deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Malicious AppX Package Installation Attempts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/

Description:
Detects potential installation or installation attempts of known malicious appx packages

Detection logic:
{
  "selection": {
    "EventID": [
      400,
      401
    ],
    "PackageFullName|contains": "3669e262-ec02-4e9d-bcb4-3d008b4afac9"
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/
Sigma Detection Rule: Deployment Of The AppX Package Was Blocked By The Policy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-01-11
Log source: windows/

Description:
Detects an appx package deployment that was blocked by the local computer policy.
The following events indicate that an AppX package deployment was blocked by a policy:
- Event ID 441: The package deployment operation is blocked by the "Allow deployment operations in special profiles" policy
- Event ID 442: Deployments to non-system volumes are blocked by the "Disable deployment of Windows Store apps to non-system volumes" policy."
- Event ID 453: Package blocked by a platform policy.
- Event ID 454: Package blocked by a platform policy.


Detection logic:
{
  "selection": {
    "EventID": [
      441,
      442,
      453,
      454
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
Sigma Detection Rule: AppX Located in Known Staging Directory Added to Deployment Pipeline
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/

Description:
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory.


Detection logic:
{
  "selection_eid": {
    "EventID": 854
  },
  "selection_paths_forward": {
    "Path|contains": [
      ":/Perflogs/",
      ":/Users/Public/",
      ":/Windows/Temp/",
      "/AppdData/Local/Temp/",
      "/Desktop/",
      "/Downloads/"
    ]
  },
  "selection_paths_back": {
    "Path|contains": [
      ":\\PerfLogs\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppdData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\"
    ]
  },
  "condition": "selection_eid and 1 of selection_paths_*"
}

References:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
Sigma Detection Rule: Windows AppX Deployment Full Trust Package Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-03
ATT&CK techniques: T1204.002, T1553.005
Log source: windows/

Description:
Detects the installation of MSIX/AppX packages with full trust privileges which run with elevated privileges outside normal AppX container restrictions

Detection logic:
{
  "selection": {
    "EventID": 400,
    "HasFullTrust": true
  },
  "filter_main_legitpath": {
    "PackageSourceUri|startswith": [
      "file:///C:/Program%20Files/",
      "file:///C:/Program%20Files%20(x86)/"
    ]
  },
  "filter_main_microsoft": [
    {
      "PackageSourceUri|startswith": "https://go.microsoft.com/fwlink/?linkid"
    },
    {
      "PackageSourceUri|contains": [
        ".cdn.microsoft.com",
        ".cdn.office.net/"
      ]
    }
  ],
  "filter_main_callerprocess": {
    "CallingProcess|startswith": [
      "sysprep.exe",
      "svchost.exe,AppReadiness"
    ]
  },
  "filter_optional_x_update": {
    "PackageSourceUri|startswith": "x-windowsupdate://"
  },
  "filter_optional_microsoftclient": {
    "PackageFullName|startswith": "MicrosoftWindows.Client."
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
Sigma Detection Rule: AppX Package Deployment Failed Due to Signing Requirements
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/

Description:
Detects an appx package deployment / installation with the error code "0x80073cff" which indicates that the package didn't meet the signing requirements.


Detection logic:
{
  "selection": {
    "EventID": 401,
    "ErrorCode": "0x80073cff"
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
Sigma Detection Rule: Deployment AppX Package Was Blocked By AppLocker
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-01-11
Log source: windows/

Description:
Detects an appx package deployment that was blocked by AppLocker policy.

Detection logic:
{
  "selection": {
    "EventID": 412
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWEventsList/CSV/Windows11/22H2/W11_22H2_Pro_20220920_22621.382/Providers/Microsoft-Windows-AppXDeployment-Server.csv
Sigma Detection Rule: Remote AppX Package Downloaded from File Sharing or CDN Domain
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/

Description:
Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain.


Detection logic:
{
  "selection": {
    "EventID": 854,
    "Path|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
Sigma Detection Rule: AppX Located in Uncommon Directory Added to Deployment Pipeline
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-11
Log source: windows/

Description:
Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in uncommon locations.


Detection logic:
{
  "selection": {
    "EventID": 854
  },
  "filter_main_generic": {
    "Path|contains": [
      ":/Program%20Files",
      ":/Windows/System32/",
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\ImmersiveControlPanel\\",
      ":\\Windows\\PrintDialog\\",
      ":\\Windows\\SystemApps\\",
      "AppData/Local/Temp/WinGet/Microsoft.Winget.Source",
      "x-windowsupdate://"
    ]
  },
  "filter_main_specific": {
    "Path|contains": [
      "https://installer.teams.static.microsoft/",
      "https://res.cdn.office.net",
      "https://statics.teams.cdn.live.net/",
      "https://statics.teams.cdn.office.net/",
      "microsoft.com"
    ]
  },
  "filter_optional_onedrive": {
    "Path|contains": "AppData\\Local\\Microsoft\\OneDrive\\"
  },
  "filter_optional_winget": {
    "Path|contains": [
      "AppData/Local/Temp/WinGet/Microsoft.Winget.Source",
      "AppData\\Local\\Temp\\WinGet\\Microsoft.Winget.Source"
    ]
  },
  "filter_optional_x_windowsupdate": {
    "Path|contains": "x-windowsupdate://"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Internal Research
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
  - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
Sigma Detection Rule: Crash Dump Created By Operating System
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Jason Mull
Date: 2025-05-12
ATT&CK techniques: T1003.002, T1005
Log source: windows/

Description:
Detects "BugCheck" errors indicating the system rebooted due to a crash, capturing the bugcheck code, dump file path, and report ID.

Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-WER-SystemErrorReporting",
    "EventID": 1001
  },
  "condition": "selection"
}

References:
  - https://www.sans.edu/cyber-research/from-crash-compromise-unlocking-potential-windows-crash-dumps-offensive-security/
  - https://jasonmull.com/articles/offensive/2025-05-12-windows-crash-dumps-offensive-security/
Sigma Detection Rule: Local Privilege Escalation Indicator TabTip
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-07
ATT&CK techniques: T1557.001
Log source: windows/

Description:
Detects the invocation of TabTip via CLSID as seen when JuicyPotatoNG is used on a system in brute force mode

Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-DistributedCOM",
    "EventID": 10001,
    "param1": "C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe",
    "param2":[PII_REDACTED],
    "param3": "{054AAE20-4BEA-4347-8A35-64A533254A9D}"
  },
  "condition": "selection"
}

References:
  - https://github.com/antonioCoco/JuicyPotatoNG
Sigma Detection Rule: ISATAP Router Address Was Set
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: hamid
Date: 2025-10-19
ATT&CK techniques: T1557, T1565.002
Log source: windows/

Description:
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6.
In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic.
This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.


Detection logic:
{
  "selection": {
    "EventID": 4100,
    "Provider_Name": "Microsoft-Windows-Iphlpsvc"
  },
  "filter_main_localhost": {
    "IsatapRouter": [
      "127.0.0.1",
      "::1"
    ]
  },
  "filter_optional_null": {
    "IsatapRouter": null
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
  - https://redfoxsec.com/blog/ipv6-dns-takeover/
  - https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
  - https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
Sigma Detection Rule: Active Directory Certificate Services Denied Certificate Enrollment Request
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: @SerkinValery
Date: 2024-03-07
ATT&CK techniques: T1553.004
Log source: windows/

Description:
Detects denied requests by Active Directory Certificate Services.
Example of these requests denial include issues with permissions on the certificate template or invalid signatures.


Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-CertificationAuthority",
    "EventID": 53
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
  - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
Sigma Detection Rule: DHCP Server Loaded the CallOut DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Dimitrios Slamaris
Date: 2017-05-15
ATT&CK techniques: T1574.001
Log source: windows/

Description:
This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded

Detection logic:
{
  "selection": {
    "EventID": 1033,
    "Provider_Name": "Microsoft-Windows-DHCP-Server"
  },
  "condition": "selection"
}

References:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
Sigma Detection Rule: DHCP Server Error Failed Loading the CallOut DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Dimitrios Slamaris, @atc_project (fix)
Date: 2017-05-15
ATT&CK techniques: T1574.001
Log source: windows/

Description:
This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded

Detection logic:
{
  "selection": {
    "EventID": [
      1031,
      1032,
      1034
    ],
    "Provider_Name": "Microsoft-Windows-DHCP-Server"
  },
  "condition": "selection"
}

References:
  - https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html
  - https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx
  - https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx
Sigma Detection Rule: NTLMv1 Logon Between Client and Server
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-04-26
ATT&CK techniques: T1550.002
Log source: windows/

Description:
Detects the reporting of NTLMv1 being used between a client and server. NTLMv1 is insecure as the underlying encryption algorithms can be brute-forced by modern hardware.

Detection logic:
{
  "selection": {
    "Provider_Name": "LsaSrv",
    "EventID": [
      6038,
      6039
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/22H2/W10_22H2_Pro_20230321_19045.2728/WEPExplorer/LsaSrv.xml
Sigma Detection Rule: NTFS Vulnerability Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-11
ATT&CK techniques: T1499.001
Log source: windows/

Description:
This the exploitation of a NTFS vulnerability as reported without many details via Twitter

Detection logic:
{
  "selection": {
    "Provider_Name": "Ntfs",
    "EventID": 55,
    "Origin": "File System Driver",
    "Description|contains|all": [
      "contains a corrupted file record",
      "The name of the file is \"\\\""
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/jonasLyk/status/[PII_REDACTED]00811010
  - https://twitter.com/wdormann/status/[PII_REDACTED]09809921
  - https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/
Sigma Detection Rule: Volume Shadow Copy Mount
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
Date: 2020-10-20
ATT&CK techniques: T1003.002
Log source: windows/

Description:
Detects volume shadow copy mount via Windows event log

Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-Ntfs",
    "EventID": 98,
    "DeviceName|contains": "HarddiskVolumeShadowCopy"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
Sigma Detection Rule: No Suitable Encryption Key Found For Generating Kerberos Ticket
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: @SerkinValery
Date: 2024-03-07
ATT&CK techniques: T1558.003
Log source: windows/

Description:
Detects errors when a target server doesn't have suitable keys for generating kerberos tickets.
This issue can occur for example when a service uses a user account or a computer account that is configured for only DES encryption on a computer that is running Windows 7 which has DES encryption for Kerberos authentication disabled.


Detection logic:
{
  "selection": {
    "Provider_Name": [
      "Kerberos-Key-Distribution-Center",
      "Microsoft-Windows-Kerberos-Key-Distribution-Center"
    ],
    "EventID": [
      16,
      27
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled
Sigma Detection Rule: Certificate Use With No Strong Mapping
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @br4dy5
Date: 2023-10-09
Log source: windows/

Description:
Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)
This could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.
Events where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.


Detection logic:
{
  "selection": {
    "Provider_Name": [
      "Kerberos-Key-Distribution-Center",
      "Microsoft-Windows-Kerberos-Key-Distribution-Center"
    ],
    "EventID": [
      39,
      41
    ]
  },
  "condition": "selection"
}

References:
  - https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16
Sigma Detection Rule: Windows Update Error
Repository: SigmaHQ/sigma
Severity: informational
Status: stable
Author: frack113
Date: 2021-12-04
ATT&CK techniques: T1584
Log source: windows/

Description:
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.


Detection logic:
{
  "selection": {
    "Provider_Name": "Microsoft-Windows-WindowsUpdateClient",
    "EventID": [
      16,
      20,
      24,
      213,
      217
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
Sigma Detection Rule: Zerologon Exploitation Using Well-known Tools
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1210
Log source: windows/

Description:
This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname.

Detection logic:
{
  "selection": {
    "EventID": [
      5805,
      5723
    ]
  },
  "keywords": [
    "kali",
    "mimikatz"
  ],
  "condition": "selection and keywords"
}

References:
  - https://www.secura.com/blog/zero-logon
  - https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382
Sigma Detection Rule: Vulnerable Netlogon Secure Channel Connection Allowed
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: NVISO
Date: 2020-09-15
ATT&CK techniques: T1548
Log source: windows/

Description:
Detects that a vulnerable Netlogon secure channel connection was allowed, which could be an indicator of CVE-2020-1472.

Detection logic:
{
  "selection": {
    "Provider_Name": "NetLogon",
    "EventID": 5829
  },
  "condition": "selection"
}

References:
  - https://support.microsoft.com/en-us/help/4557222/how-to-manage-the-changes-in-netlogon-secure-channel-connections-assoc
Sigma Detection Rule: Important Windows Eventlog Cleared
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-17
ATT&CK techniques: T1685.005
Log source: windows/

Description:
Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution

Detection logic:
{
  "selection": {
    "EventID": 104,
    "Provider_Name": "Microsoft-Windows-Eventlog",
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "Microsoft-Windows-Sysmon/Operational",
      "PowerShellCore/Operational",
      "Security",
      "System",
      "Windows PowerShell"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/deviouspolack/status/[PII_REDACTED]60209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
Sigma Detection Rule: Eventlog Cleared
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-01-10
ATT&CK techniques: T1685.005
Log source: windows/

Description:
One of the Windows Eventlogs has been cleared. e.g. caused by "wevtutil cl" command execution

Detection logic:
{
  "selection": {
    "EventID": 104,
    "Provider_Name": "Microsoft-Windows-Eventlog"
  },
  "filter_main_covered": {
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "Microsoft-Windows-Sysmon/Operational",
      "PowerShellCore/Operational",
      "Security",
      "System",
      "Windows PowerShell"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/deviouspolack/status/[PII_REDACTED]60209408
  - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100
Sigma Detection Rule: Sysmon Application Crashed
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Shelton
Date: 2022-04-26
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects application popup reporting a failure of the Sysmon service

Detection logic:
{
  "selection": {
    "Provider_Name": "Application Popup",
    "EventID": 26,
    "Caption": [
      "sysmon64.exe - Application Error",
      "sysmon.exe - Application Error"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1803/W10_1803_Pro_19700101_17134.1/WEPExplorer/Application%20Popup.xml#L36