deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdump
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: SecurityAura
Date: 2022-11-16
ATT&CK techniques: T1003
Log source: windows/file_event

Description:
Detects default filenames output from the execution of CrackMapExec and Impacket-secretsdump against an endpoint.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe",
    "TargetFilename|re": "\\\\Windows\\\\System32\\\\[a-zA-Z0-9]{8}\\.tmp$"
  },
  "condition": "selection"
}

References:
  - https://github.com/Porchetta-Industries/CrackMapExec
  - https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff[PII_REDACTED]7f836235d/examples/secretsdump.py
Sigma Detection Rule: OneNote Attachment File Dropped In Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-22
Log source: windows/file_event

Description:
Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments

Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\",
      ":\\Temp\\"
    ],
    "TargetFilename|endswith": [
      ".one",
      ".onepkg"
    ]
  },
  "filter_main_onenote": {
    "Image|contains": ":\\Program Files\\Microsoft Office\\",
    "Image|endswith": "\\ONENOTE.EXE"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
Sigma Detection Rule: Anydesk Temporary Artefact
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-11
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "\\AppData\\Roaming\\AnyDesk\\user.conf",
      "\\AppData\\Roaming\\AnyDesk\\system.conf"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
Sigma Detection Rule: Suspicious File Write to Webapps Root Directory
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-20
ATT&CK techniques: T1505.003, T1190
Log source: windows/file_event

Description:
Detects suspicious file writes to the root directory of web applications, particularly Apache web servers or Tomcat servers.
This may indicate an attempt to deploy malicious files such as web shells or other unauthorized scripts.


Detection logic:
{
  "selection_susp_img": {
    "Image|endswith": [
      "\\dotnet.exe",
      "\\w3wp.exe",
      "\\java.exe"
    ]
  },
  "selection_servers": {
    "TargetFilename|contains": [
      "\\apache",
      "\\tomcat"
    ]
  },
  "selection_path": {
    "TargetFilename|contains": "\\webapps\\ROOT\\"
  },
  "selection_susp_extensions": {
    "TargetFilename|endswith": ".jsp"
  },
  "condition": "all of selection_*"
}

References:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
Sigma Detection Rule: PowerShell Profile Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: HieuTT35, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-24
ATT&CK techniques: T1546.013
Log source: windows/file_event

Description:
Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\Microsoft.PowerShell_profile.ps1",
      "\\PowerShell\\profile.ps1",
      "\\Program Files\\PowerShell\\7-preview\\profile.ps1",
      "\\Program Files\\PowerShell\\7\\profile.ps1",
      "\\Windows\\System32\\WindowsPowerShell\\v1.0\\profile.ps1",
      "\\WindowsPowerShell\\profile.ps1"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/
  - https://persistence-info.github.io/Data/powershellprofile.html
Sigma Detection Rule: Potential Privilege Escalation Attempt Via .Exe.Local Technique
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Subhash P (@pbssubhash)
Date: 2022-12-16
Log source: windows/file_event

Description:
Detects potential privilege escalation attempt via the creation of the "*.Exe.Local" folder inside the "System32" directory in order to sideload "comctl32.dll"

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": [
      "C:\\Windows\\System32\\logonUI.exe.local",
      "C:\\Windows\\System32\\werFault.exe.local",
      "C:\\Windows\\System32\\consent.exe.local",
      "C:\\Windows\\System32\\narrator.exe.local",
      "C:\\Windows\\System32\\wermgr.exe.local"
    ],
    "TargetFilename|endswith": "\\comctl32.dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/binderlabs/DirCreate2System
  - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt
Sigma Detection Rule: UAC Bypass Using MSConfig Token Modification - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|endswith": "\\AppData\\Local\\Temp\\pkgmgr.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Legitimate Application Dropped Executable
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-08-21
ATT&CK techniques: T1218
Log source: windows/file_event

Description:
Detects programs on a Windows system that should not write executables to disk

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\eqnedt32.exe",
      "\\wordpad.exe",
      "\\wordview.exe",
      "\\certutil.exe",
      "\\certoc.exe",
      "\\CertReq.exe",
      "\\Desktopimgdownldr.exe",
      "\\esentutl.exe",
      "\\mshta.exe",
      "\\AcroRd32.exe",
      "\\RdrCEF.exe",
      "\\hh.exe",
      "\\finger.exe"
    ],
    "TargetFilename|endswith": [
      ".exe",
      ".dll",
      ".ocx"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
Sigma Detection Rule: Uncommon File Created In Office Startup Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-05
ATT&CK techniques: T1587.001
Log source: windows/file_event

Description:
Detects the creation of a file with an uncommon extension in an Office application startup folder

Detection logic:
{
  "selection_word_paths": [
    {
      "TargetFilename|contains": "\\Microsoft\\Word\\STARTUP"
    },
    {
      "TargetFilename|contains|all": [
        "\\Office",
        "\\Program Files",
        "\\STARTUP"
      ]
    }
  ],
  "filter_exclude_word_ext": {
    "TargetFilename|endswith": [
      ".docb",
      ".docm",
      ".docx",
      ".dotm",
      ".mdb",
      ".mdw",
      ".pdf",
      ".wll",
      ".wwl"
    ]
  },
  "selection_excel_paths": [
    {
      "TargetFilename|contains": "\\Microsoft\\Excel\\XLSTART"
    },
    {
      "TargetFilename|contains|all": [
        "\\Office",
        "\\Program Files",
        "\\XLSTART"
      ]
    }
  ],
  "filter_exclude_excel_ext": {
    "TargetFilename|endswith": [
      ".xll",
      ".xls",
      ".xlsm",
      ".xlsx",
      ".xlt",
      ".xltm",
      ".xlw"
    ]
  },
  "filter_main_office_click_to_run": {
    "Image|contains": ":\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\",
    "Image|endswith": "\\OfficeClickToRun.exe"
  },
  "filter_main_office_apps": {
    "Image|contains": [
      ":\\Program Files\\Microsoft Office\\",
      ":\\Program Files (x86)\\Microsoft Office\\"
    ],
    "Image|endswith": [
      "\\winword.exe",
      "\\excel.exe"
    ]
  },
  "condition": "((selection_word_paths and not filter_exclude_word_ext) or (selection_excel_paths and not filter_exclude_excel_ext)) and not 1 of filter_main_*"
}

References:
  - https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/
  - http://addbalance.com/word/startup.htm
  - https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3
  - https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions
Sigma Detection Rule: Assembly DLL Creation Via AspNetCompiler
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-14
Log source: windows/file_event

Description:
Detects the creation of new DLL assembly files by "aspnet_compiler.exe", which could be a sign of "aspnet_compiler" abuse to proxy execution through a build provider.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\aspnet_compiler.exe",
    "TargetFilename|contains|all": [
      "\\Temporary ASP.NET Files\\",
      "\\assembly\\tmp\\",
      ".dll"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - CrackMapExec File Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-03-11
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects file creation events with filename patterns used by CrackMapExec.

Detection logic:
{
  "selection_path": {
    "TargetFilename|startswith": "C:\\Windows\\Temp\\"
  },
  "selection_names_str": {
    "TargetFilename|endswith": [
      "\\temp.ps1",
      "\\msol.ps1"
    ]
  },
  "selection_names_re": [
    {
      "TargetFilename|re": "\\\\[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\\.txt$"
    },
    {
      "TargetFilename|re": "\\\\[a-zA-Z]{8}\\.tmp$"
    }
  ],
  "condition": "selection_path and 1 of selection_names_*"
}

References:
  - https://github.com/byt3bl33d3r/CrackMapExec/
Sigma Detection Rule: Process Monitor Driver Creation By Non-Sysinternals Binary
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
ATT&CK techniques: T1068
Log source: windows/file_event

Description:
Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\procmon",
    "TargetFilename|endswith": ".sys"
  },
  "filter_main_process_explorer": {
    "Image|endswith": [
      "\\procmon.exe",
      "\\procmon64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Desktopimgdownldr Target File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-03
ATT&CK techniques: T1105
Log source: windows/file_event

Description:
Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension

Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe",
    "TargetFilename|contains": "\\Personalization\\LockScreenImage\\"
  },
  "filter1": {
    "TargetFilename|contains": "C:\\Windows\\"
  },
  "filter2": {
    "TargetFilename|contains": [
      ".jpg",
      ".jpeg",
      ".png"
    ]
  },
  "condition": "selection and not filter1 and not filter2"
}

References:
  - https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]45741825
Sigma Detection Rule: ADExplorer Writing Complete AD Snapshot Into .dat File
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Arnim Rupp (Nextron Systems), Thomas Patzke
Date: 2025-07-09
ATT&CK techniques: T1087.002, T1069.002, T1482
Log source: windows/file_event

Description:
Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\ADExp.exe",
      "\\ADExplorer.exe",
      "\\ADExplorer64.exe",
      "\\ADExplorer64a.exe"
    ],
    "TargetFilename|endswith": ".dat"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
  - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
  - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
  - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
  - https://trustedsec.com/blog/adexplorer-on-engagements
Sigma Detection Rule: Potentially Suspicious File Creation by OpenEDR's ITSMService
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: @kostastsale
Date: 2026-02-19
ATT&CK techniques: T1105, T1570, T1219
Log source: windows/file_event

Description:
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.


Detection logic:
{
  "selection_process": {
    "Image|endswith": "\\COMODO\\Endpoint Manager\\ITSMService.exe"
  },
  "selection_suspicious_extensions": {
    "TargetFilename|endswith": [
      ".7z",
      ".bat",
      ".cmd",
      ".com",
      ".dll",
      ".exe",
      ".hta",
      ".js",
      ".pif",
      ".ps1",
      ".rar",
      ".scr",
      ".vbe",
      ".vbs",
      ".zip"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
Sigma Detection Rule: Created Files by Microsoft Sync Center
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: elhoim
Date: 2022-04-28
ATT&CK techniques: T1055, T1218
Log source: windows/file_event

Description:
This rule detects suspicious files created by Microsoft Sync Center (mobsync)

Detection logic:
{
  "selection_mobsync": {
    "Image|endswith": "\\mobsync.exe"
  },
  "filter_created_file": {
    "TargetFilename|endswith": [
      ".dll",
      ".exe"
    ]
  },
  "condition": "selection_mobsync and filter_created_file"
}

References:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
Sigma Detection Rule: PDF File Created By RegEdit.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-08
Log source: windows/file_event

Description:
Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process.
This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\regedit.exe",
    "TargetFilename|endswith": ".pdf"
  },
  "condition": "selection"
}

References:
  - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
Sigma Detection Rule: Potential Persistence Via Notepad++ Plugins
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-10
Log source: windows/file_event

Description:
Detects creation of new ".dll" files inside the plugins directory of a notepad++ installation by a process other than "gup.exe". Which could indicates possible persistence

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Notepad++\\plugins\\",
    "TargetFilename|endswith": ".dll"
  },
  "filter_gup": {
    "Image|endswith": "\\Notepad++\\updater\\gup.exe"
  },
  "filter_install": {
    "Image|startswith": "C:\\Users\\",
    "Image|contains": "\\AppData\\Local\\Temp\\",
    "Image|endswith": [
      "\\target.exe",
      "Installer.x64.exe"
    ]
  },
  "filter_main_installer": {
    "Image|contains": "\\npp.",
    "Image|endswith": ".exe",
    "TargetFilename": [
      "C:\\Program Files\\Notepad++\\plugins\\NppExport\\NppExport.dll",
      "C:\\Program Files\\Notepad++\\plugins\\mimeTools\\mimeTools.dll",
      "C:\\Program Files\\Notepad++\\plugins\\NppConverter\\NppConverter.dll",
      "C:\\Program Files\\Notepad++\\plugins\\Config\\nppPluginList.dll"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://pentestlab.blog/2022/02/14/persistence-notepad-plugins/
Sigma Detection Rule: Potential Startup Shortcut Persistence Via PowerShell.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christopher Peacock '@securepeacock', SCYTHE
Date: 2021-10-24
ATT&CK techniques: T1547.001
Log source: windows/file_event

Description:
Detects PowerShell writing startup shortcuts.
This procedure was highlighted in Red Canary Intel Insights Oct. 2021, "We frequently observe adversaries using PowerShell to write malicious .lnk files into the startup directory to establish persistence.
Accordingly, this detection opportunity is likely to identify persistence mechanisms in multiple threats.
In the context of Yellow Cockatoo, this persistence mechanism eventually launches the command-line script that leads to the installation of a malicious DLL"


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetFilename|contains": "\\start menu\\programs\\startup\\",
    "TargetFilename|endswith": ".lnk"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/intelligence-insights-october-2021/
  - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder
Sigma Detection Rule: Potential File Extension Spoofing Using Right-to-Left Override
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Peters (Nextron Systems), Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2024-11-17
ATT&CK techniques: T1036.002
Log source: windows/file_event

Description:
Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.


Detection logic:
{
  "selection_rtlo_unicode": {
    "TargetFilename|contains": [
      "\\u202e",
      "[U+202E]",
      "\u202e"
    ]
  },
  "selection_extensions": {
    "TargetFilename|contains": [
      "3pm.",
      "4pm.",
      "cod.",
      "fdp.",
      "ftr.",
      "gepj.",
      "gnp.",
      "gpj.",
      "ism.",
      "lmth.",
      "nls.",
      "piz.",
      "slx.",
      "tdo.",
      "vsc.",
      "vwm.",
      "xcod.",
      "xslx.",
      "xtpp."
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/blog/right-to-left-override/
  - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
Sigma Detection Rule: WinRAR Creating Files in Startup Locations
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-16
ATT&CK techniques: T1547.001
Log source: windows/file_event

Description:
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder.
This kind of behaviour has been associated with exploitation of WinRAR path traversal vulnerability CVE-2025-6218 or CVE-2025-8088.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\WinRAR.exe",
      "\\Rar.exe"
    ],
    "TargetFilename|contains": "\\Start Menu\\Programs\\Startup\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/mulwareX/CVE-2025-6218-POC
  - https://x.com/0x534c/status/[PII_REDACTED]87710685
  - https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
Sigma Detection Rule: Suspicious ASPX File Drop by Exchange
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), MSTI (query, idea)
Date: 2022-10-01
ATT&CK techniques: T1505.003
Log source: windows/file_event

Description:
Detects suspicious file type dropped by an Exchange component in IIS into a suspicious folder

Detection logic:
{
  "selection": {
    "Image|endswith": "\\w3wp.exe",
    "CommandLine|contains": "MSExchange",
    "TargetFilename|contains": [
      "FrontEnd\\HttpProxy\\",
      "\\inetpub\\wwwroot\\aspnet_client\\"
    ]
  },
  "selection_types": {
    "TargetFilename|endswith": [
      ".aspx",
      ".asp",
      ".ashx"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/
  - https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html
  - https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html