deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Download/Upload Activity Using Type Command
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-14
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects usage of the "type" command to download/upload data from WebDAV server

Detection logic:
{
  "selection_upload": {
    "CommandLine|contains|all": [
      "type ",
      " > \\\\\\\\"
    ]
  },
  "selection_download": {
    "CommandLine|contains|all": [
      "type \\\\\\\\",
      " > "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://mr0range.com/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22
Sigma Detection Rule: Chromium Browser Headless Execution To Mockbin Like Site
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-09-11
Log source: windows/process_creation

Description:
Detects the execution of a Chromium based browser process with the "headless" flag and a URL pointing to the mockbin.org service (which can be used to exfiltrate data).

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ]
  },
  "selection_headless": {
    "CommandLine|contains": "--headless"
  },
  "selection_url": {
    "CommandLine|contains": [
      "://run.mocky",
      "://mockbin"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.zscaler.com/blogs/security-research/steal-it-campaign
Sigma Detection Rule: Renamed CURL.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-09-11
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "curl.exe"
    },
    {
      "Description": "The curl executable"
    }
  ],
  "filter_main_img": {
    "Image|contains": "\\curl"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/Kostastsale/status/[PII_REDACTED]28290260
Sigma Detection Rule: Suspicious Curl.EXE Download
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-07-03
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects a suspicious curl process start on Windows and outputs the requested document to a local file

Detection logic:
{
  "selection_curl": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "selection_susp_locations": {
    "CommandLine|contains": [
      "%AppData%",
      "%Public%",
      "%Temp%",
      "%tmp%",
      "\\AppData\\",
      "\\Desktop\\",
      "\\Temp\\",
      "\\Users\\Public\\",
      "C:\\PerfLogs\\",
      "C:\\ProgramData\\",
      "C:\\Windows\\Temp\\"
    ]
  },
  "selection_susp_extensions": {
    "CommandLine|endswith": [
      ".dll",
      ".gif",
      ".jpeg",
      ".jpg",
      ".png",
      ".temp",
      ".tmp",
      ".txt",
      ".vbe",
      ".vbs"
    ]
  },
  "filter_optional_git_windows": {
    "ParentImage": "C:\\Program Files\\Git\\usr\\bin\\sh.exe",
    "Image": "C:\\Program Files\\Git\\mingw64\\bin\\curl.exe",
    "CommandLine|contains|all": [
      "--silent --show-error --output ",
      "gfw-httpget-",
      "AppData"
    ]
  },
  "condition": "selection_curl and 1 of selection_susp_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/max_mal_/status/[PII_REDACTED]97163522
  - https://web.archive.org/web/[PII_REDACTED]0046/https://twitter.com/reegun21/status/[PII_REDACTED]09790464
  - https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt
  - https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file
Sigma Detection Rule: Potential Dosfuscation Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-15
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects possible payload obfuscation via the commandline

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "^^",
      "^|^",
      ",;,",
      ";;;;",
      ";; ;;",
      "(,(,",
      "%COMSPEC:~",
      " c^m^d",
      "^c^m^d",
      " c^md",
      " cm^d",
      "^cm^d",
      " s^et ",
      " s^e^t ",
      " se^t "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/dosfuscation-report.pdf
  - https://github.com/danielbohannon/Invoke-DOSfuscation
Sigma Detection Rule: Potential DLL File Download Via PowerShell Invoke-WebRequest
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Hieu Tran
Date: 2023-03-13
ATT&CK techniques: T1059.001, T1105
Log source: windows/process_creation

Description:
Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Invoke-RestMethod ",
      "Invoke-WebRequest ",
      "IRM ",
      "IWR "
    ],
    "CommandLine|contains|all": [
      "http",
      "OutFile",
      ".dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Sigma Detection Rule: Potential Configuration And Service Reconnaissance Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1012, T1007
Log source: windows/process_creation

Description:
Detects the usage of "reg.exe" in order to query reconnaissance information from the registry. Adversaries may interact with the Windows registry to gather information about credentials, the system, configuration, and installed software.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_flag": {
    "CommandLine|contains": "query"
  },
  "selection_key": {
    "CommandLine|contains": [
      "currentVersion\\windows",
      "winlogon\\",
      "currentVersion\\shellServiceObjectDelayLoad",
      "currentVersion\\run",
      "currentVersion\\policies\\explorer\\run",
      "currentcontrolset\\services"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
Sigma Detection Rule: File Download Via Windows Defender MpCmpRun.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Matthew Matchen
Date: 2020-09-04
ATT&CK techniques: T1218, T1105
Log source: windows/process_creation

Description:
Detects the use of Windows Defender MpCmdRun.EXE to download files

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "MpCmdRun.exe"
    },
    {
      "Image|endswith": "\\MpCmdRun.exe"
    },
    {
      "CommandLine|contains": "MpCmdRun.exe"
    },
    {
      "Description": "Microsoft Malware Protection Command Line Utility"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "DownloadFile",
      "url"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4959/https://twitter.com/djmtshepana/status/[PII_REDACTED]96612866
  - https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/
Sigma Detection Rule: Registry Modification Via Regini.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Eli Salem, Sander Wiebing, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects the execution of regini.exe which can be used to modify registry keys, the changes are imported from one or more text files.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\regini.exe"
    },
    {
      "OriginalFileName": "REGINI.EXE"
    }
  ],
  "filter": {
    "CommandLine|re": ":[^ \\\\]"
  },
  "condition": "selection and not filter"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regini/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
Sigma Detection Rule: Active Directory Structure Export Via Ldifde.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
Log source: windows/process_creation

Description:
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.

Detection logic:
{
  "selection_ldif": [
    {
      "Image|endswith": "\\ldifde.exe"
    },
    {
      "OriginalFileName": "ldifde.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": "-f"
  },
  "filter_import": {
    "CommandLine|contains": " -i"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
Sigma Detection Rule: ETW Trace Evasion Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2019-03-22
ATT&CK techniques: T1070, T1685
Log source: windows/process_creation

Description:
Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.


Detection logic:
{
  "selection_clear_1": {
    "CommandLine|contains|all": [
      "cl",
      "/Trace"
    ]
  },
  "selection_clear_2": {
    "CommandLine|contains|all": [
      "clear-log",
      "/Trace"
    ]
  },
  "selection_disable_1": {
    "CommandLine|contains|all": [
      "sl",
      "/e:false"
    ]
  },
  "selection_disable_2": {
    "CommandLine|contains|all": [
      "set-log",
      "/e:false"
    ]
  },
  "selection_disable_3": {
    "CommandLine|contains|all": [
      "logman",
      "update",
      "trace",
      "--p",
      "-ets"
    ]
  },
  "selection_pwsh_remove": {
    "CommandLine|contains": "Remove-EtwTraceProvider"
  },
  "selection_pwsh_set": {
    "CommandLine|contains|all": [
      "Set-EtwTraceProvider",
      "0x11"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://abuse.io/lockergoga.txt
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Sigma Detection Rule: HackTool - Koadic Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: wagga, Jonhnathan Ribeiro, oscd.community
Date: 2020-01-12
ATT&CK techniques: T1059.003, T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects command line parameters used by Koadic hack tool

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/q",
      "/c",
      "chcp"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/
  - https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js
  - https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/
Sigma Detection Rule: Sysinternals PsSuspend Suspicious Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-23
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "pssuspend.exe"
    },
    {
      "Image|endswith": [
        "\\pssuspend.exe",
        "\\pssuspend64.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "msmpeng.exe"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
  - https://twitter.com/0gtweet/status/[PII_REDACTED]17975046
Sigma Detection Rule: PowerShell Base64 Encoded WMI Classes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-30
ATT&CK techniques: T1059.001, T1027
Log source: windows/process_creation

Description:
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_shadowcopy": {
    "CommandLine|contains": [
      "VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ",
      "cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA",
      "XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A",
      "V2luMzJfU2hhZG93Y29we",
      "dpbjMyX1NoYWRvd2NvcH",
      "XaW4zMl9TaGFkb3djb3B5"
    ]
  },
  "selection_cli_scheduledJob": {
    "CommandLine|contains": [
      "VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA",
      "cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA",
      "XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg",
      "V2luMzJfU2NoZWR1bGVkSm9i",
      "dpbjMyX1NjaGVkdWxlZEpvY",
      "XaW4zMl9TY2hlZHVsZWRKb2"
    ]
  },
  "selection_cli_process": {
    "CommandLine|contains": [
      "VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw",
      "cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA",
      "XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA",
      "V2luMzJfUHJvY2Vzc",
      "dpbjMyX1Byb2Nlc3",
      "XaW4zMl9Qcm9jZXNz"
    ]
  },
  "selection_cli_useraccount": {
    "CommandLine|contains": [
      "VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A",
      "cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA",
      "XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA",
      "V2luMzJfVXNlckFjY291bn",
      "dpbjMyX1VzZXJBY2NvdW50",
      "XaW4zMl9Vc2VyQWNjb3Vud"
    ]
  },
  "

References:
  - https://github.com/Neo23x0/Raccine/blob/20a569fa[PII_REDACTED]3dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
Sigma Detection Rule: Potentially Suspicious Rundll32.EXE Execution of UDL File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2024-08-16
ATT&CK techniques: T1218.011, T1071
Log source: windows/process_creation

Description:
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\explorer.exe"
  },
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "oledb32.dll",
      ",OpenDSLFile ",
      "\\\\Users\\\\*\\\\Downloads\\\\"
    ],
    "CommandLine|endswith": ".udl"
  },
  "condition": "all of selection_*"
}

References:
  - https://trustedsec.com/blog/oops-i-udld-it-again
Sigma Detection Rule: Potential Browser Data Stealing
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-23
ATT&CK techniques: T1555.003
Log source: windows/process_creation

Description:
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.


Detection logic:
{
  "selection_cmd": [
    {
      "CommandLine|contains": [
        "copy-item",
        "copy ",
        "cpi ",
        " cp ",
        "move ",
        "move-item",
        " mi ",
        " mv "
      ]
    },
    {
      "Image|endswith": [
        "\\esentutl.exe",
        "\\xcopy.exe",
        "\\robocopy.exe"
      ]
    },
    {
      "OriginalFileName": [
        "esentutl.exe",
        "XCOPY.EXE",
        "robocopy.exe"
      ]
    }
  ],
  "selection_path": {
    "CommandLine|contains": [
      "\\Amigo\\User Data",
      "\\BraveSoftware\\Brave-Browser\\User Data",
      "\\CentBrowser\\User Data",
      "\\Chromium\\User Data",
      "\\CocCoc\\Browser\\User Data",
      "\\Comodo\\Dragon\\User Data",
      "\\Elements Browser\\User Data",
      "\\Epic Privacy Browser\\User Data",
      "\\Google\\Chrome Beta\\User Data",
      "\\Google\\Chrome SxS\\User Data",
      "\\Google\\Chrome\\User Data\\",
      "\\Kometa\\User Data",
      "\\Maxthon5\\Users",
      "\\Microsoft\\Edge\\User Data",
      "\\Mozilla\\Firefox\\Profiles",
      "\\Nichrome\\User Data",
      "\\Opera Software\\Opera GX Stable\\",
      "\\Opera Software\\Opera Neon\\User Data",
      "\\Opera Software\\Opera Stable\\",
      "\\Orbitum\\User Data",
      "\\QIP Surf\\User Data",
      "\\Sputnik\\User Data",
      "\\Torch\\User Data",
      "\\uCozMedia\\Uran\\User Data",
      "\\Vivaldi\\User Data"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
  - https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf
Sigma Detection Rule: Shadow Copies Creation Using Operating Systems Utilities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1003, T1003.002, T1003.003
Log source: windows/process_creation

Description:
Shadow Copies creation using operating systems utilities, possible credential access

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wmic.exe",
        "\\vssadmin.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "wmic.exe",
        "VSSADMIN.EXE"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "shadow",
      "create"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/
Sigma Detection Rule: Suspicious NTLM Authentication on the Printer Spooler Service
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Elastic (idea), Tobias Michalski (Nextron Systems)
Date: 2022-05-04
ATT&CK techniques: T1212
Log source: windows/process_creation

Description:
Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "C:\\windows\\system32\\davclnt.dll,DavSetCookie",
      "http"
    ],
    "CommandLine|contains": [
      "spoolss",
      "srvsvc",
      "/print/pipe/"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/med0x2e/status/[PII_REDACTED]85200384
  - https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml
Sigma Detection Rule: Use of Wfc.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2022-06-01
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\wfc.exe"
    },
    {
      "OriginalFileName": "wfc.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
Sigma Detection Rule: Microsoft IIS Connection Strings Decryption
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-28
ATT&CK techniques: T1003
Log source: windows/process_creation

Description:
Detects use of aspnet_regiis to decrypt Microsoft IIS connection strings. An attacker with Microsoft IIS web server access via a webshell or alike can decrypt and dump any hardcoded connection strings, such as the MSSQL service account password using aspnet_regiis command.

Detection logic:
{
  "selection_name": [
    {
      "Image|endswith": "\\aspnet_regiis.exe"
    },
    {
      "OriginalFileName": "aspnet_regiis.exe"
    }
  ],
  "selection_args": {
    "CommandLine|contains|all": [
      "connectionStrings",
      " -pdf"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.elastic.co/guide/en/security/current/microsoft-iis-connection-strings-decryption.html
Sigma Detection Rule: Bypass UAC via WSReset.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community, Florian Roth
Date: 2019-10-24
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects use of WSReset.exe to bypass User Account Control (UAC). Adversaries use this technique to execute privileged processes.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\wsreset.exe"
  },
  "filter": [
    {
      "Image|endswith": "\\conhost.exe"
    },
    {
      "OriginalFileName": "CONHOST.EXE"
    }
  ],
  "condition": "selection and not filter"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  - https://www.activecyber.us/activelabs/windows-uac-bypass
  - https://twitter.com/ReaQta/status/[PII_REDACTED]31217921
Sigma Detection Rule: Service StartupType Change Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detect the use of "sc.exe" to change the startup type of a service to "disabled" or "demand"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " config ",
      "start"
    ],
    "CommandLine|contains": [
      "disabled",
      "demand"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/38283b775552da[PII_REDACTED]ea74191aa0d203edd3f61fb2dee7b0aea3514955