deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Response File Execution Via Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" with the "-f" flag in order to load a response file which might contain a malicious action.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -f "
  },
  "selection_rsp_ext": {
    "CommandLine|contains": ".rsp"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Sigma Detection Rule: OneNote.EXE Execution of Malicious Embedded Scripts
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2023-02-02
ATT&CK techniques: T1218.001
Log source: windows/process_creation

Description:
Detects the execution of malicious OneNote documents that contain embedded scripts.
When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\onenote.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "CommandLine|contains": [
      "\\exported\\",
      "\\onenoteofflinecache_files\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://bazaar.abuse.ch/browse/tag/one/
Sigma Detection Rule: Renamed BrowserCore.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2022-06-02
ATT&CK techniques: T1528, T1036.003
Log source: windows/process_creation

Description:
Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)

Detection logic:
{
  "selection": {
    "OriginalFileName": "BrowserCore.exe"
  },
  "filter_realbrowsercore": {
    "Image|endswith": "\\BrowserCore.exe"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/mariuszbit/status/[PII_REDACTED]39102720
Sigma Detection Rule: Potential RDP Tunneling Via Plink
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-04
ATT&CK techniques: T1572
Log source: windows/process_creation

Description:
Execution of plink to perform data exfiltration and tunneling

Detection logic:
{
  "selection_a": {
    "Image|endswith": "\\plink.exe",
    "CommandLine|contains": ":127.0.0.1:3389"
  },
  "selection_b1": {
    "Image|endswith": "\\plink.exe",
    "CommandLine|contains": ":3389"
  },
  "selection_b2": {
    "CommandLine|contains": [
      " -P 443",
      " -P 22"
    ]
  },
  "condition": "selection_a or all of selection_b*"
}

References:
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
Sigma Detection Rule: Potentially Suspicious NTFS Symlink Behavior Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, The DFIR Report
Date: 2022-03-02
ATT&CK techniques: T1059, T1222.001
Log source: windows/process_creation

Description:
Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.


Detection logic:
{
  "selection_img_proxy": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_fsutil_cli": {
    "CommandLine|contains|all": [
      "fsutil",
      "behavior",
      "set",
      "SymlinkEvaluation"
    ]
  },
  "selection_symlink_params": {
    "CommandLine|contains": [
      "R2L:1",
      "R2R:1",
      "L2L:1"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware
  - https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
  - https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
Sigma Detection Rule: UAC Bypass Using ChangePK and SLUI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects an UAC bypass that uses changepk.exe and slui.exe (UACMe 61)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\changepk.exe",
    "ParentImage|endswith": "\\slui.exe",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b
  - https://github.com/hfiref0x/UACME
  - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
Sigma Detection Rule: Scheduled Task Creation Masquerading as System Processes
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
ATT&CK techniques: T1053.005, T1036.004, T1036.005
Log source: windows/process_creation

Description:
Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " /create ",
    "CommandLine|contains": [
      " audiodg",
      " conhost",
      " dwm.exe",
      " explorer",
      " lsass",
      " lsm",
      " mmc",
      " msiexec",
      " regsvr32",
      " rundll32",
      " services",
      " spoolsv",
      " svchost",
      " taskeng",
      " taskhost",
      " wininit",
      " winlogon"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://tria.ge/241015-l98snsyeje/behavioral2
Sigma Detection Rule: Detected Windows Software Discovery
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-16
ATT&CK techniques: T1518
Log source: windows/process_creation

Description:
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains|all": [
      "query",
      "\\software\\",
      "/v",
      "svcversion"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
  - https://github.com/harleyQu1nn/AggressorScripts
Sigma Detection Rule: Suspicious GUP Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-02-06
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks

Detection logic:
{
  "selection": {
    "Image|endswith": "\\GUP.exe"
  },
  "filter_programfiles": {
    "Image|endswith": [
      "\\Program Files\\Notepad++\\updater\\GUP.exe",
      "\\Program Files (x86)\\Notepad++\\updater\\GUP.exe"
    ]
  },
  "filter_user": {
    "Image|contains": "\\Users\\",
    "Image|endswith": [
      "\\AppData\\Local\\Notepad++\\updater\\GUP.exe",
      "\\AppData\\Roaming\\Notepad++\\updater\\GUP.exe"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html
Sigma Detection Rule: Scripting/CommandLine Process Spawned Regsvr32
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-26
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "Image|endswith": "\\regsvr32.exe"
  },
  "filter_main_rpcproxy": {
    "ParentImage": "C:\\Windows\\System32\\cmd.exe",
    "CommandLine|endswith": " /s C:\\Windows\\System32\\RpcProxy\\RpcProxy.dll"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
Sigma Detection Rule: Suspicious Download from Office Domain
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-27
ATT&CK techniques: T1105, T1608
Log source: windows/process_creation

Description:
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents

Detection logic:
{
  "selection_download": [
    {
      "Image|endswith": [
        "\\curl.exe",
        "\\wget.exe"
      ]
    },
    {
      "CommandLine|contains": [
        "Invoke-WebRequest",
        "iwr ",
        "curl ",
        "wget ",
        "Start-BitsTransfer",
        ".DownloadFile(",
        ".DownloadString("
      ]
    }
  ],
  "selection_domains": {
    "CommandLine|contains": [
      "https://attachment.outlook.live.net/owa/",
      "https://onenoteonlinesync.onenote.com/onenoteonlinesync/"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/an0n_r0/status/[PII_REDACTED]35193346?s=12
  - https://twitter.com/mrd0x/status/[PII_REDACTED]84844803?s=12
Sigma Detection Rule: Use of VSIISExeLauncher.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-09
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\VSIISExeLauncher.exe"
    },
    {
      "OriginalFileName": "VSIISExeLauncher.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -p ",
      " -a "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VSIISExeLauncher/
Sigma Detection Rule: Suspicious Active Directory Database Snapshot Via ADExplorer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
ATT&CK techniques: T1087.002, T1069.002, T1482
Log source: windows/process_creation

Description:
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database to a suspicious directory. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\ADExp.exe",
        "\\ADExplorer.exe",
        "\\ADExplorer64.exe",
        "\\ADExplorer64a.exe"
      ]
    },
    {
      "OriginalFileName": "AdExp"
    },
    {
      "Description": "Active Directory Editor"
    },
    {
      "Product": "Sysinternals ADExplorer"
    }
  ],
  "selection_flag": {
    "CommandLine|contains": "snapshot"
  },
  "selection_paths": {
    "CommandLine|contains": [
      "\\Downloads\\",
      "\\Users\\Public\\",
      "\\AppData\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
  - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
  - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
  - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
  - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
Sigma Detection Rule: InfDefaultInstall.exe .inf Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "InfDefaultInstall.exe ",
      ".inf"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution
  - https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/
Sigma Detection Rule: Potential Privilege Escalation To LOCAL SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-05-22
ATT&CK techniques: T1587.001
Log source: windows/process_creation

Description:
Detects unknown program using commandline flags usually used by tools such as PsExec and PAExec to start programs with SYSTEM Privileges

Detection logic:
{
  "selection": {
    "CommandLine|contains|windash": [
      " -s cmd",
      " -s -i cmd",
      " -i -s cmd",
      " -s pwsh",
      " -s -i pwsh",
      " -i -s pwsh",
      " -s powershell",
      " -s -i powershell",
      " -i -s powershell"
    ]
  },
  "filter_main_exclude_coverage": {
    "CommandLine|contains": [
      "paexec",
      "PsExec",
      "accepteula"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.poweradmin.com/paexec/
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Sigma Detection Rule: Potentially Suspicious GoogleUpdate Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of "GoogleUpdate.exe"

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\GoogleUpdate.exe"
  },
  "filter_main_known_legit": [
    {
      "Image|contains": "\\Google"
    },
    {
      "Image|endswith": [
        "\\setup.exe",
        "chrome_updater.exe",
        "chrome_installer.exe"
      ]
    }
  ],
  "filter_main_image_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-28
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs.

Detection logic:
{
  "selection_sc": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_sdset": {
    "CommandLine|contains|all": [
      "sdset",
      "A;"
    ]
  },
  "selection_trustee": {
    "CommandLine|contains": [
      ";IU",
      ";SU",
      ";BA",
      ";SY",
      ";WD"
    ]
  },
  "filter_optional_hexnode": {
    "ParentImage": "C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe"
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]37936386
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
Sigma Detection Rule: Sensitive File Access Via Volume Shadow Copy Backup
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit)


Detection logic:
{
  "selection_1": {
    "CommandLine|contains": "\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy"
  },
  "selection_2": {
    "CommandLine|contains": [
      "\\\\NTDS.dit",
      "\\\\SYSTEM",
      "\\\\SECURITY"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]60002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
  - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/
Sigma Detection Rule: Suspicious Program Names
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-11
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

Detection logic:
{
  "selection_image": [
    {
      "Image|contains": [
        "\\CVE-202",
        "\\CVE202"
      ]
    },
    {
      "Image|endswith": [
        "\\poc.exe",
        "\\artifact.exe",
        "\\artifact64.exe",
        "\\artifact_protected.exe",
        "\\artifact32.exe",
        "\\artifact32big.exe",
        "obfuscated.exe",
        "obfusc.exe",
        "\\meterpreter"
      ]
    }
  ],
  "selection_commandline": {
    "CommandLine|contains": [
      "inject.ps1",
      "Invoke-CVE",
      "pupy.ps1",
      "payload.ps1",
      "beacon.ps1",
      "PowerView.ps1",
      "bypass.ps1",
      "obfuscated.ps1",
      "obfusc.ps1",
      "obfus.ps1",
      "obfs.ps1",
      "evil.ps1",
      "MiniDogz.ps1",
      "_enc.ps1",
      "\\shell.ps1",
      "\\rshell.ps1",
      "revshell.ps1",
      "\\av.ps1",
      "\\av_test.ps1",
      "adrecon.ps1",
      "mimikatz.ps1",
      "\\PowerUp_",
      "powerup.ps1",
      "\\Temp\\a.ps1",
      "\\Temp\\p.ps1",
      "\\Temp\\1.ps1",
      "Hound.ps1",
      "encode.ps1",
      "powercat.ps1"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
Sigma Detection Rule: Registry Modification of MS-settings Protocol Handler
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2021-12-20
ATT&CK techniques: T1548.002, T1546.001, T1112
Log source: windows/process_creation

Description:
Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or persistence.
Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path.


Detection logic:
{
  "selection_reg_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_pwsh_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell.exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_reg_cli": {
    "CommandLine|contains": "add"
  },
  "selection_pwsh_cli": {
    "CommandLine|contains": [
      "New-ItemProperty",
      "Set-ItemProperty",
      "ni ",
      "sp "
    ]
  },
  "selection_cli_key": {
    "CommandLine|contains": "\\ms-settings\\shell\\open\\command"
  },
  "condition": "(all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key"
}

References:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
  - https://www.trendmicro.com/en_us/research/25/f/water-curse.html
Sigma Detection Rule: Renamed Cloudflared.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-20
ATT&CK techniques: T1090.001
Log source: windows/process_creation

Description:
Detects the execution of a renamed "cloudflared" binary.

Detection logic:
{
  "selection_cleanup": {
    "CommandLine|contains|all": [
      " tunnel ",
      "cleanup "
    ],
    "CommandLine|contains": [
      "-config ",
      "-connector-id "
    ]
  },
  "selection_tunnel": {
    "CommandLine|contains|all": [
      " tunnel ",
      " run "
    ],
    "CommandLine|contains": [
      "-config ",
      "-credentials-contents ",
      "-credentials-file ",
      "-token "
    ]
  },
  "selection_accountless": {
    "CommandLine|contains|all": [
      "-url",
      "tunnel"
    ]
  },
  "selection_hashes": {
    "Hashes|contains": [
      "SHA256=2fb6c04c4f95fb8d158af94c137f90ac820716deaf88d8ebec956254e046cb29",
      "SHA256=b3d21940a10fdef5e415ad70331ce257c24fe3bcf[PII_REDACTED]e0421791f87e8",
      "SHA256=1fbd8362b2d2d2e6a5750ae3db69cd1815e6c1d31da48a98b796450971a8e039",
      "SHA256=0409c9b12f9d0eda86e461ed9bdabeefb00172b[PII_REDACTED]1a0bdf48e68dc28",
      "SHA256=7cfb411d04bac42ef93d1f0c93c0a481e38c6f4612b97ae89d[PII_REDACTED]edc7",
      "SHA256=5b3c2d846ab162dc6bc595cce3a49de5731afde5d6060be7066d21b013a28373",
      "SHA256=ce95df7f69664c3df19b76028e115931919a71517b776da7b42d353e2ff4a670",
      "SHA256=1293525a19cfe3bc8296b62fbfe19f083632ed644a1c18c10b045a1d3030d81a",
      "SHA256=af2b9161cfcb654b16408cd6b098afe9d1fb61a037d18d7090a119d4c0c8e0f0",
      "SHA256=39ddceb56a15798826a5fc4892fa2b474c444bb4d7a8bf2fa95e41cab10fa7a1",
      "SHA256=ccd11f2328023a0e7929e845d5b6e7bc783fb4650d65faef3ae090239d4bbce2",
      "SHA256=b6e5c5d2567ae8c69cc012ebca

References:
  - https://github.com/cloudflare/cloudflared/releases
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
  - https://github.com/cloudflare/cloudflared
  - https://www.intrinsec.com/akira_ransomware/
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/