deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Startup Item File Created - MacOS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-14
ATT&CK techniques: T1037.005
Log source: macos/file_event

Description:
Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence.
Adversaries may use startup items automatically executed at boot initialization to establish persistence.
Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.


Detection logic:
{
  "selection": {
    "TargetFilename|startswith": [
      "/Library/StartupItems/",
      "/System/Library/StartupItems"
    ],
    "TargetFilename|endswith": ".plist"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md
  - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
Sigma Detection Rule: Suspicious SQL Query
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @juju4
Date: 2022-12-27
ATT&CK techniques: T1190, T1505.001
Log source: /database

Description:
Detects suspicious SQL query keywrods that are often used during recon, exfiltration or destructive activities. Such as dropping tables and selecting wildcard fields

Detection logic:
{
  "keywords": [
    "drop",
    "truncate",
    "dump",
    "select \\*"
  ],
  "condition": "keywords"
}

References:
  - https://github.com/sqlmapproject/sqlmap
Sigma Detection Rule: Antivirus Exploitation Framework Detection
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2018-09-09
ATT&CK techniques: T1203, T1219.002
Log source: /antivirus

Description:
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.


Detection logic:
{
  "selection": {
    "Signature|contains": [
      "Backdoor.Cobalt",
      "Brutel",
      "BruteR",
      "CobaltStr",
      "CobaltStrike",
      "COBEACON",
      "Cometer",
      "Exploit.Script.CVE",
      "IISExchgSpawnCMD",
      "Metasploit",
      "Meterpreter",
      "MeteTool",
      "Mpreter",
      "MsfShell",
      "PowerSploit",
      "Razy",
      "Rozena",
      "Sbelt",
      "Seatbelt",
      "Sliver",
      "Swrort"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/925b0b28472d4d79b4bf92050e38cc2b8f722691c713fc28743ac38551bc3797
  - https://www.virustotal.com/gui/file/8f8daabe1c8ceb[PII_REDACTED]818e16c4aa8059bf2ce345e2f2c90b[PII_REDACTED]
  - https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466
Sigma Detection Rule: Antivirus Hacktool Detection
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2021-08-16
ATT&CK techniques: T1204
Log source: /antivirus

Description:
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.


Detection logic:
{
  "selection": [
    {
      "Signature|startswith": [
        "ATK/",
        "Exploit.Script.CVE",
        "HKTL",
        "HTOOL",
        "PWS.",
        "PWSX",
        "SecurityTool"
      ]
    },
    {
      "Signature|contains": [
        "Adfind",
        "Brutel",
        "BruteR",
        "Cobalt",
        "COBEACON",
        "Cometer",
        "DumpCreds",
        "FastReverseProxy",
        "Hacktool",
        "Havoc",
        "Impacket",
        "Keylogger",
        "Koadic",
        "Mimikatz",
        "Nighthawk",
        "PentestPowerShell",
        "Potato",
        "PowerSploit",
        "PowerSSH",
        "PshlSpy",
        "PSWTool",
        "PWCrack",
        "PWDump",
        "Rozena",
        "Rusthound",
        "Sbelt",
        "Seatbelt",
        "SecurityTool",
        "SharpDump",
        "SharpHound",
        "Shellcode",
        "Sliver",
        "Snaffler",
        "SOAPHound",
        "Splinter",
        "Swrort",
        "TurtleLoader"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/
  - https://www.nextron-systems.com/?s=antivirus
Sigma Detection Rule: Antivirus Relevant File Paths Alerts
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2018-09-09
ATT&CK techniques: T1588
Log source: /antivirus

Description:
Detects an Antivirus alert in a highly relevant file path or with a relevant file name.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.


Detection logic:
{
  "selection_path": {
    "Filename|contains": [
      ":\\PerfLogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\",
      "/www/",
      "\\inetpub\\",
      "\\tsclient\\",
      "apache",
      "nginx",
      "tomcat",
      "weblogic"
    ]
  },
  "selection_ext": {
    "Filename|endswith": [
      ".asax",
      ".ashx",
      ".asmx",
      ".asp",
      ".aspx",
      ".bat",
      ".cfm",
      ".cgi",
      ".chm",
      ".cmd",
      ".dat",
      ".ear",
      ".gif",
      ".hta",
      ".jpeg",
      ".jpg",
      ".jsp",
      ".jspx",
      ".lnk",
      ".msc",
      ".php",
      ".pl",
      ".png",
      ".ps1",
      ".psm1",
      ".py",
      ".pyc",
      ".rb",
      ".scf",
      ".sct",
      ".sh",
      ".svg",
      ".txt",
      ".vbe",
      ".vbs",
      ".war",
      ".wll",
      ".wsf",
      ".wsh",
      ".xll",
      ".xml"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.nextron-systems.com/?s=antivirus
Sigma Detection Rule: Antivirus Web Shell Detection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2018-09-09
ATT&CK techniques: T1505.003
Log source: /antivirus

Description:
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.


Detection logic:
{
  "selection": [
    {
      "Signature|startswith": [
        "ASP.",
        "IIS/BackDoor",
        "JAVA/Backdoor",
        "JSP.",
        "Perl.",
        "PHP.",
        "Troj/ASP",
        "Troj/JSP",
        "Troj/PHP",
        "VBS/Uxor"
      ]
    },
    {
      "Signature|contains": [
        "ASP_",
        "ASP:",
        "ASP.Agent",
        "ASP/",
        "Aspdoor",
        "ASPXSpy",
        "Backdoor.ASP",
        "Backdoor.Java",
        "Backdoor.JSP",
        "Backdoor.PHP",
        "Backdoor.VBS",
        "Backdoor/ASP",
        "Backdoor/Java",
        "Backdoor/JSP",
        "Backdoor/PHP",
        "Backdoor/VBS",
        "C99shell",
        "Chopper",
        "filebrowser",
        "JSP_",
        "JSP:",
        "JSP.Agent",
        "JSP/",
        "Perl:",
        "Perl/",
        "PHP_",
        "PHP:",
        "PHP.Agent",
        "PHP/",
        "PHPShell",
        "PShlSpy",
        "SinoChoper",
        "Trojan.ASP",
        "Trojan.JSP",
        "Trojan.PHP",
        "Trojan.VBS",
        "VBS.Agent",
        "VBS/Agent",
        "Webshell"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/?s=antivirus
  - https://github.com/tennc/webshell
  - https://www.virustotal.com/gui/file/bd1d[PII_REDACTED]6645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection
  - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab[PII_REDACTED]21f64c60d3887a3e8/detection
  - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f[PII_REDACTED]29ad2d7782a72dde9867941f13266310c80/detection
Sigma Detection Rule: Antivirus Password Dumper Detection
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2018-09-09
ATT&CK techniques: T1003, T1558, T1003.001, T1003.002
Log source: /antivirus

Description:
Detects a highly relevant Antivirus alert that reports a password dumper.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.


Detection logic:
{
  "selection": [
    {
      "Signature|startswith": "PWS"
    },
    {
      "Signature|contains": [
        "Certify",
        "DCSync",
        "DumpCreds",
        "DumpLsass",
        "DumpPert",
        "HTool/WCE",
        "Kekeo",
        "Lazagne",
        "LsassDump",
        "Mimikatz",
        "MultiDump",
        "Nanodump",
        "NativeDump",
        "Outflank",
        "PShlSpy",
        "PSWTool",
        "PWCrack",
        "PWDump",
        "PWS.",
        "PWSX",
        "pypykatz",
        "Rubeus",
        "SafetyKatz",
        "SecurityTool",
        "SharpChrome",
        "SharpDPAPI",
        "SharpDump",
        "SharpKatz",
        "SharpS.",
        "ShpKatz",
        "TrickDump"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619
  - https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448
Sigma Detection Rule: Antivirus Ransomware Detection
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Arnim Rupp
Date: 2022-05-12
ATT&CK techniques: T1486
Log source: /antivirus

Description:
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.


Detection logic:
{
  "selection": {
    "Signature|contains": [
      "BlackWorm",
      "Chaos",
      "Cobra",
      "ContiCrypt",
      "Crypter",
      "CRYPTES",
      "Cryptor",
      "CylanCrypt",
      "DelShad",
      "Destructor",
      "Filecoder",
      "GandCrab",
      "GrandCrab",
      "Haperlock",
      "Hiddentear",
      "HydraCrypt",
      "Krypt",
      "Lockbit",
      "Locker",
      "Mallox",
      "Phobos",
      "Ransom",
      "Ryuk",
      "Ryzerlo",
      "Stopcrypt",
      "Tescrypt",
      "TeslaCrypt",
      "WannaCry",
      "Xorist"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/?s=antivirus
  - https://www.virustotal.com/gui/file/43b0f7872900bd234975a[PII_REDACTED]f4f355dc57505517abd1ef611e1ce6916
  - https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7
  - https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045
  - https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d
Sigma Detection Rule: PwnDrp Access
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-04-15
ATT&CK techniques: T1071.001, T1102.001, T1102.003
Log source: /proxy

Description:
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

Detection logic:
{
  "selection": {
    "c-uri|contains": "/pwndrop/"
  },
  "condition": "selection"
}

References:
  - https://breakdev.org/pwndrop/
Sigma Detection Rule: Suspicious External WebDAV Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ahmed Farouk
Date: 2024-05-10
ATT&CK techniques: T1584, T1566
Log source: /proxy

Description:
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.


Detection logic:
{
  "selection_webdav": {
    "c-useragent|startswith": "Microsoft-WebDAV-MiniRedir/",
    "cs-method": "GET"
  },
  "selection_execution": {
    "c-uri|endswith": [
      ".7z",
      ".bat",
      ".dat",
      ".cmd",
      ".exe",
      ".js",
      ".lnk",
      ".ps1",
      ".rar",
      ".url",
      ".vbe",
      ".vbs",
      ".zip"
    ]
  },
  "filter_main_local_ips": {
    "dst_ip|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
  - https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
  - https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
  - https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
Sigma Detection Rule: Flash Player Update from Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-10-25
ATT&CK techniques: T1189, T1204.002, T1036.005
Log source: /proxy

Description:
Detects a flashplayer update from an unofficial location

Detection logic:
{
  "selection": [
    {
      "c-uri|contains": "/flash_install.php"
    },
    {
      "c-uri|endswith": "/install_flash_player.exe"
    }
  ],
  "filter": {
    "cs-host|endswith": ".adobe.com"
  },
  "condition": "selection and not filter"
}

References:
  - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f[PII_REDACTED]35cfb
Sigma Detection Rule: Hack Tool User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-07-08
ATT&CK techniques: T1190, T1110
Log source: /proxy

Description:
Detects suspicious user agent strings user by hack tools in proxy logs

Detection logic:
{
  "selection": {
    "c-useragent|contains": [
      "(hydra)",
      " arachni/",
      " BFAC ",
      " brutus ",
      " cgichk ",
      "core-project/1.0",
      " crimscanner/",
      "datacha0s",
      "dirbuster",
      "domino hunter",
      "dotdotpwn",
      "FHScan Core",
      "floodgate",
      "get-minimal",
      "gootkit auto-rooter scanner",
      "grendel-scan",
      " inspath ",
      "internet ninja",
      "jaascois",
      " zmeu ",
      "masscan",
      " metis ",
      "morfeus fucking scanner",
      "n-stealth",
      "nsauditor",
      "pmafind",
      "security scan",
      "springenwerk",
      "teh forest lobster",
      "toata dragostea",
      " vega/",
      "voideye",
      "webshag",
      "webvulnscan",
      " whcc/",
      " Havij",
      "absinthe",
      "bsqlbf",
      "mysqloit",
      "pangolin",
      "sql power injector",
      "sqlmap",
      "sqlninja",
      "uil2pn",
      "ruler",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb
  - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules
Sigma Detection Rule: HTTP Request With Empty User Agent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-07-08
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects a potentially suspicious empty user agent strings in proxy log.
Could potentially indicate an uncommon request method.


Detection logic:
{
  "selection": {
    "c-useragent": ""
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Carlos_Perez/status/[PII_REDACTED]45931008
Sigma Detection Rule: HackTool - BabyShark Agent Default URL Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-06-09
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects Baby Shark C2 Framework default communication patterns

Detection logic:
{
  "selection": {
    "c-uri|contains": "momyshark\\?key="
  },
  "condition": "selection"
}

References:
  - https://nasbench.medium.com/understanding-detecting-c2-frameworks-babyshark-641be4595845
Sigma Detection Rule: Suspicious User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-07-08
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects suspicious malformed user agent strings in proxy logs

Detection logic:
{
  "selection1": {
    "c-useragent|startswith": [
      "user-agent",
      "Mozilla/3.0 ",
      "Mozilla/2.0 ",
      "Mozilla/1.0 ",
      "Mozilla ",
      " Mozilla/",
      "Mozila/",
      "Mozilla/4.0 (compatible; MSIE 6.0; MS Web Services Client Protocol"
    ]
  },
  "selection2": {
    "c-useragent|contains": [
      " (compatible;MSIE ",
      ".0;Windows NT ",
      "loader"
    ]
  },
  "selection3": {
    "c-useragent": [
      "_",
      "CertUtil URL Agent",
      "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:60.0)",
      "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0",
      "HTTPS",
      "Erbium-UA-4ce7c27cb4be9d32e333bf032c88235a",
      "x",
      "xxx"
    ]
  },
  "falsepositives": [
    {
      "c-useragent": "Mozilla/3.0 * Acrobat *"
    },
    {
      "cs-host|endswith": [
        ".acrobat.com",
        ".adobe.com",
        ".adobe.io"
      ]
    }
  ],
  "condition": "1 of selection* and not falsepositives"
}

References:
  - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb
Sigma Detection Rule: Suspicious Network Communication With IPFS
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Gavin Knapp
Date: 2023-03-16
ATT&CK techniques: T1056
Log source: /proxy

Description:
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.

Detection logic:
{
  "selection": {
    "cs-uri|re": "(?i)(ipfs\\.io/|ipfs\\.io\\s).+\\..+@.+\\.[a-z]+"
  },
  "condition": "selection"
}

References:
  - https://blog.talosintelligence.com/ipfs-abuse/
  - https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11
  - https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638
Sigma Detection Rule: Download From Suspicious TLD - Blacklist
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-11-07
ATT&CK techniques: T1566, T1203, T1204.002
Log source: /proxy

Description:
Detects download of certain file types from hosts in suspicious TLDs

Detection logic:
{
  "selection": {
    "c-uri-extension": [
      "exe",
      "vbs",
      "bat",
      "rar",
      "ps1",
      "doc",
      "docm",
      "xls",
      "xlsm",
      "pptm",
      "rtf",
      "hta",
      "dll",
      "ws",
      "wsf",
      "sct",
      "zip"
    ],
    "cs-host|endswith": [
      ".country",
      ".stream",
      ".gdn",
      ".mom",
      ".xin",
      ".kim",
      ".men",
      ".loan",
      ".download",
      ".racing",
      ".online",
      ".science",
      ".ren",
      ".gb",
      ".win",
      ".top",
      ".review",
      ".vip",
      ".party",
      ".tech",
      ".xyz",
      ".date",
      ".faith",
      ".zip",
      ".cricket",
      ".space",
      ".info",
      ".vn",
      ".cm",
      ".am",
      ".cc",
      ".asia",
      ".ws",
      ".tk",
      ".biz",
      ".su",
      ".st",
      ".ro",
      ".ge",
      ".ms",
      ".pk",
      ".nu",
      ".me",
      ".ph",
      ".to",
      ".tt",
      ".name",
      ".tv",
      ".kz",
      ".tc",
      ".mobi",
      ".study",
      ".click",
      ".link",
      ".trade",
      ".accountant",
      ".cf",
      ".gq",
      ".ml",
      ".ga",
      ".pw"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap
  - https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf
  - https://www.spamhaus.org/statistics/tlds/
  - https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/
Sigma Detection Rule: Suspicious Base64 Encoded User-Agent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects suspicious encoded User-Agent strings, as seen used by some malware.

Detection logic:
{
  "selection": {
    "c-useragent|startswith": [
      "Q2hyb21l",
      "QXBwbGVXZWJLaX",
      "RGFsdmlr",
      "TW96aWxsY"
    ]
  },
  "condition": "selection"
}

References:
  - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop
Sigma Detection Rule: APT User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis
Date: 2019-11-12
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects suspicious user agent strings used in APT malware in proxy logs

Detection logic:
{
  "selection": {
    "c-useragent": [
      "SJZJ (compatible; MSIE 6.0; Win32)",
      "Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0",
      "User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC",
      "Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit)",
      "webclient",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200",
      "Mozilla/4.0 (compatible; MSI 6.0;",
      "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0",
      "Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/",
      "Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2",
      "Mozilla/4.0",
      "Netscape",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7",
      "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1",
      "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727)",
      "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)",
      "Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1)",
      "Mozilla/4.0 (compatible; MSIE 8.0; Win32)",
      "Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1",
      "Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0)",
      "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1;

References:
  - Internal Research
Sigma Detection Rule: Rclone Activity via Proxy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Janantha Marasinghe
Date: 2022-10-18
ATT&CK techniques: T1567.002
Log source: /proxy

Description:
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

Detection logic:
{
  "selection": {
    "c-useragent|startswith": "rclone/v"
  },
  "condition": "selection"
}

References:
  - https://rclone.org/
  - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone