deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Privileged System Service Operation - SeLoadDriverPrivilege
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: xknow (@xknow_infosec), xorxes (@xor_xes)
Date: 2019-04-08
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.


Detection logic:
{
  "selection_1": {
    "EventID": 4673,
    "PrivilegeList": "SeLoadDriverPrivilege",
    "Service": "-"
  },
  "filter_main_exact": {
    "ProcessName": [
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\HelpPane.exe",
      "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe",
      "C:\\Windows\\System32\\Dism.exe",
      "C:\\Windows\\System32\\fltMC.exe",
      "C:\\Windows\\System32\\mmc.exe",
      "C:\\Windows\\System32\\rundll32.exe",
      "C:\\Windows\\System32\\RuntimeBroker.exe",
      "C:\\Windows\\System32\\ShellHost.exe",
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Windows\\System32\\SystemSettingsBroker.exe",
      "C:\\Windows\\System32\\wimserv.exe"
    ]
  },
  "filter_optional_others": {
    "ProcessName|endswith": [
      "\\AppData\\Local\\Microsoft\\Teams\\current\\Teams.exe",
      "\\Google\\Chrome\\Application\\chrome.exe",
      "\\procexp.exe",
      "\\procexp64.exe",
      "\\procmon.exe",
      "\\procmon64.exe"
    ]
  },
  "filter_main_startswith": {
    "ProcessName|startswith": "C:\\Program Files\\WindowsApps\\Microsoft"
  },
  "filter_optional_dropbox": {
    "ProcessName|startswith": [
      "C:\\Program Files (x86)\\Dropbox\\",
      "C:\\Program Files\\Dropbox\\"
    ],
    "ProcessName|endswith": "\\Dropbox.exe"
  },
  "condition": "selection_1 and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
Sigma Detection Rule: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess'
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1558.003
Log source: windows/

Description:
The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA.

Detection logic:
{
  "selection": {
    "EventID": 4673,
    "Service": "LsaRegisterLogonProcess()",
    "Keywords": "0x[PII_REDACTED]000000"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
Sigma Detection Rule: Azure AD Health Service Agents Registry Keys Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Date: 2021-08-26
ATT&CK techniques: T1012
Log source: windows/

Description:
This detection uses Windows security events to detect suspicious access attempts to the registry key values and sub-keys of Azure AD Health service agents (e.g AD FS).
Information from AD Health service agents can be used to potentially abuse some of the features provided by those services in the cloud (e.g. Federation).
This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object: HKLM:\SOFTWARE\Microsoft\ADHealthAgent.
Make sure you set the SACL to propagate to its sub-keys.


Detection logic:
{
  "selection": {
    "EventID": [
      4656,
      4663
    ],
    "ObjectType": "Key",
    "ObjectName": "\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\ADHealthAgent"
  },
  "filter": {
    "ProcessName|contains": [
      "Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe",
      "Microsoft.Identity.Health.Adfs.InsightsService.exe",
      "Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe",
      "Microsoft.Identity.Health.Adfs.PshSurrogate.exe",
      "Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://o365blog.com/post/hybridhealthagent/
  - https://github.com/OTRF/Set-AuditRule/blob/c3dec[PII_REDACTED]714d850565d364ca73475ade5/rules/registry/aad_connect_health_service_agent.yml
Sigma Detection Rule: Protected Storage Service Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Detects access to a protected_storage service over the network. Potential abuse of DPAPI to extract domain backup keys from Domain Controllers

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName|contains": "IPC",
    "RelativeTargetName": "protected_storage"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
Sigma Detection Rule: ISO Image Mounted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Syed Hasan (@syedhasan009)
Date: 2021-05-29
ATT&CK techniques: T1566.001
Log source: windows/

Description:
Detects the mount of an ISO image on an endpoint

Detection logic:
{
  "selection": {
    "EventID": 4663,
    "ObjectServer": "Security",
    "ObjectType": "File",
    "ObjectName|startswith": "\\Device\\CdRom"
  },
  "filter_main_generic": {
    "ObjectName": [
      "\\Device\\CdRom0\\autorun.ico",
      "\\Device\\CdRom0\\setup.exe",
      "\\Device\\CdRom0\\setup64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore
  - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages
  - https://twitter.com/MsftSecIntel/status/[PII_REDACTED]15269121
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
Sigma Detection Rule: Metasploit Or Impacket Service Installation Via SMB PsExec
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bartlomiej Czyz, Relativity
Date: 2021-01-21
ATT&CK techniques: T1021.002, T1570, T1569.002
Log source: windows/

Description:
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|re": "^%systemroot%\\\\[a-zA-Z]{8}\\.exe$",
    "ServiceName|re": "(^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)",
    "ServiceStartType": 3,
    "ServiceType": "0x10"
  },
  "filter": {
    "ServiceName": "PSEXESVC"
  },
  "condition": "selection and not filter"
}

References:
  - https://bczyz1.github.io/2021/01/30/psexec.html
Sigma Detection Rule: Remote Access Tool Services Have Been Installed - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Connor Martin, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-23
ATT&CK techniques: T1543.003, T1569.002
Log source: windows/

Description:
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceName|contains": [
      "AmmyyAdmin",
      "AnyDesk",
      "Atera",
      "BASupportExpressSrvcUpdater",
      "BASupportExpressStandaloneService",
      "chromoting",
      "GoToAssist",
      "GoToMyPC",
      "jumpcloud",
      "LMIGuardianSvc",
      "LogMeIn",
      "monblanking",
      "Parsec",
      "RManService",
      "RPCPerformanceService",
      "RPCService",
      "SplashtopRemoteService",
      "SSUService",
      "TeamViewer",
      "TightVNC",
      "vncserver",
      "Zoho"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: Possible Shadow Credentials Added
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Elastic (idea)
Date: 2022-10-17
ATT&CK techniques: T1556
Log source: windows/

Description:
Detects possible addition of shadow credentials to an active directory object.

Detection logic:
{
  "selection": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": "msDS-KeyCredentialLink"
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html
  - https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]50187264?
Sigma Detection Rule: Remote Service Activity via SVCCTL Named Pipe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Detects remote service activity via remote access to the svcctl named pipe

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$",
    "RelativeTargetName": "svcctl",
    "AccessList|contains": "WriteData"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html
Sigma Detection Rule: CobaltStrike Service Installations - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
Date: 2021-05-26
ATT&CK techniques: T1021.002, T1543.003, T1569.002
Log source: windows/

Description:
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Detection logic:
{
  "event_id": {
    "EventID": 4697
  },
  "selection1": {
    "ServiceFileName|contains|all": [
      "ADMIN$",
      ".exe"
    ]
  },
  "selection2": {
    "ServiceFileName|contains|all": [
      "%COMSPEC%",
      "start",
      "powershell"
    ]
  },
  "selection3": {
    "ServiceFileName|contains": "powershell -nop -w hidden -encodedcommand"
  },
  "selection4": {
    "ServiceFileName|base64offset|contains": "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
  },
  "condition": "event_id and 1 of selection*"
}

References:
  - https://www.sans.org/webcasts/119395
  - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
Sigma Detection Rule: Enabled User Right in AD to Control User Objects
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @neu5ron
Date: 2017-07-30
ATT&CK techniques: T1098
Log source: windows/

Description:
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Detection logic:
{
  "selection_base": {
    "EventID": 4704
  },
  "selection_keywords": {
    "PrivilegeList|contains": "SeEnableDelegationPrivilege"
  },
  "condition": "all of selection*"
}

References:
  - https://blog.harmj0y.net/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/
Sigma Detection Rule: External Disk Drive Or USB Storage Device Was Recognized By The System
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Keith Wright
Date: 2019-11-20
ATT&CK techniques: T1091, T1200
Log source: windows/

Description:
Detects external disk drives or plugged-in USB devices.

Detection logic:
{
  "selection_eid": {
    "EventID": 6416
  },
  "selection_field": [
    {
      "ClassName": "DiskDrive"
    },
    {
      "DeviceDescription": "USB Mass Storage Device"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416
Sigma Detection Rule: Meterpreter or Cobalt Strike Getsystem Service Installation - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
Date: 2019-10-26
ATT&CK techniques: T1134.001, T1134.002
Log source: windows/

Description:
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Detection logic:
{
  "selection_eid": {
    "EventID": 4697
  },
  "selection_cli_cmd": {
    "ServiceFileName|contains|all": [
      "/c",
      "echo",
      "\\pipe\\"
    ],
    "ServiceFileName|contains": [
      "cmd",
      "%COMSPEC%"
    ]
  },
  "selection_cli_rundll": {
    "ServiceFileName|contains|all": [
      "rundll32",
      ".dll,a",
      "/p:"
    ]
  },
  "selection_cli_share": {
    "ServiceFileName|startswith": "\\\\\\\\127.0.0.1\\\\ADMIN$\\"
  },
  "condition": "selection_eid and 1 of selection_cli_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/
Sigma Detection Rule: Invoke-Obfuscation COMPRESS OBFUSCATION - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "new-object",
      "text.encoding]::ascii",
      "readtoend"
    ],
    "ServiceFileName|contains": [
      "system.io.compression.deflatestream",
      "system.io.streamreader"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Windows Default Domain GPO Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-22
ATT&CK techniques: T1484.001
Log source: windows/

Description:
Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs).
Adversaries may modify these default GPOs to deploy malicious configurations across the domain.


Detection logic:
{
  "selection": {
    "EventID": 5136,
    "ObjectClass": "groupPolicyContainer",
    "ObjectDN|startswith": [
      "CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM",
      "CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
  - https://adsecurity.org/?p=3377
  - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
  - https://jgspiers.com/audit-group-policy-changes/
Sigma Detection Rule: SMB Create Remote File Admin Share
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research)
Date: 2020-08-06
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName|endswith": "C$",
    "AccessMask": "0x2"
  },
  "filter_main_subjectusername": {
    "SubjectUserName|endswith": "$"
  },
  "filter_optional_local_ip": {
    "IpAddress": "::1"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN[PII_REDACTED]36.yaml
  - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN[PII_REDACTED]57.html?highlight=create%20file
Sigma Detection Rule: Active Directory User Backdoors
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @neu5ron
Date: 2017-04-13
ATT&CK techniques: T1098
Log source: windows/

Description:
Detects scenarios where one can control another users or computers account without having to use their credentials.

Detection logic:
{
  "selection1": {
    "EventID": 4738
  },
  "filter_empty": {
    "AllowedToDelegateTo": [
      "",
      "-"
    ]
  },
  "filter_null": {
    "AllowedToDelegateTo": null
  },
  "selection_5136_1": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": "msDS-AllowedToDelegateTo"
  },
  "selection_5136_2": {
    "EventID": 5136,
    "ObjectClass": "user",
    "AttributeLDAPDisplayName": "servicePrincipalName"
  },
  "selection_5136_3": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": "msDS-AllowedToActOnBehalfOfOtherIdentity"
  },
  "condition": "(selection1 and not 1 of filter_*) or 1 of selection_5136_*"
}

References:
  - https://msdn.microsoft.com/en-us/library/cc220234.aspx
  - https://adsecurity.org/?p=3466
  - https://blog.harmj0y.net/redteaming/another-word-on-delegation/
Sigma Detection Rule: Replay Attack Detected
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-10-14
ATT&CK techniques: T1558
Log source: windows/

Description:
Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client

Detection logic:
{
  "selection": {
    "EventID": 4649
  },
  "condition": "selection"
}

References:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649
Sigma Detection Rule: RDP over Reverse SSH Tunnel WFP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-02-16
ATT&CK techniques: T1090.001, T1090.002, T1021.001
Log source: windows/

Description:
Detects svchost hosting RDP termsvcs communicating with the loopback address

Detection logic:
{
  "selection": {
    "EventID": 5156
  },
  "sourceRDP": {
    "SourcePort": 3389,
    "DestAddress": [
      "127.*",
      "::1"
    ]
  },
  "destinationRDP": {
    "DestPort": 3389,
    "SourceAddress": [
      "127.*",
      "::1"
    ]
  },
  "filter_app_container": {
    "FilterOrigin": "AppContainer Loopback"
  },
  "filter_thor": {
    "Application|endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ]
  },
  "condition": "selection and ( sourceRDP or destinationRDP ) and not 1 of filter*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]84384514
  - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx
Sigma Detection Rule: Win Susp Computer Name Containing Samtheadmin
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: elhoim
Date: 2022-09-09
ATT&CK techniques: T1078
Log source: windows/

Description:
Detects suspicious computer name samtheadmin-{1..100}$ generated by hacktool

Detection logic:
{
  "selection1": {
    "SamAccountName|startswith": "SAMTHEADMIN-",
    "SamAccountName|endswith": "$"
  },
  "selection2": {
    "TargetUserName|startswith": "SAMTHEADMIN-",
    "TargetUserName|endswith": "$"
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]43766026
  - https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py
Sigma Detection Rule: Failed Code Integrity Checks
Repository: SigmaHQ/sigma
Severity: informational
Status: stable
Author: Thomas Patzke
Date: 2019-12-03
ATT&CK techniques: T1027.001
Log source: windows/

Description:
Detects code integrity failures such as missing page hashes or corrupted drivers due unauthorized modification. This could be a sign of tampered binaries.


Detection logic:
{
  "selection": {
    "EventID": [
      5038,
      6281
    ]
  },
  "filter_optional_crowdstrike": {
    "param1|contains": [
      "\\CSFalconServiceUninstallTool_",
      "\\Program Files\\CrowdStrike\\",
      "\\System32\\drivers\\CrowdStrike\\",
      "\\Windows\\System32\\ScriptControl64_"
    ]
  },
  "filter_optional_sophos": {
    "param1|contains": "\\Program Files\\Sophos\\"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281
Sigma Detection Rule: Important Windows Event Auditing Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-20
ATT&CK techniques: T1685.001
Log source: windows/

Description:
Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.

Detection logic:
{
  "selection_state_success_and_failure": {
    "EventID": 4719,
    "SubcategoryGuid": [
      "{0CCE9210-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9211-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9212-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9215-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE921B-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE922B-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE922F-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9230-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9235-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9236-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9237-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE923F-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9240-69AE-11D9-BED3[PII_REDACTED]30}",
      "{0CCE9242-69AE-11D9-BED3[PII_REDACTED]30}"
    ],
    "AuditPolicyChanges|contains": [
      "%%8448",
      "%%8450"
    ]
  },
  "selection_state_success_only": {
    "EventID": 4719,
    "SubcategoryGuid": "{0CCE9217-69AE-11D9-BED3[PII_REDACTED]30}",
    "AuditPolicyChanges|contains": "%%8448"
  },
  "condition": "1 of selection_*"
}

References:
  - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
  - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md
Sigma Detection Rule: Invoke-Obfuscation Via Stdin - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via Stdin in Scripts

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "set",
      "&&"
    ],
    "ServiceFileName|contains": [
      "environment",
      "invoke",
      "${input)"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009