deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Lazarus Group Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), wagga
Date: 2020-12-23
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects different process execution behaviors as described in various threat reports on Lazarus group activity

Detection logic:
{
  "selection_generic": {
    "CommandLine|contains": [
      "reg.exe save hklm\\sam %temp%\\~reg_sam.save",
      "1q2w3e4r@#$@#$@#$",
      " -hp1q2w3e4 ",
      ".dat data03 10000 -p "
    ]
  },
  "selection_netstat": {
    "CommandLine|contains|all": [
      "netstat -aon | find ",
      "ESTA",
      " > %temp%\\~"
    ]
  },
  "selection_network_discovery": {
    "CommandLine|contains|all": [
      ".255 10 C:\\ProgramData\\IBM\\",
      ".DAT"
    ]
  },
  "selection_persistence": {
    "CommandLine|contains|all": [
      " /c ",
      " -p 0x"
    ],
    "CommandLine|contains": [
      "C:\\ProgramData\\",
      "C:\\RECYCLER\\"
    ]
  },
  "selection_rundll32": {
    "CommandLine|contains|all": [
      "rundll32 ",
      "C:\\ProgramData\\"
    ],
    "CommandLine|contains": [
      ".bin,",
      ".tmp,",
      ".dat,",
      ".io,",
      ".ini,",
      ".db,"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://securelist.com/lazarus-covets-covid-19-related-intelligence/99906/
  - https://www.hvs-consulting.de/lazarus-report/
Sigma Detection Rule: Winnti Malware HK University Campaign
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis
Date: 2020-02-01
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities

Detection logic:
{
  "selection1": {
    "ParentImage|contains": [
      "C:\\Windows\\Temp",
      "\\hpqhvind.exe"
    ],
    "Image|startswith": "C:\\ProgramData\\DRM"
  },
  "selection2": {
    "ParentImage|startswith": "C:\\ProgramData\\DRM",
    "Image|endswith": "\\wmplayer.exe"
  },
  "selection3": {
    "ParentImage|endswith": "\\Test.exe",
    "Image|endswith": "\\wmplayer.exe"
  },
  "selection4": {
    "Image": "C:\\ProgramData\\DRM\\CLR\\CLR.exe"
  },
  "selection5": {
    "ParentImage|startswith": "C:\\ProgramData\\DRM\\Windows",
    "Image|endswith": "\\SearchFilterHost.exe"
  },
  "condition": "1 of selection*"
}

References:
  - https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/
Sigma Detection Rule: Winnti Pipemon Characteristics
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems), oscd.community
Date: 2020-07-30
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects specific process characteristics of Winnti Pipemon malware reported by ESET

Detection logic:
{
  "selection_1": {
    "CommandLine|contains": "setup0.exe -p"
  },
  "selection_2": {
    "CommandLine|contains": "setup.exe",
    "CommandLine|endswith": [
      "-x:0",
      "-x:1",
      "-x:2"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
Sigma Detection Rule: Kapeka Backdoor Autorun Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-03
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
    "TargetObject|endswith": [
      "\\Sens Api",
      "\\OneDrive"
    ],
    "Details|contains|all": [
      ":\\WINDOWS\\system32\\rundll32.exe",
      ".wll",
      "#1"
    ]
  },
  "condition": "selection"
}

References:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
Sigma Detection Rule: Kapeka Backdoor Loaded Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-03
ATT&CK techniques: T1204.002, T1218.011
Log source: windows/image_load

Description:
Detects the Kapeka Backdoor binary being loaded by rundll32.exe.
The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\rundll32.exe",
    "ImageLoaded|contains": [
      ":\\ProgramData",
      "\\AppData\\Local\\"
    ],
    "ImageLoaded|re": "[a-zA-Z]{5,6}\\.wll"
  },
  "condition": "selection"
}

References:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
Sigma Detection Rule: Kapeka Backdoor Scheduled Task Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-03
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.

Detection logic:
{
  "selection_eid": {
    "EventID": 4698
  },
  "selection_paths": {
    "TaskContent|contains": [
      ":\\ProgramData\\",
      "\\AppData\\Local\\"
    ]
  },
  "selection_command": {
    "TaskContent|contains|all": [
      "rundll32",
      ".wll",
      "#1"
    ]
  },
  "selection_taskname": {
    "TaskContent|contains": [
      "OneDrive",
      "Sens Api"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
Sigma Detection Rule: Kapeka Backdoor Execution Via RunDLL32.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-03
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_backdoor_path": {
    "CommandLine|contains": [
      ":\\ProgramData",
      "\\AppData\\Local"
    ]
  },
  "selection_backdoor_exec_1": {
    "CommandLine|contains|all": [
      ".wll",
      "#1",
      " -d"
    ]
  },
  "selection_backdoor_exec_2": {
    "CommandLine|contains": ".wll",
    "CommandLine|endswith": "#1"
  },
  "condition": "selection_img and selection_backdoor_path and 1 of selection_backdoor_exec_*"
}

References:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
Sigma Detection Rule: Kapeka Backdoor Configuration Persistence
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-03
ATT&CK techniques: T1553.003
Log source: windows/registry_set

Description:
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key.
The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Cryptography\\Providers\\{",
    "TargetObject|endswith": "\\Seed"
  },
  "filter_main_empty": {
    "Details|contains": "(Empty)"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
Sigma Detection Rule: Kapeka Backdoor Persistence Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-03
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects Kapeka backdoor persistence activity.
Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).
For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM.
To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command.
Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.


Detection logic:
{
  "selection_schtasks_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_schtasks_flags": {
    "CommandLine|contains|all": [
      "create",
      "ONSTART"
    ]
  },
  "selection_reg_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_reg_flags": {
    "CommandLine|contains|all": [
      "add",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
    ]
  },
  "selection_backdoor_command": {
    "CommandLine|contains|all": [
      "rundll32",
      ".wll",
      "#1"
    ],
    "CommandLine|contains": [
      "Sens Api",
      "OneDrive"
    ]
  },
  "condition": "(all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command"
}

References:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
Sigma Detection Rule: Potential Kapeka Decrypted Backdoor Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-03
Log source: windows/file_event

Description:
Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges.
The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.


Detection logic:
{
  "selection_generic": {
    "TargetFilename|contains": [
      ":\\ProgramData\\",
      "\\AppData\\Local\\"
    ],
    "TargetFilename|re": "\\\\[a-zA-Z]{5,6}\\.wll"
  },
  "selection_specific": {
    "TargetFilename|endswith": [
      "\\win32log.exe",
      "\\crdss.exe"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
Sigma Detection Rule: File Creation Related To RAT Clients
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-12-19
Log source: windows/file_event

Description:
File .conf created related to VenomRAT, AsyncRAT and Lummac samples observed in the wild.


Detection logic:
{
  "selection_required": {
    "TargetFilename|contains": "\\AppData\\Roaming\\"
  },
  "selection_variants": {
    "TargetFilename|contains": [
      "\\mydata\\",
      "\\datalogs\\",
      "\\hvnc\\",
      "\\dcrat\\"
    ],
    "TargetFilename|endswith": [
      "\\datalogs.conf",
      "\\hvnc.conf",
      "\\dcrat.conf"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
  - https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
Sigma Detection Rule: Potential Raspberry Robin Registry Set Internet Settings ZoneMap
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-31
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects registry modifications related to the proxy configuration of the system, potentially associated with the Raspberry Robin malware, as seen in campaigns running in Q1 2024.
Raspberry Robin may alter proxy settings to circumvent security measures, ensuring unhindered connection with Command and Control servers for maintaining control over compromised systems if there are any proxy settings that are blocking connections.


Detection logic:
{
  "selection_registry_image": [
    {
      "Image|contains": [
        "\\AppData\\Local\\Temp\\",
        "\\Downloads\\",
        "\\Users\\Public\\",
        "\\Windows\\Temp\\"
      ]
    },
    {
      "Image|endswith": "\\control.exe"
    }
  ],
  "selection_registry_object": {
    "TargetObject|contains": "\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\"
  },
  "selection_value_enable": {
    "TargetObject|endswith": [
      "\\IntranetName",
      "\\ProxyByPass",
      "\\UNCAsIntranet"
    ],
    "Details|contains": "DWORD (0x00000001)"
  },
  "selection_value_disable": {
    "TargetObject|endswith": "\\AutoDetect",
    "Details|contains": "DWORD (0x00000000)"
  },
  "condition": "all of selection_registry_* and 1 of selection_value_*"
}

References:
  - https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
  - https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
  - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
Sigma Detection Rule: Potential Raspberry Robin CPL Execution Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-03-07
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects the execution of a ".CPL" file located in the user temp directory via the Shell32 DLL "Control_RunDLL" export function.
This behavior was observed in multiple Raspberry-Robin variants.


Detection logic:
{
  "selection_parent_img": {
    "ParentImage|endswith": [
      "\\rundll32.exe",
      "\\control.exe"
    ]
  },
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "shell32.dll",
      "Control_RunDLL",
      ".CPL"
    ]
  },
  "selection_path": {
    "CommandLine|contains": "\\AppData\\Local\\Temp\\"
  },
  "condition": "all of selection_*"
}

References:
  - https://tria.ge/240226-fhbe7sdc39/behavioral1
  - https://bazaar.abuse.ch/browse/signature/RaspberryRobin/
Sigma Detection Rule: Potential Raspberry Robin Aclui Dll SideLoading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-07-31
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\OleView.exe",
    "ImageLoaded|endswith": "\\aclui.dll"
  },
  "filter_main_legit_oleview_paths": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Windows Kits\\",
      "C:\\Program Files\\Microsoft SDKs\\"
    ]
  },
  "filter_optional_known_oleview_paths": {
    "Image|contains": "\\Windows Resource Kit\\"
  },
  "filter_main_is_signed": {
    "Signed": "true"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
  - https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
  - https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
  - https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
  - https://strontic.github.io/xcyclopedia/library/aclui.dll-F883E9CA757B622B032FDCA5BF33D0DF.html
Sigma Detection Rule: Potential CSharp Streamer RAT Loading .NET Executable Image
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Luca Di Bartolomeo
Date: 2024-06-22
ATT&CK techniques: T1219.002
Log source: windows/image_load

Description:
Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.


Detection logic:
{
  "selection": {
    "ImageLoaded|re": "\\\\AppData\\\\Local\\\\Temp\\\\dat[0-9A-Z]{4}\\.tmp"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2024/06/10/icedid-brings-screenconnect-and-csharp-streamer-to-alphv-ransomware-deployment/#detections
  - https://cyber.wtf/2023/12/06/the-csharp-streamer-rat/
Sigma Detection Rule: DarkGate - Drop DarkGate Loader In C:\Temp Directory
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tomasz Dyduch, Josh Nickels
Date: 2024-05-31
ATT&CK techniques: T1059
Log source: windows/file_event

Description:
Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

Detection logic:
{
  "selection_filename_suffix": {
    "TargetFilename|contains": ":\\temp\\",
    "TargetFilename|endswith": [
      ".au3",
      "\\autoit3.exe"
    ]
  },
  "selection_image_suffix": {
    "Image|contains": ":\\temp\\",
    "Image|endswith": [
      ".au3",
      "\\autoit3.exe"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
  - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
Sigma Detection Rule: Lummac Stealer Activity - Execution Of More.com And Vbc.exe
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-12-19
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects the execution of more.com and vbc.exe in the process tree.
This behavior was observed by a set of samples related to Lummac Stealer.
The Lummac payload is injected into the vbc.exe process.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\more.com"
  },
  "selection_child": [
    {
      "Image|endswith": "\\vbc.exe"
    },
    {
      "OriginalFileName": "vbc.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
  - https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b[PII_REDACTED]f03a8f07eb8aef
  - https://strontic.github.io/xcyclopedia/library/more.com-EDB[PII_REDACTED]EE614B5B81B0439895E.html
  - https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html
Sigma Detection Rule: Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2024-03-22
Log source: windows/process_creation

Description:
Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command.
This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      " /create ",
      "shutdown /l /f",
      "WEEKLY"
    ]
  },
  "filter_main_system_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
  - https://tria.ge/240123-rapteaahhr/behavioral1
Sigma Detection Rule: Potential KamiKakaBot Activity - Lure Document Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2024-03-22
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects the execution of a Word document via the WinWord Start Menu shortcut.
This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "/c ",
      ".lnk ~",
      "Start Menu\\Programs\\Word"
    ],
    "CommandLine|endswith": ".doc"
  },
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
Sigma Detection Rule: Potential KamiKakaBot Activity - Winlogon Shell Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior
Date: 2024-03-22
ATT&CK techniques: T1547.001
Log source: windows/registry_set

Description:
Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.


Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
    "Details|contains|all": [
      "-nop -w h",
      "$env",
      "explorer.exe",
      "Start-Process"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
Sigma Detection Rule: ScreenConnect User Database Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matt Anderson, Andrew Schwartz, Caleb Stewart, Huntress
Date: 2024-02-21
Log source: windows/file_event

Description:
Detects file modifications to the temporary xml user database file indicating local user modification in the ScreenConnect server.
This will occur during exploitation of the ScreenConnect Authentication Bypass vulnerability (CVE-2024-1709) in versions <23.9.8, but may also be observed when making legitimate modifications to local users or permissions.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".xml",
    "TargetFilename|contains|all": [
      "Temp",
      "ScreenConnect"
    ],
    "Image|endswith": "\\ScreenConnect.Service.exe"
  },
  "condition": "selection"
}

References:
  - https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8
  - https://www.cve.org/CVERecord?id=CVE-2024-1709
  - https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass