deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Cloudflared Tunnels Related DNS Requests
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-20
ATT&CK techniques: T1071.001, T1572
Log source: windows/dns_query

Description:
Detects DNS requests to Cloudflared tunnels domains.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "QueryName|endswith": [
      ".v2.argotunnel.com",
      "protocol-v2.argotunnel.com",
      "trycloudflare.com",
      "update.argotunnel.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - Internal Research
Sigma Detection Rule: AppX Package Installation Attempts Via AppInstaller.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-24
ATT&CK techniques: T1105
Log source: windows/dns_query

Description:
Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL


Detection logic:
{
  "selection": {
    "Image|startswith": "C:\\Program Files\\WindowsApps\\Microsoft.DesktopAppInstaller_",
    "Image|endswith": "\\AppInstaller.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/notwhickey/status/[PII_REDACTED]32523264
  - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/
Sigma Detection Rule: Notepad++ Updater DNS Query to Uncommon Domains
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-02-02
ATT&CK techniques: T1195.002, T1557
Log source: windows/dns_query

Description:
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\gup.exe"
  },
  "filter_main_notepad_legit_domain": {
    "QueryName": "notepad-plus-plus.org"
  },
  "filter_optional_sourceforge_legit_domain": {
    "QueryName|endswith": ".sourceforge.net"
  },
  "filter_optional_github_legit_domain": [
    {
      "QueryName|endswith": ".githubusercontent.com"
    },
    {
      "QueryName": "github.com"
    }
  ],
  "filter_optional_google_storage_legit_domain": {
    "QueryName|endswith": ".googleapis.com"
  },
  "filter_optional_uncommon_domains": {
    "QueryName|endswith": [
      ".azurewebsites.net",
      "block.opendns.com",
      "gateway.zscalerthree.net"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
Sigma Detection Rule: Suspicious Cobalt Strike DNS Beaconing - Sysmon
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-09
ATT&CK techniques: T1071.004
Log source: windows/dns_query

Description:
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Detection logic:
{
  "selection1": {
    "QueryName|startswith": [
      "aaa.stage.",
      "post.1"
    ]
  },
  "selection2": {
    "QueryName|contains": ".stage.123456."
  },
  "condition": "1 of selection*"
}

References:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
Sigma Detection Rule: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-20
ATT&CK techniques: T1557.001, T1187
Log source: windows/dns_query

Description:
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.


Detection logic:
{
  "selection": {
    "QueryName|contains|all": [
      "UWhRCA",
      "BAAAA"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
Sigma Detection Rule: DNS Query To Common Malware Hosting and Shortener Services
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ahmed Nosir (@egycondor)
Date: 2025-06-02
ATT&CK techniques: T1071.004
Log source: windows/dns_query

Description:
Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.


Detection logic:
{
  "selection": {
    "QueryName|contains": [
      "msapp.workers.dev",
      "trycloudflare.com",
      "infinityfreeapp.com",
      "my5353.com",
      "reurl.cc",
      "lihi.cc",
      "tinyurl.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
Sigma Detection Rule: DNS Query To Remote Access Software Domain From Non-Browser App
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Connor Martin
Date: 2022-07-11
ATT&CK techniques: T1219.002
Log source: windows/dns_query

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection_generic": {
    "QueryName|endswith": [
      "agent.jumpcloud.com",
      "agentreporting.atera.com",
      "ammyy.com",
      "api.parsec.app",
      "api.playanext.com",
      "api.splashtop.com",
      "app.atera.com",
      "assist.zoho.com",
      "authentication.logmeininc.com",
      "beyondtrustcloud.com",
      "cdn.kaseya.net",
      "client.teamviewer.com",
      "comserver.corporate.beanywhere.com",
      "control.connectwise.com",
      "downloads.zohocdn.com",
      "dwservice.net",
      "express.gotoassist.com",
      "getgo.com",
      "getscreen.me",
      "integratedchat.teamviewer.com",
      "join.zoho.com",
      "kickstart.jumpcloud.com",
      "license.bomgar.com",
      "logmein-gateway.com",
      "logmein.com",
      "logmeincdn.http.internapcdn.net",
      "n-able.com",
      "net.anydesk.com",
      "netsupportsoftware.com",
      "parsecusercontent.com",
      "pubsub.atera.com",
      "relay.kaseya.net",
      "relay.screenconnect.com",
      "relay.splashtop.com",
      "remoteassistance.support.services.microsoft.com",
      "remotedesktop-pa.googleapis.com",
      "remoteutilities.com",
      "secure.logmeinrescue.com",
      "services.vnc.com",
      "static.remotepc.com",
      "swi-rc.com",
      "swi-tc.com",
      "tailscale.com",
      "telemetry.servers.qetqo.com",
      "tmate.io",
      "twingate.com",
      "zohoassist.com"
    ]
  },
  "selection_rustdesk": {
    "QueryName|endswith": ".rustdesk.com",
    "QueryName

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-6---ammyy-admin-software-execution
  - https://redcanary.com/blog/misbehaving-rats/
  - https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093
Sigma Detection Rule: DNS Query To Devtunnels Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: citron_ninja
Date: 2023-10-25
ATT&CK techniques: T1071.001, T1572
Log source: windows/dns_query

Description:
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "QueryName|endswith": ".devtunnels.ms"
  },
  "condition": "selection"
}

References:
  - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
  - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
  - https://cydefops.com/devtunnels-unleashed
Sigma Detection Rule: DNS Query Tor .Onion Address - Sysmon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-02-20
ATT&CK techniques: T1090.003
Log source: windows/dns_query

Description:
Detects DNS queries to an ".onion" address related to Tor routing networks

Detection logic:
{
  "selection": {
    "QueryName|endswith": [
      ".hiddenservice.net",
      ".onion.ca",
      ".onion.cab",
      ".onion.casa",
      ".onion.city",
      ".onion.direct",
      ".onion.dog",
      ".onion.glass",
      ".onion.gq",
      ".onion.ink",
      ".onion.it",
      ".onion.link",
      ".onion.lt",
      ".onion.lu",
      ".onion.nu",
      ".onion.pet",
      ".onion.plus",
      ".onion.rip",
      ".onion.sh",
      ".onion.to",
      ".onion.top",
      ".onion",
      ".s1.tor-gateways.de",
      ".s2.tor-gateways.de",
      ".s3.tor-gateways.de",
      ".s4.tor-gateways.de",
      ".s5.tor-gateways.de",
      ".t2w.pw",
      ".tor2web.ae.org",
      ".tor2web.blutmagie.de",
      ".tor2web.com",
      ".tor2web.fi",
      ".tor2web.io",
      ".tor2web.org",
      ".tor2web.xyz",
      ".torlink.co"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
Sigma Detection Rule: DNS HybridConnectionManager Service Bus
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
ATT&CK techniques: T1554
Log source: windows/dns_query

Description:
Detects Azure Hybrid Connection Manager services querying the Azure service bus service

Detection logic:
{
  "selection": {
    "QueryName|contains": "servicebus.windows.net",
    "Image|contains": "HybridConnectionManager"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Cyb3rWard0g/status/[PII_REDACTED]69286662
Sigma Detection Rule: DNS Query for Anonfiles.com Domain - Sysmon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-07-15
ATT&CK techniques: T1567.002
Log source: windows/dns_query

Description:
Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes

Detection logic:
{
  "selection": {
    "QueryName|contains": ".anonfiles.com"
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
Sigma Detection Rule: DNS Query To AzureWebsites.NET By Non-Browser Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-24
ATT&CK techniques: T1219.002
Log source: windows/dns_query

Description:
Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.


Detection logic:
{
  "selection": {
    "QueryName|endswith": "azurewebsites.net"
  },
  "filter_optional_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_firefox": {
    "Image": [
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_optional_ie": {
    "Image": [
      "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_optional_edge_1": [
    {
      "Image|startswith": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
    },
    {
      "Image": [
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
      ]
    }
  ],
  "filter_optional_edge_2": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft\\EdgeCore\\",
      "C:\\Program Files\\Microsoft\\EdgeCore\\"
    ],
    "Image|endswith": [
      "\\msedge.exe",
      "\\msedgewebview2.exe"
    ]
  },
  "filter_optional_safari": {
    "Image|endswith": "\\safari.exe"
  },
  "filter_optional_defender": {
    "Image|endswith": [
      "\\MsMpEng.exe",
      "\\MsSense.exe"
    ]
  },
  "filter_optional_brave": {
    "Image|endswit

References:
  - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/
  - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
Sigma Detection Rule: DNS Query Request To OneLaunch Update Service
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Josh Nickels
Date: 2024-02-26
ATT&CK techniques: T1056
Log source: windows/dns_query

Description:
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application.
When the OneLaunch application is installed it will attempt to get updates from this domain.


Detection logic:
{
  "selection": {
    "QueryName": "update.onelaunch.com",
    "Image|endswith": "\\OneLaunch.exe"
  },
  "condition": "selection"
}

References:
  - https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
  - https://www.myantispyware.com/2020/12/14/how-to-uninstall-onelaunch-browser-removal-guide/
  - https://malware.guide/browser-hijacker/remove-onelaunch-virus/
Sigma Detection Rule: TeamViewer Domain Query By Non-TeamViewer Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-30
ATT&CK techniques: T1219.002
Log source: windows/dns_query

Description:
Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)

Detection logic:
{
  "selection": {
    "QueryName": [
      "taf.teamviewer.com",
      "udp.ping.teamviewer.com"
    ]
  },
  "filter_main_teamviewer": {
    "Image|contains": "TeamViewer"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.teamviewer.com/en-us/
Sigma Detection Rule: Suspicious DNS Query for IP Lookup Service APIs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Brandon George (blog post), Thomas Patzke
Date: 2021-07-08
ATT&CK techniques: T1590
Log source: windows/dns_query

Description:
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.

Detection logic:
{
  "selection": [
    {
      "QueryName": [
        "www.ip.cn",
        "l2.io"
      ]
    },
    {
      "QueryName|contains": [
        "api.2ip.ua",
        "api.bigdatacloud.net",
        "api.ipify.org",
        "bot.whatismyipaddress.com",
        "canireachthe.net",
        "checkip.amazonaws.com",
        "checkip.dyndns.org",
        "curlmyip.com",
        "db-ip.com",
        "edns.ip-api.com",
        "eth0.me",
        "freegeoip.app",
        "geoipy.com",
        "getip.pro",
        "icanhazip.com",
        "ident.me",
        "ifconfig.io",
        "ifconfig.me",
        "ip-api.com",
        "ip.360.cn",
        "ip.anysrc.net",
        "ip.taobao.com",
        "ip.tyk.nu",
        "ipaddressworld.com",
        "ipapi.co",
        "ipconfig.io",
        "ipecho.net",
        "ipinfo.io",
        "ipip.net",
        "ipof.in",
        "ipv4.icanhazip.com",
        "ipv4bot.whatismyipaddress.com",
        "ipv6-test.com",
        "ipwho.is",
        "jsonip.com",
        "myexternalip.com",
        "seeip.org",
        "wgetip.com",
        "whatismyip.akamai.com",
        "whois.pconline.com.cn",
        "wtfismyip.com"
      ]
    }
  ],
  "filter_optional_brave": {
    "Image|endswith": "\\brave.exe"
  },
  "filter_optional_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_firefox": {
    "Image": [
      "C:

References:
  - https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon
  - https://twitter.com/neonprimetime/status/[PII_REDACTED]80428318
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
Sigma Detection Rule: Potential Packet Capture Activity Via Start-NetEventSession - ScriptBlock
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2024-05-12
ATT&CK techniques: T1040
Log source: windows/ps_script

Description:
Detects the execution of powershell scripts with calls to the "Start-NetEventSession" cmdlet. Which allows an attacker to start event and packet capture for a network event session.
Adversaries may attempt to capture network to gather information over the course of an operation.
Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Start-NetEventSession"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
  - https://github.com/0xsyr0/Awesome-Cybersecurity-Handbooks/blob/7b8935fe4c82cb64d61343de1a8b2e38dd968534/handbooks/10_post_exploitation.md
  - https://github.com/forgottentq/powershell/blob/9e616363d497143dc955c4fdce68e5c18d28a6cb/captureWindows-Endpoint.ps1#L13
Sigma Detection Rule: Potential PowerShell Obfuscation Using Character Join
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "-Alias",
      " -Value (-join("
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Connection to Remote Account
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-27
ATT&CK techniques: T1110.001
Log source: windows/ps_script

Description:
Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.
Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "System.DirectoryServices.Protocols.LdapDirectoryIdentifier",
      "System.Net.NetworkCredential",
      "System.DirectoryServices.Protocols.LdapConnection"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.001/T1110.001.md#atomic-test-2---brute-force-credentials-of-single-active-directory-domain-user-via-ldap-against-domain-controller-ntlm-or-kerberos
Sigma Detection Rule: Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-13
Log source: windows/ps_script

Description:
Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Detection logic:
{
  "selection_class": {
    "ScriptBlockText|contains": "Win32_NTEventlogFile"
  },
  "selection_function": {
    "ScriptBlockText|contains": [
      ".BackupEventlog(",
      ".ChangeSecurityPermissions(",
      ".ChangeSecurityPermissionsEx(",
      ".ClearEventLog(",
      ".Delete(",
      ".DeleteEx(",
      ".Rename(",
      ".TakeOwnerShip(",
      ".TakeOwnerShipEx("
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
Sigma Detection Rule: Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-09
ATT&CK techniques: T1218
Log source: windows/ps_script

Description:
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

Detection logic:
{
  "selection": {
    "ScriptBlockText|startswith": "function Get-VMRemoteFXPhysicalVideoAdapter {"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1