deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Remote Code Execute via Winrm.vbs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects an attempt to execute code or create service on remote host via winrm.vbs.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cscript.exe"
    },
    {
      "OriginalFileName": "cscript.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "winrm",
      "invoke Create wmicimv2/Win32_",
      "-r:http"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/bohops/status/[PII_REDACTED]51815170
  - https://redcanary.com/blog/lateral-movement-winrm-wmi/
  - https://lolbas-project.github.io/lolbas/Scripts/Winrm/
Sigma Detection Rule: Process Memory Dump via RdrLeakDiag.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-09-24
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rdrleakdiag.exe"
    },
    {
      "OriginalFileName": "RdrLeakDiag.exe"
    }
  ],
  "selection_cli_dump": {
    "CommandLine|contains|windash": [
      "/memdmp",
      "fullmemdmp"
    ]
  },
  "selection_cli_output_process": {
    "CommandLine|contains|windash": [
      " /o ",
      " /p "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]05560321?s=21
  - https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive
Sigma Detection Rule: Suspicious Execution of Hostname
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Use of hostname to get information

Detection logic:
{
  "selection": {
    "Image|endswith": "\\HOSTNAME.EXE"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-6---hostname-discovery-windows
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/hostname
Sigma Detection Rule: DLL Execution via Rasautou.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rasautou.exe"
    },
    {
      "OriginalFileName": "rasdlui.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -d ",
      " -p "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/
  - https://github.com/fireeye/DueDLLigence
  - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html
Sigma Detection Rule: Potentially Suspicious Execution Of Regasm/Regsvcs From Uncommon Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-25
ATT&CK techniques: T1218.009
Log source: windows/process_creation

Description:
Detects potentially suspicious execution of the Regasm/Regsvcs utilities from a potentially suspicious location

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\Regsvcs.exe",
        "\\Regasm.exe"
      ]
    },
    {
      "OriginalFileName": [
        "RegSvcs.exe",
        "RegAsm.exe"
      ]
    }
  ],
  "selection_dir": {
    "CommandLine|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
      "\\PerfLogs\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.fortiguard.com/threat-signal-report/4718?s=09
  - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/
Sigma Detection Rule: Service Registry Key Deleted Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-01
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects execution of "reg.exe" commands with the "delete" flag on services registry key. Often used by attacker to remove AV software services

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_delete": {
    "CommandLine|contains": " delete "
  },
  "selection_key": {
    "CommandLine|contains": "\\SYSTEM\\CurrentControlSet\\services\\"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c[PII_REDACTED]d1264f692c7664c02c68465
Sigma Detection Rule: Exports Registry Key To a File
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Oddvar Moe, Sander Wiebing, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1012
Log source: windows/process_creation

Description:
Detects the export of the target Registry key to a file.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regedit.exe"
    },
    {
      "OriginalFileName": "REGEDIT.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -E "
  },
  "filter_1": {
    "CommandLine|contains": [
      "hklm",
      "hkey_local_machine"
    ]
  },
  "filter_2": {
    "CommandLine|endswith": [
      "\\system",
      "\\sam",
      "\\security"
    ]
  },
  "condition": "all of selection_* and not all of filter_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Regedit/
  - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
Sigma Detection Rule: Visual Studio Code Tunnel Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-25
ATT&CK techniques: T1071.001
Log source: windows/process_creation

Description:
Detects the installation of VsCode tunnel (code-tunnel) as a service.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "tunnel ",
      "service",
      "internal-run",
      "tunnel-service.log"
    ]
  },
  "condition": "selection"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
Sigma Detection Rule: Potential Manage-bde.wsf Abuse To Proxy Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: oscd.community, Natalia Shornikova, Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-13
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution

Detection logic:
{
  "selection_wscript_img": [
    {
      "Image|endswith": "\\wscript.exe"
    },
    {
      "OriginalFileName": "wscript.exe"
    }
  ],
  "selection_wscript_cli": {
    "CommandLine|contains": "manage-bde.wsf"
  },
  "selection_parent": {
    "ParentImage|endswith": [
      "\\cscript.exe",
      "\\wscript.exe"
    ],
    "ParentCommandLine|contains": "manage-bde.wsf"
  },
  "selection_filter_cmd": {
    "Image|endswith": "\\cmd.exe"
  },
  "condition": "all of selection_wscript_* or (selection_parent and not selection_filter_cmd)"
}

References:
  - https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/
  - https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712
  - https://twitter.com/bohops/status/[PII_REDACTED]95741441
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]70600706
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
Sigma Detection Rule: Schtasks From Suspicious Folders
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-15
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects scheduled task creations that have suspicious action command and folder combinations

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_create": {
    "CommandLine|contains": " /create "
  },
  "selection_command": {
    "CommandLine|contains": [
      "powershell",
      "pwsh",
      "cmd /c ",
      "cmd /k ",
      "cmd /r ",
      "cmd.exe /c ",
      "cmd.exe /k ",
      "cmd.exe /r "
    ]
  },
  "selection_all_folders": {
    "CommandLine|contains": [
      "C:\\ProgramData\\",
      "%ProgramData%"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/lazarus-dream-job-chemical
Sigma Detection Rule: BitLockerTogo.EXE Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Josh Nickels, mttaggart
Date: 2024-07-11
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of "BitLockerToGo.EXE".
BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
This is a rarely used application and usage of it at all is worth investigating.
Malware such as Lumma stealer has been seen using this process as a target for process hollowing.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\BitLockerToGo.exe"
  },
  "condition": "selection"
}

References:
  - https://tria.ge/240521-ynezpagf56/behavioral1
  - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091
  - https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/
  - https://bazaar.abuse.ch/sample/64e[PII_REDACTED]cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/
Sigma Detection Rule: Suspicious RDP Redirect Using TSCON
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-03-17
ATT&CK techniques: T1563.002, T1021.001
Log source: windows/process_creation

Description:
Detects a suspicious RDP session redirect using tscon.exe

Detection logic:
{
  "selection": {
    "CommandLine|contains": " /dest:rdp-tcp#"
  },
  "condition": "selection"
}

References:
  - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
  - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/
Sigma Detection Rule: Rar Usage with Password and Compression Level
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @ROxPinTeddy
Date: 2020-05-12
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.

Detection logic:
{
  "selection_password": {
    "CommandLine|contains": " -hp"
  },
  "selection_other": {
    "CommandLine|contains": [
      " -m",
      " a "
    ]
  },
  "condition": "selection_password and selection_other"
}

References:
  - https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/
  - https://ss64.com/bash/rar.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
Sigma Detection Rule: Recon Command Output Piped To Findstr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2023-07-06
ATT&CK techniques: T1057
Log source: windows/process_creation

Description:
Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example.
Attackers often time use this technique to extract specific information they require in their reconnaissance phase.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "ipconfig*|*find",
      "net*|*find",
      "netstat*|*find",
      "ping*|*find",
      "systeminfo*|*find",
      "tasklist*|*find",
      "whoami*|*find"
    ]
  },
  "filter_optional_xampp": {
    "CommandLine|contains|all": [
      "cmd.exe /c TASKLIST /V |",
      "FIND /I",
      "\\xampp\\",
      "\\catalina_start.bat"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist
  - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf
  - https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html
Sigma Detection Rule: Use of Scriptrunner.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-01
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ScriptRunner.exe"
    },
    {
      "OriginalFileName": "ScriptRunner.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -appvscript "
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/
Sigma Detection Rule: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1552, T1087
Log source: windows/process_creation

Description:
Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs.
This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc.


Detection logic:
{
  "selection_wmi": {
    "CommandLine|contains|all": [
      "Select",
      "Win32_NTLogEvent"
    ]
  },
  "selection_wevtutil_img": [
    {
      "Image|endswith": "\\wevtutil.exe"
    },
    {
      "OriginalFileName": "wevtutil.exe"
    }
  ],
  "selection_wevtutil_cli": {
    "CommandLine|contains": [
      " qe ",
      " query-events "
    ]
  },
  "selection_wmic_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_wmic_cli": {
    "CommandLine|contains": " ntevent"
  },
  "selection_cmdlet": {
    "CommandLine|contains": [
      "Get-WinEvent ",
      "get-eventlog "
    ]
  },
  "selection_logs_name": {
    "CommandLine|contains": [
      "Microsoft-Windows-PowerShell",
      "Microsoft-Windows-Security-Auditing",
      "Microsoft-Windows-TerminalServices-LocalSessionManager",
      "Microsoft-Windows-TerminalServices-RemoteConnectionManager",
      "Microsoft-Windows-Windows Defender",
      "PowerShellCore",
      "Security",
      "Windows PowerShell"
    ]
  },
  "selection_logs_eid": {
    "CommandLine|contains": [
      "-InstanceId 462?",
      ".eventid -eq 462?",
      ".ID -eq 462?",
      "EventCode=?462?",
      "EventIdentifier=?462?",
      "System[EventID=462?]",
      "-InstanceId 4778",
      ".eventid -eq 4778",
      ".ID -eq 4778",
      "EventCode=?4778?",
      "EventIdentifier=?4778?",
      "System[EventID=4778]",
      "-InstanceId 25",
      ".eventid -eq 25",
      

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  - https://www.group-ib.com/blog/apt41-world-tour-2021/
  - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf
Sigma Detection Rule: Suspicious AddinUtil.EXE CommandLine Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\addinutil.exe"
    },
    {
      "OriginalFileName": "AddInUtil.exe"
    }
  ],
  "selection_susp_1_flags": {
    "CommandLine|contains": [
      "-AddInRoot:",
      "-PipelineRoot:"
    ]
  },
  "selection_susp_1_paths": {
    "CommandLine|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ]
  },
  "selection_susp_2": {
    "CommandLine|contains": [
      "-AddInRoot:.",
      "-AddInRoot:\".\"",
      "-PipelineRoot:.",
      "-PipelineRoot:\".\""
    ],
    "CurrentDirectory|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "selection_img and (all of selection_susp_1_* or selection_susp_2)"
}

References:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Sigma Detection Rule: Potential Binary Proxy Execution Via Cdb.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-26
ATT&CK techniques: T1106, T1218, T1127
Log source: windows/process_creation

Description:
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cdb.exe"
    },
    {
      "OriginalFileName": "CDB.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -c ",
      " -cf "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/
  - https://web.archive.org/web/[PII_REDACTED]3507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html
  - https://twitter.com/nas_bench/status/[PII_REDACTED]32120833
Sigma Detection Rule: Potentially Suspicious File Download From File Sharing Domain Via PowerShell.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-23
Log source: windows/process_creation

Description:
Detects potentially suspicious file downloads from file sharing domains using PowerShell.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_websites": {
    "CommandLine|contains": [
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "selection_download": {
    "CommandLine|contains": [
      ".DownloadString(",
      ".DownloadFile(",
      "Invoke-WebRequest ",
      "iwr ",
      "wget "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Sigma Detection Rule: Potential NTLM Coercion Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-01
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects possible NTLM coercion via certutil using the 'syncwithWU' flag

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -syncwithWU ",
      " \\\\\\\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/issues/243
Sigma Detection Rule: Suspicious Rundll32 Setupapi.dll Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Konstantin Grishchenko, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
setupapi.dll library provide InstallHinfSection function for processing INF files. INF file may contain instructions allowing to create values in the registry, modify files and install drivers. This technique could be used to obtain persistence via modifying one of Run or RunOnce registry keys, run process or use other DLLs chain calls (see references) InstallHinfSection function in setupapi.dll calls runonce.exe executable regardless of actual content of INF file.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\runonce.exe",
    "ParentImage|endswith": "\\rundll32.exe",
    "ParentCommandLine|contains|all": [
      "setupapi.dll",
      "InstallHinfSection"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Libraries/Setupapi/
  - https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf
  - https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf
  - https://twitter.com/Z3Jpa29z/status/[PII_REDACTED]92746241?s=20