deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-12-05
Log source: windows/process_creation

Description:
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\ud83d\ude00",
      "\ud83d\ude03",
      "\ud83d\ude04",
      "\ud83d\ude01",
      "\ud83d\ude06",
      "\ud83d\ude05",
      "\ud83d\ude02",
      "\ud83e\udd23",
      "\ud83e\udd72",
      "\ud83e\udd79",
      "\u263a\ufe0f",
      "\ud83d\ude0a",
      "\ud83d\ude07",
      "\ud83d\ude42",
      "\ud83d\ude43",
      "\ud83d\ude09",
      "\ud83d\ude0c",
      "\ud83d\ude0d",
      "\ud83e\udd70",
      "\ud83d\ude18",
      "\ud83d\ude17",
      "\ud83d\ude19",
      "\ud83d\ude1a",
      "\ud83d\ude0b",
      "\ud83d\ude1b",
      "\ud83d\ude1d",
      "\ud83d\ude1c",
      "\ud83e\udd2a",
      "\ud83e\udd28",
      "\ud83e\uddd0",
      "\ud83e\udd13",
      "\ud83d\ude0e",
      "\ud83e\udd78",
      "\ud83e\udd29",
      "\ud83e\udd73",
      "\ud83d\ude0f",
      "\ud83d\ude12",
      "\ud83d\ude1e",
      "\ud83d\ude14",
      "\ud83d\ude1f",
      "\ud83d\ude15",
      "\ud83d\ude41",
      "\u2639\ufe0f",
      "\ud83d\ude23",
      "\ud83d\ude16",
      "\ud83d\ude2b",
      "\ud83d\ude29",
      "\ud83e\udd7a",
      "\ud83d\ude22",
      "\ud83d\ude2d",
      "\ud83d\ude2e\u200d\ud83d\udca8",
      "\ud83d\ude24",
      "\ud83d\ude20",
      "\ud83d\ude21",
      "\ud83e\udd2c",
      "\ud83e\udd2f",
      "\ud83d\ude33",
      "\ud83e\udd75",
      "\ud83e\udd76",
      "\ud83d\ude31",
      "\ud83d\ude28",
      "\ud83d\ude30",
      "\ud83d\ude25",
      "\ud83d\ude13",
      "\ud83e\udee3",
   

References:
  - Internal Research
Sigma Detection Rule: Remote Access Tool - MeshAgent Command Execution via MeshCentral
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @Kostastsale
Date: 2024-09-22
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects the use of MeshAgent to execute commands on the target host, particularly when threat actors might abuse it to execute commands directly.
MeshAgent can execute commands on the target host by leveraging win-console to obscure their activities and win-dispatcher to run malicious code through IPC with child processes.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\meshagent.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Ylianst/MeshAgent
  - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
  - https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
Sigma Detection Rule: Potentially Suspicious Command Targeting Teams Sensitive Files
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @SerkinValery
Date: 2022-09-16
ATT&CK techniques: T1528
Log source: windows/process_creation

Description:
Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams.
The database might contain authentication tokens and other sensitive information about the logged in accounts.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\\Microsoft\\Teams\\Cookies",
      "\\Microsoft\\Teams\\Local Storage\\leveldb"
    ]
  },
  "filter_main_legit_locations": {
    "Image|endswith": "\\Microsoft\\Teams\\current\\Teams.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/
  - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens
Sigma Detection Rule: Sensitive File Recovery From Backup Via Wbadmin.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-05-10
ATT&CK techniques: T1003.003
Log source: windows/process_creation

Description:
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection_backup": {
    "CommandLine|contains|all": [
      " recovery",
      "recoveryTarget",
      "itemtype:File"
    ],
    "CommandLine|contains": [
      "\\config\\SAM",
      "\\config\\SECURITY",
      "\\config\\SYSTEM",
      "\\Windows\\NTDS\\NTDS.dit"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
Sigma Detection Rule: Suspicious Registry Modification From ADS Via Regini.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Eli Salem, Sander Wiebing, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects the import of an alternate data stream with regini.exe, regini.exe can be used to modify registry keys.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regini.exe"
    },
    {
      "OriginalFileName": "REGINI.EXE"
    }
  ],
  "selection_re": {
    "CommandLine|re": ":[^ \\\\]"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regini/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regini
Sigma Detection Rule: SQLite Firefox Profile Data DB Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-04-08
ATT&CK techniques: T1539, T1005
Log source: windows/process_creation

Description:
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.

Detection logic:
{
  "selection_sql": [
    {
      "Product": "SQLite"
    },
    {
      "Image|endswith": [
        "\\sqlite.exe",
        "\\sqlite3.exe"
      ]
    }
  ],
  "selection_firefox": {
    "CommandLine|contains": [
      "cookies.sqlite",
      "places.sqlite"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1539/T1539.md#atomic-test-1---steal-firefox-cookies-windows
  - https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/
Sigma Detection Rule: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2021-06-28
ATT&CK techniques: T1547.001
Log source: windows/process_creation

Description:
Detects suspicious command line reg.exe tool adding key to RUN key in Registry

Detection logic:
{
  "selection": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains|all": [
      "reg",
      " add "
    ],
    "CommandLine|contains": [
      "Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run"
    ]
  },
  "condition": "selection"
}

References:
  - https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/
  - https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: Windows Processes Suspicious Parent Directory
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: vburov
Date: 2019-02-23
ATT&CK techniques: T1036.003, T1036.005
Log source: windows/process_creation

Description:
Detect suspicious parent processes of well-known Windows processes

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\svchost.exe",
      "\\taskhost.exe",
      "\\lsm.exe",
      "\\lsass.exe",
      "\\services.exe",
      "\\lsaiso.exe",
      "\\csrss.exe",
      "\\wininit.exe",
      "\\winlogon.exe"
    ]
  },
  "filter_sys": [
    {
      "ParentImage|endswith": [
        "\\SavService.exe",
        "\\ngen.exe"
      ]
    },
    {
      "ParentImage|contains": [
        "\\System32\\",
        "\\SysWOW64\\"
      ]
    }
  ],
  "filter_msmpeng": {
    "ParentImage|contains": [
      "\\Windows Defender\\",
      "\\Microsoft Security Client\\"
    ],
    "ParentImage|endswith": "\\MsMpEng.exe"
  },
  "filter_null": [
    {
      "ParentImage": null
    },
    {
      "ParentImage": [
        "",
        "-"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
  - https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/
  - https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf
Sigma Detection Rule: HackTool - PowerTool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-29
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\PowerTool.exe",
        "\\PowerTool64.exe"
      ]
    },
    {
      "OriginalFileName": "PowerTool.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
  - https://twitter.com/gbti_sa/status/[PII_REDACTED]00602375?lang=en
  - https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
Sigma Detection Rule: File Download Using ProtocolHandler.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\protocolhandler.exe"
    },
    {
      "OriginalFileName": "ProtocolHandler.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "ftp://",
      "http://",
      "https://"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/
Sigma Detection Rule: Python Function Execution Security Warning Disabled In Excel
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale
Date: 2023-08-22
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects changes to the registry value "PythonFunctionWarnings" that would prevent any warnings or alerts from showing when Python functions are about to be executed.
Threat actors could run malicious code through the new Microsoft Excel feature that allows Python to run within the spreadsheet.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\Microsoft\\Office\\",
      "\\Excel\\Security",
      "PythonFunctionWarnings"
    ],
    "CommandLine|contains": " 0"
  },
  "condition": "selection"
}

References:
  - https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f[PII_REDACTED]7
Sigma Detection Rule: Suspicious Mshta.EXE Execution Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-07-17
ATT&CK techniques: T1106
Log source: windows/process_creation

Description:
Detects suspicious mshta process execution patterns

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mshta.exe"
    },
    {
      "OriginalFileName": "MSHTA.EXE"
    }
  ],
  "selection_susp": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ],
    "CommandLine|contains": [
      "\\AppData\\Local\\",
      "C:\\ProgramData\\",
      "C:\\Users\\Public\\",
      "C:\\Windows\\Temp\\"
    ]
  },
  "filter_img": [
    {
      "Image|startswith": [
        "C:\\Windows\\System32\\",
        "C:\\Windows\\SysWOW64\\"
      ]
    },
    {
      "CommandLine|contains": [
        ".htm",
        ".hta"
      ]
    },
    {
      "CommandLine|endswith": [
        "mshta.exe",
        "mshta"
      ]
    }
  ],
  "condition": "all of selection_* or (selection_img and not filter_img)"
}

References:
  - https://en.wikipedia.org/wiki/HTML_Application
  - https://www.echotrail.io/insights/search/mshta.exe
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
Sigma Detection Rule: Rundll32 Registered COM Objects
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1546.015
Log source: windows/process_creation

Description:
load malicious registered COM objects

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "-sta ",
      "-localserver "
    ],
    "CommandLine|contains|all": [
      "{",
      "}"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md
Sigma Detection Rule: Suspicious Child Process Created as System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR)
Date: 2019-10-26
ATT&CK techniques: T1134.002
Log source: windows/process_creation

Description:
Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts

Detection logic:
{
  "selection": {
    "ParentUser|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "ParentUser|endswith": [
      "\\NETWORK SERVICE",
      "\\LOCAL SERVICE"
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "User|endswith": [
      "\\SYSTEM",
      "\\Syst\u00e8me",
      "\\\u0421\u0418\u0421\u0422\u0415\u041c\u0410"
    ],
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "filter_rundll32": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": "DavSetCookie"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
  - https://github.com/antonioCoco/RogueWinRM
  - https://twitter.com/Cyb3rWard0g/status/[PII_REDACTED]43024897
Sigma Detection Rule: Suspicious VBoxDrvInst.exe Parameters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Konstantin Grishchenko, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detect VBoxDrvInst.exe run with parameters allowing processing INF file.
This allows to create values in the registry and install drivers.
For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys


Detection logic:
{
  "selection": {
    "Image|endswith": "\\VBoxDrvInst.exe",
    "CommandLine|contains|all": [
      "driver",
      "executeinf"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml
  - https://twitter.com/pabraeken/status/[PII_REDACTED]79492864
Sigma Detection Rule: Suspicious Network Command
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2021-12-07
ATT&CK techniques: T1016
Log source: windows/process_creation

Description:
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Detection logic:
{
  "selection": {
    "CommandLine|re": [
      "ipconfig\\s+/all",
      "netsh\\s+interface show interface",
      "arp\\s+-a",
      "nbtstat\\s+-n",
      "net\\s+config",
      "route\\s+print"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-1---system-network-configuration-discovery-on-windows
Sigma Detection Rule: Potential File Download Via MS-AppInstaller Protocol Handler
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
Date: 2023-11-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE
The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "ms-appinstaller://?source=",
      "http"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/
Sigma Detection Rule: New User Created Via Net.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Endgame, JHasenbusch (adapted to Sigma for oscd.community)
Date: 2018-10-30
ATT&CK techniques: T1136.001
Log source: windows/process_creation

Description:
Identifies the creation of local users via the net.exe command.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "user",
      "add"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/014c3f51-89c6-40f1-ac9c-5688f26090ab.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
Sigma Detection Rule: Suspicious Download Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1027, T1105
Log source: windows/process_creation

Description:
Detects the execution of certutil with certain flags that allow the utility to download files.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      "urlcache ",
      "verifyctl ",
      "URL "
    ]
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://forensicitguy.github.io/agenttesla-vba-certutil-download/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/egre55/status/[PII_REDACTED]16193025
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Sigma Detection Rule: Potential Renamed Rundll32 Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-22
Log source: windows/process_creation

Description:
Detects when 'DllRegisterServer' is called in the commandline and the image is not rundll32. This could mean that the 'rundll32' utility has been renamed in order to avoid detection

Detection logic:
{
  "selection": {
    "CommandLine|contains": "DllRegisterServer"
  },
  "filter": {
    "Image|endswith": "\\rundll32.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/swisscom_csirt/status/[PII_REDACTED]22521602?s=20
  - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/
Sigma Detection Rule: Php Inline Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\php.exe"
    },
    {
      "OriginalFileName": "php.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -r"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.php.net/manual/en/features.commandline.php
  - https://www.revshells.com/
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
Sigma Detection Rule: PUA - Ngrok Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-14
ATT&CK techniques: T1572
Log source: windows/process_creation

Description:
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.


Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      " tcp 139",
      " tcp 445",
      " tcp 3389",
      " tcp 5985",
      " tcp 5986"
    ]
  },
  "selection2": {
    "CommandLine|contains|all": [
      " start ",
      "--all",
      "--config",
      ".yml"
    ]
  },
  "selection3": {
    "Image|endswith": "ngrok.exe",
    "CommandLine|contains": [
      " tcp ",
      " http ",
      " authtoken "
    ]
  },
  "selection4": {
    "CommandLine|contains": [
      ".exe authtoken ",
      ".exe start --all"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://ngrok.com/docs
  - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
  - https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp
  - https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb[PII_REDACTED]4c82f325282f805d1085527e1e2ccfa1/detection
  - https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/