deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Vsls-Agent Command With AgentExtensionPath Load
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: bohops
Date: 2022-10-30
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter

Detection logic:
{
  "selection": {
    "Image|endswith": "\\vsls-agent.exe",
    "CommandLine|contains": "--agentExtensionPath"
  },
  "filter": {
    "CommandLine|contains": "Microsoft.VisualStudio.LiveShare.Agent."
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/bohops/status/[PII_REDACTED]04729857
Sigma Detection Rule: Csc.EXE Execution Form Potentially Suspicious Parent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2019-02-11
ATT&CK techniques: T1059.005, T1059.007, T1218.005, T1027.004
Log source: windows/process_creation

Description:
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\csc.exe"
    },
    {
      "OriginalFileName": "csc.exe"
    }
  ],
  "selection_parent_generic": {
    "ParentImage|endswith": [
      "\\cscript.exe",
      "\\excel.exe",
      "\\mshta.exe",
      "\\onenote.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe",
      "\\wscript.exe"
    ]
  },
  "selection_parent_powershell": {
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "ParentCommandLine|contains": [
      "-Encoded ",
      "FromBase64String"
    ]
  },
  "selection_parent_susp_location": [
    {
      "ParentCommandLine|re": "(?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\\\[Aa]pp[Dd]ata\\\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\\\[^\\\\]{1,256}$"
    },
    {
      "ParentCommandLine|contains": [
        ":\\PerfLogs\\",
        ":\\Users\\Public\\",
        ":\\Windows\\Temp\\",
        "\\Temporary Internet"
      ]
    },
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "filter_main_programfiles": {
    "ParentImage|startswith": [
      "C:\\Program Files (x

References:
  - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing
  - https://reaqta.com/2017/11/short-journey-darkvnc/
  - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
Sigma Detection Rule: Invoke-Obfuscation Obfuscated IEX Invocation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Date: 2019-11-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Detection logic:
{
  "selection": [
    {
      "CommandLine|re": "\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\["
    },
    {
      "CommandLine|re": "\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\["
    },
    {
      "CommandLine|re": "\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\["
    },
    {
      "CommandLine|re": "\\$env:ComSpec\\[(?:\\s*\\d{1,3}\\s*,){2}"
    },
    {
      "CommandLine|re": "\\*mdr\\*\\W\\s*\\)\\.Name"
    },
    {
      "CommandLine|re": "\\$VerbosePreference\\.ToString\\("
    },
    {
      "CommandLine|re": "\\[String\\]\\s*\\$VerbosePreference"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
Sigma Detection Rule: Renamed Plink Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-06
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects the execution of a renamed version of the Plink binary

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "Plink"
    },
    {
      "CommandLine|contains|all": [
        " -l forward",
        " -P ",
        " -R "
      ]
    }
  ],
  "filter": {
    "Image|endswith": "\\plink.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
  - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html
Sigma Detection Rule: Remote Access Tool - ScreenConnect Server Web Shell Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jason Rathbun (Blackpoint Cyber)
Date: 2024-02-26
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects potential web shell execution from the ScreenConnect server process.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\ScreenConnect.Service.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\csc.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
Sigma Detection Rule: Disabled IE Security Features
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-06-19
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features

Detection logic:
{
  "selection1": {
    "CommandLine|contains|all": [
      " -name IEHarden ",
      " -value 0 "
    ]
  },
  "selection2": {
    "CommandLine|contains|all": [
      " -name DEPOff ",
      " -value 1 "
    ]
  },
  "selection3": {
    "CommandLine|contains|all": [
      " -name DisableFirstRunCustomize ",
      " -value 2 "
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
Sigma Detection Rule: Potential PowerShell Execution Policy Tampering - ProcCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/process_creation

Description:
Detects changes to the PowerShell execution policy registry key in order to bypass signing requirements for script execution from the CommandLine

Detection logic:
{
  "selection_path": {
    "CommandLine|contains": [
      "\\ShellIds\\Microsoft.PowerShell\\ExecutionPolicy",
      "\\Policies\\Microsoft\\Windows\\PowerShell\\ExecutionPolicy"
    ]
  },
  "selection_values": {
    "CommandLine|contains": [
      "Bypass",
      "RemoteSigned",
      "Unrestricted"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/de-de/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.3
Sigma Detection Rule: Indirect Command Execution By Program Compatibility Wizard
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: A. Sungurov , oscd.community
Date: 2020-10-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detect indirect command execution via Program Compatibility Assistant pcwrun.exe

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\pcwrun.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/pabraeken/status/[PII_REDACTED]33708544
  - https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/
Sigma Detection Rule: PUA - TruffleHog Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-24
ATT&CK techniques: T1083, T1552.001
Log source: windows/process_creation

Description:
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\trufflehog.exe"
  },
  "selection_cli_platform": {
    "CommandLine|contains": [
      " docker --image ",
      " Git ",
      " GitHub ",
      " Jira ",
      " Slack ",
      " Confluence ",
      " SharePoint ",
      " s3 ",
      " gcs "
    ]
  },
  "selection_cli_verified": {
    "CommandLine|contains": " --results=verified"
  },
  "condition": "selection_img or all of selection_cli_*"
}

References:
  - https://github.com/trufflesecurity/trufflehog
  - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
Sigma Detection Rule: RDP Port Forwarding Rule Added Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), oscd.community
Date: 2019-01-29
ATT&CK techniques: T1090
Log source: windows/process_creation

Description:
Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " i",
      " p",
      "=3389",
      " c"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
Sigma Detection Rule: Invoke-Obfuscation CLIP+ Launcher
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated use of Clip.exe to execute PowerShell

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "cmd",
      "&&",
      "clipboard]::",
      "-f"
    ],
    "CommandLine|contains": [
      "/c",
      "/r"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Remote Access Tool - AnyDesk Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-11
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\AnyDesk.exe",
        "\\AnyDeskMSI.exe"
      ]
    },
    {
      "Description": "AnyDesk"
    },
    {
      "Product": "AnyDesk"
    },
    {
      "Company": "AnyDesk Software GmbH"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
Sigma Detection Rule: Renamed ZOHO Dctask64 Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-01-28
ATT&CK techniques: T1036, T1055.001, T1202, T1218
Log source: windows/process_creation

Description:
Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.


Detection logic:
{
  "selection": {
    "Hashes|contains": [
      "IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD",
      "IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA",
      "IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3",
      "IMPHASH=F1039CED4B91572AB7847D26032E6BBF"
    ]
  },
  "filter_main_legit_name": {
    "Image|endswith": "\\dctask64.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]81825540
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]89111296
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]75911424
Sigma Detection Rule: Suspicious File Downloaded From Direct IP Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1027, T1105
Log source: windows/process_creation

Description:
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      "urlcache ",
      "verifyctl ",
      "URL "
    ]
  },
  "selection_http": {
    "CommandLine|contains": [
      "://1",
      "://2",
      "://3",
      "://4",
      "://5",
      "://6",
      "://7",
      "://8",
      "://9"
    ]
  },
  "filter_main_seven_zip": {
    "CommandLine|contains": "://7-"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://forensicitguy.github.io/agenttesla-vba-certutil-download/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/egre55/status/[PII_REDACTED]16193025
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Sigma Detection Rule: HackTool - SILENTTRINITY Stager Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Aleksey Potapov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1071
Log source: windows/process_creation

Description:
Detects SILENTTRINITY stager use via PE metadata

Detection logic:
{
  "selection": {
    "Description|contains": "st2stager"
  },
  "condition": "selection"
}

References:
  - https://github.com/byt3bl33d3r/SILENTTRINITY
Sigma Detection Rule: Registry Export of Third-Party Credentials
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-22
ATT&CK techniques: T1552.002
Log source: windows/process_creation

Description:
Detects the use of reg.exe to export registry paths associated with third-party credentials.
Credential stealers have been known to use this technique to extract sensitive information from the registry.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_cli_save": {
    "CommandLine|contains": [
      "save",
      "export"
    ]
  },
  "selection_cli_path": {
    "CommandLine|contains": [
      "\\Software\\Aerofox\\Foxmail\\V3.1",
      "\\Software\\Aerofox\\FoxmailPreview",
      "\\Software\\DownloadManager\\Passwords",
      "\\Software\\FTPWare\\COREFTP\\Sites",
      "\\Software\\IncrediMail\\Identities",
      "\\Software\\Martin Prikryl\\WinSCP 2\\Sessions",
      "\\Software\\Mobatek\\MobaXterm",
      "\\Software\\OpenSSH\\Agent\\Keys",
      "\\Software\\OpenVPN-GUI\\configs",
      "\\Software\\ORL\\WinVNC3\\Password",
      "\\Software\\Qualcomm\\Eudora\\CommandLine",
      "\\Software\\RealVNC\\WinVNC4",
      "\\Software\\RimArts\\B2\\Settings",
      "\\Software\\SimonTatham\\PuTTY\\Sessions",
      "\\Software\\SimonTatham\\PuTTY\\SshHostKeys",
      "\\Software\\Sota\\FFFTP",
      "\\Software\\TightVNC\\Server",
      "\\Software\\WOW6432Node\\Radmin\\v3.0\\Server\\Parameters\\Radmin"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior
Sigma Detection Rule: HackTool - Wmiexec Default Powershell Command
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-08
Log source: windows/process_creation

Description:
Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script

Detection logic:
{
  "selection": {
    "CommandLine|contains": "-NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc"
  },
  "condition": "selection"
}

References:
  - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
Sigma Detection Rule: Suspicious Response File Execution Via Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -f "
  },
  "filter_main_rsp_ext": {
    "CommandLine|contains": ".rsp"
  },
  "filter_main_runonce_odbc": {
    "ParentImage": "C:\\Windows\\System32\\runonce.exe",
    "Image": "C:\\Windows\\System32\\odbcconf.exe",
    "CommandLine|contains": ".exe /E /F \"C:\\WINDOWS\\system32\\odbcconf.tmp\""
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
Sigma Detection Rule: Potentially Suspicious WebDAV LNK Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski
Date: 2023-08-21
ATT&CK techniques: T1059.001, T1204
Log source: windows/process_creation

Description:
Detects possible execution via LNK file accessed on a WebDAV server.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\explorer.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "CommandLine|contains": "\\DavWWWRoot\\"
  },
  "condition": "selection"
}

References:
  - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
  - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
Sigma Detection Rule: HackTool - WSASS Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-23
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects execution of WSASS, a tool used to dump LSASS memory on Windows systems by leveraging WER's
(Windows Error Reporting) WerFaultSecure.EXE to bypass PPL (Protected Process Light) protections.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\wsass.exe"
  },
  "selection_hash": {
    "Hashes|contains": "IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42"
  },
  "selection_cli": {
    "CommandLine|re": "(?i)\\.exe[\\\"\\']?\\s+[^\\\"]{0,64}werfaultsecure\\.exe[\\\"\\']?\\s+\\d{2,10}"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/TwoSevenOneT/WSASS
  - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
Sigma Detection Rule: HackTool - Default PowerSploit/Empire Scheduled Task Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, @Karneades
Date: 2018-03-06
ATT&CK techniques: T1053.005, T1059.001
Log source: windows/process_creation

Description:
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      "/Create",
      "powershell.exe -NonI",
      "/TN Updater /TR"
    ],
    "CommandLine|contains": [
      "/SC ONLOGON",
      "/SC DAILY /ST",
      "/SC ONIDLE",
      "/SC HOURLY"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py
Sigma Detection Rule: PUA - Wsudo Suspicious Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-02
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

Detection logic:
{
  "selection_metadata": [
    {
      "Image|endswith": "\\wsudo.exe"
    },
    {
      "OriginalFileName": "wsudo.exe"
    },
    {
      "Description": "Windows sudo utility"
    },
    {
      "ParentImage|endswith": "\\wsudo-bridge.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "-u System",
      "-uSystem",
      "-u TrustedInstaller",
      "-uTrustedInstaller",
      " --ti "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/M2Team/Privexec/
Sigma Detection Rule: Remote Access Tool - ScreenConnect Remote Command Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ali Alwashali
Date: 2023-10-10
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detects the execution of a system command via the ScreenConnect RMM service.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\ScreenConnect.ClientService.exe"
  },
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "\\TEMP\\ScreenConnect\\"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/SigmaHQ/sigma/pull/4467
Sigma Detection Rule: Operator Bloopers Cobalt Strike Modules
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: _pete_0, TheDFIRReport
Date: 2022-05-06
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detects Cobalt Strike module/commands accidentally entered in CMD shell

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "Cmd.Exe"
    },
    {
      "Image|endswith": "\\cmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "Invoke-UserHunter",
      "Invoke-ShareFinder",
      "Invoke-Kerberoast",
      "Invoke-SMBAutoBrute",
      "Invoke-Nightmare",
      "zerologon",
      "av_query"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf
  - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
  - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/