deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious File Execution From Internet Hosted WebDav Share
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-09-01
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.EXE"
    }
  ],
  "selection_base": {
    "CommandLine|contains|all": [
      " net use http",
      "& start /b ",
      "\\DavWWWRoot\\"
    ]
  },
  "selection_ext": {
    "CommandLine|contains": [
      ".exe ",
      ".dll ",
      ".bat ",
      ".vbs ",
      ".ps1 "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/ShadowChasing1/status/[PII_REDACTED]61944576
  - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c[PII_REDACTED]6dcaa0104/behavior
Sigma Detection Rule: Remote Access Tool - NetSupport Execution From Unusual Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-19
Log source: windows/process_creation

Description:
Detects execution of client32.exe (NetSupport RAT) from an unusual location (outside of 'C:\Program Files')

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\client32.exe"
    },
    {
      "Product|contains": "NetSupport Remote Control"
    },
    {
      "OriginalFileName|contains": "client32.exe"
    },
    {
      "Hashes|contains": "IMPHASH=a9d50692e95b79723f3e76fcf70d023e"
    }
  ],
  "filter": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: HKTL - SharpSuccessor Privilege Escalation Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-06
ATT&CK techniques: T1068
Log source: windows/process_creation

Description:
Detects the execution of SharpSuccessor, a tool used to exploit the BadSuccessor attack for privilege escalation in WinServer 2025 Active Directory environments.
Successful usage of this tool can let the attackers gain the domain admin privileges by exploiting the BadSuccessor vulnerability.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SharpSuccessor.exe"
    },
    {
      "OriginalFileName": "SharpSuccessor.exe"
    },
    {
      "CommandLine|contains": "SharpSuccessor"
    },
    {
      "CommandLine|contains|all": [
        " add ",
        " /impersonate",
        " /path",
        " /account",
        " /name"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/logangoins/SharpSuccessor
Sigma Detection Rule: Msxsl.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1220
Log source: windows/process_creation

Description:
Detects the execution of the MSXSL utility. This can be used to execute Extensible Stylesheet Language (XSL) files. These files are commonly used to describe the processing and rendering of data within XML files.
Adversaries can abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\msxsl.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msxsl/
Sigma Detection Rule: Potentially Suspicious CMD Shell Output Redirect
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains": [
      ">?%APPDATA%\\",
      ">?%TEMP%\\",
      ">?%TMP%\\",
      ">?%USERPROFILE%\\",
      ">?C:\\ProgramData\\",
      ">?C:\\Temp\\",
      ">?C:\\Users\\Public\\",
      ">?C:\\Windows\\Temp\\"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains": [
      " >",
      "\">",
      "'>"
    ],
    "CommandLine|contains|all": [
      "C:\\Users\\",
      "\\AppData\\Local\\"
    ]
  },
  "condition": "selection_img and 1 of selection_cli_*"
}

References:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Sigma Detection Rule: Remote Access Tool - AnyDesk Execution With Known Revoked Signing Certificate
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sai Prashanth Pulisetti, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-08
Log source: windows/process_creation

Description:
Detects the execution of an AnyDesk binary with a version prior to 8.0.8.
Prior to version 8.0.8, the Anydesk application used a signing certificate that got compromised by threat actors.
Use this rule to detect instances of older versions of Anydesk using the compromised certificate
This is recommended in order to avoid attackers leveraging the certificate and signing their binaries to bypass detections.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\AnyDesk.exe"
    },
    {
      "Description": "AnyDesk"
    },
    {
      "Product": "AnyDesk"
    },
    {
      "Company": "AnyDesk Software GmbH"
    }
  ],
  "selection_version": {
    "FileVersion|startswith": [
      "7.0.",
      "7.1.",
      "8.0.1",
      "8.0.2",
      "8.0.3",
      "8.0.4",
      "8.0.5",
      "8.0.6",
      "8.0.7"
    ]
  },
  "filter_main_uninstall": {
    "CommandLine|contains": [
      " --remove",
      " --uninstall"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/anydesk-says-hackers-breached-its-production-servers-reset-passwords/
  - https://anydesk.com/en/changelog/windows
Sigma Detection Rule: Use of TTDInject.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-16
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "ttdinject.exe"
    },
    {
      "OriginalFileName": "TTDInject.EXE"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ttdinject/
Sigma Detection Rule: Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-14
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

Detection logic:
{
  "selection_bin_img": [
    {
      "Image|endswith": "\\VMwareToolBoxCmd.exe"
    },
    {
      "OriginalFileName": "toolbox-cmd.exe"
    }
  ],
  "selection_bin_cli": {
    "CommandLine|contains|all": [
      " script ",
      " set "
    ]
  },
  "selection_susp_paths": {
    "CommandLine|contains": [
      ":\\PerfLogs\\",
      ":\\Temp\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
Sigma Detection Rule: File And SubFolder Enumeration Via Dir Command
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-13
ATT&CK techniques: T1217
Log source: windows/process_creation

Description:
Detects usage of the "dir" command part of Windows CMD with the "/S" command line flag in order to enumerate files in a specified directory and all subdirectories.


Detection logic:
{
  "selection_cmd": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "dir*-s"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
Sigma Detection Rule: Elevated System Shell Spawned From Uncommon Parent Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Tim Shelton (update fp)
Date: 2022-12-05
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

Detection logic:
{
  "selection_shell": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\powershell_ise.exe",
        "\\pwsh.exe",
        "\\cmd.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "powershell_ise.EXE",
        "pwsh.dll",
        "Cmd.Exe"
      ]
    }
  ],
  "selection_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "LogonId": "0x3e7"
  },
  "filter_main_generic": {
    "ParentImage|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\ProgramData\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\Temp\\",
      ":\\Windows\\WinSxS\\"
    ]
  },
  "filter_optional_manageengine": {
    "ParentImage|endswith": ":\\ManageEngine\\ADManager Plus\\pgsql\\bin\\postgres.exe",
    "Image|endswith": "\\cmd.exe"
  },
  "filter_optional_asgard": {
    "CommandLine|contains": ":\\WINDOWS\\system32\\cmd.exe /c \"",
    "CurrentDirectory|contains": ":\\WINDOWS\\Temp\\asgard2-agent\\"
  },
  "filter_optional_ibm_spectrumprotect": {
    "ParentImage|contains": ":\\IBM\\SpectrumProtect\\webserver\\scripts\\",
    "CommandLine|contains": ":\\IBM\\SpectrumProtect\\webserver\\scripts\\"
  },
  "filter_main_parent_null": {
    "ParentImage": null
  },
  "filter_main_parent_empty": {
    "ParentImage": [
      "",
      "-"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/Wh04m1001/SysmonEoP
Sigma Detection Rule: Potential Privilege Escalation via Service Permissions Weakness
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov
Date: 2019-10-26
ATT&CK techniques: T1574.011
Log source: windows/process_creation

Description:
Detect modification of services configuration (ImagePath, FailureCommand and ServiceDLL) in registry by processes with Medium integrity level

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "Medium",
      "S-1-16-8192"
    ],
    "CommandLine|contains|all": [
      "ControlSet",
      "services"
    ],
    "CommandLine|contains": [
      "\\ImagePath",
      "\\FailureCommand",
      "\\ServiceDll"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://pentestlab.blog/2017/03/31/insecure-registry-permissions/
Sigma Detection Rule: Change Default File Association Via Assoc
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1546.001
Log source: windows/process_creation

Description:
Detects file association changes using the builtin "assoc" command.
When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "assoc"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.001/T1546.001.md
Sigma Detection Rule: Malicious PowerShell Commandlets - ProcessCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
ATT&CK techniques: T1482, T1087, T1087.001, T1087.002, T1069.001, T1069.002, T1069, T1059.001
Log source: windows/process_creation

Description:
Detects Commandlet names from well-known PowerShell exploitation frameworks

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Add-Exfiltration",
      "Add-Persistence",
      "Add-RegBackdoor",
      "Add-RemoteRegBackdoor",
      "Add-ScrnSaveBackdoor",
      "Check-VM",
      "ConvertTo-Rc4ByteStream",
      "Decrypt-Hash",
      "Disable-ADIDNSNode",
      "Disable-MachineAccount",
      "Do-Exfiltration",
      "Enable-ADIDNSNode",
      "Enable-MachineAccount",
      "Enabled-DuplicateToken",
      "Exploit-Jboss",
      "Export-ADR",
      "Export-ADRCSV",
      "Export-ADRExcel",
      "Export-ADRHTML",
      "Export-ADRJSON",
      "Export-ADRXML",
      "Find-Fruit",
      "Find-GPOLocation",
      "Find-TrustedDocuments",
      "Get-ADIDNS",
      "Get-ApplicationHost",
      "Get-ChromeDump",
      "Get-ClipboardContents",
      "Get-FoxDump",
      "Get-GPPPassword",
      "Get-IndexedItem",
      "Get-KerberosAESKey",
      "Get-Keystrokes",
      "Get-LSASecret",
      "Get-MachineAccountAttribute",
      "Get-MachineAccountCreator",
      "Get-PassHashes",
      "Get-RegAlwaysInstallElevated",
      "Get-RegAutoLogon",
      "Get-RemoteBootKey",
      "Get-RemoteCachedCredential",
      "Get-RemoteLocalAccountHash",
      "Get-RemoteLSAKey",
      "Get-RemoteMachineAccountHash",
      "Get-RemoteNLKMKey",
      "Get-RickAstley",
      "Get-Screenshot",
      "Get-SecurityPackages",
      "Get-ServiceFilePermission",
      "Get-ServicePermission",
      "Get-ServiceUnquoted",
      "Get-SiteListPassword",
      "Get-System",
    

References:
  - https://adsecurity.org/?p=2921
  - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
  - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1
  - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1
  - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1
Sigma Detection Rule: HackTool - DInjector PowerShell Cradle Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-07
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects the use of the Dinject PowerShell cradle based on the specific flags

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      " /am51",
      " /password"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4856/https://github.com/snovvcrash/DInjector
Sigma Detection Rule: Attempts of Kerberos Coercion Via DNS SPN Spoofing
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-20
ATT&CK techniques: T1557.001, T1187
Log source: windows/process_creation

Description:
Detects the presence of "UWhRC....AAYBAAAA" pattern in command line.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like in CVE-2025-33073.
If you see this pattern in the command line, it is likely an attempt to add spoofed Service Principal Names (SPNs) to DNS records,
or checking for the presence of such records through the `nslookup` command.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "UWhRCA",
      "BAAAA"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
  - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
Sigma Detection Rule: Enumeration for Credentials in Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-20
ATT&CK techniques: T1552.002
Log source: windows/process_creation

Description:
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
The Windows Registry stores configuration information that can be used by the system or other programs.
Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services


Detection logic:
{
  "reg": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains|all": [
      " query ",
      "/t ",
      "REG_SZ",
      "/s"
    ]
  },
  "hive": [
    {
      "CommandLine|contains|all": [
        "/f ",
        "HKLM"
      ]
    },
    {
      "CommandLine|contains|all": [
        "/f ",
        "HKCU"
      ]
    },
    {
      "CommandLine|contains": "HKCU\\Software\\SimonTatham\\PuTTY\\Sessions"
    }
  ],
  "condition": "reg and hive"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.002/T1552.002.md
Sigma Detection Rule: Mavinject Inject DLL Into Running Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth
Date: 2021-07-12
ATT&CK techniques: T1055.001, T1218.013
Log source: windows/process_creation

Description:
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Detection logic:
{
  "selection": {
    "CommandLine|contains": " /INJECTRUNNING "
  },
  "filter": {
    "ParentImage": "C:\\Windows\\System32\\AppVClient.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md
  - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]07510784
  - https://reaqta.com/2017/12/mavinject-microsoft-injector/
Sigma Detection Rule: Potentially Suspicious Call To Win32_NTEventlogFile Class
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-13
Log source: windows/process_creation

Description:
Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script

Detection logic:
{
  "selection_class": {
    "CommandLine|contains": "Win32_NTEventlogFile"
  },
  "selection_function": {
    "CommandLine|contains": [
      ".BackupEventlog(",
      ".ChangeSecurityPermissions(",
      ".ChangeSecurityPermissionsEx(",
      ".ClearEventLog(",
      ".Delete(",
      ".DeleteEx(",
      ".Rename(",
      ".TakeOwnerShip(",
      ".TakeOwnerShipEx("
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)
Sigma Detection Rule: Renamed Visual Studio Code Tunnel Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-28
ATT&CK techniques: T1071.001, T1219
Log source: windows/process_creation

Description:
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

Detection logic:
{
  "selection_image_only_tunnel": {
    "OriginalFileName": null,
    "CommandLine|endswith": ".exe tunnel"
  },
  "selection_image_tunnel_args": {
    "CommandLine|contains|all": [
      ".exe tunnel",
      "--accept-server-license-terms"
    ]
  },
  "selection_image_tunnel_service": {
    "CommandLine|contains|all": [
      "tunnel ",
      "service",
      "internal-run",
      "tunnel-service.log"
    ]
  },
  "selection_parent_tunnel": {
    "ParentCommandLine|endswith": " tunnel",
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "/d /c ",
      "\\servers\\Stable-",
      "code-server.cmd"
    ]
  },
  "filter_main_parent_code": {
    "ParentImage|endswith": [
      "\\code-tunnel.exe",
      "\\code.exe"
    ]
  },
  "filter_main_image_code": {
    "Image|endswith": [
      "\\code-tunnel.exe",
      "\\code.exe"
    ]
  },
  "condition": "(1 of selection_image_* and not 1 of filter_main_image_*) or (selection_parent_tunnel and not 1 of filter_main_parent_*)"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
Sigma Detection Rule: Suspicious Electron Application Child Processes
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-21
Log source: windows/process_creation

Description:
Detects suspicious child processes of electron apps (teams, discord, slack, etc.). This could be a potential sign of ".asar" file tampering (See reference section for more information) or binary execution proxy through specific CLI arguments (see related rule)


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\chrome.exe",
      "\\discord.exe",
      "\\GitHubDesktop.exe",
      "\\keybase.exe",
      "\\msedge.exe",
      "\\msedgewebview2.exe",
      "\\msteams.exe",
      "\\slack.exe",
      "\\teams.exe"
    ]
  },
  "selection_child_image": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\whoami.exe",
      "\\wscript.exe"
    ]
  },
  "selection_child_paths": {
    "Image|contains": [
      ":\\ProgramData\\",
      ":\\Temp\\",
      "\\AppData\\Local\\Temp\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ]
  },
  "filter_optional_discord": {
    "ParentImage|endswith": "\\Discord.exe",
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": "\\NVSMI\\nvidia-smi.exe"
  },
  "condition": "selection_parent and 1 of selection_child_* and not 1 of filter_optional_*"
}

References:
  - https://taggart-tech.com/quasar-electron/
  - https://github.com/mttaggart/quasar
  - https://positive.security/blog/ms-officecmd-rce
  - https://lolbas-project.github.io/lolbas/Binaries/Msedge/
  - https://lolbas-project.github.io/lolbas/Binaries/Teams/