deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Service Startup Type Change Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-27
ATT&CK techniques: T1047, T1685
Log source: windows/process_creation

Description:
Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " service ",
      "ChangeStartMode"
    ],
    "CommandLine|contains": [
      "Manual",
      "Disabled"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/
Sigma Detection Rule: Potential MsiExec Masquerading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-11-14
ATT&CK techniques: T1036.005
Log source: windows/process_creation

Description:
Detects the execution of msiexec.exe from an uncommon directory

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\msiexec.exe"
    },
    {
      "OriginalFileName": "\\msiexec.exe"
    }
  ],
  "filter": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/200_okay_/status/[PII_REDACTED]11215104
Sigma Detection Rule: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated Powershell via VAR++ LAUNCHER

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "&&set",
      "cmd",
      "/c",
      "-f"
    ],
    "CommandLine|contains": [
      "{0}",
      "{1}",
      "{2}",
      "{3}",
      "{4}",
      "{5}"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Python Inline Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "python.exe"
    },
    {
      "Image|endswith": [
        "python.exe",
        "python3.exe",
        "python2.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -c"
  },
  "filter_main_python_1": {
    "ParentImage|startswith": [
      "C:\\Program Files\\Python",
      "C:\\Program Files (x86)\\Python"
    ],
    "ParentImage|endswith": "\\python.exe",
    "ParentCommandLine|contains": "-E -s -m ensurepip -U --default-pip"
  },
  "filter_main_python_trace": {
    "ParentImage|startswith": [
      "C:\\Program Files\\Python",
      "C:\\Program Files (x86)\\Python"
    ],
    "CommandLine|contains|all": [
      "-W ignore::DeprecationWarning",
      "['install', '--no-cache-dir', '--no-index', '--find-links',",
      "'--upgrade', 'pip'"
    ]
  },
  "filter_optional_vscode": [
    {
      "ParentImage|endswith": "\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe"
    },
    {
      "ParentImage": [
        "C:\\Program Files\\Microsoft VS Code\\Code.exe",
        "C:\\Program Files (x86)\\Microsoft VS Code\\Code.exe"
      ]
    }
  ],
  "filter_optional_pip": {
    "CommandLine|contains|all": [
      "<pip-setuptools-caller>",
      "exec(compile("
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://docs.python.org/3/using/cmdline.html#cmdoption-c
  - https://www.revshells.com/
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
Sigma Detection Rule: Unmount Share Via Net.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: oscd.community, @redcanary, Zach Stanford @svch0st
Date: 2020-10-08
ATT&CK techniques: T1070.005
Log source: windows/process_creation

Description:
Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "share",
      "/delete"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md
Sigma Detection Rule: Insensitive Subfolder Search Via Findstr.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-05
ATT&CK techniques: T1218, T1564.004, T1552.001, T1105
Log source: windows/process_creation

Description:
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.


Detection logic:
{
  "selection_findstr": [
    {
      "CommandLine|contains": "findstr"
    },
    {
      "Image|endswith": "findstr.exe"
    },
    {
      "OriginalFileName": "FINDSTR.EXE"
    }
  ],
  "selection_cli_search_subfolder": {
    "CommandLine|contains|windash": " -s "
  },
  "selection_cli_search_insensitive": {
    "CommandLine|contains|windash": " -i "
  },
  "condition": "selection_findstr and all of selection_cli_search_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Findstr/
  - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: HackTool - Potential Impacket Lateral Movement Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ecco, oscd.community, Jonhnathan Ribeiro, Tim Rauch
Date: 2019-09-03
ATT&CK techniques: T1047, T1021.003
Log source: windows/process_creation

Description:
Detects wmiexec/dcomexec/atexec/smbexec from Impacket framework

Detection logic:
{
  "selection_other": {
    "ParentImage|endswith": [
      "\\wmiprvse.exe",
      "\\mmc.exe",
      "\\explorer.exe",
      "\\services.exe"
    ],
    "CommandLine|contains|all": [
      "cmd.exe",
      "/Q",
      "/c",
      "\\\\\\\\127.0.0.1\\\\",
      "&1"
    ]
  },
  "selection_atexec": {
    "ParentCommandLine|contains": [
      "svchost.exe -k netsvcs",
      "taskeng.exe"
    ],
    "CommandLine|contains|all": [
      "cmd.exe",
      "/C",
      "Windows\\Temp\\",
      "&1"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py
  - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py
  - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py
  - https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py
  - https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html
Sigma Detection Rule: Invoke-Obfuscation Via Stdin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated Powershell via Stdin in Scripts

Detection logic:
{
  "selection": {
    "CommandLine|re": "(?i)(?:set).*&&\\s?set.*(?:environment|invoke|\\$\\{?input).*&&.*\""
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Cscript/Wscript Potentially Suspicious Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86')
Date: 2023-05-15
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of Wscript/Cscript. These include processes such as rundll32 with uncommon exports or PowerShell spawning rundll32 or regsvr32.
Malware such as Pikabot and Qakbot were seen using similar techniques as well as many others.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\wscript.exe",
      "\\cscript.exe"
    ]
  },
  "selection_cli_script_main": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "selection_cli_script_option_mshta": {
    "CommandLine|contains|all": [
      "mshta",
      "http"
    ]
  },
  "selection_cli_script_option_other": {
    "CommandLine|contains": [
      "rundll32",
      "regsvr32",
      "msiexec"
    ]
  },
  "selection_cli_standalone": {
    "Image|endswith": "\\rundll32.exe"
  },
  "filter_main_rundll32_known_exports": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      "UpdatePerUserSystemParameters",
      "PrintUIEntry",
      "ClearMyTracksByProcess"
    ]
  },
  "condition": "selection_parent and ( selection_cli_standalone or (selection_cli_script_main and 1 of selection_cli_script_option_*) ) and not 1 of filter_main_*"
}

References:
  - Internal Research
  - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_30.10.2023.txt
  - https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
Sigma Detection Rule: HackTool - Htran/NATBypass Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-12-27
ATT&CK techniques: T1090
Log source: windows/process_creation

Description:
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\htran.exe",
      "\\lcx.exe"
    ]
  },
  "selection_cli": {
    "CommandLine|contains": [
      ".exe -tran ",
      ".exe -slave "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/HiwinCN/HTran
  - https://github.com/cw1997/NATBypass
Sigma Detection Rule: File Download Via Bitsadmin
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael Haag, FPT.EagleEye
Date: 2017-03-09
ATT&CK techniques: T1197, T1036.003, T1105
Log source: windows/process_creation

Description:
Detects usage of bitsadmin downloading a file

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": " /transfer "
  },
  "selection_cli_1": {
    "CommandLine|contains": [
      " /create ",
      " /addfile "
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains": "http"
  },
  "condition": "selection_img and (selection_cmd or all of selection_cli_*)"
}

References:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
Sigma Detection Rule: Shell32 DLL Execution in Suspicious Directory
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-11-24
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects shell32.dll executing a DLL in a suspicious directory

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "shell32.dll",
      "Control_RunDLL"
    ],
    "CommandLine|contains": [
      "%AppData%",
      "%LocalAppData%",
      "%Temp%",
      "%tmp%",
      "\\AppData\\",
      "\\Temp\\",
      "\\Users\\Public\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.group-ib.com/resources/threat-research/red-curl-2.html
Sigma Detection Rule: Potential Commandline Obfuscation Using Escape Characters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: juju4
Date: 2018-12-11
ATT&CK techniques: T1140
Log source: windows/process_creation

Description:
Detects potential commandline obfuscation using known escape characters

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "h^t^t^p",
      "h\"t\"t\"p"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/vysecurity/status/[PII_REDACTED]58385153
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]17756673
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]37678592
  - https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques
  - https://web.archive.org/web/[PII_REDACTED]4956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
Sigma Detection Rule: SQL Client Tools PowerShell Session Detection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Agro (@agro_sev) oscd.communitly
Date: 2020-10-13
ATT&CK techniques: T1059.001, T1127
Log source: windows/process_creation

Description:
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\sqltoolsps.exe"
    },
    {
      "ParentImage|endswith": "\\sqltoolsps.exe"
    },
    {
      "OriginalFileName": "\\sqltoolsps.exe"
    }
  ],
  "filter": {
    "ParentImage|endswith": "\\smss.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml
  - https://twitter.com/pabraeken/status/[PII_REDACTED]40992768
Sigma Detection Rule: Suspicious Driver Install by pnputil.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Hai Vaknin @LuxNoBulIshit, Avihay eldad  @aloneliassaf, Austin Songer @austinsonger
Date: 2021-09-30
ATT&CK techniques: T1547
Log source: windows/process_creation

Description:
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "-i",
      "/install",
      "-a",
      "/add-driver",
      ".inf"
    ],
    "Image|endswith": "\\pnputil.exe"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax
  - https://strontic.github.io/xcyclopedia/library/pnputil.exe-60EDC5E6BDBAEE441F2E3AEACD0340D2.html
Sigma Detection Rule: Uncommon Child Process Of AddinUtil.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\addinutil.exe"
  },
  "filter_main_werfault": {
    "Image|endswith": [
      ":\\Windows\\System32\\conhost.exe",
      ":\\Windows\\System32\\werfault.exe",
      ":\\Windows\\SysWOW64\\werfault.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Sigma Detection Rule: Use of Pcalua For Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2022-06-14
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\pcalua.exe",
    "CommandLine|contains": " -a"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/
  - https://pentestlab.blog/2020/07/06/indirect-command-execution/
Sigma Detection Rule: Suspicious Execution of Shutdown to Log Out
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-10-01
ATT&CK techniques: T1529
Log source: windows/process_creation

Description:
Detects the rare use of the command line tool shutdown to logoff a user

Detection logic:
{
  "selection": {
    "Image|endswith": "\\shutdown.exe",
    "CommandLine|contains": "/l"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1529/T1529.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
Sigma Detection Rule: Dism Remove Online Package
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-16
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Deployment Image Servicing and Management tool. DISM is used to enumerate, install, uninstall, configure, and update features and packages in Windows images

Detection logic:
{
  "selection_dismhost": {
    "Image|endswith": "\\DismHost.exe",
    "ParentCommandLine|contains|all": [
      "/Online",
      "/Disable-Feature"
    ]
  },
  "selection_dism": {
    "Image|endswith": "\\Dism.exe",
    "CommandLine|contains|all": [
      "/Online",
      "/Disable-Feature"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md#atomic-test-26---disable-windows-defender-with-dism
  - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html
Sigma Detection Rule: HackTool - SharpUp PrivEsc Tool Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-20
ATT&CK techniques: T1615, T1569.002, T1574.005
Log source: windows/process_creation

Description:
Detects the use of SharpUp, a tool for local privilege escalation

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SharpUp.exe"
    },
    {
      "Description": "SharpUp"
    },
    {
      "CommandLine|contains": [
        "HijackablePaths",
        "UnquotedServicePath",
        "ProcessDLLHijack",
        "ModifiableServiceBinaries",
        "ModifiableScheduledTask",
        "DomainGPPPassword",
        "CachedGPPPassword"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/GhostPack/SharpUp
Sigma Detection Rule: Tor Client/Browser Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-02-20
ATT&CK techniques: T1090.003
Log source: windows/process_creation

Description:
Detects the use of Tor or Tor-Browser to connect to onion routing networks

Detection logic:
{
  "selection": [
    {
      "Description": "Tor Browser"
    },
    {
      "Product": "Tor Browser"
    },
    {
      "Image|endswith": [
        "\\tor.exe",
        "\\Tor Browser\\Browser\\firefox.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
Sigma Detection Rule: Sensitive File Dump Via Wbadmin.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-05-10
ATT&CK techniques: T1003.003
Log source: windows/process_creation

Description:
Detects the dump of highly sensitive files such as "NTDS.DIT" and "SECURITY" hive.
Attackers can leverage the "wbadmin" utility in order to dump sensitive files that might contain credential or sensitive information.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection_backup": {
    "CommandLine|contains": [
      "start",
      "backup"
    ]
  },
  "selection_path": {
    "CommandLine|contains": [
      "\\config\\SAM",
      "\\config\\SECURITY",
      "\\config\\SYSTEM",
      "\\Windows\\NTDS\\NTDS.dit"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
  - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
Sigma Detection Rule: Persistence Via Sticky Key Backdoor
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Sreeman
Date: 2020-02-18
ATT&CK techniques: T1546.008
Log source: windows/process_creation

Description:
By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system.
When the sticky keys are "activated" the privilleged shell is launched.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "copy ",
      "/y ",
      "C:\\windows\\system32\\cmd.exe C:\\windows\\system32\\sethc.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html
  - https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf
  - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors
Sigma Detection Rule: Potential Arbitrary Command Execution Via FTP.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\ftp.exe"
  },
  "selection_child_img": [
    {
      "Image|endswith": "\\ftp.exe"
    },
    {
      "OriginalFileName": "ftp.exe"
    }
  ],
  "selection_child_cli": {
    "CommandLine|contains|windash": "-s:"
  },
  "condition": "selection_parent or all of selection_child_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ftp/