deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Access Tool - LogMeIn Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-11
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Description": "LMIGuardianSvc"
    },
    {
      "Product": "LMIGuardianSvc"
    },
    {
      "Company": "LogMeIn, Inc."
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows
Sigma Detection Rule: Indirect Inline Command Execution Via Bash.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-24
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects execution of Microsoft bash launcher with the "-c" flag.
This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        ":\\Windows\\System32\\bash.exe",
        ":\\Windows\\SysWOW64\\bash.exe"
      ]
    },
    {
      "OriginalFileName": "Bash.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -c "
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Bash/
Sigma Detection Rule: Compress Data and Lock With Password for Exfiltration With WINZIP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-27
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Detection logic:
{
  "selection_winzip": {
    "CommandLine|contains": [
      "winzip.exe",
      "winzip64.exe"
    ]
  },
  "selection_password": {
    "CommandLine|contains": "-s\""
  },
  "selection_other": {
    "CommandLine|contains": [
      " -min ",
      " -a "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
Sigma Detection Rule: Potential Suspicious Activity Using SeCEdit
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Janantha Marasinghe
Date: 2022-11-18
ATT&CK techniques: T1685.001, T1547.001, T1505.005, T1556.002, T1685, T1574.007, T1564.002, T1546.008, T1546.007, T1547.014, T1547.010, T1547.002, T1557, T1082
Log source: windows/process_creation

Description:
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\secedit.exe"
    },
    {
      "OriginalFileName": "SeCEdit"
    }
  ],
  "selection_flags_discovery": {
    "CommandLine|contains|all": [
      "/export",
      "/cfg"
    ]
  },
  "selection_flags_configure": {
    "CommandLine|contains|all": [
      "/configure",
      "/db"
    ]
  },
  "condition": "selection_img and (1 of selection_flags_*)"
}

References:
  - https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit
Sigma Detection Rule: Taskkill Symantec Endpoint Protection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ilya Krestinichev, Florian Roth (Nextron Systems)
Date: 2022-09-13
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects one of the possible scenarios for disabling Symantec Endpoint Protection.
Symantec Endpoint Protection antivirus software services incorrectly implement the protected service mechanism.
As a result, the NT AUTHORITY/SYSTEM user can execute the taskkill /im command several times ccSvcHst.exe /f, thereby killing the process belonging to the service, and thus shutting down the service.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "taskkill",
      " /F ",
      " /IM ",
      "ccSvcHst.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.exploit-db.com/exploits/37525
  - https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection
  - https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer
Sigma Detection Rule: CobaltStrike Load by Rundll32
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Wojciech Lesicki
Date: 2021-06-01
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.

Detection logic:
{
  "selection_rundll": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine|contains": [
        "rundll32.exe",
        "rundll32 "
      ]
    }
  ],
  "selection_params": {
    "CommandLine|contains": ".dll",
    "CommandLine|endswith": [
      " StartW",
      ",StartW"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.cobaltstrike.com/help-windows-executable
  - https://redcanary.com/threat-detection-report/
  - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
Sigma Detection Rule: Suspicious FileFix Execution Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: 0xFustang, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-24
ATT&CK techniques: T1204.004
Log source: windows/process_creation

Description:
Detects suspicious FileFix execution patterns where users are tricked into running malicious commands through browser file upload dialog manipulation.
This attack typically begins when users visit malicious websites impersonating legitimate services or news platforms,
which may display fake CAPTCHA challenges or direct instructions to open file explorer and paste clipboard content.
The clipboard content usually contains commands that download and execute malware, such as information stealing tools.


Detection logic:
{
  "selection_exec_parent": {
    "ParentImage|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\firefox.exe",
      "\\msedge.exe"
    ],
    "CommandLine|contains": "#"
  },
  "selection_cli_lolbin": {
    "CommandLine|contains": [
      "%comspec%",
      "bitsadmin",
      "certutil",
      "cmd",
      "cscript",
      "curl",
      "finger",
      "mshta",
      "powershell",
      "pwsh",
      "regsvr32",
      "rundll32",
      "schtasks",
      "wget",
      "wscript"
    ]
  },
  "selection_cli_captcha": {
    "CommandLine|contains": [
      "account",
      "anti-bot",
      "botcheck",
      "captcha",
      "challenge",
      "confirmation",
      "fraud",
      "human",
      "identification",
      "identificator",
      "identity",
      "robot",
      "validation",
      "verification",
      "verify"
    ]
  },
  "condition": "selection_exec_parent and 1 of selection_cli_*"
}

References:
  - https://mrd0x.com/filefix-clickfix-alternative/
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
Sigma Detection Rule: Suspicious Provlaunch.EXE Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-08
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\provlaunch.exe"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\calc.exe",
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\notepad.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "Image|contains": [
        ":\\PerfLogs\\",
        ":\\Temp\\",
        ":\\Users\\Public\\",
        "\\AppData\\Temp\\",
        "\\Windows\\System32\\Tasks\\",
        "\\Windows\\Tasks\\",
        "\\Windows\\Temp\\"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]62153472
Sigma Detection Rule: Persistence Via TypedPaths - CommandLine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-22
Log source: windows/process_creation

Description:
Detects modification addition to the 'TypedPaths' key in the user or admin registry via the commandline. Which might indicate persistence attempt

Detection logic:
{
  "selection": {
    "CommandLine|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TypedPaths"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/dez_/status/[PII_REDACTED]50257154
  - https://forensafe.com/blogs/typedpaths.html
Sigma Detection Rule: Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-05
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
This behavior has been observed in-the-wild by different threat actors.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\iexpress.exe"
    },
    {
      "OriginalFileName": "IEXPRESS.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " /n "
  },
  "selection_paths": {
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
Sigma Detection Rule: Potential Excel.EXE DCOM Lateral Movement Via ActivateMicrosoftApp
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Aaron Stratton
Date: 2023-11-13
ATT&CK techniques: T1021.003
Log source: windows/process_creation

Description:
Detects suspicious child processes of Excel which could be an indicator of lateral movement leveraging the "ActivateMicrosoftApp" Excel DCOM object.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\excel.exe"
  },
  "selection_child": [
    {
      "OriginalFileName": [
        "foxprow.exe",
        "schdplus.exe",
        "winproj.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\foxprow.exe",
        "\\schdplus.exe",
        "\\winproj.exe"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://posts.specterops.io/lateral-movement-abuse-the-power-of-dcom-excel-application-3c016d0d9922
  - https://github.com/grayhatkiller/SharpExShell
  - https://learn.microsoft.com/en-us/office/vba/api/excel.xlmsapplication
Sigma Detection Rule: User Added to Remote Desktop Users Group
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-06
ATT&CK techniques: T1133, T1136.001, T1021.001
Log source: windows/process_creation

Description:
Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".

Detection logic:
{
  "selection_main": [
    {
      "CommandLine|contains|all": [
        "localgroup ",
        " /add"
      ]
    },
    {
      "CommandLine|contains|all": [
        "Add-LocalGroupMember ",
        " -Group "
      ]
    }
  ],
  "selection_group": {
    "CommandLine|contains": [
      "Remote Desktop Users",
      "Utilisateurs du Bureau \u00e0 distance",
      "Usuarios de escritorio remoto"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/
Sigma Detection Rule: Suspicious Kernel Dump Using Dtrace
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-28
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1

Detection logic:
{
  "selection_plain": {
    "Image|endswith": "\\dtrace.exe",
    "CommandLine|contains": "lkd(0)"
  },
  "selection_obfuscated": {
    "CommandLine|contains|all": [
      "syscall:::return",
      "lkd("
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]90208777?s=12
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace
Sigma Detection Rule: ImagingDevices Unusual Parent/Child Processes
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-27
Log source: windows/process_creation

Description:
Detects unusual parent or children of the ImagingDevices.exe (Windows Contacts) process as seen being used with Bumblebee activity

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\WmiPrvSE.exe",
      "\\svchost.exe",
      "\\dllhost.exe"
    ],
    "Image|endswith": "\\ImagingDevices.exe"
  },
  "selection_child": {
    "ParentImage|endswith": "\\ImagingDevices.exe"
  },
  "condition": "1 of selection_*"
}

References:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-07-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Invoke-ATHRemoteFXvGPUDisablementCommand",
      "Invoke-ATHRemoteFXvGPUDisableme"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
Sigma Detection Rule: Bypass UAC via CMSTP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1548.002, T1218.003
Log source: windows/process_creation

Description:
Detect commandline usage of Microsoft Connection Manager Profile Installer (cmstp.exe) to install specially formatted local .INF files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmstp.exe"
    },
    {
      "OriginalFileName": "CMSTP.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "/s",
      "-s",
      "/au",
      "-au",
      "/ni",
      "-ni"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/e584f1a1-c303-4885-8a66-21360c90995b.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.003/T1218.003.md
  - https://lolbas-project.github.io/lolbas/Binaries/Cmstp/
Sigma Detection Rule: Add Insecure Download Source To Winget
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\winget.exe"
    },
    {
      "OriginalFileName": "winget.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "source ",
      "add ",
      "http://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Sigma Detection Rule: Outlook EnableUnsafeClientMailRules Setting Enabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
Date: 2018-12-27
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

Detection logic:
{
  "selection": {
    "CommandLine|contains": "\\Outlook\\Security\\EnableUnsafeClientMailRules"
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44
  - https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048
Sigma Detection Rule: Gzip Archive Decode Via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Hieu Tran
Date: 2023-03-13
ATT&CK techniques: T1132.001
Log source: windows/process_creation

Description:
Detects attempts of decoding encoded Gzip archives via PowerShell.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "GZipStream",
      "::Decompress"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Sigma Detection Rule: Powershell Base64 Encoded MpPreference Cmdlet
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-04
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV

Detection logic:
{
  "selection": [
    {
      "CommandLine|base64offset|contains": [
        "Add-MpPreference ",
        "Set-MpPreference ",
        "add-mppreference ",
        "set-mppreference "
      ]
    },
    {
      "CommandLine|contains": [
        "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA",
        "EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA",
        "BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA",
        "UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA",
        "MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA",
        "TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA",
        "YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA",
        "EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA",
        "hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA",
        "cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA",
        "MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA",
        "zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://twitter.com/AdamTheAnalyst/status/[PII_REDACTED]19590403
Sigma Detection Rule: PowerShell Base64 Encoded Reflective Assembly Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems), pH-T (Nextron Systems)
Date: 2022-03-01
ATT&CK techniques: T1059.001, T1027, T1620
Log source: windows/process_creation

Description:
Detects base64 encoded .NET reflective loading of Assembly

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA",
      "sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA",
      "bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA",
      "AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiAC",
      "BbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgAp",
      "AWwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAK",
      "WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAKQ",
      "sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiACkA",
      "bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgApA",
      "WwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA",
      "sAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA",
      "bAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/Raccine/blob/20a569fa[PII_REDACTED]3dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
Sigma Detection Rule: Group Membership Reconnaissance Via Whoami.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-28
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects the execution of whoami.exe with the /group command line flag to show group membership for the current user, account type, security identifiers (SID), and attributes.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /groups",
      " -groups"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/whoami