deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PrintBrm ZIP Creation of Extraction
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-05-02
ATT&CK techniques: T1105, T1564.004
Log source: windows/process_creation

Description:
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\PrintBrm.exe",
    "CommandLine|contains|all": [
      " -f",
      ".zip"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/PrintBrm/
Sigma Detection Rule: LSA PPL Protection Setting Modification via CommandLine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-03-22
ATT&CK techniques: T1689
Log source: windows/process_creation

Description:
Detects modification of LSA PPL protection settings via CommandLine.
It may indicate an attempt to disable protection and enable credential dumping tools to access LSASS process memory.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\reg.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "reg.exe",
        "powershell.exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_action": {
    "CommandLine|contains|all": [
      "ControlSet",
      "\\Control\\Lsa"
    ],
    "CommandLine|contains": [
      "Set-ItemProperty",
      "New-ItemProperty",
      " add "
    ]
  },
  "selection_key": {
    "CommandLine|contains": [
      "IsPplAutoEnabled",
      "RunAsPPL",
      "RunAsPPLBoot"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
  - https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825
Sigma Detection Rule: Remote Access Tool - Renamed MeshAgent Execution - Windows
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Norbert Jaśniewicz (AlphaSOC)
Date: 2025-05-19
ATT&CK techniques: T1219.002, T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed instance of the Remote Monitoring and Management (RMM) tool, MeshAgent.
RMM tools such as MeshAgent are commonly utilized by IT administrators for legitimate remote support and system management.
However, malicious actors may exploit these tools by renaming them to bypass detection mechanisms, enabling unauthorized access and control over compromised systems.


Detection logic:
{
  "selection_meshagent": [
    {
      "CommandLine|contains": "--meshServiceName"
    },
    {
      "OriginalFileName|contains": "meshagent"
    }
  ],
  "filter_main_legitimate": {
    "Image|endswith": "\\meshagent.exe"
  },
  "condition": "selection_meshagent and not 1 of filter_main_*"
}

References:
  - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
  - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
  - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
  - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
Sigma Detection Rule: Suspicious FromBase64String Usage On Gzip Archive - Process Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-23
ATT&CK techniques: T1132.001
Log source: windows/process_creation

Description:
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "FromBase64String",
      "MemoryStream",
      "H4sI"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
Sigma Detection Rule: File Decoded From Base64/Hex Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2023-02-15
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. This can be abused by attackers to decode an encoded payload before execution

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": [
      "-decode ",
      "-decodehex "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]17991680
  - https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil
Sigma Detection Rule: Process Proxy Execution Via Squirrel.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Date: 2022-06-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\squirrel.exe",
      "\\update.exe"
    ]
  },
  "selection_exec": {
    "CommandLine|contains": [
      "--processStart",
      "--processStartAndWait",
      "--createShortcut"
    ]
  },
  "filter_optional_discord": {
    "CommandLine|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\Discord\\Update.exe",
      "Discord.exe"
    ],
    "CommandLine|contains": [
      "--createShortcut",
      "--processStart"
    ]
  },
  "filter_optional_github_desktop": {
    "CommandLine|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\GitHubDesktop\\Update.exe",
      "GitHubDesktop.exe"
    ],
    "CommandLine|contains": [
      "--createShortcut",
      "--processStartAndWait"
    ]
  },
  "filter_optional_teams": {
    "CommandLine|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\Microsoft\\Teams\\Update.exe",
      "Teams.exe"
    ],
    "CommandLine|contains": [
      "--processStart",
      "--createShortcut"
    ]
  },
  "filter_optional_yammer": {
    "CommandLine|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\yammerdesktop\\Update.exe",
      "Yammer.exe"
    ],
    "CommandLine|contains": [
      "--processStart",
      "--createShortcut"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/
  - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
  - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
Sigma Detection Rule: Greedy File Deletion Using Del
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113 , X__Junior (Nextron Systems)
Date: 2021-12-02
ATT&CK techniques: T1070.004
Log source: windows/process_creation

Description:
Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_del": {
    "CommandLine|contains": [
      "del ",
      "erase "
    ]
  },
  "selection_extensions": {
    "CommandLine|contains": [
      "\\\\\\*.au3",
      "\\\\\\*.dll",
      "\\\\\\*.exe",
      "\\\\\\*.js"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase
Sigma Detection Rule: Rundll32 Execution Without CommandLine Parameters
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-27
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects suspicious start of rundll32.exe without any parameters as found in CobaltStrike beacon activity

Detection logic:
{
  "selection": {
    "CommandLine|endswith": [
      "\\rundll32.exe",
      "\\rundll32.exe\"",
      "\\rundll32"
    ]
  },
  "filter": {
    "ParentImage|contains": [
      "\\AppData\\Local\\",
      "\\Microsoft\\Edge\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.cobaltstrike.com/help-opsec
  - https://twitter.com/ber_m1ng/status/[PII_REDACTED]35778309
Sigma Detection Rule: Psexec Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: omkar72
Date: 2020-10-30
ATT&CK techniques: T1569, T1021
Log source: windows/process_creation

Description:
Detects user accept agreement execution in psexec commandline

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\psexec.exe"
    },
    {
      "OriginalFileName": "psexec.c"
    }
  ],
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Sigma Detection Rule: Suspicious PowerShell IEX Execution Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-03-24
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious ways to run Invoke-Execution using IEX alias

Detection logic:
{
  "selection_combined_1": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      " | iex;",
      " | iex ",
      " | iex}",
      " | IEX ;",
      " | IEX -Error",
      " | IEX (new",
      ");IEX "
    ]
  },
  "selection_combined_2": {
    "CommandLine|contains": [
      "::FromBase64String",
      ".GetString([System.Convert]::"
    ]
  },
  "selection_standalone": {
    "CommandLine|contains": [
      ")|iex;$",
      ");iex($",
      ");iex $",
      " | IEX | ",
      " | iex\\\""
    ]
  },
  "condition": "all of selection_combined_* or selection_standalone"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Sigma Detection Rule: Nslookup PowerShell Download Cradle - ProcessCreation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-05
Log source: windows/process_creation

Description:
Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\nslookup.exe"
    },
    {
      "OriginalFileName": "\\nslookup.exe"
    }
  ],
  "selection_cmd": {
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      " -q=txt ",
      " -querytype=txt "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]32651264
Sigma Detection Rule: Suspect Svchost Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: David Burkett, @signalblur
Date: 2019-12-28
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

Detection logic:
{
  "selection": {
    "CommandLine|endswith": "svchost.exe",
    "Image|endswith": "\\svchost.exe"
  },
  "filter": [
    {
      "ParentImage|endswith": [
        "\\rpcnet.exe",
        "\\rpcnetp.exe"
      ]
    },
    {
      "CommandLine": null
    }
  ],
  "condition": "selection and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
Sigma Detection Rule: Suspicious XOR Encoded PowerShell Command
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali
Date: 2018-09-05
ATT&CK techniques: T1059.001, T1140, T1027
Log source: windows/process_creation

Description:
Detects presence of a potentially xor encoded powershell command

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Description": "Windows PowerShell"
    },
    {
      "Product": "PowerShell Core 6"
    }
  ],
  "selection_cli_xor": {
    "CommandLine|contains": "bxor"
  },
  "selection_cli_other": {
    "CommandLine|contains": [
      "ForEach",
      "for(",
      "for ",
      "-join ",
      "-join'",
      "-join\"",
      "-join`",
      "::Join",
      "[char]"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
  - https://redcanary.com/blog/yellow-cockatoo/
  - https://zero2auto.com/2020/05/19/netwalker-re/
  - https://mez0.cc/posts/cobaltstrike-powershell-exec/
Sigma Detection Rule: Screen Capture Activity Via Psr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community
Date: 2019-10-12
ATT&CK techniques: T1113
Log source: windows/process_creation

Description:
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\Psr.exe",
    "CommandLine|contains": [
      "/start",
      "-start"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Psr/
  - https://web.archive.org/web/[PII_REDACTED]1156/https://www.sans.org/cyber-security-summit/archives/file/summit-archive[PII_REDACTED].pdf
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
Sigma Detection Rule: Suspicious Scan Loop Network
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-12
ATT&CK techniques: T1059, T1018
Log source: windows/process_creation

Description:
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Detection logic:
{
  "selection_loop": {
    "CommandLine|contains": [
      "for ",
      "foreach "
    ]
  },
  "selection_tools": {
    "CommandLine|contains": [
      "nslookup",
      "ping"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://ss64.com/nt/for.html
  - https://ss64.com/ps/foreach-object.html
Sigma Detection Rule: Use of FSharp Interpreters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2022-06-02
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\fsi.exe",
        "\\fsianycpu.exe"
      ]
    },
    {
      "OriginalFileName": [
        "fsi.exe",
        "fsianycpu.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
  - https://bohops.com/2020/11/02/exploring-the-wdac-microsoft-recommended-block-rules-part-ii-wfc-fsi/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/FsiAnyCpu/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Fsi/
Sigma Detection Rule: RunMRU Registry Key Deletion
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-25
ATT&CK techniques: T1070.003
Log source: windows/process_creation

Description:
Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog.
In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands.
Adversaries may delete this key to cover their tracks after executing commands.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " del",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
Sigma Detection Rule: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 4
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-12-05
Log source: windows/process_creation

Description:
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\ud83d\udd38",
      "\ud83d\udd39",
      "\ud83d\udd36",
      "\ud83d\udd37",
      "\ud83d\udd33",
      "\ud83d\udd32",
      "\u25aa\ufe0f",
      "\u25ab\ufe0f",
      "\u25fe\ufe0f",
      "\u25fd\ufe0f",
      "\u25fc\ufe0f",
      "\u25fb\ufe0f",
      "\ud83d\udfe5",
      "\ud83d\udfe7",
      "\ud83d\udfe8",
      "\ud83d\udfe9",
      "\ud83d\udfe6",
      "\ud83d\udfea",
      "\u2b1b\ufe0f",
      "\u2b1c\ufe0f",
      "\ud83d\udfeb",
      "\ud83d\udd08",
      "\ud83d\udd07",
      "\ud83d\udd09",
      "\ud83d\udd0a",
      "\ud83d\udd14",
      "\ud83d\udd15",
      "\ud83d\udce3",
      "\ud83d\udce2",
      "\ud83d\udc41\u200d\ud83d\udde8",
      "\ud83d\udcac",
      "\ud83d\udcad",
      "\ud83d\uddef",
      "\u2660\ufe0f",
      "\u2663\ufe0f",
      "\u2665\ufe0f",
      "\u2666\ufe0f",
      "\ud83c\udccf",
      "\ud83c\udfb4",
      "\ud83c\udc04\ufe0f",
      "\ud83d\udd50",
      "\ud83d\udd51",
      "\ud83d\udd52",
      "\ud83d\udd53",
      "\ud83d\udd54",
      "\ud83d\udd55",
      "\ud83d\udd56",
      "\ud83d\udd57",
      "\ud83d\udd58",
      "\ud83d\udd59",
      "\ud83d\udd5a",
      "\ud83d\udd5b",
      "\ud83d\udd5c",
      "\ud83d\udd5d",
      "\ud83d\udd5e",
      "\ud83d\udd5f",
      "\ud83d\udd60",
      "\ud83d\udd61",
      "\ud83d\udd62",
      "\ud83d\udd63",
      "\ud83d\udd64",
      "\ud83d\udd65",
      "\ud83d\udd66",
      "\ud83d\udd67\u2722",
      "\u2723

References:
  - Internal Research
Sigma Detection Rule: Tap Installer Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1048
Log source: windows/process_creation

Description:
Well-known TAP software installation. Possible preparation for data exfiltration using tunneling techniques

Detection logic:
{
  "selection": {
    "Image|endswith": "\\tapinstall.exe"
  },
  "filter_optional_avast": {
    "Image|contains": [
      ":\\Program Files\\Avast Software\\SecureLine VPN\\",
      ":\\Program Files (x86)\\Avast Software\\SecureLine VPN\\"
    ]
  },
  "filter_optional_openvpn": {
    "Image|contains": ":\\Program Files\\OpenVPN Connect\\drivers\\tap\\"
  },
  "filter_optional_protonvpn": {
    "Image|contains": ":\\Program Files (x86)\\Proton Technologies\\ProtonVPNTap\\installer\\"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
Sigma Detection Rule: Non-privileged Usage of Reg or Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov (idea), Ryan Plas (rule), oscd.community
Date: 2020-10-05
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry

Detection logic:
{
  "selection_cli": [
    {
      "CommandLine|contains|all": [
        "reg ",
        "add"
      ]
    },
    {
      "CommandLine|contains": [
        "powershell",
        "set-itemproperty",
        " sp ",
        "new-itemproperty"
      ]
    }
  ],
  "selection_data": {
    "IntegrityLevel": [
      "Medium",
      "S-1-16-8192"
    ],
    "CommandLine|contains|all": [
      "ControlSet",
      "Services"
    ],
    "CommandLine|contains": [
      "ImagePath",
      "FailureCommand",
      "ServiceDLL"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal[PII_REDACTED]58/95/hunting-for-privilege-escalation-in-windows-environment-20-638.jpg
Sigma Detection Rule: PUA - RunXCmd Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-24
ATT&CK techniques: T1569.002
Log source: windows/process_creation

Description:
Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts

Detection logic:
{
  "selection_account": {
    "CommandLine|contains": [
      " /account=system ",
      " /account=ti "
    ]
  },
  "selection_exec": {
    "CommandLine|contains": "/exec="
  },
  "condition": "all of selection_*"
}

References:
  - https://www.d7xtech.com/free-software/runx/
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Sigma Detection Rule: Suspicious Usage Of Active Directory Diagnostic Tool (ntdsutil.exe)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-14
ATT&CK techniques: T1003.003
Log source: windows/process_creation

Description:
Detects execution of ntdsutil.exe to perform different actions such as restoring snapshots...etc.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ntdsutil.exe"
    },
    {
      "OriginalFileName": "ntdsutil.exe"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|contains|all": [
        "snapshot",
        "mount "
      ]
    },
    {
      "CommandLine|contains|all": [
        "ac",
        " i",
        " ntds"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments