deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: COLDSTEEL RAT Cleanup Command Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-30
Log source: windows/process_creation

Description:
Detects the creation of a "rundll32" process from the ColdSteel persistence service to initiate the cleanup command by calling one of its own exports. This functionality is not present in "MileStone2017" and some "MileStone2016" samples

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\svchost.exe",
    "ParentCommandLine|contains": [
      " -k msupdate",
      " -k msupdate2",
      " -k alg"
    ],
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      "UpdateDriverForPlugAndPlayDevicesW",
      "ServiceMain",
      "DiUninstallDevice"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: Potential COLDSTEEL Persistence Service DLL Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-02
Log source: windows/image_load

Description:
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism


Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe",
    "ImageLoaded|endswith": "\\AppData\\Roaming\\newdev.dll"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: COLDSTEEL Persistence Service Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-02
Log source: windows/

Description:
Detects the creation of new services potentially related to COLDSTEEL RAT

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": [
      "Name",
      "msupdate",
      "msupdate2"
    ],
    "ImagePath|contains": "\\Windows\\System32\\svchost.exe"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: Potential COLDSTEEL RAT File Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-30
Log source: windows/file_event

Description:
Detects the creation of a file named "dllhost.exe" in the "C:\users\public\Documents\" directory. Seen being used by the COLDSTEEL RAT in some of its variants.

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\users\\public\\Documents\\dllhost.exe"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: COLDSTEEL RAT Anonymous User Process Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-30
Log source: windows/process_creation

Description:
Detects the creation of a process executing as user called "ANONYMOUS" seen used by the "MileStone2016" variant of COLDSTEEL

Detection logic:
{
  "selection": {
    "ParentImage|contains": [
      "\\Windows\\System32\\",
      "\\AppData\\"
    ],
    "User|contains": "ANONYMOUS"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: Potential COLDSTEEL Persistence Service DLL Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-04-30
Log source: windows/file_event

Description:
Detects the creation of a file in a specific location and with a specific name related to COLDSTEEL RAT

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|endswith": "\\AppData\\Roaming\\newdev.dll"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: Injected Browser Process Spawning Rundll32 - GuLoader Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2023-08-07
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects the execution of installed GuLoader malware on the host.
GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\chrome.exe",
      "\\firefox.exe",
      "\\msedge.exe"
    ],
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|endswith": "\\rundll32.exe"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Griffon Malware Attack Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-09
Log source: windows/process_creation

Description:
Detects process execution patterns related to Griffon malware as reported by Kaspersky

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\local\\temp\\",
      "//b /e:jscript",
      ".txt"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
Sigma Detection Rule: Potential Encrypted Registry Blob Related To SNAKE Malware
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-10
Log source: windows/registry_set

Description:
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Classes\\.wav\\OpenWithProgIds\\"
  },
  "filter_main_wav": [
    {
      "TargetObject|endswith": ".AssocFile.WAV"
    },
    {
      "TargetObject|contains": ".wav."
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: SNAKE Malware Service Persistence
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-10
Log source: windows/

Description:
Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName|contains": "WerFaultSvc",
    "ImagePath|startswith": "C:\\Windows\\WinSxS\\",
    "ImagePath|endswith": "\\WerFault.exe"
  },
  "condition": "selection"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: SNAKE Malware WerFault Persistence File Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-10
Log source: windows/file_event

Description:
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\WinSxS\\",
    "TargetFilename|endswith": "\\WerFault.exe"
  },
  "filter_main_system_location": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: SNAKE Malware Covert Store Registry Key
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-11
Log source: windows/registry_event

Description:
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "SECURITY\\Policy\\Secrets\\n"
  },
  "condition": "selection"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: Potential SNAKE Malware Installation Binary Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/process_creation

Description:
Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\jpsetup.exe",
      "\\jpinst.exe"
    ]
  },
  "filter_main_cli_name": {
    "CommandLine": [
      "jpinst.exe",
      "jpinst",
      "jpsetup.exe",
      "jpsetup"
    ]
  },
  "filter_main_cli_empty": {
    "CommandLine": ""
  },
  "filter_main_cli_null": {
    "CommandLine": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: SNAKE Malware Installer Name Indicators
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-10
Log source: windows/file_event

Description:
Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\jpsetup.exe",
      "\\jpinst.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: Potential SNAKE Malware Installation CLI Arguments Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/process_creation

Description:
Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

Detection logic:
{
  "selection": {
    "CommandLine|re": "\\s[a-fA-F0-9]{64}\\s[a-fA-F0-9]{16}"
  },
  "condition": "selection"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: Potential SNAKE Malware Persistence Service Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/process_creation

Description:
Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\services.exe",
    "Image|startswith": "C:\\Windows\\WinSxS\\",
    "Image|endswith": "\\WerFault.exe"
  },
  "condition": "selection"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: SNAKE Malware Kernel Driver File Indicator
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-10
Log source: windows/file_event

Description:
Detects SNAKE malware kernel driver file indicator

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\Windows\\System32\\Com\\Comadmin.dat"
  },
  "condition": "selection"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: IcedID Malware Suspicious Single Digit DLL Execution Via Rundll32
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-31
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects RunDLL32.exe executing a single digit DLL named "1.dll" with the export function "DllRegisterServer". This behaviour was often seen used by malware and especially IcedID

Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|endswith": [
      "\\1.dll, DllRegisterServer",
      " 1.dll, DllRegisterServer"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Sigma Detection Rule: Ursnif Redirection Of Discovery Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2023-07-16
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\explorer.exe",
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "/C ",
      " >> *\\AppData\\local\\temp\\*.bin"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: DarkGate - Autoit3.EXE File Creation By Uncommon Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski
Date: 2023-10-15
ATT&CK techniques: T1105, T1059
Log source: windows/file_event

Description:
Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe.
This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs
process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other
processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\Autoit3.exe",
      "\\curl.exe",
      "\\ExtExport.exe",
      "\\KeyScramblerLogon.exe",
      "\\wmprph.exe"
    ],
    "TargetFilename|endswith": "\\Autoit3.exe"
  },
  "condition": "selection"
}

References:
  - https://github.security.telekom.com/2023/08/darkgate-loader.html
  - https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
  - https://github.com/pr0xylife/DarkGate/tree/main
Sigma Detection Rule: DarkGate - User Created Via Net.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-08-27
ATT&CK techniques: T1136.001
Log source: windows/process_creation

Description:
Detects creation of local users via the net.exe command with the name of "DarkGate"

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains|all": [
      "user",
      "add",
      "DarkGate",
      "SafeMode"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: DarkGate - Autoit3.EXE Execution Parameters
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Micah Babinski
Date: 2023-10-15
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within
the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate
command-and-control server.


Detection logic:
{
  "selection_proc": [
    {
      "Image|endswith": "\\Autoit3.exe"
    },
    {
      "OriginalFileName": "AutoIt3.exe"
    }
  ],
  "selection_parent": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\KeyScramblerLogon.exe",
      "\\msiexec.exe"
    ]
  },
  "filter_main_legit_autoit_location": {
    "Image|endswith": [
      ":\\Program Files (x86)\\AutoIt3\\AutoIt3.exe",
      ":\\Program Files\\AutoIt3\\AutoIt3.exe"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.security.telekom.com/2023/08/darkgate-loader.html
  - https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
  - https://github.com/pr0xylife/DarkGate/tree/main
Sigma Detection Rule: Potential CVE-2023-2283 Exploitation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-06-09
ATT&CK techniques: T1190
Log source: linux/

Description:
Detects potential exploitation attempt of CVE-2023-2283 an authentication bypass in libSSH. The exploitation method causes an error message stating that keys for curve25519 could not be generated. It is an error message that is a sign of an exploitation attempt. It is not a sign of a successful exploitation.

Detection logic:
{
  "keywords": [
    "Failed to generate curve25519 keys"
  ],
  "condition": "keywords"
}

References:
  - https://twitter.com/kevin_backhouse/status/[PII_REDACTED]41357056?s=20
  - https://git.libssh.org/projects/libssh.git/tree/src/curve25519.c#n420
  - https://nvd.nist.gov/vuln/detail/CVE-2023-2283
  - https://www.blumira.com/cve-2023-2283/
  - https://github.com/github/securitylab/tree/1786eaae7f90d87ce633c46bbaa0691d2f9bf449/SecurityExploits/libssh/pubkey-auth-bypass-CVE-2023-2283
Sigma Detection Rule: CVE-2023-1389 Potential Exploitation Attempt - Unauthenticated Command Injection In TP-Link Archer AX21
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Rohit Jain
Date: 2024-06-25
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects potential exploitation attempt of CVE-2023-1389 an Unauthenticated Command Injection in TP-Link Archer AX21.


Detection logic:
{
  "selection_uri": {
    "cs-method": [
      "GET",
      "POST"
    ],
    "cs-uri|contains|all": [
      "/cgi-bin/luci/;stok=/locale",
      "form=country"
    ]
  },
  "selection_keyword": [
    "operation=write",
    "country=$("
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.tenable.com/security/research/tra-2023-11
  - https://github.com/Voyag3r-Security/CVE-2023-1389/blob/4ecada7335b17bf543c0e33b2c9fb6b6215c09ae/archer-rev-shell.py
  - https://www.zerodayinitiative.com/blog/2023/4/21/tp-link-wan-side-vulnerability-cve-2023-1389-added-to-the-mirai-botnet-arsenal
Sigma Detection Rule: Potential Exploitation Attempt Of Undocumented WindowsServer RCE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
Date: 2023-01-21
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects potential exploitation attempt of undocumented Windows Server Pre Auth Remote Code Execution (RCE)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\svchost.exe",
    "Image|endswith": "\\svchost.exe",
    "ParentCommandLine|contains": "-k DHCPServer",
    "CommandLine|contains": "-k DHCPServer",
    "User|contains": [
      "NETWORK SERVICE",
      "NETZWERKDIENST",
      "SERVIZIO DI RETE",
      "SERVICIO DE RED"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/pull/3946
  - https://twitter.com/hackerfantastic/status/[PII_REDACTED]03438592?s=20
Sigma Detection Rule: CVE-2023-23397 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Robert Lee @quantum_cookie
Date: 2023-03-16
Log source: windows/

Description:
Detects outlook initiating connection to a WebDAV or SMB share, which could be a sign of CVE-2023-23397 exploitation.

Detection logic:
{
  "selection": {
    "EventID": [
      4656,
      4663
    ],
    "ProcessName|endswith": "\\OUTLOOK.EXE",
    "ObjectName|contains|all": [
      "\\REGISTRY\\MACHINE\\SYSTEM",
      "Services\\"
    ],
    "ObjectName|endswith": [
      "WebClient\\NetworkProvider",
      "LanmanWorkstation\\NetworkProvider"
    ],
    "AccessList|contains": "%%4416"
  },
  "condition": "selection"
}

References:
  - https://www.trustedsec.com/blog/critical-outlook-vulnerability-in-depth-technical-analysis-and-recommendations-cve-2023-23397/
Sigma Detection Rule: Potential CVE-2023-23397 Exploitation Attempt - SMB
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-05
Log source: windows/

Description:
Detects (failed) outbound connection attempts to internet facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397.

Detection logic:
{
  "selection": {
    "EventID": [
      30803,
      30804,
      30806
    ]
  },
  "filter_main_local_ips": [
    {
      "ServerAddress|cidr": [
        "10.0.0.0/8",
        "127.0.0.0/8",
        "169.254.0.0/16",
        "172.16.0.0/12",
        "192.168.0.0/16",
        "::1/128",
        "fe80::/10",
        "fc00::/7"
      ]
    },
    {
      "Address|startswith": [
        "10.",
        "127.",
        "169.254.",
        "172.",
        "192.168.",
        "::1",
        "fe80::",
        "fc00::"
      ]
    },
    {
      "Address|contains": [
        "[PII_REDACTED][PII_REDACTED][PII_REDACTED]01",
        "FE[PII_REDACTED]0000",
        "FC[PII_REDACTED]0000",
        "0200????C0A8",
        "0200????AC",
        "0200????0A",
        "0200????7F",
        "0200????A9FE"
      ]
    },
    {
      "ServerAddress|contains": [
        "[PII_REDACTED][PII_REDACTED][PII_REDACTED]01",
        "FE[PII_REDACTED]0000",
        "FC[PII_REDACTED]0000",
        "0200????C0A8",
        "0200????AC",
        "0200????0A",
        "0200????7F",
        "0200????A9FE"
      ]
    },
    {
      "RemoteAddress|contains": [
        "[PII_REDACTED][PII_REDACTED][PII_REDACTED]01",
        "FE[PII_REDACTED]0000",
        "FC[PII_REDACTED]0000",
        "0200????C0A8",
        "0200????AC",
        "0200????0A",
        "0200????7F",
        "0200????A9FE"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
  - https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
Sigma Detection Rule: Outlook Task/Note Reminder Received
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-05
ATT&CK techniques: T1137
Log source: windows/registry_set

Description:
Detects changes to the registry values related to outlook that indicates that a reminder was triggered for a Note or Task item. This could be a sign of exploitation of CVE-2023-23397. Further investigation is required to determine the success of an exploitation.

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Office\\",
      "\\Outlook\\"
    ],
    "TargetObject|contains": [
      "\\Tasks\\",
      "\\Notes\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/