deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PUA - Netcat Suspicious Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2021-07-21
ATT&CK techniques: T1095
Log source: windows/process_creation

Description:
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\nc.exe",
      "\\ncat.exe",
      "\\netcat.exe"
    ]
  },
  "selection_cmdline": {
    "CommandLine|contains": [
      " -lvp ",
      " -lvnp",
      " -l -v -p ",
      " -lv -p ",
      " -l --proxy-type http ",
      " -vnl --exec ",
      " -vnl -e ",
      " --lua-exec ",
      " --sh-exec "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://nmap.org/ncat/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
  - https://www.revshells.com/
Sigma Detection Rule: File Download Via InstallUtil.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\"


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\InstallUtil.exe"
    },
    {
      "OriginalFileName": "InstallUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "ftp://",
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/239
Sigma Detection Rule: New Root Certificate Installed Via CertMgr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, @redcanary, Zach Stanford @svch0st
Date: 2023-03-05
ATT&CK techniques: T1553.004
Log source: windows/process_creation

Description:
Detects execution of "certmgr" with the "add" flag in order to install a new certificate on the system.
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\CertMgr.exe"
    },
    {
      "OriginalFileName": "CERTMGT.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/add",
      "root"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
  - https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/
Sigma Detection Rule: Query Usage To Exfil Data
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
Log source: windows/process_creation

Description:
Detects usage of "query.exe" a system binary to exfil information such as "sessions" and "processes" for later use

Detection logic:
{
  "selection": {
    "Image|endswith": ":\\Windows\\System32\\query.exe",
    "CommandLine|contains": [
      "session >",
      "process >"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/MichalKoczwara/status/[PII_REDACTED]16498688
Sigma Detection Rule: Remote Access Tool - UltraViewer Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-09-25
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Product": "UltraViewer"
    },
    {
      "Company": "DucFabulous Co,ltd"
    },
    {
      "OriginalFileName": "UltraViewer_Desktop.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md
Sigma Detection Rule: Potentially Suspicious Powershell Script Execution From Temp Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton
Date: 2021-07-14
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects a potentially suspicious powershell script executions from temporary folder

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      "\\Windows\\Temp",
      "\\Temporary Internet",
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming\\Temp",
      "%TEMP%",
      "%TMP%",
      "%LocalAppData%\\Temp"
    ]
  },
  "filter_optional_vscode": {
    "CommandLine|contains": "-WindowStyle hidden -Verb runAs"
  },
  "filter_optional_amazon_ec2": {
    "CommandLine|contains": "\\Windows\\system32\\config\\systemprofile\\AppData\\Local\\Temp\\Amazon\\EC2-Windows\\"
  },
  "filter_optional_generic": {
    "CommandLine|contains": [
      " >",
      "Out-File",
      "ConvertTo-Json"
    ]
  },
  "filter_optional_chocolatey_installer": {
    "ParentImage": [
      "C:\\Windows\\System32\\Msiexec.exe",
      "C:\\Windows\\SysWOW64\\Msiexec.exe"
    ],
    "Image|endswith": "\\powershell.exe",
    "CommandLine|contains|all": [
      "-NoProfile -ExecutionPolicy Bypass -Command",
      "AppData\\Local\\Temp\\",
      "Install-Chocolatey.ps1"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/
Sigma Detection Rule: New Virtual Smart Card Created Via TpmVscMgr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-15
Log source: windows/process_creation

Description:
Detects execution of "Tpmvscmgr.exe" to create a new virtual smart card.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\tpmvscmgr.exe",
    "OriginalFileName": "TpmVscMgr.exe"
  },
  "selection_cli": {
    "CommandLine|contains": "create"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
Sigma Detection Rule: PUA - NSudo Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
Date: 2022-01-24
ATT&CK techniques: T1569.002
Log source: windows/process_creation

Description:
Detects the use of NSudo tool for command execution

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\NSudo.exe",
        "\\NSudoLC.exe",
        "\\NSudoLG.exe"
      ]
    },
    {
      "OriginalFileName": [
        "NSudo.exe",
        "NSudoLC.exe",
        "NSudoLG.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "-U:S ",
      "-U:T ",
      "-U:E ",
      "-P:E ",
      "-M:S ",
      "-M:H ",
      "-U=S ",
      "-U=T ",
      "-U=E ",
      "-P=E ",
      "-M=S ",
      "-M=H ",
      "-ShowWindowMode:Hide"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4836/https://nsudo.m2team.org/en-us/
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Sigma Detection Rule: Suspicious Execution of Powershell with Base64
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-02
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Commandline to launch powershell with a base64 payload

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      " -e ",
      " -en ",
      " -enc ",
      " -enco",
      " -ec "
    ]
  },
  "filter_encoding": {
    "CommandLine|contains": " -Encoding "
  },
  "filter_azure": {
    "ParentImage|contains": [
      "C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\",
      "\\gc_worker.exe"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets
  - https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
  - https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/
Sigma Detection Rule: Potential PowerShell Obfuscation Via Reversed Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton
Date: 2020-10-11
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "hctac",
      "kaerb",
      "dnammoc",
      "ekovn",
      "eliFd",
      "rahc",
      "etirw",
      "golon",
      "tninon",
      "eddih",
      "tpircS",
      "ssecorp",
      "llehsrewop",
      "esnopser",
      "daolnwod",
      "tneilCbeW",
      "tneilc",
      "ptth",
      "elifotevas",
      "46esab",
      "htaPpmeTteG",
      "tcejbO",
      "maerts",
      "hcaerof",
      "retupmoc"
    ]
  },
  "filter_main_encoded_keyword": {
    "CommandLine|contains": [
      " -EncodedCommand ",
      " -enc "
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66
Sigma Detection Rule: PUA - CleanWipe Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-18
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the use of CleanWipe a tool usually used to delete Symantec antivirus.

Detection logic:
{
  "selection1": {
    "Image|endswith": "\\SepRemovalToolNative_x64.exe"
  },
  "selection2": {
    "Image|endswith": "\\CATClean.exe",
    "CommandLine|contains": "--uninstall"
  },
  "selection3": {
    "Image|endswith": "\\NetInstaller.exe",
    "CommandLine|contains": "-r"
  },
  "selection4": {
    "Image|endswith": "\\WFPUnins.exe",
    "CommandLine|contains|all": [
      "/uninstall",
      "/enterprise"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/CleanWipe
Sigma Detection Rule: Renamed CreateDump Utility Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-20
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory

Detection logic:
{
  "selection_pe": {
    "OriginalFileName": "FX_VER_INTERNALNAME_STR"
  },
  "selection_cli": [
    {
      "CommandLine|contains|all": [
        " -u ",
        " -f ",
        ".dmp"
      ]
    },
    {
      "CommandLine|contains|all": [
        " --full ",
        " --name ",
        ".dmp"
      ]
    }
  ],
  "filter": {
    "Image|endswith": "\\createdump.exe"
  },
  "condition": "1 of selection_* and not filter"
}

References:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://twitter.com/bopin2020/status/[PII_REDACTED]99272960
Sigma Detection Rule: Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dotnet.exe"
    },
    {
      "OriginalFileName": ".NET Host"
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      ".csproj",
      ".csproj\"",
      ".dll",
      ".dll\"",
      ".csproj'",
      ".dll'"
    ]
  },
  "filter_optional_notepadplus_plus": {
    "ParentImage": [
      "C:\\Program Files (x86)\\Notepad++\\notepad++.exe",
      "C:\\Program Files\\Notepad++\\notepad++.exe"
    ],
    "CommandLine|contains|all": [
      "C:\\ProgramData\\CSScriptNpp\\",
      "-cscs_path:",
      "\\cs-script\\cscs.dll"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/
  - https://twitter.com/_felamos/status/[PII_REDACTED]68555264
  - https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/
Sigma Detection Rule: Imports Registry Key From an ADS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Oddvar Moe, Sander Wiebing, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects the import of a alternate datastream to the registry with regedit.exe.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regedit.exe"
    },
    {
      "OriginalFileName": "REGEDIT.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /i ",
      ".reg"
    ],
    "CommandLine|re": ":[^ \\\\]"
  },
  "filter": {
    "CommandLine|contains|windash": [
      " -e ",
      " -a ",
      " -c "
    ]
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: Suspicious Windows Update Agent Empty Cmdline
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-26
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\Wuauclt.exe"
    },
    {
      "OriginalFileName": "Wuauclt.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      "Wuauclt",
      "Wuauclt.exe"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://redcanary.com/blog/blackbyte-ransomware/
Sigma Detection Rule: Browser Started with Remote Debugging
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-27
ATT&CK techniques: T1185
Log source: windows/process_creation

Description:
Detects browsers starting with the remote debugging flags. Which is a technique often used to perform browser injection attacks

Detection logic:
{
  "selection_chromium_based": {
    "CommandLine|contains": " --remote-debugging-"
  },
  "selection_firefox": {
    "Image|endswith": "\\firefox.exe",
    "CommandLine|contains": " -start-debugger-server"
  },
  "condition": "1 of selection_*"
}

References:
  - https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf
  - https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/
  - https://github.com/defaultnamehere/cookie_crimes/
  - https://github.com/wunderwuzzi23/firefox-cookiemonster
Sigma Detection Rule: Potentially Suspicious Execution From Parent Process In Public Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-25
ATT&CK techniques: T1564, T1059
Log source: windows/process_creation

Description:
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.


Detection logic:
{
  "selection_parent": {
    "ParentImage|contains": ":\\Users\\Public\\"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\bitsadmin.exe",
        "\\certutil.exe",
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "CommandLine|contains": [
        "bitsadmin",
        "certutil",
        "cscript",
        "mshta",
        "powershell",
        "regsvr32",
        "rundll32",
        "wscript"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/blog/blackbyte-ransomware/
Sigma Detection Rule: PsExec/PAExec Escalation to LOCAL SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-11-23
ATT&CK techniques: T1587.001
Log source: windows/process_creation

Description:
Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights

Detection logic:
{
  "selection_sys": {
    "CommandLine|contains|windash": [
      " -s cmd",
      " -s -i cmd",
      " -i -s cmd",
      " -s pwsh",
      " -s -i pwsh",
      " -i -s pwsh",
      " -s powershell",
      " -s -i powershell",
      " -i -s powershell"
    ]
  },
  "selection_other": {
    "CommandLine|contains": [
      "psexec",
      "paexec",
      "accepteula"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.poweradmin.com/paexec/
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Sigma Detection Rule: Add New Download Source To Winget
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-17
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects usage of winget to add new additional download sources

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\winget.exe"
    },
    {
      "OriginalFileName": "winget.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "source ",
      "add "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/source
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Sigma Detection Rule: WSL Child Process Anomaly
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-23
ATT&CK techniques: T1218, T1202
Log source: windows/process_creation

Description:
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\wsl.exe",
      "\\wslhost.exe"
    ]
  },
  "selection_children_images": {
    "Image|endswith": [
      "\\calc.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ]
  },
  "selection_children_paths": {
    "Image|contains": [
      "\\AppData\\Local\\Temp\\",
      "C:\\Users\\Public\\",
      "C:\\Windows\\Temp\\",
      "C:\\Temp\\",
      "\\Downloads\\",
      "\\Desktop\\"
    ]
  },
  "condition": "selection_parent and 1 of selection_children_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/
  - https://twitter.com/nas_bench/status/[PII_REDACTED]29808642
Sigma Detection Rule: HackTool - Doppelanger LSASS Dumper Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-01
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the execution of the Doppelanger hacktool which is used to dump LSASS memory via process cloning while evading common detection methods

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Doppelganger.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=AB94D5217896ADCD765A06B2D52F0AEB",
        "IMPHASH=65F0EA61156EE0C2A35421926F0C7F78"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/
  - https://github.com/vari-sh/RedTeamGrimoire/tree/668e[PII_REDACTED]065729ad623f8c02f7be21bb08/Doppelganger
Sigma Detection Rule: Process Access via TrolleyExpress Exclusion
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-10
ATT&CK techniques: T1218.011, T1003.001
Log source: windows/process_creation

Description:
Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\\TrolleyExpress 7",
      "\\TrolleyExpress 8",
      "\\TrolleyExpress 9",
      "\\TrolleyExpress.exe 7",
      "\\TrolleyExpress.exe 8",
      "\\TrolleyExpress.exe 9",
      "\\TrolleyExpress.exe -ma "
    ]
  },
  "renamed": {
    "Image|endswith": "\\TrolleyExpress.exe"
  },
  "filter_renamed": {
    "OriginalFileName|contains": "CtxInstall"
  },
  "filter_empty": {
    "OriginalFileName": null
  },
  "condition": "selection or ( renamed and not 1 of filter* )"
}

References:
  - https://twitter.com/_xpn_/status/[PII_REDACTED]68178176
  - https://www.youtube.com/watch?v=Ie831jF0bb0
Sigma Detection Rule: New Generic Credentials Added Via Cmdkey.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-03
ATT&CK techniques: T1003.005
Log source: windows/process_creation

Description:
Detects usage of "cmdkey.exe" to add generic credentials.
As an example, this can be used before connecting to an RDP session via command line interface.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmdkey.exe"
    },
    {
      "OriginalFileName": "cmdkey.exe"
    }
  ],
  "selection_cli_generic": {
    "CommandLine|contains|windash": " -g"
  },
  "selection_cli_user": {
    "CommandLine|contains|windash": " -u"
  },
  "selection_cli_password": {
    "CommandLine|contains|windash": " -p"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol