deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Windows Backup Deleted Via Wbadmin.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-13
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects the deletion of backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "delete ",
      "backup"
    ]
  },
  "filter_main_keep_versions": {
    "CommandLine|contains": "keepVersions:0"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
  - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted
  - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
Sigma Detection Rule: Exchange PowerShell Snap-Ins Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-03-03
ATT&CK techniques: T1059.001, T1114
Log source: windows/process_creation

Description:
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "Add-PSSnapin"
  },
  "selection_module": {
    "CommandLine|contains": [
      "Microsoft.Exchange.Powershell.Snapin",
      "Microsoft.Exchange.Management.PowerShell.SnapIn"
    ]
  },
  "filter_msiexec": {
    "ParentImage": "C:\\Windows\\System32\\msiexec.exe",
    "CommandLine|contains": "$exserver=Get-ExchangeServer ([Environment]::MachineName) -ErrorVariable exerr 2> $null"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://www.intrinsec.com/apt27-analysis/
Sigma Detection Rule: Visual Studio Code Tunnel Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), citron_ninja
Date: 2023-10-25
ATT&CK techniques: T1071.001, T1219
Log source: windows/process_creation

Description:
Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Detection logic:
{
  "selection_only_tunnel": {
    "OriginalFileName": null,
    "CommandLine|endswith": ".exe tunnel"
  },
  "selection_tunnel_args": {
    "CommandLine|contains|all": [
      ".exe tunnel",
      "--accept-server-license-terms"
    ]
  },
  "selection_parent_tunnel": {
    "ParentCommandLine|endswith": " tunnel",
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "/d /c ",
      "\\servers\\Stable-",
      "code-server.cmd"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
Sigma Detection Rule: Netsh Allow Group Policy on Microsoft Defender Firewall
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-09
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Adversaries may modify system firewalls in order to bypass controls limiting network usage

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "advfirewall",
      "firewall",
      "set",
      "rule",
      "group=",
      "new",
      "enable=Yes"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior
Sigma Detection Rule: HackTool - Inveigh Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-24
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the use of Inveigh a cross-platform .NET IPv4/IPv6 machine-in-the-middle tool

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Inveigh.exe"
    },
    {
      "OriginalFileName": [
        "\\Inveigh.exe",
        "\\Inveigh.dll"
      ]
    },
    {
      "Description": "Inveigh"
    },
    {
      "CommandLine|contains": [
        " -SpooferIP",
        " -ReplyToIPs ",
        " -ReplyToDomains ",
        " -ReplyToMACs ",
        " -SnifferIP"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/Kevin-Robertson/Inveigh
  - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
Sigma Detection Rule: PUA - Nimgrab Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-08-28
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.

Detection logic:
{
  "selection_name": {
    "Image|endswith": "\\nimgrab.exe"
  },
  "selection_hashes": {
    "Hashes|contains": [
      "MD5=2DD44C3C29D667F5C0EF5F9D7C7FFB8B",
      "SHA256=F266609E91985F0FE3E31C5E8FAEEEC4FFA5E0322D8B6F15FE69F4C5165B9559",
      "IMPHASH=C07FDDD21D123EA9B3A08EEF44AAAC45"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md
Sigma Detection Rule: Suspicious MsiExec Embedding Parent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-16
ATT&CK techniques: T1218.007
Log source: windows/process_creation

Description:
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\cmd.exe"
    ],
    "ParentCommandLine|contains|all": [
      "MsiExec.exe",
      "-Embedding "
    ]
  },
  "filter_splunk_ufw": {
    "Image|endswith": ":\\Windows\\System32\\cmd.exe",
    "CommandLine|contains": "C:\\Program Files\\SplunkUniversalForwarder\\bin\\"
  },
  "filter_vs": [
    {
      "CommandLine|contains": "\\DismFoDInstall.cmd"
    },
    {
      "ParentCommandLine|contains|all": [
        "\\MsiExec.exe -Embedding ",
        "Global\\MSI0000"
      ]
    }
  ],
  "condition": "selection and not 1 of filter*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
Sigma Detection Rule: Suspicious X509Enrollment - Process Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-23
ATT&CK techniques: T1553.004
Log source: windows/process_creation

Description:
Detect use of X509Enrollment

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "X509Enrollment.CBinaryConverter",
      "884e2002-217d-11da-b2a4-000e7bbb2b09"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
  - https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
Sigma Detection Rule: HackTool - UACMe Akagi Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata

Detection logic:
{
  "selection_pe": [
    {
      "Product": "UACMe"
    },
    {
      "Company": [
        "REvol Corp",
        "APT 92",
        "UG North",
        "Hazardous Environments",
        "CD Project Rekt"
      ]
    },
    {
      "Description": [
        "UACMe main module",
        "Pentesting utility"
      ]
    },
    {
      "OriginalFileName": [
        "Akagi.exe",
        "Akagi64.exe"
      ]
    }
  ],
  "selection_img": {
    "Image|endswith": [
      "\\Akagi64.exe",
      "\\Akagi.exe"
    ]
  },
  "selection_hashes_sysmon": {
    "Hashes|contains": [
      "IMPHASH=767637C23BB42CD5D7397CF58B0BE688",
      "IMPHASH=14C4E4C72BA075E9069EE67F39188AD8",
      "IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC",
      "IMPHASH=7D010C6BB6A3726F327F7E239166D127",
      "IMPHASH=89159BA4DD04E4CE5559F132A9964EB3",
      "IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F",
      "IMPHASH=5834ED4291BDEB928270428EBBAF7604",
      "IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38",
      "IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894",
      "IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74",
      "IMPHASH=3DE09703C8E79ED2CA3F[PII_REDACTED]6B"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: HackTool - HandleKatz LSASS Dumper Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-18
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the use of HandleKatz, a tool that demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same

Detection logic:
{
  "selection_loader_img": {
    "Image|endswith": "\\loader.exe",
    "CommandLine|contains": "--pid:"
  },
  "selection_loader_imphash": {
    "Hashes|contains": [
      "IMPHASH=38D9E015591BBFD4929E0D0F47FA0055",
      "IMPHASH=0E2216679CA6E1094D63322E3412D650"
    ]
  },
  "selection_flags": {
    "CommandLine|contains|all": [
      "--pid:",
      "--outfile:"
    ],
    "CommandLine|contains": [
      ".dmp",
      "lsass",
      ".obf",
      "dump"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/codewhitesec/HandleKatz
Sigma Detection Rule: Suspicious Modification Of Scheduled Tasks
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-28
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects when an attacker tries to modify an already existing scheduled tasks to run from a suspicious location
Attackers can create a simple looking task in order to avoid detection on creation as it's often the most focused on
Instead they modify the task after creation to include their malicious payload


Detection logic:
{
  "selection_schtasks": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      " /Change ",
      " /TN "
    ]
  },
  "selection_susp_locations": {
    "CommandLine|contains": [
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming\\",
      "\\Users\\Public\\",
      "\\WINDOWS\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Temporary Internet",
      "C:\\ProgramData\\",
      "C:\\Perflogs\\",
      "%ProgramData%",
      "%appdata%",
      "%comspec%",
      "%localappdata%"
    ]
  },
  "selection_susp_images": {
    "CommandLine|contains": [
      "regsvr32",
      "rundll32",
      "cmd /c ",
      "cmd /k ",
      "cmd /r ",
      "cmd.exe /c ",
      "cmd.exe /k ",
      "cmd.exe /r ",
      "powershell",
      "mshta",
      "wscript",
      "cscript",
      "certutil",
      "bitsadmin",
      "bash.exe",
      "bash ",
      "scrcons",
      "wmic ",
      "wmic.exe",
      "forfiles",
      "scriptrunner",
      "hh.exe",
      "hh "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks
Sigma Detection Rule: Fsutil Suspicious Invocation
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ecco, E.M. Anhaus, oscd.community
Date: 2019-09-26
ATT&CK techniques: T1070, T1485
Log source: windows/process_creation

Description:
Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc).
Might be used by ransomwares during the attack (seen by NotPetya and others).


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\fsutil.exe"
    },
    {
      "OriginalFileName": "fsutil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "deletejournal",
      "createjournal",
      "setZeroData"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md
  - https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html
  - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  - https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt
Sigma Detection Rule: Set Suspicious Files as System Files Using Attrib.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1564.001
Log source: windows/process_creation

Description:
Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\attrib.exe"
    },
    {
      "OriginalFileName": "ATTRIB.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " +s"
  },
  "selection_paths": {
    "CommandLine|contains": [
      " %",
      "\\Users\\Public\\",
      "\\AppData\\Local\\",
      "\\ProgramData\\",
      "\\Downloads\\",
      "\\Windows\\Temp\\"
    ]
  },
  "selection_ext": {
    "CommandLine|contains": [
      ".bat",
      ".dll",
      ".exe",
      ".hta",
      ".ps1",
      ".vbe",
      ".vbs"
    ]
  },
  "filter_optional_installer": {
    "CommandLine|contains|all": [
      "\\Windows\\TEMP\\",
      ".exe"
    ]
  },
  "condition": "all of selection* and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4
  - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0
  - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
Sigma Detection Rule: Potential Windows Defender Tampering Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-12-11
ATT&CK techniques: T1047, T1685
Log source: windows/process_creation

Description:
Detects potential tampering with Windows Defender settings such as adding exclusion using wmic

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Image|endswith": "\\WMIC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "/Namespace:\\\\\\\\root\\\\Microsoft\\\\Windows\\\\Defender"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md
  - https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/
  - https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/
Sigma Detection Rule: Invoke-Obfuscation STDIN+ Launcher
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated use of stdin to execute PowerShell

Detection logic:
{
  "selection": {
    "CommandLine|re": "cmd.{0,5}(?:/c|/r).+powershell.+(?:\\$\\{?input\\}?|noexit).+\\\""
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Potential Remote SquiblyTwo Technique Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1047, T1220, T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI)
to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process
malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript.
The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it
with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common
LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.


Detection logic:
{
  "selection_pe": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E",
        "IMPHASH=37777A96245A3C74EB217308F3546F4C",
        "IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206",
        "IMPHASH=B12619881D79C3ACADF45E752A58554A",
        "IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "/format:",
    "CommandLine|contains": [
      "://",
      "\\\\\\\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
  - https://twitter.com/mattifestation/status/[PII_REDACTED]42595328
  - https://atomicredteam.io/defense-evasion/T1220/
  - https://lolbas-project.github.io/lolbas/Binaries/Wmic/
  - https://x.com/byrne_emmy12099/status/[PII_REDACTED]26658668
Sigma Detection Rule: Permission Misconfiguration Reconnaissance Via Findstr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1552.006
Log source: windows/process_creation

Description:
Detects usage of findstr with the "EVERYONE" or "BUILTIN" keywords.
This was seen being used in combination with "icacls" and other utilities to spot misconfigured files or folders permissions.


Detection logic:
{
  "selection_findstr_img": [
    {
      "Image|endswith": [
        "\\find.exe",
        "\\findstr.exe"
      ]
    },
    {
      "OriginalFileName": [
        "FIND.EXE",
        "FINDSTR.EXE"
      ]
    }
  ],
  "selection_findstr_cli": {
    "CommandLine|contains": [
      "\"Everyone\"",
      "'Everyone'",
      "\"BUILTIN\\\\\"",
      "'BUILTIN\\'"
    ]
  },
  "selection_special": {
    "CommandLine|contains|all": [
      "icacls ",
      "findstr ",
      "Everyone"
    ]
  },
  "condition": "all of selection_findstr_* or selection_special"
}

References:
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Potentially Suspicious DLL Registered Via Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" with the "REGSVR" action where the DLL in question doesn't contain a ".dll" extension. Which is often used as a method to evade defenses.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "REGSVR "
  },
  "filter_main_dll_ext": {
    "CommandLine|contains": ".dll"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html
Sigma Detection Rule: Potential Meterpreter/CobaltStrike Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Ecco, Florian Roth
Date: 2019-10-26
ATT&CK techniques: T1134.001, T1134.002
Log source: windows/process_creation

Description:
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Detection logic:
{
  "selection_img": {
    "ParentImage|endswith": "\\services.exe"
  },
  "selection_technique_1": {
    "CommandLine|contains|all": [
      "/c",
      "echo",
      "\\pipe\\"
    ],
    "CommandLine|contains": [
      "cmd",
      "%COMSPEC%"
    ]
  },
  "selection_technique_2": {
    "CommandLine|contains|all": [
      "rundll32",
      ".dll,a",
      "/p:"
    ]
  },
  "filter_defender": {
    "CommandLine|contains": "MpCmdRun"
  },
  "condition": "selection_img and 1 of selection_technique_* and not 1 of filter_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
Sigma Detection Rule: MMC Executing Files with Reversed Extensions Using RTLO Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
ATT&CK techniques: T1204.002, T1218.014, T1036.002
Log source: windows/process_creation

Description:
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.

Detection logic:
{
  "selection_image": [
    {
      "Image|endswith": "\\mmc.exe"
    },
    {
      "OriginalFileName": "MMC.exe"
    }
  ],
  "selection_commandline": {
    "CommandLine|contains": [
      "cod.msc",
      "fdp.msc",
      "ftr.msc",
      "lmth.msc",
      "slx.msc",
      "tdo.msc",
      "xcod.msc",
      "xslx.msc",
      "xtpp.msc"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
  - https://en.wikipedia.org/wiki/Right-to-left_override
  - https://tria.ge/241015-l98snsyeje/behavioral2