deardaniel/secdata-raw huggingface dataset:
Elastic SIEM Detection Rules: rundll32 execution aggregated by cmdline

# Rundll32 Execution Aggregated by Command Line

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt aggregate Rundll32 execution by normalized `process.command_line` and returns instances that are unique by frequency. Rundll32 is one of the most abused binaries to proxy execution of malicious commands and modules.

- **UUID:** `44e6adc6-e183-4bfa-b06d-db41669641fa`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows), [system](https://docs.elastic.co/integrations/system)
- **Language:** `[ES|QL]`
- **Source File:** [Rundll32 Execution Aggregated by Command Line](../queries/rundll32_execution_aggregated_by_cmdline.toml)

## Query

```sql
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "process" and event.action in ("start", "Process creation", "created-process") and
  to_lower(process.name) == "rundll32.exe" and
  not process.command_line rlike """.*(zzzzInvokeManagedCustomActionOutOfProc|GeneralTel.dll,RunInUserCxt|ShOpenVerbApplication|davclnt.dll,DavSetCookie|FileProtocolHandler|EDGEHTML.dll|FirewallControlPanel.dll,ShowNotificationDialog|printui.dll,PrintUIEntryDPIAware|Program Files|SHCreateLocalServerRunDll|ImageView_Fullscreen|StatusMonitorEntryPoint|Control_RunDLL|HotPlugSafeRemovalDriveNotification|AppxDeploymentClient.dll|acproxy.dll,PerformAutochkOperations|CapabilityAccessManagerDoStoreMaintenance|dfshim.dll|display.dll,ShowAdapterSettings|ForceProxyDetectionOnNextRun|PfSvWsSwapAssessmentTask|acmigration.dll,ApplyMigrationShims|LenovoBatteryGaugePackage.dll|-localserver|DriverStore|CnmDxPEntryPoint|DeferredDelete|DeviceProperties_RunDLL|AppxDeploymentClient.dll|spool\\DRIVERS|printui.dll,PrintUIEntry|DfdGetDefaultPolicyAndSMART|cryptext.dll,CryptExt|WininetPlugin.dll|ClearMyTracksByProcess|SusRunTask|OpenURL|CleanupTemporaryState).*"""
| keep process.parent.name, process.command_line, host.id
| eval cmdline = replace(process.command_line, """[cC]:\\[uU][sS][eE][rR][sS]\\[a-zA-Z0-9\.\-\_\$~ ]+\\""", "C:\\\\users\\\\user\\\\")
| eval cmdline = replace(cmdline, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")
| stats hosts =count_distinct(host.id), total = count() by cmdline, process.parent.name
| where hosts == 1
```

## Notes

- Execution of DLLs from suspicious paths or with suspicious export function names or from suspicious parent should be further reviewed.
- Parents such as svchost, `explorer.exe`, `wmiprvse.exe`, `winword.exe` and others should be carefully reviewed.

## MITRE ATT&CK Techniques

- [T1127](https://attack.mitre.org/techniques/T1127)
- [T1218](https://attack.mitre.org/techniques/T1218)
- [T1218.011](https://attack.mitre.org/techniques/T1218/011)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: suspicious base64 encoded powershell commands

# Suspicious Base64 Encoded Powershell Command

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies base64 encoded powershell commands in process start events and filters ones with suspicious keywords like downloaders and evasion related commands.

- **UUID:** `2e583d3c-7ad6-4544-a0db-c685b2066493`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows), [system](https://docs.elastic.co/integrations/system)
- **Language:** `[ES|QL]`
- **Source File:** [Suspicious Base64 Encoded Powershell Command](../queries/suspicious_base64_encoded_powershell_commands.toml)

## Query

```sql
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*
| where host.os.type == "windows" and event.category == "process" and event.type == "start" and TO_LOWER(process.name) == "powershell.exe" and process.command_line rlike ".+ -(e|E).*"
| keep agent.id, process.command_line
 /* simplified regex to extract base64 encoded blob */
| grok process.command_line """(?<base64_data>([A-Za-z0-9+/]+={1,2}$|[A-Za-z0-9+/]{100,}))"""
| where base64_data is not null
 /* base64 decode added in 8.14 */
| eval decoded_base64_cmdline = replace(TO_LOWER(FROM_BASE64(base64_data)), """\u0000""", "")
 /* most common suspicious keywords, you can add more patterns here */
| where decoded_base64_cmdline rlike """.*(http|webclient|download|mppreference|sockets|bxor|.replace|reflection|assembly|load|bits|start-proc|iwr|frombase64).*"""
| keep agent.id, process.command_line, decoded_base64_cmdline
```

## Notes

- This hunt can be expanded to include more evasion techniques and downloaders.
- Pivoting by `agent.id` can provide more context on the affected hosts.

## MITRE ATT&CK Techniques

- [T1059](https://attack.mitre.org/techniques/T1059)
- [T1059.001](https://attack.mitre.org/techniques/T1059/001)
- [T1027](https://attack.mitre.org/techniques/T1027)
- [T1027.010](https://attack.mitre.org/techniques/T1027/010)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: pe file transfer via smb admin shares by agent

# PE File Transfer via SMB_Admin Shares by Agent or User

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt looks for a high number of executable file transfers via the SMB protocol by the same user or agent to more than a defined maxium threshold of targets. This could be a sign of lateral movement via the Windows Admin Shares.

- **UUID:** `814894a4-c951-4f33-ab0b-09354e1cb957`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [PE File Transfer via SMB_Admin Shares by Agent or User](../queries/pe_file_transfer_via_smb_admin_shares_by_agent.toml)

## Query

```sql
from logs-endpoint.events.file-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "file" and event.action != "deletion" and process.pid == 4 and
  starts_with(file.Ext.header_bytes, "4d5a*") and (starts_with(user.id, "S-1-5-21-") or starts_with(user.id, "S-1-12-1-"))
| stats agents = count_distinct(host.id), total = count(*) by user.name
| where agents == 1 and total <= 3
```

```sql
from logs-endpoint.events.file-*
| where  @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "file" and event.action != "deletion" and process.pid == 4 and
  starts_with(file.Ext.header_bytes, "4d5a*") and (starts_with(user.id, "S-1-5-21-") or starts_with(user.id, "S-1-12-1-"))
| stats agents = count_distinct(host.id), total = count(*) by user.name
 /* threshold set to 10 but can be adjusted to reduce normal baseline in your env */
| where agents >= 10
```

## Notes

- Further investigation can done pivoting by `host.id` and `user.name`.

## MITRE ATT&CK Techniques

- [T1021](https://attack.mitre.org/techniques/T1021)
- [T1021.002](https://attack.mitre.org/techniques/T1021/002)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: network discovery via sensitive ports by unusual process

# Network Discovery via Sensitive Ports by Unusual Process

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt looks for either processes connecting to multiple sensitive TCP ports (SMB, RDP, LDAP, Kerberos and ADWS), a high number of SMB/RDP connections to unique destinations or the same process connecting to both RDP and SMB (should be rare).

- **UUID:** `386f9cec-bb44-4dd2-8368-45e6fa0a425b`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Network Discovery via Sensitive Ports by Unusual Process](../queries/network_discovery_via_sensitive_ports_by_unusual_process.toml)

## Query

```sql
from logs-endpoint.events.network-*, logs-windows.sysmon_operational-*
| where @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "network" and network.direction == "egress" and
  network.transport == "tcp"and destination.port in (3389, 445, 389, 9389, 88, 5985, 5986, 22) and source.port >= 49152 and
  process.pid != 4
| keep process.executable, destination.port, destination.ip, process.entity_id
 /* network events with SMB or RDP as a target */
| eval smb_dip = case(destination.port == 445, destination.ip, null), rdp_dip = case(destination.port == 389, destination.ip, null)
 /* unique count by destination.port, number of distinct SMB and RDP destinations */
| stats count_unique_ports = count_distinct(destination.port), count_smb_dst =  count_distinct(smb_dip), count_rdp_dst =  count_distinct(rdp_dip) by process.entity_id, process.executable
| where count_unique_ports >= 3 or count_rdp_dst >= 10 or count_smb_dst >= 10 or (count_rdp_dst >= 1 and count_rdp_dst >= 1)
```

## Notes

- The query thresholds for SMB or RDP need to be adjusted to your environment.
- You can add more sensitive ports to the list like FTP, SSH and others.
- Elastic Network events include process code signature information, this can be added to filter out signed third party false positives.

## MITRE ATT&CK Techniques

- [T1021](https://attack.mitre.org/techniques/T1021)
- [T1021.002](https://attack.mitre.org/techniques/T1021/002)
- [T1021.001](https://attack.mitre.org/techniques/T1021/001)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: detect masquerading attempts as native windows binaries

# Masquerading Attempts as Native Windows Binaries

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt detects processes named as legit Microsoft native binaries located in the system32 folder. Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. 
- **UUID:** `a2006c66-d6ab-43ee-871e-d650e38f7972`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Masquerading Attempts as Native Windows Binaries](../queries/detect_masquerading_attempts_as_native_windows_binaries.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where  @timestamp > NOW() - 7 day
| where event.type == "start" and event.action == "start" and host.os.name == "Windows" and not starts_with(process.executable, "C:\\Program Files\\WindowsApps\\") and not starts_with(process.executable, "C:\\Windows\\System32\\DriverStore\\") and process.name != "setup.exe"
| keep process.name.caseless, process.executable.caseless, process.code_signature.subject_name, process.code_signature.trusted, process.code_signature.exists, host.id
 /* system_bin contain Microsoft signed and located in system32 folder process names */
 /* non_system_bin contain non Microsoft signed process names */
| eval system_bin = case(starts_with(process.executable.caseless, "c:\\windows\\system32") and starts_with(process.code_signature.subject_name, "Microsoft") and process.code_signature.trusted == true, process.name.caseless, null), non_system_bin = case(process.code_signature.exists == false or process.code_signature.trusted != true or not starts_with(process.code_signature.subject_name, "Microsoft"), process.name.caseless, null)
 /* aggregate unique process name counts  by process.name and host.id */
| stats count_system_bin = count(system_bin), count_non_system_bin = count(non_system_bin) by process.name.caseless, host.id
 /* filter where the same process.name is present in both system_bin and non_system_bin */
| where count_system_bin >= 1 and count_non_system_bin >= 1
```

## Notes

- Output of the query is the `process.name` and `host.id` where you can pivot by `host.id` and `process.name` (non Microsoft signed) to find the specific suspicious instances.
- Potential false-positives include processes with missing code signature details due to enrichment bugs.
- The queried index must capture process start events with code signature information (e.g. Windows event 4688 is not supported).

## MITRE ATT&CK Techniques

- [T1036](https://attack.mitre.org/techniques/T1036)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: detect rare lsass process access attempts

# Rare LSASS Process Access Attempts

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt identifies instances where a process attempts to open the Local Security Authority Subsystem Service (LSASS) memory and where the number of occurrences is limited to one unique agent and a low number of attempts. This may indicate either a rare legitimate condition or a malicious process attempting to obtain credentials or inject code into the LSASS.

- **UUID:** `d0aed6f5-f84c-4da8-bb2a-b5ca0fbb55e0`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Rare LSASS Process Access Attempts](../queries/detect_rare_lsass_process_access_attempts.toml)

## Query

```sql
from logs-endpoint.events.api*
| where  @timestamp > NOW() - 7 day
| where event.category == "api" and host.os.family == "windows" and process.Ext.api.name in ("OpenProcess", "OpenThread", "ReadProcessMemory") and
 Target.process.name == "lsass.exe"
| keep process.executable.caseless, host.id
 /* normalize process paths to reduce known random patterns in process.executable */
| eval process = replace(process.executable.caseless, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")
| stats occurrences = count(process), agents = count_distinct(host.id) by process
| where agents == 1 and occurrences <= 10
```

```sql
from logs-windows.sysmon_operational-*
| where  @timestamp > NOW() - 7 day
| where event.category == "process" and host.os.family == "windows" and event.action == "ProcessAccess" and
  winlog.event_data.TargetImage in ("C:\\Windows\\system32\\lsass.exe", "c:\\Windows\\system32\\lsass.exe", "c:\\Windows\\System32\\lsass.exe")
| keep process.executable, host.id
 /* normalize process paths to reduce known random patterns in process.executable */
| eval process_path = replace(process.executable, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")
| eval process_path = replace(process_path, """[cC]:\\[uU][sS][eE][rR][sS]\\[a-zA-Z0-9\.\-\_\$~]+\\""", "C:\\\\users\\\\user\\\\")
| stats occurrences = count(process_path), agents = count_distinct(host.id) by process_path
| where agents == 1 and occurrences <= 10
```

## Notes

- Based on the process.executable and process.name you can pivot and investigate further for the matching instances.
- Potential false-positives include rare legitimate conditions that may trigger this behavior due to third-party software or LSASS crashing.

## MITRE ATT&CK Techniques

- [T1003](https://attack.mitre.org/techniques/T1003)
- [T1003.001](https://attack.mitre.org/techniques/T1003/001)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: drivers load with low occurrence frequency

# Low Occurrence of Drivers Loaded on Unique Hosts

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt helps identify drivers loaded once on a unique host and with a unique hash over a 15 day period of time. Advanced adversaries may leverage legit vulnerable driver to tamper with existing defences or execute code in Kernel mode.

- **UUID:** `cebfbb4d-5b2a-44d8-b763-5512b654fb26`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint), [windows](https://docs.elastic.co/integrations/windows), [system](https://docs.elastic.co/integrations/system)
- **Language:** `[ES|QL]`
- **Source File:** [Low Occurrence of Drivers Loaded on Unique Hosts](../queries/drivers_load_with_low_occurrence_frequency.toml)

## Query

```sql
from logs-endpoint.events.library-*
| where @timestamp > now() - 15 day
| where host.os.family == "windows" and event.category == "driver" and event.action == "load" and dll.Ext.relative_file_creation_time <= 900
| stats host_count = count_distinct(host.id), total_count = count(*), hash_count = count_distinct(dll.hash.sha256) by dll.name, dll.pe.imphash
| where host_count == 1 and total_count == 1 and hash_count == 1
```

```sql
from logs-windows.sysmon_operational-*
| where @timestamp > now() - 15 day
| where host.os.family == "windows" and event.category == "driver"
| stats host_count = count_distinct(host.id), total_count = count(*), hash_count = count_distinct(file.hash.sha256) by file.name
| where host_count == 1 and total_count == 1 and hash_count == 1
```

```sql
from logs-system.system-*
| where  @timestamp > now() - 15day
| where host.os.family == "windows" and event.code == "7045" and
  winlog.event_data.ServiceType == "kernel mode driver"
| eval ServiceFileName = replace(winlog.event_data.ImagePath, """([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|ns[a-z][A-Z0-9]{3,4}\.tmp|DX[A-Z0-9]{3,4}\.tmp|7z[A-Z0-9]{3,5}\.tmp|[0-9\.\-\_]{3,})""", "")
| eval ServiceFileName = replace(ServiceFileName, """.inf_amd[a-z0-9]{5,}\\""", "_replaced_")
| eval ServiceFileName = replace(ServiceFileName, """[cC]:\\[uU][sS][eE][rR][sS]\\[a-zA-Z0-9ñ\.\-\_\$~ ]+\\""", "C:\\\\users\\\\user\\\\")
| stats cc = count(*), hosts = count_distinct(host.id) by ServiceFileName
| where hosts == 1 and cc == 1
```

## Notes

- This hunt has three optional queries, one for Elastic Defend data, another for Sysmon data and the last one for Windows 7045 events.
- Further investigation can be done pivoting by `dll.pe.imphash` or `dll.name.`
- `dll.Ext.relative_file_creation_time` is used in the first query to limit the result to recently dropped drivers (populated in Elastic Defend).
- Aggregation can also be done by `dll.hash.sha256` / `file.hash.sha256` but will return more results.
- Bring Your Own Vulnerable Driver (BYOVD) are all signed and not malicious, further investigation should be done to check the surrounding events (service creation, process that dropped the driver etc.).

## MITRE ATT&CK Techniques

- [T1068](https://attack.mitre.org/techniques/T1068)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: execution via network logon by occurrence frequency by top source ip

# Frequency of Process Execution via Network Logon by Source Address

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt aggregates process execution and remote network logons by source address, account name and process hash. It then limits the results by unique host within a 7 day period. This may indicate lateral movement via remote services.

- **UUID:** `24108755-4d1f-4d7a-ad5f-04c2ca55e9a3`
- **Integration:** [endpoint](https://docs.elastic.co/integrations/endpoint)
- **Language:** `[ES|QL]`
- **Source File:** [Frequency of Process Execution via Network Logon by Source Address](../queries/execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.toml)

## Query

```sql
from logs-endpoint.events.process-*
| where  @timestamp > now() - 7 day and host.os.family == "windows" and
  event.category == "process" and event.action == "start" and
  /* network logon type and the execution is within 30 seconds of the logon time */
  process.Ext.session_info.logon_type == "Network" and process.Ext.session_info.relative_logon_time <= 30
| stats total = count(*) by process.Ext.session_info.client_address, user.name
 /* sort by top source.ip and account */
| sort total desc
```

```sql
from logs-endpoint.events.process-*
| where  @timestamp > now() - 7 day and host.os.family == "windows" and
  event.category == "process" and event.action == "start" and
  /* network logon type and the execution is within 30 seconds of the logon time */
  process.Ext.session_info.logon_type == "Network" and process.Ext.session_info.relative_logon_time <= 30
| stats total = count(*), hosts = count_distinct(host.id) by process.hash.sha256, process.Ext.session_info.client_address, user.name, process.parent.name
 /* unique hash limited to one host and number of execution is 1 */
| where  hosts == 1 and total == 1
```

## Notes

- The second query highest occurrence of source addresses/accounts performing remote process execution
- `process.Ext.session_info.*` is populated for Elastic Defend versions 8.6.0+ and above.
- Execution via legitimate Microsoft processes for PowerShell and cmd need to be further investigated via aggregation by `process.command_line`.
- Aggregation can be also done by `process.executable`, normalizing process path by removing random patterns using the ES|QL REPLACE function.

## MITRE ATT&CK Techniques

- [T1021](https://attack.mitre.org/techniques/T1021)

## License

- `Elastic License v2`
Elastic SIEM Detection Rules: createremotethread by source process with low occurrence

# Low Occurrence Rate of CreateRemoteThread by Source Process

---

## Metadata

- **Author:** Elastic
- **Description:** This hunt attempts to identify remote process injection by aggregating Sysmon `CreateRemoteThread` events by source process and returns the ones that we observed in only one unique host.
- **UUID:** `4f878255-53b8-4914-9a7d-4b668bd2ea6a`
- **Integration:** [windows](https://docs.elastic.co/integrations/windows)
- **Language:** `[ES|QL]`
- **Source File:** [Low Occurrence Rate of CreateRemoteThread by Source Process](../queries/createremotethread_by_source_process_with_low_occurrence.toml)

## Query

```sql
from logs-windows.sysmon_operational-*
| where @timestamp > now() - 7 day
| where host.os.family == "windows" and event.category == "process" and event.action == "CreateRemoteThread"
| eval source_process = replace(process.executable, """[cC]:\\[uU][sS][eE][rR][sS]\\[a-zA-Z0-9ñ\.\-\_\$~ ]+\\""", "C:\\\\users\\\\user\\\\")
| stats cc = count(*), hosts = count_distinct(host.id) by source_process
 /* unique source and target processes combined and observed in 1 host */
| where hosts == 1 and cc == 1
```

## Notes

- Adding `winlog.event_data.TargetImage` to the aggregation clause can be beneficial but may introduce more false-positives.

## MITRE ATT&CK Techniques

- [T1055](https://attack.mitre.org/techniques/T1055)

## License

- `Elastic License v2`