deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Access Tool - ScreenConnect Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Description": "ScreenConnect Service"
    },
    {
      "Product": "ScreenConnect"
    },
    {
      "Company": "ScreenConnect Software"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows
Sigma Detection Rule: Potential Recon Activity Using DriverQuery.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-19
Log source: windows/process_creation

Description:
Detect usage of the "driverquery" utility to perform reconnaissance on installed drivers

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "driverquery.exe"
    },
    {
      "OriginalFileName": "drvqry.exe"
    }
  ],
  "selection_parent": [
    {
      "ParentImage|endswith": [
        "\\cscript.exe",
        "\\mshta.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "ParentImage|contains": [
        "\\AppData\\Local\\",
        "\\Users\\Public\\",
        "\\Windows\\Temp\\"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
  - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
  - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
Sigma Detection Rule: Hidden Powershell in Link File Pattern
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-06
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects events that appear when a user click on a link file with a powershell command in it

Detection logic:
{
  "selection": {
    "ParentImage": "C:\\Windows\\explorer.exe",
    "Image": "C:\\Windows\\System32\\cmd.exe",
    "CommandLine|contains|all": [
      "powershell",
      ".lnk"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.x86matthew.com/view_post?id=embed_exe_lnk
Sigma Detection Rule: Sensitive File Dump Via Print.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ayush Anand (Securityinbits)
Date: 2026-04-28
ATT&CK techniques: T1003.003, T1003.002, T1218
Log source: windows/process_creation

Description:
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\print.exe"
    },
    {
      "OriginalFileName": "Print.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "/D",
    "CommandLine|contains": [
      "\\config\\SAM",
      "\\config\\SECURITY",
      "\\config\\SYSTEM",
      "\\windows\\ntds\\ntds.dit"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
  - https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2
  - https://lolbas-project.github.io/lolbas/Binaries/Print/
Sigma Detection Rule: File Encryption Using Gpg4win
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-09
Log source: windows/process_creation

Description:
Detects usage of Gpg4win to encrypt files

Detection logic:
{
  "selection_metadata": [
    {
      "Image|endswith": [
        "\\gpg.exe",
        "\\gpg2.exe"
      ]
    },
    {
      "Description": "GnuPG\u2019s OpenPGP tool"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -c ",
      "passphrase"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://www.gpg4win.de/documentation.html
  - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
Sigma Detection Rule: Run PowerShell Script from Redirected Input Stream
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community
Date: 2020-10-17
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects PowerShell script execution via input stream redirect

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|re": "\\s-\\s*<"
  },
  "condition": "selection"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Powershell.yml
  - https://twitter.com/Moriarty_Meng/status/[PII_REDACTED]83370752
Sigma Detection Rule: Suspicious Runscripthelper.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects execution of powershell scripts via Runscripthelper.exe

Detection logic:
{
  "selection": {
    "Image|endswith": "\\Runscripthelper.exe",
    "CommandLine|contains": "surfacecheck"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Runscripthelper/
Sigma Detection Rule: Service StartupType Change Via PowerShell Set-Service
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-04
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\powershell.exe"
    },
    {
      "OriginalFileName": "PowerShell.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "Set-Service",
      "-StartupType"
    ],
    "CommandLine|contains": [
      "Disabled",
      "Manual"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/38283b775552da[PII_REDACTED]ea74191aa0d203edd3f61fb2dee7b0aea3514955
Sigma Detection Rule: Windows Recovery Environment Disabled Via Reagentc
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Daniel Koifman (KoifSec), Michael Vilshin
Date: 2025-07-31
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects attempts to disable windows recovery environment using Reagentc.
ReAgentc.exe is a command-line tool in Windows used to manage the Windows Recovery Environment (WinRE).
It allows users to enable, disable, and configure WinRE, which is used for troubleshooting and repairing common boot issues.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reagentc.exe"
    },
    {
      "OriginalFileName": "reagentc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "/disable"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
  - https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
Sigma Detection Rule: Invoke-Obfuscation VAR+ Launcher
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated use of Environment Variables to execute PowerShell

Detection logic:
{
  "selection": {
    "CommandLine|re": "cmd.{0,5}(?:/c|/r)(?:\\s|)\\\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\\\"\\s+?\\-f(?:.*\\)){1,}.*\\\""
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: PUA - PingCastle Execution From Potentially Suspicious Parent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2024-01-11
ATT&CK techniques: T1595
Log source: windows/process_creation

Description:
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.


Detection logic:
{
  "selection_parent_ext": {
    "ParentCommandLine|contains": [
      ".bat",
      ".chm",
      ".cmd",
      ".hta",
      ".htm",
      ".html",
      ".js",
      ".lnk",
      ".ps1",
      ".vbe",
      ".vbs",
      ".wsf"
    ]
  },
  "selection_parent_path_1": {
    "ParentCommandLine|contains": [
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming\\",
      "\\Temporary Internet"
    ]
  },
  "selection_parent_path_2": [
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "ParentCommandLine|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    }
  ],
  "selection_cli": [
    {
      "Image|endswith": "\\PingCastle.exe"
    },
    {
      "OriginalFileName": "PingCastle.exe"
    },
    {
      "Product": "Ping Castle"
    },
    {
      "CommandLine|contains": [
        "--scanner aclcheck",
        "--scanner antivirus",
        "--scanner computerversion",
        "--scanner foreignusers",
        "--scanner laps_bitlocker",
        "--scanner localadmin",
        "--scanner nullsession",
        "--scanner nullsession-trust",
        "--scanner oxidbindings",
        "--scanner remote",
        "--scanner share",
        "--scanner smb",
        "--scanner smb3que

References:
  - https://github.com/vletoux/pingcastle
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d[PII_REDACTED]07da36a58/Functions/Start-ADEnum.ps1#L450
  - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
  - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
Sigma Detection Rule: MSHTA Execution with Suspicious File Extensions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2019-02-22
ATT&CK techniques: T1140, T1218.005, T1059.007
Log source: windows/process_creation

Description:
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mshta.exe"
    },
    {
      "OriginalFileName": "mshta.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      ".7z",
      ".avi",
      ".bat",
      ".bmp",
      ".conf",
      ".csv",
      ".dll",
      ".doc",
      ".gif",
      ".gz",
      ".ini",
      ".jpe",
      ".jpg",
      ".json",
      ".lnk",
      ".log",
      ".mkv",
      ".mp3",
      ".mp4",
      ".pdf",
      ".png",
      ".ppt",
      ".rar",
      ".rtf",
      ".svg",
      ".tar",
      ".tmp",
      ".txt",
      ".xls",
      ".xml",
      ".yaml",
      ".yml",
      ".zip",
      "vbscript"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - http://blog.sevagas.com/?Hacking-around-HTA-files
  - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356
  - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script
  - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997
  - https://twitter.com/mattifestation/status/[PII_REDACTED]02563846
Sigma Detection Rule: OpenEDR Spawning Command Shell
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: @kostastsale
Date: 2026-02-19
ATT&CK techniques: T1059.003, T1021.004, T1219
Log source: windows/process_creation

Description:
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.


Detection logic:
{
  "selection_img": {
    "ParentImage|endswith": "\\ITSMService.exe",
    "Image|endswith": "\\ssh-shellhost.exe",
    "CommandLine|contains": "--pty"
  },
  "selection_cli_shell": {
    "CommandLine|contains": [
      "bash",
      "cmd",
      "powershell",
      "pwsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
Sigma Detection Rule: HackTool - CreateMiniDump Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-12-22
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\CreateMiniDump.exe"
    },
    {
      "Hashes|contains": "IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f"
    }
  ],
  "condition": "selection"
}

References:
  - https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass
Sigma Detection Rule: Suspicious SYSTEM User Process Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
Date: 2021-12-20
ATT&CK techniques: T1134, T1003, T1027
Log source: windows/process_creation

Description:
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "selection_special": [
    {
      "Image|endswith": [
        "\\calc.exe",
        "\\cscript.exe",
        "\\forfiles.exe",
        "\\hh.exe",
        "\\mshta.exe",
        "\\ping.exe",
        "\\wscript.exe"
      ]
    },
    {
      "CommandLine|re": "net\\s+user\\s+"
    },
    {
      "CommandLine|contains": [
        " -NoP ",
        " -W Hidden ",
        " -decode ",
        " /decode ",
        " /urlcache ",
        " -urlcache ",
        " -e* JAB",
        " -e* SUVYI",
        " -e* SQBFAFgA",
        " -e* aWV4I",
        " -e* IAB",
        " -e* PAA",
        " -e* aQBlAHgA",
        "vssadmin delete shadows",
        "reg SAVE HKLM",
        " -ma ",
        "Microsoft\\Windows\\CurrentVersion\\Run",
        ".downloadstring(",
        ".downloadfile(",
        " /ticket:",
        "dpapi::",
        "event::clear",
        "event::drop",
        "id::modify",
        "kerberos::",
        "lsadump::",
        "misc::",
        "privilege::",
        "rpc::",
        "sekurlsa::",
        "sid::",
        "token::",
        "vault::cred",
        "vault::list",
        " p::d ",
        ";iex(",
        "MiniDump"
      ]
    }
  ],
  "filter_main_ping": {
    "CommandLine|contains|all": [
      "ping",
      "127.0.0.1",
      " -n "
    ]
  },
  "filter_vs": {
    "Image|endswith": "\\PING.EXE",


References:
  - Internal Research
  - https://tools.thehacker.recipes/mimikatz/modules
Sigma Detection Rule: AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Detection logic:
{
  "contains_format_pretty_arg": {
    "CommandLine|contains": [
      "format:pretty",
      "format:\"pretty\"",
      "format:\"text\"",
      "format:text"
    ]
  },
  "image_from_system_folder": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "contains_winrm": {
    "CommandLine|contains": "winrm"
  },
  "condition": "contains_winrm and (contains_format_pretty_arg and not image_from_system_folder)"
}

References:
  - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404
Sigma Detection Rule: Use Of The SFTP.EXE Binary As A LOLBIN
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-10
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag

Detection logic:
{
  "selection": {
    "Image|endswith": "\\sftp.exe",
    "CommandLine|contains": [
      " -D ..",
      " -D C:\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/264
Sigma Detection Rule: Explorer Process Tree Break
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber
Date: 2019-06-29
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,
which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"


Detection logic:
{
  "selection_factory": {
    "CommandLine|contains": "/factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b}"
  },
  "selection_root": {
    "CommandLine|contains": "explorer.exe",
    "CommandLine|contains|windash": " /root,"
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/CyberRaiju/status/[PII_REDACTED]22058752
  - https://twitter.com/bohops/status/[PII_REDACTED]54909188?s=12
  - https://twitter.com/nas_bench/status/[PII_REDACTED]58233858
  - https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/
Sigma Detection Rule: Malicious PE Execution by Microsoft Visual Studio Debugger
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community
Date: 2020-10-14
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger.
This option may be used adversaries to execute malicious code by signed verified binary.
The debugger is installed alongside with Microsoft Visual Studio package.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\vsjitdebugger.exe"
  },
  "reduction1": {
    "Image|endswith": "\\vsimmersiveactivatehelper*.exe"
  },
  "reduction2": {
    "Image|endswith": "\\devenv.exe"
  },
  "condition": "selection and not (reduction1 or reduction2)"
}

References:
  - https://twitter.com/pabraeken/status/[PII_REDACTED]20452353
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/
  - https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
Sigma Detection Rule: Esentutl Steals Browser Information
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1005
Log source: windows/process_creation

Description:
One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\esentutl.exe"
    },
    {
      "OriginalFileName": "esentutl.exe"
    }
  ],
  "selection_flag": {
    "CommandLine|contains|windash": "-r"
  },
  "selection_webcache": {
    "CommandLine|contains": "\\Windows\\WebCache"
  },
  "condition": "all of selection*"
}

References:
  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
  - https://redcanary.com/threat-detection-report/threats/qbot/
  - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
Sigma Detection Rule: UAC Bypass via ICMLuaUtil
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Elastic (idea)
Date: 2022-09-13
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using ICMLuaUtil Elevated COM interface

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\dllhost.exe",
    "ParentCommandLine|contains": [
      "/Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",
      "/Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}"
    ]
  },
  "filter": [
    {
      "Image|endswith": "\\WerFault.exe"
    },
    {
      "OriginalFileName": "WerFault.exe"
    }
  ],
  "condition": "selection and not filter"
}

References:
  - https://www.elastic.co/guide/en/security/current/uac-bypass-via-icmluautil-elevated-com-interface.html
Sigma Detection Rule: Potential Arbitrary Command Execution Using Msdt.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-29
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\msdt.exe"
    },
    {
      "OriginalFileName": "msdt.exe"
    }
  ],
  "selection_cmd_inline": {
    "CommandLine|contains": "IT_BrowseForFile="
  },
  "selection_cmd_answerfile_flag": {
    "CommandLine|contains": " PCWDiagnostic"
  },
  "selection_cmd_answerfile_param": {
    "CommandLine|contains|windash": " -af "
  },
  "condition": "selection_img and (selection_cmd_inline or all of selection_cmd_answerfile_*)"
}

References:
  - https://twitter.com/nao_sec/status/[PII_REDACTED]79401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
  - https://twitter.com/_JohnHammond/status/[PII_REDACTED]67675648