deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: IIS WebServer Access Logs Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-16
ATT&CK techniques: T1070
Log source: windows/file_delete

Description:
Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\inetpub\\logs\\LogFiles\\",
    "TargetFilename|endswith": ".log"
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/current/webserver-access-logs-deleted.html
Sigma Detection Rule: Suspicious Appended Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-07-16
ATT&CK techniques: T1486
Log source: windows/file_rename

Description:
Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc.

Detection logic:
{
  "selection": {
    "SourceFilename|endswith": [
      ".doc",
      ".docx",
      ".jpeg",
      ".jpg",
      ".lnk",
      ".pdf",
      ".png",
      ".pst",
      ".rtf",
      ".xls",
      ".xlsx"
    ],
    "TargetFilename|contains": [
      ".doc.",
      ".docx.",
      ".jpeg.",
      ".jpg.",
      ".lnk.",
      ".pdf.",
      ".png.",
      ".pst.",
      ".rtf.",
      ".xls.",
      ".xlsx."
    ]
  },
  "filter_main_generic": {
    "TargetFilename|endswith": [
      ".backup",
      ".bak",
      ".old",
      ".orig",
      ".temp",
      ".tmp"
    ]
  },
  "filter_optional_anaconda": {
    "TargetFilename|contains": ":\\ProgramData\\Anaconda3\\",
    "TargetFilename|endswith": ".c~"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/
  - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/
Sigma Detection Rule: Unusual File Modification by dns.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch (Nextron Systems), Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1133
Log source: windows/file_change

Description:
Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\dns.exe"
  },
  "filter": {
    "TargetFilename|endswith": "\\dns.log"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
Sigma Detection Rule: Rclone Config File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Aaron Greetham (@beardofbinary) - NCC Group
Date: 2021-05-26
ATT&CK techniques: T1567.002
Log source: windows/file_event

Description:
Detects Rclone config files being created

Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      ":\\Users\\",
      "\\.config\\rclone\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
Sigma Detection Rule: HackTool - Impacket File Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: The DFIR Report, IrishDeath
Date: 2025-05-19
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects file creation events with filename patterns used by Impacket.

Detection logic:
{
  "selection_names_re": {
    "TargetFilename|re": "\\\\sessionresume_[a-zA-Z]{8}$"
  },
  "condition": "selection_names_re"
}

References:
  - https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
  - https://github.com/fortra/impacket
Sigma Detection Rule: UAC Bypass Abusing Winsat Path Parsing - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|endswith": [
      "\\AppData\\Local\\Temp\\system32\\winsat.exe",
      "\\AppData\\Local\\Temp\\system32\\winmm.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious PROCEXP152.sys File Created In TMP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
Date: 2019-04-08
ATT&CK techniques: T1685
Log source: windows/file_event

Description:
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder.
This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\",
    "TargetFilename|endswith": "PROCEXP152.sys"
  },
  "filter": {
    "Image|contains": [
      "\\procexp64.exe",
      "\\procexp.exe",
      "\\procmon64.exe",
      "\\procmon.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
Sigma Detection Rule: Malicious DLL File Dropped in the Teams or OneDrive Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-08-12
ATT&CK techniques: T1574.001
Log source: windows/file_event

Description:
Detects creation of a malicious DLL file in the location where the OneDrive or Team applications
Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded


Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      "iphlpapi.dll",
      "\\AppData\\Local\\Microsoft"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/
Sigma Detection Rule: Suspicious File Creation Activity From Fake Recycle.Bin Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-12
Log source: windows/file_event

Description:
Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware

Detection logic:
{
  "selection": [
    {
      "Image|contains": [
        "RECYCLERS.BIN\\",
        "RECYCLER.BIN\\"
      ]
    },
    {
      "TargetFilename|contains": [
        "RECYCLERS.BIN\\",
        "RECYCLER.BIN\\"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
  - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
Sigma Detection Rule: LiveKD Driver Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-16
Log source: windows/file_event

Description:
Detects the creation of the LiveKD driver, which is used for live kernel debugging

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\Windows\\System32\\drivers\\LiveKdD.SYS",
    "Image|endswith": [
      "\\livekd.exe",
      "\\livek64.exe"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Potential Binary Or Script Dropper Via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-17
Log source: windows/file_event

Description:
Detects PowerShell creating a binary executable or a script file.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe"
    ],
    "TargetFilename|endswith": [
      ".bat",
      ".chm",
      ".cmd",
      ".com",
      ".dll",
      ".exe",
      ".hta",
      ".jar",
      ".js",
      ".ocx",
      ".scr",
      ".sys",
      ".vbe",
      ".vbs",
      ".wsf"
    ]
  },
  "filter_main_user_temp": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\",
    "TargetFilename|endswith": [
      ".dll",
      ".exe"
    ]
  },
  "filter_main_other_temp": {
    "TargetFilename|startswith": [
      "C:\\Windows\\Temp\\",
      "C:\\Windows\\SystemTemp\\"
    ],
    "TargetFilename|endswith": [
      ".dll",
      ".exe"
    ]
  },
  "filter_main_powershell_module": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "\\WindowsPowerShell\\Modules\\",
    "TargetFilename|endswith": ".dll"
  },
  "filter_main_nuget": {
    "TargetFilename|startswith": "C:\\Program Files\\PackageManagement\\ProviderAssemblies\\nuget\\",
    "TargetFilename|endswith": "\\Microsoft.PackageManagement.NuGetProvider.dll"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Sigma Detection Rule: DPAPI Backup Keys And Certificate Export Activity IOC
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nounou Mbeiri, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-26
ATT&CK techniques: T1555, T1552.004
Log source: windows/file_event

Description:
Detects file names with specific patterns seen generated and used by tools such as Mimikatz and DSInternals related to exported or stolen DPAPI backup keys and certificates.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "ntds_capi_",
      "ntds_legacy_",
      "ntds_unknown_"
    ],
    "TargetFilename|endswith": [
      ".cer",
      ".key",
      ".pfx",
      ".pvk"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
  - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.Common/Data/DPAPI/DPAPIBackupKey.cs#L28-L32
Sigma Detection Rule: WScript or CScript Dropper - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Shelton
Date: 2022-01-10
ATT&CK techniques: T1059.005, T1059.007
Log source: windows/file_event

Description:
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\wscript.exe",
      "\\cscript.exe"
    ],
    "TargetFilename|contains": [
      ":\\Perflogs\\",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Tmp\\",
      ":\\Users\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming\\Temp",
      "\\Start Menu\\Programs\\Startup\\",
      "\\Temporary Internet"
    ],
    "TargetFilename|endswith": [
      ".js",
      ".jse",
      ".vba",
      ".vbe",
      ".vbs",
      ".wsf",
      ".wsh"
    ]
  },
  "condition": "selection"
}

References:
  - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846)
Sigma Detection Rule: Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Scoubi (@ScoubiMtl)
Date: 2023-10-09
ATT&CK techniques: T1564.004
Log source: windows/file_event

Description:
Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"


Detection logic:
{
  "selection": {
    "TargetFilename|contains": "::$index_allocation"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/pfiatde/status/[PII_REDACTED]88738305
  - https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/
  - https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/
  - https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3
Sigma Detection Rule: HackTool - SafetyKatz Dump Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis
Date: 2018-07-24
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects default lsass dump filename generated by SafetyKatz.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\Temp\\debug.bin"
  },
  "condition": "selection"
}

References:
  - https://github.com/GhostPack/SafetyKatz
  - https://github.com/GhostPack/SafetyKatz/blob/715b311f76eb3a4c8d00a1bd29c6cd1899e450b7/SafetyKatz/Program.cs#L63
Sigma Detection Rule: Adwind RAT / JRAT File Artifact
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tom Ueltschi, Jonhnathan Ribeiro, oscd.community
Date: 2017-11-10
ATT&CK techniques: T1059.005, T1059.007
Log source: windows/file_event

Description:
Detects javaw.exe in AppData folder as used by Adwind / JRAT

Detection logic:
{
  "selection": [
    {
      "TargetFilename|contains|all": [
        "\\AppData\\Roaming\\Oracle\\bin\\java",
        ".exe"
      ]
    },
    {
      "TargetFilename|contains|all": [
        "\\Retrive",
        ".vbs"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/ba86fa0d4b6af2db0656a88b1dd29f36fe362473ae8ad04255c4e52f214a541c?environmentId=100
  - https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf
Sigma Detection Rule: GoToAssist Temporary Installation Artefact
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\LogMeInInc\\GoToAssist Remote Support Expert\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
Sigma Detection Rule: PsExec Service File Creation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Thomas Patzke
Date: 2017-06-12
ATT&CK techniques: T1569.002
Log source: windows/file_event

Description:
Detects default PsExec service filename which indicates PsExec service installation and execution

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\PSEXESVC.exe"
  },
  "condition": "selection"
}

References:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
Sigma Detection Rule: Potential Webshell Creation On Static Website
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community, Tim Shelton, Thurein Oo
Date: 2019-10-22
ATT&CK techniques: T1505.003
Log source: windows/file_event

Description:
Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.

Detection logic:
{
  "selection_wwwroot_path": {
    "TargetFilename|contains": "\\inetpub\\wwwroot\\"
  },
  "selection_wwwroot_ext": {
    "TargetFilename|contains": [
      ".ashx",
      ".asp",
      ".ph",
      ".soap"
    ]
  },
  "selection_htdocs_path": {
    "TargetFilename|contains": [
      "\\www\\",
      "\\htdocs\\",
      "\\html\\"
    ]
  },
  "selection_htdocs_ext": {
    "TargetFilename|contains": ".ph"
  },
  "filter_main_temp": {
    "TargetFilename|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Windows\\Temp\\"
    ]
  },
  "filter_main_system": {
    "Image": "System"
  },
  "filter_main_legitimate": {
    "TargetFilename|contains": "\\xampp"
  },
  "condition": "(all of selection_wwwroot_* or all of selection_htdocs_*) and not 1 of filter_main_*"
}

References:
  - PT ESC rule and personal experience
  - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f[PII_REDACTED]fe30482a636/Upload%20Insecure%20Files/README.md
Sigma Detection Rule: ScreenConnect Temporary Installation Artefact
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Bin\\ScreenConnect."
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
Sigma Detection Rule: Wmiexec Default Output File
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-02
ATT&CK techniques: T1047
Log source: windows/file_event

Description:
Detects the creation of the default output filename used by the wmiexec tool

Detection logic:
{
  "selection": [
    {
      "TargetFilename|re": "\\\\Windows\\\\__1\\d{9}\\.\\d{1,7}$"
    },
    {
      "TargetFilename|re": "C:\\\\__1\\d{9}\\.\\d{1,7}$"
    },
    {
      "TargetFilename|re": "D:\\\\__1\\d{9}\\.\\d{1,7}$"
    }
  ],
  "condition": "selection"
}

References:
  - https://www.crowdstrike.com/blog/how-to-detect-and-prevent-impackets-wmiexec/
  - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py
Sigma Detection Rule: Wmiprvse Wbemcomn DLL Hijack - File
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-12
ATT&CK techniques: T1047, T1021.002
Log source: windows/file_event

Description:
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.

Detection logic:
{
  "selection": {
    "Image": "System",
    "TargetFilename|endswith": "\\wbem\\wbemcomn.dll"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
Sigma Detection Rule: File Creation In Suspicious Directory By Msdt.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Vadim Varganov, Florian Roth (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1547.001
Log source: windows/file_event

Description:
Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of either Follina or Dogwalk vulnerabilities

Detection logic:
{
  "selection": {
    "Image|endswith": "\\msdt.exe",
    "TargetFilename|contains": [
      "\\Desktop\\",
      "\\Start Menu\\Programs\\Startup\\",
      "C:\\PerfLogs\\",
      "C:\\ProgramData\\",
      "C:\\Users\\Public\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd
  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
Sigma Detection Rule: Files With System Process Name In Unsuspected Locations
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-05-26
ATT&CK techniques: T1036.005
Log source: windows/file_event

Description:
Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).
It is highly recommended to perform an initial baseline before using this rule in production.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\AtBroker.exe",
      "\\audiodg.exe",
      "\\backgroundTaskHost.exe",
      "\\bcdedit.exe",
      "\\bitsadmin.exe",
      "\\cmdl32.exe",
      "\\cmstp.exe",
      "\\conhost.exe",
      "\\csrss.exe",
      "\\dasHost.exe",
      "\\dfrgui.exe",
      "\\dllhost.exe",
      "\\dwm.exe",
      "\\eventcreate.exe",
      "\\eventvwr.exe",
      "\\explorer.exe",
      "\\extrac32.exe",
      "\\fontdrvhost.exe",
      "\\fsquirt.exe",
      "\\ipconfig.exe",
      "\\iscsicli.exe",
      "\\iscsicpl.exe",
      "\\logman.exe",
      "\\LogonUI.exe",
      "\\LsaIso.exe",
      "\\lsass.exe",
      "\\lsm.exe",
      "\\msiexec.exe",
      "\\msinfo32.exe",
      "\\mstsc.exe",
      "\\nbtstat.exe",
      "\\odbcconf.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regini.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\RuntimeBroker.exe",
      "\\schtasks.exe",
      "\\SearchFilterHost.exe",
      "\\SearchIndexer.exe",
      "\\SearchProtocolHost.exe",
      "\\SecurityHealthService.exe",
      "\\SecurityHealthSystray.exe",
      "\\services.exe",
      "\\ShellAppRuntime.exe",
      "\\sihost.exe",
      "\\smartscreen.exe",
      "\\smss.exe",
      "\\spoolsv.exe",
      "\\svchost.exe",
      "\\SystemSettingsBroker.exe",
      "\\taskhost.exe",
      "\\taskhostw.exe",
      "\\Taskmgr.exe",
      "\\TiWorker.exe",
      "\\vssadmin.exe",
      "\\w32tm.exe",
      "\\WerFault

References:
  - Internal Research
Sigma Detection Rule: Potential Persistence Attempt Via ErrorHandler.Cmd
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-09
Log source: windows/file_event

Description:
Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence
The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\WINDOWS\\Setup\\Scripts\\ErrorHandler.cmd"
  },
  "condition": "selection"
}

References:
  - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
  - https://github.com/last-byte/PersistenceSniper