deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Security Tools Keyword Lookup Via Findstr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2023-10-20
ATT&CK techniques: T1518.001
Log source: windows/process_creation

Description:
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\find.exe",
        "\\findstr.exe"
      ]
    },
    {
      "OriginalFileName": [
        "FIND.EXE",
        "FINDSTR.EXE"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      " avira",
      " avira\"",
      " cb",
      " cb\"",
      " cylance",
      " cylance\"",
      " defender",
      " defender\"",
      " kaspersky",
      " kaspersky\"",
      " kes",
      " kes\"",
      " mc",
      " mc\"",
      " sec",
      " sec\"",
      " sentinel",
      " sentinel\"",
      " symantec",
      " symantec\"",
      " virus",
      " virus\""
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
  - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
Sigma Detection Rule: Monitoring For Persistence Via BITS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-10-29
ATT&CK techniques: T1197
Log source: windows/process_creation

Description:
BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished.
When the job runs on the system the command specified in the BITS job will be executed.
This can be abused by actors to create a backdoor within the system and for persistence.
It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_cli_notify_1": {
    "CommandLine|contains": "/SetNotifyCmdLine"
  },
  "selection_cli_notify_2": {
    "CommandLine|contains": [
      "%COMSPEC%",
      "cmd.exe",
      "regsvr32.exe"
    ]
  },
  "selection_cli_add_1": {
    "CommandLine|contains": "/Addfile"
  },
  "selection_cli_add_2": {
    "CommandLine|contains": [
      "http:",
      "https:",
      "ftp:",
      "ftps:"
    ]
  },
  "condition": "selection_img and (all of selection_cli_notify_* or all of selection_cli_add_*)"
}

References:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
  - http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html
  - https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394
Sigma Detection Rule: Suspicious PowerShell Parent Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Harish Segar
Date: 2020-03-20
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects a suspicious or uncommon parent processes of PowerShell

Detection logic:
{
  "selection_parent": [
    {
      "ParentImage|contains": "tomcat"
    },
    {
      "ParentImage|endswith": [
        "\\amigo.exe",
        "\\browser.exe",
        "\\chrome.exe",
        "\\firefox.exe",
        "\\httpd.exe",
        "\\iexplore.exe",
        "\\jbosssvc.exe",
        "\\microsoftedge.exe",
        "\\microsoftedgecp.exe",
        "\\MicrosoftEdgeSH.exe",
        "\\mshta.exe",
        "\\nginx.exe",
        "\\outlook.exe",
        "\\php-cgi.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\safari.exe",
        "\\services.exe",
        "\\sqlagent.exe",
        "\\sqlserver.exe",
        "\\sqlservr.exe",
        "\\vivaldi.exe",
        "\\w3wp.exe"
      ]
    }
  ],
  "selection_powershell": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "CommandLine|contains": [
        "/c powershell",
        "/c pwsh"
      ]
    },
    {
      "Description": "Windows PowerShell"
    },
    {
      "Product": "PowerShell Core 6"
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26
Sigma Detection Rule: Import PowerShell Modules From Suspicious Directories - ProcCreation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-10
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects powershell scripts that import modules from suspicious directories

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Import-Module \"$Env:Temp\\",
      "Import-Module '$Env:Temp\\",
      "Import-Module $Env:Temp\\",
      "Import-Module \"$Env:Appdata\\",
      "Import-Module '$Env:Appdata\\",
      "Import-Module $Env:Appdata\\",
      "Import-Module C:\\Users\\Public\\",
      "ipmo \"$Env:Temp\\",
      "ipmo '$Env:Temp\\",
      "ipmo $Env:Temp\\",
      "ipmo \"$Env:Appdata\\",
      "ipmo '$Env:Appdata\\",
      "ipmo $Env:Appdata\\",
      "ipmo C:\\Users\\Public\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md
Sigma Detection Rule: Insecure Proxy/DOH Transfer Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-27
Log source: windows/process_creation

Description:
Detects execution of "curl.exe" with the "insecure" flag over proxy or DOH.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "--doh-insecure",
      "--proxy-insecure"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://curl.se/docs/manpage.html
Sigma Detection Rule: UAC Bypass Using Event Viewer RecentViews
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-22
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using Event Viewer RecentViews

Detection logic:
{
  "selection_path": {
    "CommandLine|contains": [
      "\\Event Viewer\\RecentViews",
      "\\EventV~1\\RecentViews"
    ]
  },
  "selection_redirect": {
    "CommandLine|contains": ">"
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/orange_8361/status/[PII_REDACTED]68626944
  - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
Sigma Detection Rule: Tamper Windows Defender Remove-MpPreference
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects attempts to remove Windows Defender configurations using the 'MpPreference' cmdlet

Detection logic:
{
  "selection_remove": {
    "CommandLine|contains": "Remove-MpPreference"
  },
  "selection_tamper": {
    "CommandLine|contains": [
      "-ControlledFolderAccessProtectedFolders ",
      "-AttackSurfaceReductionRules_Ids ",
      "-AttackSurfaceReductionRules_Actions ",
      "-CheckForSignaturesBeforeRunningScan "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
Sigma Detection Rule: Potential Encoded PowerShell Patterns In CommandLine
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Date: 2020-10-11
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects specific combinations of encoding methods in PowerShell via the commandline

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_to_1": {
    "CommandLine|contains": [
      "ToInt",
      "ToDecimal",
      "ToByte",
      "ToUint",
      "ToSingle",
      "ToSByte"
    ]
  },
  "selection_to_2": {
    "CommandLine|contains": [
      "ToChar",
      "ToString",
      "String"
    ]
  },
  "selection_gen_1": {
    "CommandLine|contains|all": [
      "char",
      "join"
    ]
  },
  "selection_gen_2": {
    "CommandLine|contains|all": [
      "split",
      "join"
    ]
  },
  "condition": "selection_img and (all of selection_to_* or 1 of selection_gen_*)"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
Sigma Detection Rule: HackTool - GMER Rootkit Detector and Remover Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-05
Log source: windows/process_creation

Description:
Detects the execution GMER tool based on image and hash fields.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\gmer.exe"
  },
  "selection_sysmon_hash": {
    "Hashes|contains": [
      "MD5=E9DC058440D321AA17D0600B3CA0AB04",
      "SHA1=539C228B6B332F5AA523E5CE358C16647D8BBE57",
      "SHA256=E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB[PII_REDACTED]"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - http://www.gmer.net/
Sigma Detection Rule: HackTool - RedMimicry Winnti Playbook Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Alexander Rausch
Date: 2020-06-24
ATT&CK techniques: T1106, T1059.003, T1218.011
Log source: windows/process_creation

Description:
Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\rundll32.exe",
      "\\cmd.exe"
    ],
    "CommandLine|contains": [
      "gthread-3.6.dll",
      "\\Windows\\Temp\\tmp.bat",
      "sigcmm-2.4.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://redmimicry.com/posts/redmimicry-winnti/
Sigma Detection Rule: Java Running with Remote Debugging
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1203
Log source: windows/process_creation

Description:
Detects a JAVA process running with remote debugging allowing more than just localhost to connect

Detection logic:
{
  "selection_jdwp_transport": {
    "CommandLine|contains": "transport=dt_socket,address="
  },
  "selection_old_jvm_version": {
    "CommandLine|contains": [
      "jre1.",
      "jdk1."
    ]
  },
  "exclusion": {
    "CommandLine|contains": [
      "address=127.0.0.1",
      "address=localhost"
    ]
  },
  "condition": "all of selection_* and not exclusion"
}

References:
  - https://dzone.com/articles/remote-debugging-java-applications-with-jdwp
Sigma Detection Rule: Lsass Memory Dump via Comsvcs DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-20
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "SourceImage|endswith": "\\rundll32.exe",
    "CallTrace|contains": "comsvcs.dll"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/shantanukhande/status/[PII_REDACTED]98388484
  - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
Sigma Detection Rule: Potentially Suspicious GrantedAccess Flags On LSASS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth, Roberto Rodriguez, Dimitrios Slamaris, Mark Russinovich, Thomas Patzke, Teymur Kheirkhabarov, Sherif Eldeeb, James Dickenson, Aleksey Potapov, oscd.community
Date: 2021-11-22
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects process access requests to LSASS process with potentially suspicious access flags

Detection logic:
{
  "selection_target": {
    "TargetImage|endswith": "\\lsass.exe"
  },
  "selection_access": [
    {
      "GrantedAccess|endswith": [
        "30",
        "50",
        "70",
        "90",
        "B0",
        "D0",
        "F0",
        "18",
        "38",
        "58",
        "78",
        "98",
        "B8",
        "D8",
        "F8",
        "1A",
        "3A",
        "5A",
        "7A",
        "9A",
        "BA",
        "DA",
        "FA",
        "0x14C2"
      ]
    },
    {
      "GrantedAccess|startswith": [
        "0x100000",
        "0x1418",
        "0x1438",
        "0x143a",
        "0x1f0fff",
        "0x1f1fff",
        "0x1f2fff",
        "0x1f3fff",
        "0x40"
      ]
    }
  ],
  "filter_main_generic": {
    "SourceImage|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_malwarebytes": {
    "SourceImage|endswith": ":\\ProgramData\\MALWAREBYTES\\MBAMSERVICE\\ctlrupdate\\mbupdatr.exe"
  },
  "filter_optional_vscode": {
    "SourceImage|endswith": "\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
  },
  "filter_main_windefend_1": {
    "SourceImage|contains": ":\\ProgramData\\Microsoft\\Windows Defender\\",
    "SourceImage|endswith": "\\MsMpEng.exe"
  },
  "filter_main_windefend_2": {
    "CallTrace|contains|all": [
      "|?:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\{",
      "}\\mpengine.dll+"
   

References:
  - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
  - https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
  - https://web.archive.org/web/[PII_REDACTED]3920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://web.archive.org/web/[PII_REDACTED]3146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
Sigma Detection Rule: Potential Direct Syscall of NtOpenProcess
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christian Burkard (Nextron Systems), Tim Shelton (FP)
Date: 2021-07-28
ATT&CK techniques: T1106
Log source: windows/process_access

Description:
Detects potential calls to NtOpenProcess directly from NTDLL.

Detection logic:
{
  "selection": {
    "CallTrace|startswith": "UNKNOWN"
  },
  "filter_main_vcredist": {
    "TargetImage|endswith": "vcredist_x64.exe",
    "SourceImage|endswith": "vcredist_x64.exe"
  },
  "filter_main_generic": {
    "SourceImage|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\WinSxS\\"
    ],
    "TargetImage|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\WinSxS\\"
    ]
  },
  "filter_main_kerneltrace_edge": {
    "Provider_Name": "Microsoft-Windows-Kernel-Audit-API-Calls"
  },
  "filter_optional_vmware": {
    "TargetImage|endswith": ":\\Windows\\system32\\systeminfo.exe",
    "SourceImage|endswith": "setup64.exe"
  },
  "filter_optional_cylance": {
    "SourceImage|endswith": ":\\Windows\\Explorer.EXE",
    "TargetImage|endswith": ":\\Program Files\\Cylance\\Desktop\\CylanceUI.exe"
  },
  "filter_optional_amazon": {
    "SourceImage|endswith": "AmazonSSMAgentSetup.exe",
    "TargetImage|endswith": "AmazonSSMAgentSetup.exe"
  },
  "filter_optional_vscode": {
    "SourceImage|endswith": "\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe",
    "TargetImage|endswith": "\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
  },
  "filter_optional_teams": {
    "TargetImage|endswith": "\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
    "S

References:
  - https://medium.com/falconforce/falconfriday-direct-system-calls-and-cobalt-strike-bofs-0xff14-741fa8e1bdd6
Sigma Detection Rule: Uncommon Process Access Rights For Target Image
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-05-27
ATT&CK techniques: T1055.011
Log source: windows/process_access

Description:
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.


Detection logic:
{
  "selection": {
    "TargetImage|endswith": [
      "\\calc.exe",
      "\\calculator.exe",
      "\\mspaint.exe",
      "\\notepad.exe",
      "\\ping.exe",
      "\\wordpad.exe",
      "\\write.exe"
    ],
    "GrantedAccess": "0x1FFFFF"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
Sigma Detection Rule: Potential Credential Dumping Activity Via LSASS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden, Michael Haag
Date: 2019-04-03
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects process access requests to the LSASS process with specific call trace calls and access masks.
This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature.


Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "GrantedAccess|contains": [
      "0x1038",
      "0x1438",
      "0x143a",
      "0x1fffff"
    ],
    "CallTrace|contains": [
      "dbgcore.dll",
      "dbghelp.dll",
      "kernel32.dll",
      "kernelbase.dll",
      "ntdll.dll"
    ]
  },
  "filter_main_system_user": {
    "SourceUser|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "filter_optional_thor": {
    "CallTrace|contains|all": [
      ":\\Windows\\Temp\\asgard2-agent\\",
      "\\thor\\thor64.exe+",
      "|UNKNOWN("
    ],
    "GrantedAccess": "0x103800"
  },
  "filter_optional_sysmon": {
    "SourceImage|endswith": ":\\Windows\\Sysmon64.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
  - https://web.archive.org/web/[PII_REDACTED]3920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md
  - https://research.splunk.com/endpoint/windows_possible_credential_dumping/
Sigma Detection Rule: LSASS Access From Potentially White-Listed Processes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-10
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects a possible process memory dump that uses a white-listed filename like TrolleyExpress.exe as a way to dump the LSASS process memory without Microsoft Defender interference


Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "SourceImage|endswith": [
      "\\TrolleyExpress.exe",
      "\\ProcessDump.exe",
      "\\dump64.exe"
    ],
    "GrantedAccess|endswith": [
      "10",
      "30",
      "50",
      "70",
      "90",
      "B0",
      "D0",
      "F0",
      "18",
      "38",
      "58",
      "78",
      "98",
      "B8",
      "D8",
      "F8",
      "1A",
      "3A",
      "5A",
      "7A",
      "9A",
      "BA",
      "DA",
      "FA",
      "0x14C2",
      "FF"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/_xpn_/status/[PII_REDACTED]68178176
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
  - https://twitter.com/mrd0x/status/[PII_REDACTED]17251595
Sigma Detection Rule: HackTool - LittleCorporal Generated Maldoc Injection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1204.002, T1055.003
Log source: windows/process_access

Description:
Detects the process injection of a LittleCorporal generated Maldoc.

Detection logic:
{
  "selection": {
    "SourceImage|endswith": "\\winword.exe",
    "CallTrace|contains|all": [
      ":\\Windows\\Microsoft.NET\\Framework64\\v2.",
      "UNKNOWN"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/connormcgarr/LittleCorporal
Sigma Detection Rule: Suspicious Svchost Process Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Burrell
Date: 2020-01-02
ATT&CK techniques: T1685.001
Log source: windows/process_access

Description:
Detects suspicious access to the "svchost" process such as that used by Invoke-Phantom to kill the thread of the Windows event logging service.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": ":\\Windows\\System32\\svchost.exe",
    "GrantedAccess": "0x1F3FFF",
    "CallTrace|contains": "UNKNOWN"
  },
  "filter_main_msbuild": {
    "SourceImage|contains": ":\\Program Files\\Microsoft Visual Studio\\",
    "SourceImage|endswith": "\\MSBuild\\Current\\Bin\\MSBuild.exe",
    "CallTrace|contains": [
      "Microsoft.Build.ni.dll",
      "System.ni.dll"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/hlldz/Invoke-Phant0m
  - https://twitter.com/timbmsft/status/[PII_REDACTED]76214784
Sigma Detection Rule: Function Call From Undocumented COM Interface EditionUpgradeManager
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, Dmitry Uchakin
Date: 2020-10-07
ATT&CK techniques: T1548.002
Log source: windows/process_access

Description:
Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.

Detection logic:
{
  "selection": {
    "CallTrace|contains": "editionupgrademanagerobj.dll"
  },
  "condition": "selection"
}

References:
  - https://www.snip2code.com/Snippet/4397378/UAC-bypass-using-EditionUpgradeManager-C/
  - https://gist.github.com/hfiref0x/de9c[PII_REDACTED]6f5ebf8d9ae2407611
Sigma Detection Rule: Credential Dumping Attempt Via Svchost
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florent Labouyrie
Date: 2021-04-30
ATT&CK techniques: T1548
Log source: windows/process_access

Description:
Detects when a process tries to access the memory of svchost to potentially dump credentials.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\svchost.exe",
    "GrantedAccess": "0x143a"
  },
  "filter_main_known_processes": {
    "SourceImage|endswith": [
      "\\services.exe",
      "\\msiexec.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research