deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Windows Internet Hosted WebDav Share Mount Via Net.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-21
ATT&CK techniques: T1021.002
Log source: windows/process_creation

Description:
Detects when an internet hosted webdav share is mounted using the "net.exe" utility

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " use ",
      " http"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
Sigma Detection Rule: Whoami.EXE Execution With Output Option
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-28
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use.

Detection logic:
{
  "selection_main_img": [
    {
      "Image|endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "selection_main_cli": {
    "CommandLine|contains": [
      " /FO CSV",
      " -FO CSV"
    ]
  },
  "selection_special": {
    "CommandLine|contains": "whoami*>"
  },
  "condition": "all of selection_main_* or selection_special"
}

References:
  - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
  - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s
Sigma Detection Rule: Imports Registry Key From a File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Oddvar Moe, Sander Wiebing, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects the import of the specified file to the registry with regedit.exe.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regedit.exe"
    },
    {
      "OriginalFileName": "REGEDIT.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /i ",
      " /s ",
      ".reg"
    ]
  },
  "filter_1": {
    "CommandLine|contains|windash": [
      " -e ",
      " -a ",
      " -c "
    ]
  },
  "filter_2": {
    "CommandLine|re": ":[^ \\\\]"
  },
  "condition": "all of selection_* and not all of filter_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: Devcon Execution Disabling VMware VMCI Device
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Matt Anderson, Dray Agha, Anna Pham (Huntress)
Date: 2026-01-02
ATT&CK techniques: T1543.003, T1685
Log source: windows/process_creation

Description:
Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device.
This can be legitimate during VMware Tools troubleshooting or driver conflicts, but may also indicate malware attempting to hijack communication with the hardware via the VMCI device.
This has been used to facilitate VMware ESXi vulnerability exploits to escape VMs and execute code on the ESXi host.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\devcon.exe"
    },
    {
      "OriginalFileName": "DevCon.exe"
    }
  ],
  "selection_action": {
    "CommandLine|contains": " disable "
  },
  "selection_vmci_pci": {
    "CommandLine|contains": [
      "15AD&DEV_0740",
      "VMWVMCIHOSTDEV"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
  - https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
  - https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
  - https://huntress.com/blog/esxi-vm-escape-exploit
Sigma Detection Rule: Suspicious WMIC Execution Via Office Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Vadim Khrykov, Cyb3rEng
Date: 2021-08-23
ATT&CK techniques: T1204.002, T1047, T1218.010
Log source: windows/process_creation

Description:
Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\WINWORD.EXE",
      "\\EXCEL.EXE",
      "\\POWERPNT.exe",
      "\\MSPUB.exe",
      "\\VISIO.exe",
      "\\MSACCESS.EXE",
      "\\EQNEDT32.EXE",
      "\\ONENOTE.EXE",
      "\\wordpad.exe",
      "\\wordview.exe"
    ]
  },
  "selection_wmic_img": [
    {
      "Image|endswith": "\\wbem\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_wmic_cli": {
    "CommandLine|contains|all": [
      "process",
      "create",
      "call"
    ],
    "CommandLine|contains": [
      "regsvr32",
      "rundll32",
      "msiexec",
      "mshta",
      "verclsid",
      "wscript",
      "cscript"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
Sigma Detection Rule: Potential Mpclient.DLL Sideloading Via Defender Binaries
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2022-08-01
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\MpCmdRun.exe",
      "\\NisSrv.exe"
    ]
  },
  "filter_main_known_locations": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Windows Defender\\",
      "C:\\Program Files\\Microsoft Security Client\\",
      "C:\\Program Files\\Windows Defender\\",
      "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool
Sigma Detection Rule: Potentially Suspicious Desktop Background Change Using Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Stephen Lincoln @slincoln-aiq (AttackIQ)
Date: 2023-12-21
ATT&CK techniques: T1112, T1491.001
Log source: windows/process_creation

Description:
Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background.
This is a common technique used by malware to change the desktop background to a ransom note or other image.


Detection logic:
{
  "selection_reg_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_reg_flag": {
    "CommandLine|contains": "add"
  },
  "selection_keys": {
    "CommandLine|contains": [
      "Control Panel\\Desktop",
      "CurrentVersion\\Policies\\ActiveDesktop",
      "CurrentVersion\\Policies\\System"
    ]
  },
  "selection_cli_reg_1": {
    "CommandLine|contains|all": [
      "/v NoChangingWallpaper",
      "/d 1"
    ]
  },
  "selection_cli_reg_2": {
    "CommandLine|contains|all": [
      "/v Wallpaper",
      "/t REG_SZ"
    ]
  },
  "selection_cli_reg_3": {
    "CommandLine|contains|all": [
      "/v WallpaperStyle",
      "/d 2"
    ]
  },
  "condition": "all of selection_reg_* and selection_keys and 1 of selection_cli_reg_*"
}

References:
  - https://www.attackiq.com/2023/09/20/emulating-rhysida/
  - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/
  - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html
  - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f[PII_REDACTED]628e4f2ceb5bf2c41b8cd3c6/behavior
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper
Sigma Detection Rule: File Decryption Using Gpg4win
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-09
Log source: windows/process_creation

Description:
Detects usage of Gpg4win to decrypt files

Detection logic:
{
  "selection_metadata": [
    {
      "Image|endswith": [
        "\\gpg.exe",
        "\\gpg2.exe"
      ]
    },
    {
      "Description": "GnuPG\u2019s OpenPGP tool"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -d ",
      "passphrase"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html
  - https://www.gpg4win.de/documentation.html
  - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/
Sigma Detection Rule: MsiExec Web Install
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-02-09
ATT&CK techniques: T1218.007, T1105
Log source: windows/process_creation

Description:
Detects suspicious msiexec process starts with web addresses as parameter

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      " msiexec",
      "://"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/
Sigma Detection Rule: Use of Remote.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2022-06-02
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\remote.exe"
    },
    {
      "OriginalFileName": "remote.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://blog.thecybersecuritytutor.com/Exeuction-AWL-Bypass-Remote-exe-LOLBin/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Remote/
Sigma Detection Rule: Add Windows Capability Via PowerShell Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-22
Log source: windows/process_creation

Description:
Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cmdlet": {
    "CommandLine|contains": "Add-WindowsCapability"
  },
  "selection_capa": {
    "CommandLine|contains": "OpenSSH."
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
  - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
Sigma Detection Rule: Scheduled Task Creation Via Schtasks.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects the creation of scheduled tasks by user accounts via the "schtasks" utility.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": " /create "
  },
  "filter_main_system_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "filter_optional_msoffice": {
    "ParentImage": [
      "C:\\Program Files\\Microsoft Office\\root\\integration\\integrator.exe",
      "C:\\Program Files (x86)\\Microsoft Office\\root\\integration\\integrator.exe"
    ],
    "Image": [
      "C:\\Windows\\System32\\schtasks.exe",
      "C:\\Windows\\SysWOW64\\schtasks.exe"
    ],
    "CommandLine|contains": "Microsoft\\Office\\Office Performance Monitor"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
Sigma Detection Rule: Suspicious Diantz Alternate Data Stream Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-26
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "diantz.exe",
      ".cab"
    ],
    "CommandLine|re": ":[^\\\\]"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Diantz/
Sigma Detection Rule: Suspicious Msiexec Quiet Install From Remote Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-28
ATT&CK techniques: T1218.007
Log source: windows/process_creation

Description:
Detects usage of Msiexec.exe to install packages hosted remotely quietly

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\msiexec.exe"
    },
    {
      "OriginalFileName": "msiexec.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": [
      "-i",
      "-package",
      "-a",
      "-j"
    ]
  },
  "selection_quiet": {
    "CommandLine|contains|windash": "-q"
  },
  "selection_remote": {
    "CommandLine|contains": [
      "http",
      "\\\\\\\\"
    ]
  },
  "filter_optional_openoffice": {
    "CommandLine|contains|all": [
      "\\AppData\\Local\\Temp\\OpenOffice",
      "Installation Files\\openoffice"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
Sigma Detection Rule: Potentially Suspicious Child Process Of Regsvr32
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-05
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of "regsvr32.exe".

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\regsvr32.exe",
    "Image|endswith": [
      "\\calc.exe",
      "\\cscript.exe",
      "\\explorer.exe",
      "\\mshta.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\nltest.exe",
      "\\notepad.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\reg.exe",
      "\\schtasks.exe",
      "\\werfault.exe",
      "\\wscript.exe"
    ]
  },
  "filter_main_werfault": {
    "Image|endswith": "\\werfault.exe",
    "CommandLine|contains": " -u -p "
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://redcanary.com/blog/intelligence-insights-april-2022/
  - https://www.echotrail.io/insights/search/regsvr32.exe
  - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo
Sigma Detection Rule: Suspicious File Encoded To Base64 Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extensions of the file is suspicious

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-encode"
  },
  "selection_extension": {
    "CommandLine|contains": [
      ".acl",
      ".bat",
      ".doc",
      ".gif",
      ".jpeg",
      ".jpg",
      ".mp3",
      ".pdf",
      ".png",
      ".ppt",
      ".tmp",
      ".xls",
      ".xml"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior
  - https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior
  - https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior
  - https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior
Sigma Detection Rule: New Network Trace Capture Started Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kutepov Anton, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1040
Log source: windows/process_creation

Description:
Detects the execution of netsh with the "trace" flag in order to start a network capture

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "trace",
      "start"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/
  - https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/
Sigma Detection Rule: Net WebClient Casing Anomalies
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-24
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_encoded": {
    "CommandLine|contains": [
      "TgBlAFQALgB3AEUAQg",
      "4AZQBUAC4AdwBFAEIA",
      "OAGUAVAAuAHcARQBCA",
      "bgBFAHQALgB3AGUAYg",
      "4ARQB0AC4AdwBlAGIA",
      "uAEUAdAAuAHcAZQBiA",
      "TgBFAHQALgB3AGUAYg",
      "OAEUAdAAuAHcAZQBiA",
      "bgBlAFQALgB3AGUAYg",
      "4AZQBUAC4AdwBlAGIA",
      "uAGUAVAAuAHcAZQBiA",
      "TgBlAFQALgB3AGUAYg",
      "OAGUAVAAuAHcAZQBiA",
      "bgBFAFQALgB3AGUAYg",
      "4ARQBUAC4AdwBlAGIA",
      "uAEUAVAAuAHcAZQBiA",
      "bgBlAHQALgBXAGUAYg",
      "4AZQB0AC4AVwBlAGIA",
      "uAGUAdAAuAFcAZQBiA",
      "bgBFAHQALgBXAGUAYg",
      "4ARQB0AC4AVwBlAGIA",
      "uAEUAdAAuAFcAZQBiA",
      "TgBFAHQALgBXAGUAYg",
      "OAEUAdAAuAFcAZQBiA",
      "bgBlAFQALgBXAGUAYg",
      "4AZQBUAC4AVwBlAGIA",
      "uAGUAVAAuAFcAZQBiA",
      "TgBlAFQALgBXAGUAYg",
      "OAGUAVAAuAFcAZQBiA",
      "bgBFAFQALgBXAGUAYg",
      "4ARQBUAC4AVwBlAGIA",
      "uAEUAVAAuAFcAZQBiA",
      "bgBlAHQALgB3AEUAYg",
      "4AZQB0AC4AdwBFAGIA",
      "uAGUAdAAuAHcARQBiA",
      "TgBlAHQALgB3AEUAYg",
      "OAGUAdAAuAHcARQBiA",
      "bgBFAHQALgB3AEUAYg",
      "4ARQB0AC4AdwBFAGIA",
      "uAEUAdAAuAHcARQBiA",
      "TgBFAHQALgB3AEUAYg",
      "OAEUAdAAuAHcARQBiA",
      "bgBlAFQALgB3AEUAYg",
      "4AZQBUAC4AdwBFAGI

References:
  - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/
Sigma Detection Rule: RestrictedAdminMode Registry Value Tampering - ProcCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2023-01-13
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects changes to the "DisableRestrictedAdmin" registry value in order to disable or enable RestrictedAdmin mode.
RestrictedAdmin mode prevents the transmission of reusable credentials to the remote system to which you connect using Remote Desktop.
This prevents your credentials from being harvested during the initial connection process if the remote server has been compromise


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\System\\CurrentControlSet\\Control\\Lsa",
      "DisableRestrictedAdmin"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/a8e3cf63e97b973a25903d3df9fd55da6252e564/atomics/T1112/T1112.md
  - https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
Sigma Detection Rule: Renamed NetSupport RAT Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-19
Log source: windows/process_creation

Description:
Detects the execution of a renamed "client32.exe" (NetSupport RAT) via Imphash, Product and OriginalFileName strings

Detection logic:
{
  "selection": [
    {
      "Product|contains": "NetSupport Remote Control"
    },
    {
      "OriginalFileName|contains": "client32.exe"
    },
    {
      "Hashes|contains": "IMPHASH=A9D50692E95B79723F3E76FCF70D023E"
    }
  ],
  "filter": {
    "Image|endswith": "\\client32.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: Webshell Hacking Activity Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-17
ATT&CK techniques: T1505.003, T1018, T1033, T1087
Log source: windows/process_creation

Description:
Detects certain parent child patterns found in cases in which a web shell is used to perform certain credential dumping or exfiltration activities on a compromised system


Detection logic:
{
  "selection_webserver_image": {
    "ParentImage|endswith": [
      "\\caddy.exe",
      "\\httpd.exe",
      "\\nginx.exe",
      "\\php-cgi.exe",
      "\\w3wp.exe",
      "\\ws_tomcatservice.exe"
    ]
  },
  "selection_webserver_characteristics_tomcat1": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentImage|contains": [
      "-tomcat-",
      "\\tomcat"
    ]
  },
  "selection_webserver_characteristics_tomcat2": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "CommandLine|contains": [
      "catalina.jar",
      "CATALINA_HOME"
    ]
  },
  "selection_child_1": {
    "CommandLine|contains|all": [
      "rundll32",
      "comsvcs"
    ]
  },
  "selection_child_2": {
    "CommandLine|contains|all": [
      " -hp",
      " a ",
      " -m"
    ]
  },
  "selection_child_3": {
    "CommandLine|contains|all": [
      "net",
      " user ",
      " /add"
    ]
  },
  "selection_child_4": {
    "CommandLine|contains|all": [
      "net",
      " localgroup ",
      " administrators ",
      "/add"
    ]
  },
  "selection_child_5": {
    "Image|endswith": [
      "\\ntdsutil.exe",
      "\\ldifde.exe",
      "\\adfind.exe",
      "\\procdump.exe",
      "\\Nanodump.exe",
      "\\vssadmin.exe",
      "\\fsutil.exe"
    ]
  },
  "selection_child_6": {
    "CommandLine|contains": [
      " -decode ",
      " -NoP ",
      " -W Hidden ",
      " /decode ",
      " /ticket:",
      " sekurlsa",
      ".dmp

References:
  - https://youtu.be/7aemGhaE9ds?t=641