deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Compress-Archive Cmdlet Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1560
Log source: windows/ps_script

Description:
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Compress-Archive"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560/T1560.md
Sigma Detection Rule: Inbox Rules Creation Or Update Activity Via ExchangePowerShell Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-02-10
ATT&CK techniques: T1564.008, T1114.003
Log source: windows/ps_script

Description:
Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails.
The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails.
Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.


Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": [
      "New-InboxRule",
      "Set-InboxRule"
    ]
  },
  "selection_params": {
    "ScriptBlockText|contains": [
      "DeleteMessage",
      "MarkAsRead",
      "MoveToFolder",
      "SubjectOrBodyContainsWords"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps
  - https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps
Sigma Detection Rule: Potential Data Exfiltration Over SMTP Via Send-MailMessage Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-09-26
ATT&CK techniques: T1048.003
Log source: windows/ps_script

Description:
Detects the execution of a PowerShell script with a call to the "Send-MailMessage" cmdlet along with the "-Attachments" flag. This could be a potential sign of data exfiltration via Email.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Send-MailMessage*-Attachments"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4
  - https://www.ietf.org/rfc/rfc2821.txt
Sigma Detection Rule: WinAPI Library Calls Via PowerShell Scripts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-21
ATT&CK techniques: T1059.001, T1106
Log source: windows/ps_script

Description:
Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Advapi32.dll",
      "kernel32.dll",
      "KernelBase.dll",
      "ntdll.dll",
      "secur32.dll",
      "user32.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: New Windows Firewall Rule Added Via New-NetFirewallRule Cmdlet - ScriptBlock
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2024-05-10
ATT&CK techniques: T1686.003
Log source: windows/ps_script

Description:
Detects when a powershell script contains calls to the "New-NetFirewallRule" cmdlet in order to add a new firewall rule with an "Allow" action.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "New-NetFirewallRule*-Action*Allow"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
  - https://malware.news/t/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/72170
  - https://cybersecuritynews.com/rhysida-ransomware-attacking-windows/
Sigma Detection Rule: WinAPI Function Calls Via PowerShell Scripts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-21
ATT&CK techniques: T1059.001, T1106
Log source: windows/ps_script

Description:
Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "AddSecurityPackage",
      "AdjustTokenPrivileges",
      "CloseHandle",
      "CreateProcessWithToken",
      "CreateRemoteThread",
      "CreateThread",
      "CreateUserThread",
      "DangerousGetHandle",
      "DuplicateTokenEx",
      "EnumerateSecurityPackages",
      "FreeLibrary",
      "GetDelegateForFunctionPointer",
      "GetLogonSessionData",
      "GetModuleHandle",
      "GetProcAddress",
      "GetProcessHandle",
      "GetTokenInformation",
      "ImpersonateLoggedOnUser",
      "LoadLibrary",
      "memcpy",
      "MiniDumpWriteDump",
      "OpenDesktop",
      "OpenProcess",
      "OpenProcessToken",
      "OpenThreadToken",
      "OpenWindowStation",
      "QueueUserApc",
      "ReadProcessMemory",
      "RevertToSelf",
      "RtlCreateUserThread",
      "SetThreadToken",
      "VirtualAlloc",
      "VirtualFree",
      "VirtualProtect",
      "WaitForSingleObject",
      "WriteInt32",
      "WriteProcessMemory",
      "ZeroFreeGlobalAllocUnicode"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Windows Mail App Mailbox Access Via PowerShell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-07-08
ATT&CK techniques: T1070.008
Log source: windows/ps_script

Description:
Detects PowerShell scripts that try to access the default Windows MailApp MailBox. This indicates manipulation of or access to the stored emails of a user. E.g. this could be used by an attacker to exfiltrate or delete the content of the emails.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "\\Comms\\Unistore\\data"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1070.008/T1070.008.md
Sigma Detection Rule: Mail Forwarding/Redirecting Activity Via ExchangePowerShell Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Nasreddine Bencherchali (Nextron Systems), Marco Pedrinazzi (@pedrinazziM) (InTheCyber)
Date: 2026-03-01
ATT&CK techniques: T1114.003, T1564.008, T1020
Log source: windows/ps_script

Description:
Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": [
      "New-InboxRule",
      "Set-InboxRule",
      "Set-Mailbox"
    ]
  },
  "selection_params": {
    "ScriptBlockText|contains": [
      "ForwardAsAttachmentTo",
      "ForwardingAddress",
      "ForwardingSmtpAddress",
      "ForwardTo",
      "RedirectTo"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/blog/email-forwarding-rules/
  - https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
Sigma Detection Rule: Potential Registry Reconnaissance Via PowerShell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-07-02
ATT&CK techniques: T1012, T1007
Log source: windows/ps_script

Description:
Detects PowerShell scripts with potential registry reconnaissance capabilities. Adversaries may interact with the Windows registry to gather information about the system credentials, configuration, and installed software.

Detection logic:
{
  "selection": {
    "ScriptBlockText|re": "(Get-Item|gci|Get-ChildItem).{1,64}-Path.{1,64}\\\\(currentcontrolset\\\\services|CurrentVersion\\\\Policies\\\\Explorer\\\\Run|CurrentVersion\\\\Run|CurrentVersion\\\\ShellServiceObjectDelayLoad|CurrentVersion\\\\Windows\\winlogon)\\\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1012/T1012.md
Sigma Detection Rule: SMB over QUIC Via PowerShell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-07-21
ATT&CK techniques: T1570
Log source: windows/ps_script

Description:
Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-SmbMapping",
      "-TransportType QUIC"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1570/T1570.md
  - https://learn.microsoft.com/en-us/powershell/module/smbshare/new-smbmapping?view=windowsserver2022-ps
  - https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
Sigma Detection Rule: Powershell Token Obfuscation - Powershell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-27
ATT&CK techniques: T1027.009
Log source: windows/ps_script

Description:
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation in Powershell scripts.
Use this rule as a threat-hunting baseline to find obfuscated scripts in your environment.
Once tested and tuned, consider deploying a production detection rule based on this hunting rule.


Detection logic:
{
  "selection": [
    {
      "ScriptBlockText|re": "\\w+`(\\w+|-|.)`[\\w+|\\s]"
    },
    {
      "ScriptBlockText|re": "\"(\\{\\d\\}){2,}\"\\s*-f"
    },
    {
      "ScriptBlockText|re": "(?i)\\$\\{`?e`?n`?v`?:`?p`?a`?t`?h`?\\}"
    }
  ],
  "filter_envpath": {
    "ScriptBlockText|contains": "${env:path}"
  },
  "filter_chocolatey": {
    "ScriptBlockText|contains": [
      "it will return true or false instead",
      "The function also prevents `Get-ItemProperty` from failing"
    ]
  },
  "filter_exchange": {
    "Path|startswith": "C:\\Program Files\\Microsoft\\Exchange Server\\",
    "Path|endswith": "\\bin\\servicecontrol.ps1",
    "ScriptBlockText|contains": "`r`n"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation
Sigma Detection Rule: Use Of Remove-Item to Delete File - ScriptBlock
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-15
ATT&CK techniques: T1070.004
Log source: windows/ps_script

Description:
PowerShell Remove-Item  with -Path to delete a file or a folder with "-Recurse"

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Remove-Item -Path ",
      "del -Path ",
      "erase -Path ",
      "rd -Path ",
      "ri -Path ",
      "rm -Path ",
      "rmdir -Path "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md
  - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Remove-Item?view=powershell-5.1&viewFallbackFrom=powershell-7
Sigma Detection Rule: Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2023-07-13
ATT&CK techniques: T1518.001, T1016
Log source: windows/ps_module

Description:
Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.

Detection logic:
{
  "selection_payload": {
    "Payload|contains": [
      "Get-NetFirewallRule",
      "Show-NetFirewallRule"
    ]
  },
  "selection_contextinfo": {
    "ContextInfo|contains": [
      "Get-NetFirewallRule",
      "Show-NetFirewallRule"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/get-netfirewallrule?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/show-netfirewallrule?view=windowsserver2022-ps
Sigma Detection Rule: Uncommon PowerShell Hosts
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-11
ATT&CK techniques: T1059.001
Log source: windows/ps_classic_start

Description:
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Detection logic:
{
  "selection": {
    "Data|contains": "HostApplication="
  },
  "filter_main_ps": {
    "Data|contains": [
      "HostApplication=?:/Windows/System32/WindowsPowerShell/v1.0/powershell",
      "HostApplication=?:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell",
      "HostApplication=?:\\Windows\\System32\\sdiagnhost.exe",
      "HostApplication=?:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=?:\\Windows\\SysWOW64\\sdiagnhost.exe",
      "HostApplication=?:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=powershell"
    ]
  },
  "filter_optional_citrix": {
    "Data|contains": "Citrix\\ConfigSync\\ConfigSync.ps1"
  },
  "filter_optional_hexnode": {
    "Data|contains": "HostApplication=C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
Sigma Detection Rule: bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Teymur Kheirkhabarov, Harish Segar
Date: 2020-06-29
ATT&CK techniques: T1059.001
Log source: windows/ps_classic_start

Description:
Detects powershell execution with that make use of to the bxor (Bitwise XOR).
Attackers might use as an alternative obfuscation method to Base64 encoded commands.
Investigate the CommandLine and process tree to determine if the activity is malicious.


Detection logic:
{
  "selection": {
    "Data|contains|all": [
      "HostName=ConsoleHost",
      " -bxor "
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=46
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
Sigma Detection Rule: Scheduled Task Created - Registry
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Center for Threat Informed Defense (CTID) Summiting the Pyramid Team
Date: 2023-09-27
ATT&CK techniques: T1053.005
Log source: windows/registry_event

Description:
Detects the creation of a scheduled task via Registry keys.

Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\",
      "\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/task_scheduling/
  - https://posts.specterops.io/abstracting-scheduled-tasks-3b6451f6a1c5
Sigma Detection Rule: Microsoft Office Trusted Location Updated
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-21
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to the registry keys related to "Trusted Location" of Microsoft Office. Attackers might add additional trusted locations to avoid macro security restrictions.

Detection logic:
{
  "selection": {
    "TargetObject|contains": "Security\\Trusted Locations\\Location",
    "TargetObject|endswith": "\\Path"
  },
  "filter_main_office_click_to_run": {
    "Image|contains": ":\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\",
    "Image|endswith": "\\OfficeClickToRun.exe"
  },
  "filter_main_office_apps": {
    "Image|contains": [
      ":\\Program Files\\Microsoft Office\\",
      ":\\Program Files (x86)\\Microsoft Office\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01
Sigma Detection Rule: Command Executed Via Run Dialog Box - Registry
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ahmed Farouk, Nasreddine Bencherchali
Date: 2024-11-01
Log source: windows/registry_set

Description:
Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key.
This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"
  },
  "filter_main_mrulist": {
    "TargetObject|endswith": "\\MRUList"
  },
  "filter_optional_ping": {
    "Details|contains": "ping"
  },
  "filter_optional_generic": {
    "Details": [
      "%appdata%\\1",
      "%localappdata%\\1",
      "%public%\\1",
      "%temp%\\1",
      "calc\\1",
      "dxdiag\\1",
      "explorer\\1",
      "gpedit.msc\\1",
      "mmc\\1",
      "notepad\\1",
      "regedit\\1",
      "services.msc\\1",
      "winver\\1"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.forensafe.com/blogs/runmrukey.html
  - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
  - https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
Sigma Detection Rule: Service Binary in User Controlled Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-05-02
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects the setting of the "ImagePath" value of a service registry key to a path controlled by a non-administrator user such as "\AppData\" or "\ProgramData\".
Attackers often use such directories for staging purposes.
This rule might also trigger on badly written software, where if an attacker controls an auto starting service, they might achieve persistence or privilege escalation.
Note that while ProgramData is a user controlled folder, software might apply strict ACLs which makes them only accessible to admin users. Remove such folders via filters if you experience a lot of noise.


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "ControlSet",
      "\\Services\\"
    ],
    "TargetObject|endswith": "\\ImagePath",
    "Details|contains": [
      ":\\ProgramData\\",
      "\\AppData\\Local\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "filter_optional_zoom": {
    "TargetObject|contains": "\\Services\\ZoomCptService",
    "Details|contains": "C:\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe"
  },
  "filter_optional_mbami": {
    "TargetObject|contains": "\\Services\\MBAMInstallerService",
    "Details|contains|all": [
      "C:\\Users\\",
      "AppData\\Local\\Temp\\MBAMInstallerService.exe"
    ]
  },
  "filter_main_windefend": {
    "TargetObject|contains": [
      "\\Services\\WinDefend\\",
      "\\Services\\MpKs"
    ],
    "Details|contains": "C:\\ProgramData\\Microsoft\\Windows Defender\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-12-01
ATT&CK techniques: T1059.001, T1027.010, T1547.001
Log source: windows/registry_set

Description:
Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.


Detection logic:
{
  "selection_key": {
    "TargetObject|contains": "\\Shell\\Open\\Command"
  },
  "selection_value_img": {
    "Details|contains": [
      "powershell",
      "pwsh"
    ]
  },
  "selection_value_namespace": {
    "Details|contains": "System.Security.Cryptography."
  },
  "selection_value_classes": {
    "Details|contains": [
      ".AesCryptoServiceProvider",
      ".DESCryptoServiceProvider",
      ".DSACryptoServiceProvider",
      ".RC2CryptoServiceProvider",
      ".Rijndael",
      ".RSACryptoServiceProvider",
      ".TripleDESCryptoServiceProvider"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0
  - https://squiblydoo.blog/2023/11/07/october-2023-solarmarker/
Sigma Detection Rule: Shell Context Menu Command Tampering
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-03-06
Log source: windows/registry_set

Description:
Detects changes to shell context menu commands. Use this rule to hunt for potential anomalies and suspicious shell commands.

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\Software\\Classes\\",
      "\\shell\\",
      "\\command\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://mrd0x.com/sentinelone-persistence-via-menu-context/
Sigma Detection Rule: PsExec Default Named Pipe
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Thomas Patzke
Date: 2017-06-12
ATT&CK techniques: T1569.002
Log source: windows/pipe_created

Description:
Detects PsExec service default pipe creation

Detection logic:
{
  "selection": {
    "PipeName": "\\PSEXESVC"
  },
  "condition": "selection"
}

References:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
Sigma Detection Rule: CreateRemoteThread API and LoadLibrary
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-11
ATT&CK techniques: T1055.001
Log source: windows/create_remote_thread

Description:
Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process

Detection logic:
{
  "selection": {
    "StartModule|endswith": "\\kernel32.dll",
    "StartFunction": "LoadLibraryA"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/180719-DLLProcessInjectionCreateRemoteThread/notebook.html