deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Writing Local Admin Share
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1546.002
Log source: windows/file_event

Description:
Aversaries may use to interact with a remote network share using Server Message Block (SMB).
This technique is used by post-exploitation frameworks.


Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      "\\\\\\\\127.0.0",
      "\\ADMIN$\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-4---execute-command-writing-output-to-local-admin-share
Sigma Detection Rule: NTDS Exfiltration Filename Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-11
ATT&CK techniques: T1003.003
Log source: windows/file_event

Description:
Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\All.cab",
      ".ntds.cleartext"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb
  - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1
  - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405
Sigma Detection Rule: HackTool - Powerup Write Hijack DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Subhash Popuri (@pbssubhash)
Date: 2021-08-21
ATT&CK techniques: T1574.001
Log source: windows/file_event

Description:
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation.
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetFilename|endswith": ".bat"
  },
  "condition": "selection"
}

References:
  - https://powersploit.readthedocs.io/en/latest/Privesc/Write-HijackDll/
Sigma Detection Rule: Potentially Suspicious DMP/HDMP File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-07
Log source: windows/file_event

Description:
Detects the creation of a file with the ".dmp"/".hdmp" extension by a shell or scripting application such as "cmd", "powershell", etc. Often created by software during a crash. Memory dumps can sometimes contain sensitive information such as credentials. It's best to determine the source of the crash.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "TargetFilename|endswith": [
      ".dmp",
      ".dump",
      ".hdmp"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps
Sigma Detection Rule: Potential Initial Access via DLL Search Order Hijacking
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch (rule), Elastic (idea)
Date: 2022-10-21
ATT&CK techniques: T1566, T1566.001, T1574, T1574.001
Log source: windows/file_event

Description:
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\winword.exe",
      "\\excel.exe",
      "\\powerpnt.exe",
      "\\MSACCESS.EXE",
      "\\MSPUB.EXE",
      "\\fltldr.exe",
      "\\cmd.exe",
      "\\certutil.exe",
      "\\mshta.exe",
      "\\cscript.exe",
      "\\wscript.exe",
      "\\curl.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetFilename|endswith": ".dll",
    "TargetFilename|contains|all": [
      "\\Users\\",
      "\\AppData\\"
    ],
    "TargetFilename|contains": [
      "\\Microsoft\\OneDrive\\",
      "\\Microsoft OneDrive\\",
      "\\Microsoft\\Teams\\",
      "\\Local\\slack\\app-",
      "\\Local\\Programs\\Microsoft VS Code\\"
    ]
  },
  "filter": {
    "Image|endswith": "\\cmd.exe",
    "TargetFilename|contains|all": [
      "\\Users\\",
      "\\AppData\\",
      "\\Microsoft\\OneDrive\\",
      "\\api-ms-win-core-"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d46dd4ac6866b4337ec126be8cee0e115467b3e8703794ba6f6df6432c806bc
  - https://posts.specterops.io/automating-dll-hijack-discovery-81c4295904b0
Sigma Detection Rule: Suspicious Outlook Macro Created
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
ATT&CK techniques: T1137, T1008, T1546
Log source: windows/file_event

Description:
Detects the creation of a macro file for Outlook.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\Microsoft\\Outlook\\VbaProject.OTM"
  },
  "filter": {
    "Image|endswith": "\\outlook.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53
  - https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/
Sigma Detection Rule: PowerShell Module File Created By Non-PowerShell Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-09
Log source: windows/file_event

Description:
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process

Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "\\WindowsPowerShell\\Modules\\",
      "\\PowerShell\\7\\Modules\\"
    ]
  },
  "filter_main_pwsh": {
    "Image|endswith": [
      ":\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      ":\\Program Files\\PowerShell\\7\\pwsh.exe",
      ":\\Windows\\System32\\poqexec.exe",
      ":\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      ":\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      ":\\Windows\\SysWOW64\\poqexec.exe",
      ":\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      ":\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_main_msiexec": {
    "Image": [
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
  - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
Sigma Detection Rule: WMI Persistence - Script Event Consumer File Write
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thomas Patzke
Date: 2018-03-07
ATT&CK techniques: T1546.003
Log source: windows/file_event

Description:
Detects file writes of WMI script event consumer

Detection logic:
{
  "selection": {
    "Image": "C:\\WINDOWS\\system32\\wbem\\scrcons.exe"
  },
  "condition": "selection"
}

References:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Sigma Detection Rule: Hijack Legit RDP Session to Move Laterally
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-02-21
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder

Detection logic:
{
  "selection": {
    "Image|endswith": "\\mstsc.exe",
    "TargetFilename|contains": "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Renamed VsCode Code Tunnel Execution - File Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-25
Log source: windows/file_event

Description:
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\code_tunnel.json"
  },
  "filter_main_legit_name": {
    "Image|endswith": [
      "\\code-tunnel.exe",
      "\\code.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
Sigma Detection Rule: HackTool - Typical HiveNightmare SAM File Export
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-23
ATT&CK techniques: T1552.001
Log source: windows/file_event

Description:
Detects files written by the different tools that exploit HiveNightmare

Detection logic:
{
  "selection": [
    {
      "TargetFilename|contains": [
        "\\hive_sam_",
        "\\SAM-2021-",
        "\\SAM-2022-",
        "\\SAM-2023-",
        "\\SAM-haxx",
        "\\Sam.save"
      ]
    },
    {
      "TargetFilename": "C:\\windows\\temp\\sam"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/GossiTheDog/HiveNightmare
  - https://github.com/FireFart/hivenightmare/
  - https://github.com/WiredPulse/Invoke-HiveNightmare
  - https://twitter.com/cube0x0/status/[PII_REDACTED]59378944
Sigma Detection Rule: New Custom Shim Database Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-29
ATT&CK techniques: T1547.009
Log source: windows/file_event

Description:
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      ":\\Windows\\apppatch\\Custom\\",
      ":\\Windows\\apppatch\\CustomSDB\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory
  - https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence
  - https://liberty-shell.com/sec/2020/02/25/shim-persistence/
  - https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/
Sigma Detection Rule: Suspicious File Creation In Uncommon AppData Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
Log source: windows/file_event

Description:
Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "\\AppData\\",
    "TargetFilename|endswith": [
      ".bat",
      ".cmd",
      ".cpl",
      ".dll",
      ".exe",
      ".hta",
      ".iso",
      ".lnk",
      ".msi",
      ".ps1",
      ".psm1",
      ".scr",
      ".vbe",
      ".vbs"
    ]
  },
  "filter_main": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": [
      "\\AppData\\Local\\",
      "\\AppData\\LocalLow\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "condition": "selection and not filter_main"
}

References:
  - Internal Research
Sigma Detection Rule: Potential Persistence Via Outlook Form
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-10
ATT&CK techniques: T1137.003
Log source: windows/file_event

Description:
Detects the creation of a new Outlook form which can contain malicious code

Detection logic:
{
  "selection": {
    "Image|endswith": "\\outlook.exe",
    "TargetFilename|contains": [
      "\\AppData\\Local\\Microsoft\\FORMS\\IPM",
      "\\Local Settings\\Application Data\\Microsoft\\Forms"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79
  - https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form
  - https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/
Sigma Detection Rule: BloodHound Collection Files
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: C.J. May
Date: 2022-08-09
ATT&CK techniques: T1087.001, T1087.002, T1482, T1069.001, T1069.002, T1059.001
Log source: windows/file_event

Description:
Detects default file names outputted by the BloodHound collection tool SharpHound

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "BloodHound.zip",
      "_computers.json",
      "_containers.json",
      "_gpos.json",
      "_groups.json",
      "_ous.json",
      "_users.json"
    ]
  },
  "filter_optional_ms_winapps": {
    "Image|endswith": "\\svchost.exe",
    "TargetFilename|startswith": "C:\\Program Files\\WindowsApps\\Microsoft.",
    "TargetFilename|endswith": "\\pocket_containers.json"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection
Sigma Detection Rule: UEFI Persistence Via Wpbbin - FileCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-18
ATT&CK techniques: T1542.001
Log source: windows/file_event

Description:
Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\Windows\\System32\\wpbbin.exe"
  },
  "condition": "selection"
}

References:
  - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
  - https://persistence-info.github.io/Data/wpbbin.html
Sigma Detection Rule: NTDS.DIT Created
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
ATT&CK techniques: T1003.003
Log source: windows/file_event

Description:
Detects creation of a file named "ntds.dit" (Active Directory Database)

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "ntds.dit"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Double Extension Files
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2022-06-19
ATT&CK techniques: T1036.007
Log source: windows/file_event

Description:
Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default.

Detection logic:
{
  "selection_gen": {
    "TargetFilename|endswith": [
      ".exe",
      ".iso",
      ".rar",
      ".svg",
      ".zip"
    ],
    "TargetFilename|contains": [
      ".doc.",
      ".docx.",
      ".gif.",
      ".jpeg.",
      ".jpg.",
      ".mp3.",
      ".mp4.",
      ".pdf.",
      ".png.",
      ".ppt.",
      ".pptx.",
      ".rtf.",
      ".svg.",
      ".txt.",
      ".xls.",
      ".xlsx."
    ]
  },
  "selection_exe": {
    "TargetFilename|endswith": [
      ".rar.exe",
      ".zip.exe"
    ]
  },
  "filter_icons_linux": {
    "TargetFilename|startswith": "/usr/share/icons/"
  },
  "condition": "1 of selection_* and not 1 of filter_*"
}

References:
  - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
  - https://twitter.com/malwrhunterteam/status/[PII_REDACTED]11960321
  - https://twitter.com/luc4m/status/[PII_REDACTED]26254080
Sigma Detection Rule: Suspicious Scheduled Task Write to System32 Tasks
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-16
ATT&CK techniques: T1053
Log source: windows/file_event

Description:
Detects the creation of tasks from processes executed from suspicious locations

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Windows\\System32\\Tasks",
    "Image|contains": [
      "\\AppData\\",
      "C:\\PerfLogs",
      "\\Windows\\System32\\config\\systemprofile"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Drop Binaries Into Spool Drivers Color Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-28
Log source: windows/file_event

Description:
Detects the creation of suspcious binary files inside the "\windows\system32\spool\drivers\color\" as seen in the blog referenced below

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\spool\\drivers\\color\\",
    "TargetFilename|endswith": [
      ".dll",
      ".exe",
      ".sys"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/
Sigma Detection Rule: Suspicious Executable File Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-09-05
ATT&CK techniques: T1564
Log source: windows/file_event

Description:
Detect creation of suspicious executable file names.
Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ":\\$Recycle.Bin.exe",
      ":\\Documents and Settings.exe",
      ":\\MSOCache.exe",
      ":\\PerfLogs.exe",
      ":\\Recovery.exe",
      ".bat.exe",
      ".sys.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae
  - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/
Sigma Detection Rule: Legitimate Application Writing Files In Uncommon Location
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-12-10
ATT&CK techniques: T1218, T1105
Log source: windows/file_event

Description:
Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.
Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\eqnedt32.exe",
      "\\wordpad.exe",
      "\\wordview.exe",
      "\\cmdl32.exe",
      "\\certutil.exe",
      "\\certoc.exe",
      "\\CertReq.exe",
      "\\bitsadmin.exe",
      "\\Desktopimgdownldr.exe",
      "\\esentutl.exe",
      "\\expand.exe",
      "\\extrac32.exe",
      "\\replace.exe",
      "\\mshta.exe",
      "\\ftp.exe",
      "\\Ldifde.exe",
      "\\RdrCEF.exe",
      "\\hh.exe",
      "\\finger.exe",
      "\\findstr.exe"
    ]
  },
  "selection_locations": {
    "TargetFilename|contains": [
      ":\\Perflogs",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\",
      "\\$Recycle.Bin\\",
      "\\AppData\\Local\\",
      "\\AppData\\Roaming\\",
      "\\Contacts\\",
      "\\Desktop\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\inetpub\\wwwroot\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\Start Menu\\Programs\\Startup\\",
      "\\Users\\Default\\",
      "\\Videos\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/#/download
Sigma Detection Rule: Process Explorer Driver Creation By Non-Sysinternals Binary
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-05-05
ATT&CK techniques: T1068
Log source: windows/file_event

Description:
Detects creation of the Process Explorer drivers by processes other than Process Explorer (procexp) itself.
Hack tools or malware may use the Process Explorer driver to elevate privileges, drops it to disk for a few moments, runs a service using that driver and removes it afterwards.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\PROCEXP",
    "TargetFilename|endswith": ".sys"
  },
  "filter_main_process_explorer": {
    "Image|endswith": [
      "\\procexp.exe",
      "\\procexp64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
  - https://github.com/Yaxser/Backstab
  - https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks
  - https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/
Sigma Detection Rule: Office Macro File Creation From Suspicious Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-23
ATT&CK techniques: T1566.001
Log source: windows/file_event

Description:
Detects the creation of a office macro file from a a suspicious process

Detection logic:
{
  "selection_cmd": [
    {
      "Image|endswith": [
        "\\cscript.exe",
        "\\mshta.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "ParentImage|endswith": [
        "\\cscript.exe",
        "\\mshta.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    }
  ],
  "selection_ext": {
    "TargetFilename|endswith": [
      ".docm",
      ".dotm",
      ".xlsm",
      ".xltm",
      ".potm",
      ".pptm"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference