deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Memory Dumping Activity Via LiveKD
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/process_creation

Description:
Detects execution of LiveKD based on PE metadata or image name

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\livekd.exe",
        "\\livekd64.exe"
      ]
    },
    {
      "OriginalFileName": "livekd.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
Sigma Detection Rule: Dynamic .NET Compilation Via Csc.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
Date: 2019-08-24
ATT&CK techniques: T1027.004
Log source: windows/process_creation

Description:
Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\csc.exe"
  },
  "selection_susp_location_1": {
    "CommandLine|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\Temporary Internet",
      "\\Windows\\Temp\\"
    ]
  },
  "selection_susp_location_2": [
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "selection_susp_location_3": {
    "CommandLine|re": "(?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\\\[Aa]pp[Dd]ata\\\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\\\[^\\\\]{1,256}$"
  },
  "filter_main_programfiles": {
    "ParentImage|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\"
    ]
  },
  "filter_main_sdiagnhost": {
    "ParentImage": "C:\\Windows\\System32\\sdiagnhost.exe"
  },
  "filter_main_w3p": {
    "ParentImage": "C:\\Windows\\System32\\inetsrv\\w3wp.exe"
  },
  "filter_optional_chocolatey": {
    "ParentImage": [
      "C:\\ProgramData\\chocolatey\\choco.exe",
      "C:\\ProgramData\\chocolatey\\tools\\shimgen.exe"
    ]
  },
  "filter_optional_defender": {
    "ParentCommandLine|contains": "\\ProgramData\\Microsoft\\Wi

References:
  - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
  - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
  - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]82448897
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe
Sigma Detection Rule: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-14
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\VMwareToolBoxCmd.exe"
    },
    {
      "OriginalFileName": "toolbox-cmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " script ",
      " set "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
  - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
Sigma Detection Rule: Renamed BOINC Client Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matt Anderson (Huntress)
Date: 2024-07-23
ATT&CK techniques: T1553
Log source: windows/process_creation

Description:
Detects the execution of a renamed BOINC binary.

Detection logic:
{
  "selection": {
    "OriginalFileName": "BOINC.exe"
  },
  "filter_main_legit_name": {
    "Image|endswith": "\\BOINC.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://boinc.berkeley.edu/
  - https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
Sigma Detection Rule: Security Privileges Enumeration Via Whoami.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-05
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects a whoami.exe executed with the /priv command line flag instructing the tool to show all current user privileges. This is often used after a privilege escalation attempt.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /priv",
      " -priv"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami
Sigma Detection Rule: SyncAppvPublishingServer Execute Arbitrary PowerShell Code
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SyncAppvPublishingServer.exe"
    },
    {
      "OriginalFileName": "syncappvpublishingserver.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "\"n; "
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
Sigma Detection Rule: Suspicious Extrac32 Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-26
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Download or Copy file with Extrac32

Detection logic:
{
  "selection_lolbas": [
    {
      "CommandLine|contains": "extrac32.exe"
    },
    {
      "Image|endswith": "\\extrac32.exe"
    },
    {
      "OriginalFileName": "extrac32.exe"
    }
  ],
  "selection_archive": {
    "CommandLine|contains": ".cab"
  },
  "selection_options": {
    "CommandLine|contains": [
      "/C",
      "/Y",
      " \\\\\\\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Extrac32/
Sigma Detection Rule: Suspicious UltraVNC Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2022-03-04
ATT&CK techniques: T1021.005
Log source: windows/process_creation

Description:
Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group)

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "-autoreconnect ",
      "-connect ",
      "-id:"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine
  - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution
  - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html
Sigma Detection Rule: PowerShell Base64 Encoded FromBase64String Cmdlet
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-08-24
ATT&CK techniques: T1140, T1059.001
Log source: windows/process_creation

Description:
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Detection logic:
{
  "selection": [
    {
      "CommandLine|base64offset|contains": "::FromBase64String"
    },
    {
      "CommandLine|contains": [
        "OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA",
        "oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA",
        "6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Uncommon Child Process Spawned By Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Harjot Singh @cyb3rjy0t
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects an uncommon child process of "odbcconf.exe" binary which normally shouldn't have any child processes.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\odbcconf.exe"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://medium.com/@cyberjyot/t1218-008-dll-execution-using-odbcconf-exe-803fa9e08dac
Sigma Detection Rule: CMSTP Execution Process Creation
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nik Seetharaman
Date: 2018-07-16
ATT&CK techniques: T1218.003
Log source: windows/process_creation

Description:
Detects various indicators of Microsoft Connection Manager Profile Installer execution

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\cmstp.exe"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
Sigma Detection Rule: MSExchange Transport Agent Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-08
ATT&CK techniques: T1505.002
Log source: windows/process_creation

Description:
Detects the Installation of a Exchange Transport Agent

Detection logic:
{
  "selection": {
    "CommandLine|contains": "Install-TransportAgent"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
Sigma Detection Rule: Suspicious Encoded PowerShell Command Line
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community
Date: 2018-09-03
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_enc": {
    "CommandLine|contains": " -e"
  },
  "selection_cli_content": {
    "CommandLine|contains": [
      " JAB",
      " SUVYI",
      " SQBFAFgA",
      " aQBlAHgA",
      " aWV4I",
      " IAA",
      " IAB",
      " UwB",
      " cwB"
    ]
  },
  "selection_standalone": {
    "CommandLine|contains": [
      ".exe -ENCOD ",
      " BA^J e-"
    ]
  },
  "filter_optional_remote_signed": {
    "CommandLine|contains": " -ExecutionPolicy remotesigned "
  },
  "condition": "selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
Sigma Detection Rule: 7Zip Compressing Dump Files
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-27
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects execution of 7z in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.

Detection logic:
{
  "selection_img": [
    {
      "Description|contains": "7-Zip"
    },
    {
      "Image|endswith": [
        "\\7z.exe",
        "\\7zr.exe",
        "\\7za.exe"
      ]
    },
    {
      "OriginalFileName": [
        "7z.exe",
        "7za.exe"
      ]
    }
  ],
  "selection_extension": {
    "CommandLine|contains": [
      ".dmp",
      ".dump",
      ".hdmp"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: PUA - AdFind Suspicious Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Janantha Marasinghe (https://github.com/blueteam0ps), FPT.EagleEye Team, omkar72, oscd.community
Date: 2021-02-02
ATT&CK techniques: T1018, T1087.002, T1482, T1069.002
Log source: windows/process_creation

Description:
Detects AdFind execution with common flags seen used during attacks

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "domainlist",
      "trustdmp",
      "dcmodes",
      "adinfo",
      "-sc dclist",
      "computer_pwdnotreqd",
      "objectcategory=",
      "-subnets -f",
      "name=\"Domain Admins\"",
      "-sc u:",
      "domainncs",
      "dompol",
      " oudmp ",
      "subnetdmp",
      "gpodmp",
      "fspdmp",
      "users_noexpire",
      "computers_active",
      "computers_pwdnotreqd"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://thedfirreport.com/2020/05/08/adfind-recon/
  - https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
  - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
Sigma Detection Rule: Disable Windows IIS HTTP Logging
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-09
ATT&CK techniques: T1685.001
Log source: windows/process_creation

Description:
Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union)

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\appcmd.exe"
    },
    {
      "OriginalFileName": "appcmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "set",
      "config",
      "section:httplogging",
      "dontLog:true"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.002/T1562.002.md#atomic-test-1---disable-windows-iis-http-logging
Sigma Detection Rule: Invocation of Active Directory Diagnostic Tool (ntdsutil.exe)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Thomas Patzke
Date: 2019-01-16
ATT&CK techniques: T1003.003
Log source: windows/process_creation

Description:
Detects execution of ntdsutil.exe, which can be used for various attacks against the NTDS database (NTDS.DIT)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\ntdsutil.exe"
  },
  "condition": "selection"
}

References:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/ntdsutil.htm
Sigma Detection Rule: Port Forwarding Activity Via SSH.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-12
ATT&CK techniques: T1572, T1021.001, T1021.004
Log source: windows/process_creation

Description:
Detects port forwarding activity via SSH.exe

Detection logic:
{
  "selection": {
    "Image|endswith": "\\ssh.exe",
    "CommandLine|contains|windash": " -R "
  },
  "condition": "selection"
}

References:
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Suspicious Process Masquerading As SvcHost.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-08-07
ATT&CK techniques: T1036.005
Log source: windows/process_creation

Description:
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe"
  },
  "filter_main_img_location": {
    "Image": [
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Windows\\SysWOW64\\svchost.exe"
    ]
  },
  "filter_main_ofn": {
    "OriginalFileName": "svchost.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://tria.ge/240731-jh4crsycnb/behavioral2
  - https://redcanary.com/blog/threat-detection/process-masquerading/
Sigma Detection Rule: Potential Credential Dumping Attempt Using New NetworkProvider - CLI
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-23
ATT&CK techniques: T1003
Log source: windows/process_creation

Description:
Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\System\\CurrentControlSet\\Services\\",
      "\\NetworkProvider"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade
  - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy
Sigma Detection Rule: CodePage Modification Via MODE.COM To Russian Language
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-01-17
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects a CodePage modification using the "mode.com" utility to Russian language.
This behavior has been used by threat actors behind Dharma ransomware.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mode.com"
    },
    {
      "OriginalFileName": "MODE.COM"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " con ",
      " cp ",
      " select="
    ],
    "CommandLine|endswith": [
      "=1251",
      "=866"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/mode
  - https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
  - https://www.virustotal.com/gui/file/5e75ef02517afd6e8ba6462b19217dc4a5a574abb33d10eb0f2bab49d8d48c22/behavior
Sigma Detection Rule: Potential PowerShell Console History Access Attempt via History File
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Luc Génaux
Date: 2025-04-03
ATT&CK techniques: T1552.001
Log source: windows/process_creation

Description:
Detects potential access attempts to the PowerShell console history directly via history file (ConsoleHost_history.txt).
This can give access to plaintext passwords used in PowerShell commands or used for general reconnaissance.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "ConsoleHost_history.txt",
      "(Get-PSReadLineOption).HistorySavePath"
    ]
  },
  "condition": "selection"
}

References:
  - https://0xdf.gitlab.io/2018/11/08/powershell-history-file.html
Sigma Detection Rule: Malicious Base64 Encoded PowerShell Keywords in Command Lines
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: John Lambert (rule)
Date: 2019-01-16
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects base64 encoded strings used in hidden malicious PowerShell command lines

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_hidden": {
    "CommandLine|contains": " hidden "
  },
  "selection_encoded": {
    "CommandLine|contains": [
      "AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA",
      "aXRzYWRtaW4gL3RyYW5zZmVy",
      "IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA",
      "JpdHNhZG1pbiAvdHJhbnNmZX",
      "YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg",
      "Yml0c2FkbWluIC90cmFuc2Zlc",
      "AGMAaAB1AG4AawBfAHMAaQB6AGUA",
      "JABjAGgAdQBuAGsAXwBzAGkAegBlA",
      "JGNodW5rX3Npem",
      "QAYwBoAHUAbgBrAF8AcwBpAHoAZQ",
      "RjaHVua19zaXpl",
      "Y2h1bmtfc2l6Z",
      "AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A",
      "kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg",
      "lPLkNvbXByZXNzaW9u",
      "SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA",
      "SU8uQ29tcHJlc3Npb2",
      "Ty5Db21wcmVzc2lvb",
      "AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ",
      "kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA",
      "lPLk1lbW9yeVN0cmVhb",
      "SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A",
      "SU8uTWVtb3J5U3RyZWFt",
      "Ty5NZW1vcnlTdHJlYW",
      "4ARwBlAHQAQwBoAHUAbgBrA",
      "5HZXRDaHVua",
      "AEcAZQB0AEMAaAB1AG4Aaw",
      "LgBHAGUAdABDAGgAdQBuAGsA",
      "LkdldENodW5r",
      "R2V0Q2h1bm",
      "AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A",
      "QASABSAEUAQQBEAF8ASQBOAE

References:
  - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/
Sigma Detection Rule: Powershell Token Obfuscation - Process Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-12-27
ATT&CK techniques: T1027.009
Log source: windows/process_creation

Description:
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation

Detection logic:
{
  "selection": [
    {
      "CommandLine|re": "\\w+`(?:\\w+|-|.)`[\\w+|\\s]"
    },
    {
      "CommandLine|re": "\"(?:\\{\\d\\})+\"\\s*-f"
    },
    {
      "CommandLine|re": "(?i)\\$\\{`?e`?n`?v`?:`?p`?a`?t`?h`?\\}"
    }
  ],
  "filter_main_envpath": {
    "CommandLine|contains": "${env:path}"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation
Sigma Detection Rule: Uninstall Sysinternals Sysmon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-12
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the removal of Sysmon, which could be a potential attempt at defense evasion

Detection logic:
{
  "selection_pe": [
    {
      "Image|endswith": [
        "\\Sysmon64.exe",
        "\\Sysmon.exe"
      ]
    },
    {
      "Description": "System activity monitor"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-u"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-11---uninstall-sysmon
Sigma Detection Rule: Invoke-Obfuscation COMPRESS OBFUSCATION
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "new-object",
      "text.encoding]::ascii"
    ],
    "CommandLine|contains": [
      "system.io.compression.deflatestream",
      "system.io.streamreader",
      "readtoend("
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009