ".cip",
      ".p7b"
    ],
    "IntegrityLevel": "High"
  },
  "condition": "selection"
}

References:
  - https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
  - https://www.virustotal.com/gui/file/d2a4f52a9923336f119a52e531bbb1e66f18322fd8efa9af1a64b94f4d36dc97
Sigma Detection Rule: WebDAV Temporary Local File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski
Date: 2023-08-21
ATT&CK techniques: T1584, T1566
Log source: windows/file_event

Description:
Detects the creation of WebDAV temporary files with potentially suspicious extensions

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\TfsStore\\Tfs_DAV\\",
    "TargetFilename|endswith": [
      ".7z",
      ".bat",
      ".dat",
      ".ico",
      ".js",
      ".lnk",
      ".ps1",
      ".rar",
      ".vbe",
      ".vbs",
      ".zip"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
  - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
  - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
Sigma Detection Rule: VsCode Code Tunnel Execution File Indicator
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-25
Log source: windows/file_event

Description:
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility. Attackers can abuse this functionality to establish a C2 channel


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\code_tunnel.json"
  },
  "condition": "selection"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
Sigma Detection Rule: Python Path Configuration File Creation - Windows
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)
Date: 2024-04-25
ATT&CK techniques: T1059.006
Log source: windows/file_event

Description:
Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence.
Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script.
Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).


Detection logic:
{
  "selection": {
    "TargetFilename|re": "(?i)\\\\(venv|python(.+)?)\\\\lib\\\\site-packages\\\\",
    "TargetFilename|endswith": ".pth"
  },
  "filter_main_python": {
    "Image|endswith": "\\python.exe",
    "TargetFilename|endswith": [
      "\\pywin32.pth",
      "\\distutils-precedence.pth"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.volexity.com/blog/2024/04/12/zero-day-exploitation-of-unauthenticated-remote-code-execution-vulnerability-in-globalprotect-cve-2024-3400/
  - https://www.virustotal.com/gui/file/3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac
  - https://docs.python.org/3/library/site.html
Sigma Detection Rule: DMP/HDMP File Creation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-07
Log source: windows/file_event

Description:
Detects the creation of a file with the ".dmp"/".hdmp" extension. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ".dmp",
      ".dump",
      ".hdmp"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps