deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PUA - System Informer Driver Load
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-05-08
ATT&CK techniques: T1543
Log source: windows/driver_load

Description:
Detects driver load of the System Informer tool

Detection logic:
{
  "selection": [
    {
      "ImageLoaded|endswith": "\\SystemInformer.sys"
    },
    {
      "Hashes|contains": [
        "SHA256=8B9AD98944AC9886EA4CB07700E71B78BE4A2740934BB7E46CA3B56A7C59AD24",
        "SHA256=A41348BEC147CA4D9EA[PII_REDACTED]EB5CEA2E20202AF599D2B30625433BCF454",
        "SHA256=38EE0A88AF8535A11EFE8D8DA9C6812AA07067B75A64D99705A742589BDD846D",
        "SHA256=A773891ACF203A7EB0C0D30942FB1347648F1CD918AE2BFD9A4857B4DCF5081B",
        "SHA256=4C3B81AC88A987BBDF7D41FA0AECC2CEDF5B9BD2F45E7A21F376D05345FC211D",
        "SHA256=3241BC14BEC51CE6A691B9A3562E5C1D52E9D057D27A3D67FD0B245C350B6D34",
        "SHA256=047C42E9BBA[PII_REDACTED]7C7DAFC1E043FB038C796422D[PII_REDACTED]7D68EE89",
        "SHA256=18931DC81E95D0020466FA091E16869DBE824E543A4C2C8FE644FA71A0F44FEB",
        "SHA256=B4C2EF76C204273132FDE38F0DED641C2C5EE767652E64E4C4071A4A973B6C1B",
        "SHA256=640954AFC268565F7DAA6E6F81A8EE05311E33E34332B501A3C3FE5B22ADEA97",
        "SHA256=251BE949F662C838718F8AA0A5F8211FB90346D02BD63FF91E6B224E0E01B656",
        "SHA256=E2606F272F7BA054DF16BE464FDA57211EF0D14A0D959F9C8DCB0575DF1186E4",
        "SHA256=3A9E1D17BEEB514F1B9B3BACAEE7420285DE5CBDCE89C5319A992C6CBD1DE138"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://systeminformer.sourceforge.io/
  - https://github.com/winsiderss/systeminformer
Sigma Detection Rule: Driver Load From A Temporary Directory
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-02-12
ATT&CK techniques: T1543.003
Log source: windows/driver_load

Description:
Detects a driver load from a temporary directory

Detection logic:
{
  "selection": {
    "ImageLoaded|contains": "\\Temp\\"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: PUA - Process Hacker Driver Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-11-16
ATT&CK techniques: T1543
Log source: windows/driver_load

Description:
Detects driver load of the Process Hacker tool

Detection logic:
{
  "selection": [
    {
      "ImageLoaded|endswith": "\\kprocesshacker.sys"
    },
    {
      "Hashes|contains": [
        "IMPHASH=821D74031D3F625BCBD0DF08B70F1E77",
        "IMPHASH=F86759BB4DE[PII_REDACTED]DC06E998A39",
        "IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18",
        "IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://processhacker.sourceforge.io/
Sigma Detection Rule: Malicious Driver Load By Name
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-03
ATT&CK techniques: T1543.003, T1068
Log source: windows/driver_load

Description:
Detects loading of known malicious drivers via the file name of the drivers.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\wfshbr64.sys",
      "\\ktmutil7odm.sys",
      "\\ktes.sys",
      "\\a26363e7b02b13f2b8d697abb90cd5c3.sys",
      "\\kt2.sys",
      "\\[PII_REDACTED]bd56c2d93c21cab91e82a5.sys",
      "\\malicious.sys",
      "\\a236e7d654cd932b7d11cb604629a2d0.sys",
      "\\spwizimgvt.sys",
      "\\c94f405c5929cfcccc8ad00b42c95083.sys",
      "\\fur.sys",
      "\\wantd.sys",
      "\\windbg.sys",
      "\\4118b86e490aed091b1a219dba45f332.sys",
      "\\gmer64.sys",
      "\\1fc7aeeff3ab19004d2e53eae8160ab1.sys",
      "\\poortry2.sys",
      "\\wintapix.sys",
      "\\daxin_blank6.sys",
      "\\6771b13a53b9c7449d4891e427735ea2.sys",
      "\\blacklotus_driver.sys",
      "\\air_system10.sys",
      "\\dkrtk.sys",
      "\\7.sys",
      "\\sense5ext.sys",
      "\\ktgn.sys",
      "\\ndislan.sys",
      "\\nlslexicons0024uvn.sys",
      "\\be[PII_REDACTED]e589080df02bb3ca6e6a.sys",
      "\\4.sys",
      "\\wantd_2.sys",
      "\\e29f6311ae87542b3d693c1f38e4e3ad.sys",
      "\\daxin_blank3.sys",
      "\\gftkyj64.sys",
      "\\daxin_blank2.sys",
      "\\wantd_4.sys",
      "\\reddriver.sys",
      "\\834761775.sys",
      "\\mlgbbiicaihflrnh.sys",
      "\\mjj0ge.sys",
      "\\daxin_blank.sys",
      "\\daxin_blank5.sys",
      "\\poortry1.sys",
      "\\msqpq.sys",
      "\\mimidrv.sys",
      "\\e939448b28a4edc81f1f974cebf6e7d2.sys",
      "\\prokiller64.sys",
      "\\nodedriver.sys",
      "\\wantd_3.sys",
      "\\lctka.sys",
  

References:
  - https://loldrivers.io/
Sigma Detection Rule: Potentially Suspicious Self Extraction Directive File Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-02-05
ATT&CK techniques: T1218
Log source: windows/file_executable_detected

Description:
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".sed"
  },
  "condition": "selection"
}

References:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
Sigma Detection Rule: Access To Crypto Currency Wallets By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2024-07-29
ATT&CK techniques: T1003
Log source: windows/file_access

Description:
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.


Detection logic:
{
  "selection": [
    {
      "FileName|contains": [
        "\\AppData\\Roaming\\Ethereum\\keystore\\",
        "\\AppData\\Roaming\\EthereumClassic\\keystore\\",
        "\\AppData\\Roaming\\monero\\wallets\\"
      ]
    },
    {
      "FileName|endswith": [
        "\\AppData\\Roaming\\Bitcoin\\wallet.dat",
        "\\AppData\\Roaming\\BitcoinABC\\wallet.dat",
        "\\AppData\\Roaming\\BitcoinSV\\wallet.dat",
        "\\AppData\\Roaming\\DashCore\\wallet.dat",
        "\\AppData\\Roaming\\DogeCoin\\wallet.dat",
        "\\AppData\\Roaming\\Litecoin\\wallet.dat",
        "\\AppData\\Roaming\\Ripple\\wallet.dat",
        "\\AppData\\Roaming\\Zcash\\wallet.dat"
      ]
    }
  ],
  "filter_main_system": {
    "Image": "System"
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_optional_defender": {
    "Image|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\",
    "Image|endswith": [
      "\\MpCopyAccelerator.exe",
      "\\MsMpEng.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Internal Research
Sigma Detection Rule: Credential Manager Access By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-11
ATT&CK techniques: T1003
Log source: windows/file_access

Description:
Detects suspicious processes based on name and location that access the windows credential manager and vault.
Which can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::cred" function


Detection logic:
{
  "selection": {
    "FileName|contains": [
      "\\AppData\\Local\\Microsoft\\Credentials\\",
      "\\AppData\\Roaming\\Microsoft\\Credentials\\",
      "\\AppData\\Local\\Microsoft\\Vault\\",
      "\\ProgramData\\Microsoft\\Vault\\"
    ]
  },
  "filter_system_folders": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Microsoft Teams Sensitive File Access By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @SerkinValery
Date: 2024-07-22
ATT&CK techniques: T1528
Log source: windows/file_access

Description:
Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.


Detection logic:
{
  "selection": {
    "FileName|contains": [
      "\\Microsoft\\Teams\\Cookies",
      "\\Microsoft\\Teams\\Local Storage\\leveldb"
    ]
  },
  "filter_main_legit_location": {
    "Image|endswith": "\\Microsoft\\Teams\\current\\Teams.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  - https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
Sigma Detection Rule: Access To Potentially Sensitive Sysvol Files By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-12-21
ATT&CK techniques: T1552.006
Log source: windows/file_access

Description:
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.

Detection logic:
{
  "selection": {
    "FileName|startswith": "\\\\",
    "FileName|contains|all": [
      "\\sysvol\\",
      "\\Policies\\"
    ],
    "FileName|endswith": [
      "audit.csv",
      "Files.xml",
      "GptTmpl.inf",
      "groups.xml",
      "Registry.pol",
      "Registry.xml",
      "scheduledtasks.xml",
      "scripts.ini",
      "services.xml"
    ]
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_main_explorer": {
    "Image": "C:\\Windows\\explorer.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/vletoux/pingcastle
Sigma Detection Rule: Access To Windows Credential History File By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
ATT&CK techniques: T1555.004
Log source: windows/file_access

Description:
Detects file access requests to the Windows Credential History File by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function


Detection logic:
{
  "selection": {
    "FileName|endswith": "\\Microsoft\\Protect\\CREDHIST"
  },
  "filter_main_system_folders": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "filter_main_explorer": {
    "Image": "C:\\Windows\\explorer.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist
  - https://www.passcape.com/windows_password_recovery_dpapi_credhist
Sigma Detection Rule: Suspicious File Access to Browser Credential Storage
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: frack113, X__Junior (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems), Parth-FourCore
Date: 2025-05-22
ATT&CK techniques: T1555.003, T1217
Log source: windows/file_access

Description:
Detects file access to browser credential storage paths by non-browser processes, which may indicate credential access attempts.
Adversaries may attempt to access browser credential storage to extract sensitive information such as usernames and passwords or cookies.
This behavior is often commonly observed in credential stealing malware.


Detection logic:
{
  "selection_browser_paths": {
    "FileName|contains": [
      "\\Sputnik\\Sputnik",
      "\\MapleStudio\\ChromePlus",
      "\\QIP Surf",
      "\\BlackHawk",
      "\\7Star\\7Star",
      "\\CatalinaGroup\\Citrio",
      "\\Google\\Chrome",
      "\\Coowon\\Coowon",
      "\\CocCoc\\Browser",
      "\\uCozMedia\\Uran",
      "\\Tencent\\QQBrowser",
      "\\Orbitum",
      "\\Slimjet",
      "\\Iridium",
      "\\Vivaldi",
      "\\Chromium",
      "\\GhostBrowser",
      "\\CentBrowser",
      "\\Xvast",
      "\\Chedot",
      "\\SuperBird",
      "\\360Browser\\Browser",
      "\\360Chrome\\Chrome",
      "\\Comodo\\Dragon",
      "\\BraveSoftware\\Brave-Browser",
      "\\Torch",
      "\\UCBrowser\\",
      "\\Blisk",
      "\\Epic Privacy Browser",
      "\\Nichrome",
      "\\Amigo",
      "\\Kometa",
      "\\Xpom",
      "\\Microsoft\\Edge",
      "\\Liebao7Default\\EncryptedStorage",
      "\\AVAST Software\\Browser",
      "\\Kinza",
      "\\Mozilla\\SeaMonkey\\",
      "\\Comodo\\IceDragon\\",
      "\\8pecxstudios\\Cyberfox\\",
      "\\FlashPeak\\SlimBrowser\\",
      "\\Moonchild Productions\\Pale Moon\\"
    ]
  },
  "selection_browser_subpaths": {
    "FileName|contains": [
      "\\Profiles\\",
      "\\User Data"
    ]
  },
  "selection_cred_files": [
    {
      "FileName|contains": [
        "\\Login Data",
        "\\Cookies",
        "\\EncryptedStorage",
        "\\WebCache\\"
      ]
    },
    {
      "FileName|endswith": [
        "cert9.db",

References:
  - https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1
  - https://fourcore.io/blogs/threat-hunting-browser-credential-stealing
Sigma Detection Rule: Access To Windows DPAPI Master Keys By Uncommon Applications
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
ATT&CK techniques: T1555.004
Log source: windows/file_access

Description:
Detects file access requests to the the Windows Data Protection API Master keys by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::masterkey" function


Detection logic:
{
  "selection": {
    "FileName|contains": [
      "\\Microsoft\\Protect\\S-1-5-18\\",
      "\\Microsoft\\Protect\\S-1-5-21-"
    ]
  },
  "filter_system_folders": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\",
      "C:\\Windows\\system32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
  - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords
Sigma Detection Rule: Tomcat WebServer Logs Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-16
ATT&CK techniques: T1070
Log source: windows/file_delete

Description:
Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      "\\Tomcat",
      "\\logs\\"
    ],
    "TargetFilename|contains": [
      "catalina.",
      "_access_log.",
      "localhost."
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
  - https://linuxhint.com/view-tomcat-logs-windows/
Sigma Detection Rule: TeamViewer Log File Deleted
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-16
ATT&CK techniques: T1070.004
Log source: windows/file_delete

Description:
Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\TeamViewer_",
    "TargetFilename|endswith": ".log"
  },
  "filter": {
    "Image": "C:\\Windows\\system32\\svchost.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
Sigma Detection Rule: PowerShell Console History Logs Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1070
Log source: windows/file_delete

Description:
Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\PSReadLine\\ConsoleHost_history.txt"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: EventLog EVTX File Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1070
Log source: windows/file_delete

Description:
Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\winevt\\Logs\\",
    "TargetFilename|endswith": ".evtx"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Backup Files Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-02
ATT&CK techniques: T1490
Log source: windows/file_delete

Description:
Detects deletion of files with extensions often used for backup files. Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wt.exe",
      "\\rundll32.exe",
      "\\regsvr32.exe"
    ],
    "TargetFilename|endswith": [
      ".VHD",
      ".bac",
      ".bak",
      ".wbcat",
      ".bkf",
      ".set",
      ".win",
      ".dsk"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-6---windows---delete-backup-files
Sigma Detection Rule: ADS Zone.Identifier Deleted By Uncommon Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-04
ATT&CK techniques: T1070.004
Log source: windows/file_delete

Description:
Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ":Zone.Identifier"
  },
  "filter_main_generic": {
    "Image": [
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "C:\\Windows\\SysWOW64\\explorer.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_optional_browsers_chrome": {
    "Image": [
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_browsers_firefox": {
    "Image": [
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_optional_browsers_msedge": {
    "Image": [
      "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
      "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/
  - Internal Research
Sigma Detection Rule: Process Deletion of Its Own Executable
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2024-09-03
Log source: windows/file_delete

Description:
Detects the deletion of a process's executable by itself. This is usually not possible without workarounds and may be used by malware to hide its traces.


Detection logic:
{
  "selection": {
    "TargetFilename|fieldref": "Image"
  },
  "condition": "selection"
}

References:
  - https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
Sigma Detection Rule: Unusual File Deletion by Dns.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch (Nextron Systems), Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1133
Log source: windows/file_delete

Description:
Detects an unexpected file being deleted by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\dns.exe"
  },
  "filter": {
    "TargetFilename|endswith": "\\dns.log"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
Sigma Detection Rule: Exchange PowerShell Cmdlet History Deleted
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-26
ATT&CK techniques: T1070
Log source: windows/file_delete

Description:
Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "\\Logging\\CmdletInfra\\LocalPowerShell\\Cmdlet\\",
    "TargetFilename|contains": "_Cmdlet_"
  },
  "condition": "selection"
}

References:
  - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
Sigma Detection Rule: File Deleted Via Sysinternals SDelete
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1070.004
Log source: windows/file_delete

Description:
Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ".AAA",
      ".ZZZ"
    ]
  },
  "filter_wireshark": {
    "TargetFilename|endswith": "\\Wireshark\\radius\\dictionary.alcatel-lucent.aaa"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/9
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.B.4_83D62033-105A-4A02-8B75-DAB52D8D51EC.md
Sigma Detection Rule: Prefetch File Deleted
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Cedric MAURUGEON
Date: 2021-09-29
ATT&CK techniques: T1070.004
Log source: windows/file_delete

Description:
Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

Detection logic:
{
  "selection": {
    "TargetFilename|contains": ":\\Windows\\Prefetch\\",
    "TargetFilename|endswith": ".pf"
  },
  "filter_main_svchost": {
    "Image|endswith": ":\\windows\\system32\\svchost.exe",
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
  - https://www.group-ib.com/blog/hunting-for-ttps-with-prefetch-files/