deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Explorer NOUACCHECK Flag
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-23
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects suspicious starts of explorer.exe that use the /NOUACCHECK flag that allows to run all sub processes of that newly started explorer.exe without any UAC checks

Detection logic:
{
  "selection": {
    "Image|endswith": "\\explorer.exe",
    "CommandLine|contains": "/NOUACCHECK"
  },
  "filter_dc_logon": [
    {
      "ParentCommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule"
    },
    {
      "ParentImage": "C:\\Windows\\System32\\svchost.exe"
    }
  ],
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/ORCA6665/status/[PII_REDACTED]44095491
Sigma Detection Rule: Enumerate All Information With Whoami.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-04
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects the execution of "whoami.exe" with the "/all" flag

Detection logic:
{
  "selection_main_img": [
    {
      "Image|endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "selection_main_cli": {
    "CommandLine|contains|windash": " -all"
  },
  "condition": "all of selection_main_*"
}

References:
  - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
  - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s
Sigma Detection Rule: Active Directory Structure Export Via Csvde.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
ATT&CK techniques: T1087.002
Log source: windows/process_creation

Description:
Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\csvde.exe"
    },
    {
      "OriginalFileName": "csvde.exe"
    }
  ],
  "selection_remote": {
    "CommandLine|contains": " -f"
  },
  "filter_import": {
    "CommandLine|contains": " -i"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
  - https://web.archive.org/web/[PII_REDACTED]3601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
  - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
  - https://redcanary.com/blog/msix-installers/
Sigma Detection Rule: Renamed PsExec Service Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-21
Log source: windows/process_creation

Description:
Detects suspicious launch of a renamed version of the PSEXESVC service with, which is not often used by legitimate administrators

Detection logic:
{
  "selection": {
    "OriginalFileName": "psexesvc.exe"
  },
  "filter": {
    "Image": "C:\\Windows\\PSEXESVC.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.youtube.com/watch?v=ro2QuZTIMBM
Sigma Detection Rule: Control Panel Items
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
Date: 2020-06-22
ATT&CK techniques: T1218.002, T1546
Log source: windows/process_creation

Description:
Detects the malicious use of a control panel item

Detection logic:
{
  "selection_reg_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_reg_cli": {
    "CommandLine|contains|all": [
      "add",
      "CurrentVersion\\Control Panel\\CPLs"
    ]
  },
  "selection_cpl": {
    "CommandLine|endswith": ".cpl"
  },
  "filter_cpl_sys": {
    "CommandLine|contains": [
      "\\System32\\",
      "%System%",
      "|C:\\Windows\\system32|"
    ]
  },
  "filter_cpl_igfx": {
    "CommandLine|contains|all": [
      "regsvr32 ",
      " /s ",
      "igfxCPL.cpl"
    ]
  },
  "condition": "all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)"
}

References:
  - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
Sigma Detection Rule: Uncommon Svchost Parent Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-08-15
ATT&CK techniques: T1036.005
Log source: windows/process_creation

Description:
Detects an uncommon svchost parent process

Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe"
  },
  "filter_main_generic": {
    "ParentImage|endswith": [
      "\\Mrt.exe",
      "\\MsMpEng.exe",
      "\\ngen.exe",
      "\\rpcnet.exe",
      "\\services.exe",
      "\\TiWorker.exe"
    ]
  },
  "filter_main_parent_null": {
    "ParentImage": null
  },
  "filter_main_parent_empty": {
    "ParentImage": [
      "-",
      ""
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Potential Execution of Sysinternals Tools
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Markus Neis
Date: 2017-08-28
ATT&CK techniques: T1588.002
Log source: windows/process_creation

Description:
Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools

Detection logic:
{
  "selection": {
    "CommandLine|contains|windash": " -accepteula"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Moti_B/status/[PII_REDACTED]35035392
Sigma Detection Rule: Copying Sensitive Files with Credential Data
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1003.002, T1003.003
Log source: windows/process_creation

Description:
Files with well-known filenames (sensitive files with credential data) copying

Detection logic:
{
  "selection_esent_img": [
    {
      "Image|endswith": "\\esentutl.exe"
    },
    {
      "OriginalFileName": "\\esentutl.exe"
    }
  ],
  "selection_esent_cli": {
    "CommandLine|contains|windash": [
      "vss",
      " /m ",
      " /y "
    ]
  },
  "selection_susp_paths": {
    "CommandLine|contains": [
      "\\config\\RegBack\\sam",
      "\\config\\RegBack\\security",
      "\\config\\RegBack\\system",
      "\\config\\sam",
      "\\config\\security",
      "\\config\\system ",
      "\\repair\\sam",
      "\\repair\\security",
      "\\repair\\system",
      "\\windows\\ntds\\ntds.dit"
    ]
  },
  "condition": "all of selection_esent_* or selection_susp_paths"
}

References:
  - https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Esentutl.yml
Sigma Detection Rule: HackTool - SOAPHound Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2024-01-26
ATT&CK techniques: T1087
Log source: windows/process_creation

Description:
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.


Detection logic:
{
  "selection_1": {
    "CommandLine|contains": [
      " --buildcache ",
      " --bhdump ",
      " --certdump ",
      " --dnsdump "
    ]
  },
  "selection_2": {
    "CommandLine|contains": [
      " -c ",
      " --cachefilename ",
      " -o ",
      " --outputdirectory"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/FalconForceTeam/SOAPHound
  - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
Sigma Detection Rule: Suspicious Use of CSharp Interactive Console
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael R. (@nahamike01)
Date: 2020-03-08
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects the execution of CSharp interactive console by PowerShell

Detection logic:
{
  "selection": {
    "Image|endswith": "\\csi.exe",
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\powershell_ise.exe"
    ],
    "OriginalFileName": "csi.exe"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/
Sigma Detection Rule: Suspicious RASdial Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: juju4
Date: 2019-01-16
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects suspicious process related to rasdial.exe

Detection logic:
{
  "selection": {
    "Image|endswith": "rasdial.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/subTee/status/[PII_REDACTED]07830785
Sigma Detection Rule: PUA - CsExec Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-22
ATT&CK techniques: T1587.001, T1569.002
Log source: windows/process_creation

Description:
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

Detection logic:
{
  "selection": {
    "Image|endswith": "\\csexec.exe"
  },
  "selection_pe": {
    "Description": "csexec"
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/malcomvetter/CSExec
  - https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
Sigma Detection Rule: Windows Share Mount Via Net.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-02
ATT&CK techniques: T1021.002
Log source: windows/process_creation

Description:
Detects when a share is mounted using the "net.exe" utility

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " use ",
      " \\\\\\\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
Sigma Detection Rule: User Added To Highly Privileged Group
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-23
ATT&CK techniques: T1098
Log source: windows/process_creation

Description:
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".

Detection logic:
{
  "selection_main": [
    {
      "CommandLine|contains|all": [
        "localgroup ",
        " /add"
      ]
    },
    {
      "CommandLine|contains|all": [
        "Add-LocalGroupMember ",
        " -Group "
      ]
    }
  ],
  "selection_group": {
    "CommandLine|contains": [
      "Group Policy Creator Owners",
      "Schema Admins"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Sigma Detection Rule: UAC Bypass Using DismHost
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using DismHost DLL hijacking (UACMe 63)

Detection logic:
{
  "selection": {
    "ParentImage|contains|all": [
      "C:\\Users\\",
      "\\AppData\\Local\\Temp\\",
      "\\DismHost.exe"
    ],
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: UAC Bypass Using Windows Media Player - Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32)

Detection logic:
{
  "selection_img_1": {
    "Image": "C:\\Program Files\\Windows Media Player\\osk.exe"
  },
  "selection_img_2": {
    "Image": "C:\\Windows\\System32\\cmd.exe",
    "ParentCommandLine": "\"C:\\Windows\\system32\\mmc.exe\" \"C:\\Windows\\system32\\eventvwr.msc\" /s"
  },
  "selection_integrity": {
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "1 of selection_img_* and selection_integrity"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Remote Access Tool - RURAT Execution From Unusual Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-19
Log source: windows/process_creation

Description:
Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files')

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\rutserv.exe",
        "\\rfusclient.exe"
      ]
    },
    {
      "Product": "Remote Utilities"
    }
  ],
  "filter": {
    "Image|startswith": [
      "C:\\Program Files\\Remote Utilities",
      "C:\\Program Files (x86)\\Remote Utilities"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: WMI Persistence - Script Event Consumer
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Thomas Patzke
Date: 2018-03-07
ATT&CK techniques: T1546.003
Log source: windows/process_creation

Description:
Detects WMI script event consumers

Detection logic:
{
  "selection": {
    "Image": "C:\\WINDOWS\\system32\\wbem\\scrcons.exe",
    "ParentImage": "C:\\Windows\\System32\\svchost.exe"
  },
  "condition": "selection"
}

References:
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Sigma Detection Rule: Suspicious Autorun Registry Modified via WMI
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-17
ATT&CK techniques: T1547.001, T1047
Log source: windows/process_creation

Description:
Detects suspicious activity where the WMIC process is used to create an autorun registry entry via reg.exe, which is often indicative of persistence mechanisms employed by malware.


Detection logic:
{
  "selection_execution_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "ParentImage|endswith": "\\wmiprvse.exe"
    }
  ],
  "selection_execution_cmd": {
    "CommandLine|contains|all": [
      "reg",
      " add "
    ],
    "CommandLine|contains": [
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run"
    ]
  },
  "selection_suspicious_paths_1": {
    "CommandLine|contains": [
      ":\\Perflogs",
      ":\\ProgramData'",
      ":\\Windows\\Temp",
      ":\\Temp",
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming",
      ":\\$Recycle.bin",
      ":\\Users\\Default",
      ":\\Users\\public",
      "%temp%",
      "%tmp%",
      "%Public%",
      "%AppData%"
    ]
  },
  "selection_suspicious_paths_user_1": {
    "CommandLine|contains": ":\\Users\\"
  },
  "selection_suspicious_paths_user_2": {
    "CommandLine|contains": [
      "\\Favorites",
      "\\Favourites",
      "\\Contacts",
      "\\Music",
      "\\Pictures",
      "\\Documents",
      "\\Photos"
    ]
  },
  "condition": "all of selection_execution_* and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_*))"
}

References:
  - Internal Research
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-06
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory.
The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\OfflineScannerShell.exe"
    },
    {
      "OriginalFileName": "OfflineScannerShell.exe"
    }
  ],
  "filter_main_legit_dir": {
    "CurrentDirectory": "C:\\Program Files\\Windows Defender\\Offline\\"
  },
  "filter_main_empty": {
    "CurrentDirectory": ""
  },
  "filter_main_null": {
    "CurrentDirectory": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/
Sigma Detection Rule: Potential Persistence Attempt Via Existing Service Tampering
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-09-29
ATT&CK techniques: T1543.003, T1574.011
Log source: windows/process_creation

Description:
Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.

Detection logic:
{
  "selection_sc": [
    {
      "CommandLine|contains|all": [
        "sc ",
        "config ",
        "binpath="
      ]
    },
    {
      "CommandLine|contains|all": [
        "sc ",
        "failure",
        "command="
      ]
    }
  ],
  "selection_reg_img": [
    {
      "CommandLine|contains|all": [
        "reg ",
        "add ",
        "FailureCommand"
      ]
    },
    {
      "CommandLine|contains|all": [
        "reg ",
        "add ",
        "ImagePath"
      ]
    }
  ],
  "selection_reg_ext": {
    "CommandLine|contains": [
      ".sh",
      ".exe",
      ".dll",
      ".bin$",
      ".bat",
      ".cmd",
      ".js",
      ".msh$",
      ".reg$",
      ".scr",
      ".ps",
      ".vb",
      ".jar",
      ".pl"
    ]
  },
  "condition": "selection_sc or all of selection_reg_*"
}

References:
  - https://pentestlab.blog/2020/01/22/persistence-modify-existing-service/
Sigma Detection Rule: Execute Code with Pester.bat
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1059.001, T1216
Log source: windows/process_creation

Description:
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Detection logic:
{
  "powershell_module": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains|all": [
      "Pester",
      "Get-Help"
    ]
  },
  "cmd_execution": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "pester",
      ";"
    ]
  },
  "get_help": {
    "CommandLine|contains": [
      "help",
      "\\?"
    ]
  },
  "condition": "powershell_module or (cmd_execution and get_help)"
}

References:
  - https://twitter.com/Oddvarmoe/status/[PII_REDACTED]44258816
  - https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
Sigma Detection Rule: HackTool - PPID Spoofing SelectMyParent Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-23
ATT&CK techniques: T1134.004
Log source: windows/process_creation

Description:
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SelectMyParent.exe"
    },
    {
      "CommandLine|contains": [
        "PPID-spoof",
        "ppid_spoof",
        "spoof-ppid",
        "spoof_ppid",
        "ppidspoof",
        "spoofppid",
        "spoofedppid",
        " -spawnto "
      ]
    },
    {
      "OriginalFileName|contains": [
        "PPID-spoof",
        "ppid_spoof",
        "spoof-ppid",
        "spoof_ppid",
        "ppidspoof",
        "spoofppid",
        "spoofedppid"
      ]
    },
    {
      "Description": "SelectMyParent"
    },
    {
      "Hashes|contains": [
        "IMPHASH=04D974875BD225F00902B4CAD9AF3FBC",
        "IMPHASH=A782AF154C9E743DDF3F3EB2B8F3D16E",
        "IMPHASH=89059503D7FBF470E68F7E63313DA3AD",
        "IMPHASH=CA[PII_REDACTED]5C8281AB8A130B3D6BAD"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://pentestlab.blog/2020/02/24/parent-pid-spoofing/
  - https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks
  - https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing
  - https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files
Sigma Detection Rule: File In Suspicious Location Encoded To Base64 Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files are located in potentially suspicious locations

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-encode"
  },
  "selection_extension": {
    "CommandLine|contains": [
      "\\AppData\\Roaming\\",
      "\\Desktop\\",
      "\\Local\\Temp\\",
      "\\PerfLogs\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\",
      "$Recycle.Bin"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior
  - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior
  - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior
  - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior