deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Access Tool - Simple Help Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-23
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": {
    "Image|contains": [
      "\\JWrapper-Remote Access\\",
      "\\JWrapper-Remote Support\\"
    ],
    "Image|endswith": "\\SimpleService.exe"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Sigma Detection Rule: Kernel Memory Dump Via LiveKD
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-16
Log source: windows/process_creation

Description:
Detects execution of LiveKD with the "-m" flag to potentially dump the kernel memory

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\livekd.exe",
        "\\livekd64.exe"
      ]
    },
    {
      "OriginalFileName": "livekd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -m"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
  - https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/
  - https://kb.acronis.com/content/60892
Sigma Detection Rule: Obfuscated IP Download Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
Date: 2022-08-03
Log source: windows/process_creation

Description:
Detects use of an encoded/obfuscated version of an IP address (hex, octal...) in an URL combined with a download command

Detection logic:
{
  "selection_command": {
    "CommandLine|contains": [
      "Invoke-WebRequest",
      "iwr ",
      "Invoke-RestMethod",
      "irm ",
      "wget ",
      "curl ",
      "DownloadFile",
      "DownloadString"
    ]
  },
  "selection_ip_1": {
    "CommandLine|contains": [
      " 0x",
      "//0x",
      ".0x",
      ".00x"
    ]
  },
  "selection_ip_2": {
    "CommandLine|contains|all": [
      "http://%",
      "%2e"
    ]
  },
  "selection_ip_3": [
    {
      "CommandLine|re": "https?://[0-9]{1,3}\\.[0-9]{1,3}\\.0[0-9]{3,4}"
    },
    {
      "CommandLine|re": "https?://[0-9]{1,3}\\.0[0-9]{3,7}"
    },
    {
      "CommandLine|re": "https?://0[0-9]{3,11}"
    },
    {
      "CommandLine|re": "https?://(?:0[0-9]{1,11}\\.){3}0[0-9]{1,11}"
    },
    {
      "CommandLine|re": "https?://0[0-9]{1,11}"
    },
    {
      "CommandLine|re": " [0-7]{7,13}"
    }
  ],
  "filter_main_valid_ip": {
    "CommandLine|re": "https?://(?:(?:25[0-5]|(?:2[0-4]|1\\d|[1-9])?\\d)(?:\\.|\\b)){4}"
  },
  "condition": "selection_command and 1 of selection_ip_* and not 1 of filter_main_*"
}

References:
  - https://h.43z.one/ipconverter/
  - https://twitter.com/Yasser_Elsnbary/status/[PII_REDACTED]54564608
  - https://twitter.com/fr0s7_/status/[PII_REDACTED]05404948
Sigma Detection Rule: Setup16.EXE Execution With Custom .Lst File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2024-12-01
ATT&CK techniques: T1574.005
Log source: windows/process_creation

Description:
Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.


Detection logic:
{
  "selection": {
    "ParentImage": "C:\\Windows\\SysWOW64\\setup16.exe",
    "ParentCommandLine|contains": " -m "
  },
  "filter_optional_valid_path": {
    "Image|startswith": "C:\\~MSSETUP.T\\"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
Sigma Detection Rule: HackTool - Impersonate Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sai Prashanth Pulisetti @pulisettis
Date: 2022-12-21
ATT&CK techniques: T1134.001, T1134.003
Log source: windows/process_creation

Description:
Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively

Detection logic:
{
  "selection_commandline_exe": {
    "CommandLine|contains": "impersonate.exe"
  },
  "selection_commandline_opt": {
    "CommandLine|contains": [
      " list ",
      " exec ",
      " adduser "
    ]
  },
  "selection_hash": {
    "Hashes|contains": [
      "MD5=9520714AB576B0ED01D[PII_REDACTED]D01",
      "SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC[PII_REDACTED]E2101E1A024D52264BB0A8A",
      "IMPHASH=0A358FFC1697B7A07D0E817AC740DF62"
    ]
  },
  "condition": "all of selection_commandline_* or selection_hash"
}

References:
  - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/
  - https://github.com/sensepost/impersonate
Sigma Detection Rule: Potentially Suspicious Rundll32 Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects suspicious execution of rundll32, with specific calls to some DLLs with known LOLBIN functionalities

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains|all": [
        "javascript:",
        ".RegisterXLL"
      ]
    },
    {
      "CommandLine|contains|all": [
        "url.dll",
        "OpenURL"
      ]
    },
    {
      "CommandLine|contains|all": [
        "url.dll",
        "OpenURLA"
      ]
    },
    {
      "CommandLine|contains|all": [
        "url.dll",
        "FileProtocolHandler"
      ]
    },
    {
      "CommandLine|contains|all": [
        "zipfldr.dll",
        "RouteTheCall"
      ]
    },
    {
      "CommandLine|contains|all": [
        "shell32.dll",
        "Control_RunDLL"
      ]
    },
    {
      "CommandLine|contains|all": [
        "shell32.dll",
        "ShellExec_RunDLL"
      ]
    },
    {
      "CommandLine|contains|all": [
        "mshtml.dll",
        "PrintHTML"
      ]
    },
    {
      "CommandLine|contains|all": [
        "advpack.dll",
        "LaunchINFSection"
      ]
    },
    {
      "CommandLine|contains|all": [
        "advpack.dll",
        "RegisterOCX"
      ]
    },
    {
      "CommandLine|contains|all": [
        "ieadvpack.dll",
        "LaunchINFSection"
      ]
    },
    {
      "CommandLine|contains|all": [
        "ieadvpack.dll",
        "RegisterOCX"
      ]
    },
    {
      "CommandLine|contains|all": [
        "ieframe.dll",
        "OpenURL"
      ]
    },
    {
      "CommandLine|contains|all": [
        "shdocvw.dll",
        "OpenURL"
      ]
    },
    {
      "CommandLine|contains|all": [
        "

References:
  - http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]28725250
  - https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52
  - https://twitter.com/nas_bench/status/[PII_REDACTED]71583746
  - https://twitter.com/eral4m/status/[PII_REDACTED]67240209
Sigma Detection Rule: Suspicious Child Process Of Wermgr.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-14
ATT&CK techniques: T1055, T1036
Log source: windows/process_creation

Description:
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\wermgr.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\ipconfig.exe",
      "\\mshta.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\netstat.exe",
      "\\nslookup.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\systeminfo.exe",
      "\\whoami.exe",
      "\\wscript.exe"
    ]
  },
  "filter_main_rundll32": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains|all": [
      "C:\\Windows\\system32\\WerConCpl.dll",
      "LaunchErcApp "
    ],
    "CommandLine|contains": [
      "-queuereporting",
      "-responsepester"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html
  - https://www.echotrail.io/insights/search/wermgr.exe
  - https://github.com/binderlabs/DirCreate2System
Sigma Detection Rule: PUA - Radmin Viewer Utility Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-22
ATT&CK techniques: T1072
Log source: windows/process_creation

Description:
Detects the execution of Radmin which can be abused by an adversary to remotely control Windows machines

Detection logic:
{
  "selection": [
    {
      "Description": "Radmin Viewer"
    },
    {
      "Product": "Radmin Viewer"
    },
    {
      "OriginalFileName": "Radmin.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md
  - https://www.radmin.fr/
Sigma Detection Rule: Potential COM Objects Download Cradles Usage - Process Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-25
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Detection logic:
{
  "selection_1": {
    "CommandLine|contains": "[Type]::GetTypeFromCLSID("
  },
  "selection_2": {
    "CommandLine|contains": [
      "0002DF01-0000-0000-C[PII_REDACTED]00046",
      "F6D90F16-9C73-11D3-B32E-00C04F990BB4",
      "F5078F35-C551-11D3-89B9-0000F81FE221",
      "88d96a0a-f192-11d4-a65f[PII_REDACTED]e5",
      "AFBA6B42-5692-48EA-8141-DC517DCF0EF1",
      "AFB40FFD-B609-40A3-9828-F88BBE11E4E3",
      "88d96a0b-f192-11d4-a65f[PII_REDACTED]e5",
      "2087c2f4-2cef-4953-a8ab-66779b670495",
      "000209FF-0000-0000-C[PII_REDACTED]00046",
      "[PII_REDACTED]-C[PII_REDACTED]00046"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57
Sigma Detection Rule: Windows MSIX Package Support Framework AI_STUBS Execution
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-03
ATT&CK techniques: T1218, T1553.005, T1204.002
Log source: windows/process_creation

Description:
Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\AI_STUBS\\AiStubX64Elevated.exe",
      "\\AI_STUBS\\AiStubX86Elevated.exe",
      "\\AI_STUBS\\AiStubX64.exe",
      "\\AI_STUBS\\AiStubX86.exe"
    ],
    "OriginalFileName": "popupwrapper.exe"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/threat-intelligence/msix-installers/
  - https://redcanary.com/threat-detection-report/techniques/installer-packages/
  - https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
Sigma Detection Rule: Harvesting Of Wifi Credentials Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Hunkeler (@Karneades), oscd.community
Date: 2020-04-20
ATT&CK techniques: T1040
Log source: windows/process_creation

Description:
Detect the harvesting of wifi credentials using netsh.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "wlan",
      " s",
      " p",
      " k",
      "=clear"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.malwarebytes.com/threat-analysis/2020/04/new-agenttesla-variant-steals-wifi-credentials/
Sigma Detection Rule: Changing Existing Service ImagePath Value Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1574.011
Log source: windows/process_creation

Description:
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services


Detection logic:
{
  "selection": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains|all": [
      "add ",
      "SYSTEM\\CurrentControlSet\\Services\\",
      " ImagePath "
    ]
  },
  "selection_value": {
    "CommandLine|contains|windash": " -d "
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-2---service-imagepath-change-with-regexe
Sigma Detection Rule: Service Started/Stopped Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects usage of wmic to start or stop a service

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Image|endswith": "\\WMIC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " service ",
      " call "
    ],
    "CommandLine|contains": [
      "stopservice",
      "startservice"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Sigma Detection Rule: Suspicious Invoke-WebRequest Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-02
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell_ise.EXE",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_commands": {
    "CommandLine|contains": [
      "curl ",
      "Invoke-WebRequest",
      "iwr ",
      "wget "
    ]
  },
  "selection_flags": {
    "CommandLine|contains": [
      " -ur",
      " -o"
    ]
  },
  "selection_susp_locations": {
    "CommandLine|contains": [
      "\\AppData\\",
      "\\Desktop\\",
      "\\Temp\\",
      "\\Users\\Public\\",
      "%AppData%",
      "%Public%",
      "%Temp%",
      "%tmp%",
      ":\\Windows\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
Sigma Detection Rule: Uncommon One Time Only Scheduled Task At 00:00
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-07-15
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects scheduled task creation events that include suspicious actions, and is run once at 00:00

Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "wscript",
      "vbscript",
      "cscript",
      "wmic ",
      "wmic.exe",
      "regsvr32.exe",
      "powershell",
      "\\AppData\\"
    ]
  },
  "selection_time": {
    "CommandLine|contains|all": [
      "once",
      "00:00"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
Sigma Detection Rule: Suspicious Git Clone
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-03
ATT&CK techniques: T1593.003
Log source: windows/process_creation

Description:
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\git.exe",
        "\\git-remote-https.exe"
      ]
    },
    {
      "OriginalFileName": "git.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " clone ",
      "git-remote-https "
    ]
  },
  "selection_keyword": {
    "CommandLine|contains": [
      "exploit",
      "Vulns",
      "vulnerability",
      "RemoteCodeExecution",
      "Invoke-",
      "CVE-",
      "poc-",
      "ProofOfConcept",
      "proxyshell",
      "log4shell",
      "eternalblue",
      "eternal-blue",
      "MS17-"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e[PII_REDACTED]897b620c25fde1ea258c8218fe3d3/history.txt
Sigma Detection Rule: UAC Bypass Using Consent and Comctl32 - Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using consent.exe and comctl32.dll (UACMe 22)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\consent.exe",
    "Image|endswith": "\\werfault.exe",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious Scheduled Task Creation via Masqueraded XML File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel, Elastic (idea)
Date: 2023-04-20
ATT&CK techniques: T1036.005, T1053.005
Log source: windows/process_creation

Description:
Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_create": {
    "CommandLine|contains": [
      "/create",
      "-create"
    ]
  },
  "selection_cli_xml": {
    "CommandLine|contains": [
      "/xml",
      "-xml"
    ]
  },
  "filter_main_extension_xml": {
    "CommandLine|contains": ".xml"
  },
  "filter_main_system_process": {
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "filter_main_rundll32": {
    "ParentImage|endswith": "\\rundll32.exe",
    "ParentCommandLine|contains|all": [
      ":\\WINDOWS\\Installer\\MSI",
      ".tmp,zzzzInvokeManagedCustomActionOutOfProc"
    ]
  },
  "filter_optional_third_party": {
    "ParentImage|endswith": [
      ":\\ProgramData\\OEM\\UpgradeTool\\CareCenter_*\\BUnzip\\Setup_msi.exe",
      ":\\Program Files\\Axis Communications\\AXIS Camera Station\\SetupActions.exe",
      ":\\Program Files\\Axis Communications\\AXIS Device Manager\\AdmSetupActions.exe",
      ":\\Program Files (x86)\\Zemana\\AntiMalware\\AntiMalware.exe",
      ":\\Program Files\\Dell\\SupportAssist\\pcdrcui.exe"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/taskschd/daily-trigger-example--xml-
  - https://github.com/elastic/protections-artifacts/blob/084067123d3328a823b1c3fdde305b694275c794/behavior/rules/persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
Sigma Detection Rule: Indirect Command Execution via SFTP ProxyCommand
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-27
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.
Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\sftp.exe",
    "CommandLine|contains": "ProxyCommand="
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Sftp/
  - https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/
Sigma Detection Rule: PUA- IOX Tunneling Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-08
ATT&CK techniques: T1090
Log source: windows/process_creation

Description:
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes

Detection logic:
{
  "selection": {
    "Image|endswith": "\\iox.exe"
  },
  "selection_commandline": {
    "CommandLine|contains": [
      ".exe fwd -l ",
      ".exe fwd -r ",
      ".exe proxy -l ",
      ".exe proxy -r "
    ]
  },
  "selection_hashes": {
    "Hashes|contains": [
      "MD5=9DB2D314DD3F704A02051EF5EA210993",
      "SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD",
      "SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/EddieIvan01/iox
Sigma Detection Rule: Remote XSL Execution Via Msxsl.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-11-09
ATT&CK techniques: T1220
Log source: windows/process_creation

Description:
Detects the execution of the "msxsl" binary with an "http" keyword in the command line. This might indicate a potential remote execution of XSL files.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\msxsl.exe",
    "CommandLine|contains": "http"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
Sigma Detection Rule: Suspicious Execution From Outlook Temporary Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-01
ATT&CK techniques: T1566.001
Log source: windows/process_creation

Description:
Detects a suspicious program execution in Outlook temp folder

Detection logic:
{
  "selection": {
    "Image|contains": "\\Temporary Internet Files\\Content.Outlook\\"
  },
  "condition": "selection"
}

References:
  - Internal Research