deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Suspicious PowerShell Module File Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-09
Log source: windows/file_event

Description:
Detects the creation of a new PowerShell module in the first folder of the module directory structure "\WindowsPowerShell\Modules\malware\malware.psm1". This is somewhat an uncommon practice as legitimate modules often includes a version folder.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\\\WindowsPowerShell\\\\Modules\\\\*\\.ps",
      "\\\\WindowsPowerShell\\\\Modules\\\\*\\.dll"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
  - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
Sigma Detection Rule: Windows Shell/Scripting Application File Write to Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-20
ATT&CK techniques: T1059
Log source: windows/file_event

Description:
Detects Windows shells and scripting applications that write files to suspicious folders

Detection logic:
{
  "selection_1": {
    "Image|endswith": [
      "\\bash.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\msbuild.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\sh.exe",
      "\\wscript.exe"
    ],
    "TargetFilename|startswith": [
      "C:\\PerfLogs\\",
      "C:\\Users\\Public\\"
    ]
  },
  "selection_2": {
    "Image|endswith": [
      "\\certutil.exe",
      "\\forfiles.exe",
      "\\mshta.exe",
      "\\schtasks.exe",
      "\\scriptrunner.exe",
      "\\wmic.exe"
    ],
    "TargetFilename|contains": [
      "C:\\PerfLogs\\",
      "C:\\Users\\Public\\",
      "C:\\Windows\\Temp\\"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - Mimikatz Kirbi File Creation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), David ANDRE
Date: 2021-11-08
ATT&CK techniques: T1558
Log source: windows/file_event

Description:
Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ".kirbi",
      "mimilsa.log"
    ]
  },
  "condition": "selection"
}

References:
  - https://cobalt.io/blog/kerberoast-attack-techniques
  - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/
Sigma Detection Rule: WinSxS Executable File Creation By Non-System Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-11
Log source: windows/file_event

Description:
Detects the creation of binaries in the WinSxS folder by non-system processes

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\WinSxS\\",
    "TargetFilename|endswith": ".exe"
  },
  "filter_main_system_location": {
    "Image|startswith": [
      "C:\\Windows\\Systems32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://media.defense.gov/2023/May/09/[PII_REDACTED]/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
Sigma Detection Rule: Suspicious File Created In PerfLogs
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
ATT&CK techniques: T1059
Log source: windows/file_event

Description:
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\PerfLogs\\",
    "TargetFilename|endswith": [
      ".7z",
      ".bat",
      ".bin",
      ".chm",
      ".dll",
      ".exe",
      ".hta",
      ".lnk",
      ".ps1",
      ".psm1",
      ".py",
      ".scr",
      ".sys",
      ".vbe",
      ".vbs",
      ".zip"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Suspicious File Write to SharePoint Layouts Directory
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-24
ATT&CK techniques: T1190, T1505.003
Log source: windows/file_event

Description:
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation.
This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\w3wp.exe"
    ],
    "TargetFilename|startswith": [
      "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\",
      "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\"
    ],
    "TargetFilename|contains": [
      "\\15\\TEMPLATE\\LAYOUTS\\",
      "\\16\\TEMPLATE\\LAYOUTS\\"
    ],
    "TargetFilename|endswith": [
      ".asax",
      ".ascx",
      ".ashx",
      ".asmx",
      ".asp",
      ".aspx",
      ".bat",
      ".cmd",
      ".cer",
      ".config",
      ".hta",
      ".js",
      ".jsp",
      ".jspx",
      ".php",
      ".ps1",
      ".vbs"
    ]
  },
  "condition": "selection"
}

References:
  - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
  - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
Sigma Detection Rule: Creation of a Diagcab
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-06-08
Log source: windows/file_event

Description:
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".diagcab"
  },
  "condition": "selection"
}

References:
  - https://threadreaderapp.com/thread/[PII_REDACTED]41086720.html
Sigma Detection Rule: Desktop.INI Created by Uncommon Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)
Date: 2020-03-19
ATT&CK techniques: T1547.009
Log source: windows/file_event

Description:
Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\desktop.ini"
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\Windows\\",
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_main_upgrade": {
    "TargetFilename|startswith": "C:\\$WINDOWS.~BT\\NewOS\\"
  },
  "filter_optional_jetbrains": {
    "Image|startswith": "C:\\Users\\",
    "Image|endswith": "\\AppData\\Local\\JetBrains\\Toolbox\\bin\\7z.exe",
    "TargetFilename|contains": "\\JetBrains\\apps\\"
  },
  "filter_optional_onedrive": {
    "Image|startswith": "C:\\Users\\",
    "Image|contains": "\\AppData\\Local\\Microsoft\\OneDrive\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://isc.sans.edu/forums/diary/Desktopini+as+a+postexploitation+tool/25912/
Sigma Detection Rule: Potentially Suspicious WDAC Policy File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: X__Junior
Date: 2025-02-07
Log source: windows/file_event

Description:
Detects suspicious Windows Defender Application Control (WDAC) policy file creation from abnormal processes that could be abused by attacker to block EDR/AV components while allowing their own malicious code to run on the system.


Detection logic:
{
  "selection_target": {
    "TargetFilename|contains": "\\Windows\\System32\\CodeIntegrity\\"
  },
  "filter_main_images": {
    "Image|endswith": [
      "\\Microsoft.ConfigurationManagement.exe",
      "\\WDAC Wizard.exe",
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\dllhost.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "C:\\Windows\\SysWOW64\\dllhost.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_main_cli": [
    {
      "CommandLine|contains|all": [
        "ConvertFrom-CIPolicy -XmlFilePath",
        "-BinaryFilePath "
      ]
    },
    {
      "CommandLine|contains": "CiTool --update-policy"
    },
    {
      "CommandLine|contains|all": [
        "Copy-Item -Path",
        "-Destination"
      ]
    }
  ],
  "filter_main_system": {
    "Image": "System"
  },
  "filter_main_wuauclt": {
    "Image": [
      "C:\\Windows\\System32\\wuauclt.exe",
      "C:\\Windows\\UUS\\arm64\\wuaucltcore.exe"
    ]
  },
  "condition": "selection_target and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
  - https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
  - https://github.com/logangoins/Krueger/tree/main
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script
Sigma Detection Rule: VsCode Powershell Profile Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1546.013
Log source: windows/file_event

Description:
Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\Microsoft.VSCode_profile.ps1"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_profiles?view=powershell-7.2
Sigma Detection Rule: HackTool - NetExec File Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-08
ATT&CK techniques: T1021.002, T1059.005
Log source: windows/file_event

Description:
Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.


Detection logic:
{
  "selection": [
    {
      "Image|contains": "\\nxc-windows-latest\\"
    },
    {
      "TargetFilename|contains|all": [
        "\\Temp\\_MEI",
        "\\nxc\\data\\"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/Pennyw0rth/NetExec
  - https://www.netexec.wiki/
Sigma Detection Rule: NTDS.DIT Creation By Uncommon Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1003.002, T1003.003
Log source: windows/file_event

Description:
Detects creation of a file named "ntds.dit" (Active Directory Database) by an uncommon process or a process located in a suspicious directory

Detection logic:
{
  "selection_ntds": {
    "TargetFilename|endswith": "\\ntds.dit"
  },
  "selection_process_img": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe",
      "\\wsl.exe",
      "\\wt.exe"
    ]
  },
  "selection_process_paths": {
    "Image|contains": [
      "\\AppData\\",
      "\\Temp\\",
      "\\Public\\",
      "\\PerfLogs\\"
    ]
  },
  "condition": "selection_ntds and 1 of selection_process_*"
}

References:
  - https://stealthbits.com/blog/extracting-password-hashes-from-the-ntds-dit-file/
  - https://adsecurity.org/?p=2398
Sigma Detection Rule: LSASS Process Memory Dump Creation Via Taskmgr.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-10-19
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      ":\\Windows\\system32\\taskmgr.exe",
      ":\\Windows\\SysWOW64\\taskmgr.exe"
    ],
    "TargetFilename|contains|all": [
      "\\AppData\\Local\\Temp\\",
      "\\lsass",
      ".DMP"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1003.001/T1003.001.md#L1
Sigma Detection Rule: Suspicious Creation with Colorcpl
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-21
ATT&CK techniques: T1564
Log source: windows/file_event

Description:
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\

Detection logic:
{
  "selection": {
    "Image|endswith": "\\colorcpl.exe"
  },
  "filter_ext": {
    "TargetFilename|endswith": [
      ".icm",
      ".gmmp",
      ".cdmp",
      ".camp"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/eral4m/status/[PII_REDACTED]24231172?s=20
Sigma Detection Rule: .RDP File Created By Uncommon Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-18
Log source: windows/file_event

Description:
Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".rdp",
    "Image|endswith": [
      "\\brave.exe",
      "\\CCleaner Browser\\Application\\CCleanerBrowser.exe",
      "\\chromium.exe",
      "\\firefox.exe",
      "\\Google\\Chrome\\Application\\chrome.exe",
      "\\iexplore.exe",
      "\\microsoftedge.exe",
      "\\msedge.exe",
      "\\Opera.exe",
      "\\Vivaldi.exe",
      "\\Whale.exe",
      "\\olk.exe",
      "\\Outlook.exe",
      "\\RuntimeBroker.exe",
      "\\Thunderbird.exe",
      "\\Discord.exe",
      "\\Keybase.exe",
      "\\msteams.exe",
      "\\Slack.exe",
      "\\teams.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/[PII_REDACTED]4748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
Sigma Detection Rule: Suspicious DotNET CLR Usage Log Artifact
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, omkar72, oscd.community, Wojciech Lesicki
Date: 2022-11-18
ATT&CK techniques: T1218
Log source: windows/file_event

Description:
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\UsageLogs\\cmstp.exe.log",
      "\\UsageLogs\\cscript.exe.log",
      "\\UsageLogs\\mshta.exe.log",
      "\\UsageLogs\\msxsl.exe.log",
      "\\UsageLogs\\regsvr32.exe.log",
      "\\UsageLogs\\rundll32.exe.log",
      "\\UsageLogs\\svchost.exe.log",
      "\\UsageLogs\\wscript.exe.log",
      "\\UsageLogs\\wmic.exe.log"
    ]
  },
  "filter_main_rundll32": {
    "ParentImage|endswith": "\\MsiExec.exe",
    "ParentCommandLine|contains": " -Embedding",
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains|all": [
      "Temp",
      "zzzzInvokeManagedCustomActionOutOfProc"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
  - https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml
  - https://web.archive.org/web/[PII_REDACTED]2428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
  - https://web.archive.org/web/[PII_REDACTED]4538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
Sigma Detection Rule: Uncommon File Created by Notepad++ Updater Gup.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-02-03
ATT&CK techniques: T1195.002, T1557
Log source: windows/file_event

Description:
Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations.
This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\gup.exe"
  },
  "filter_main_legit_paths": {
    "TargetFilename|startswith": [
      "C:\\Program Files\\Notepad++\\",
      "C:\\Program Files (x86)\\Notepad++\\"
    ]
  },
  "filter_main_temp_update_installer": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains|all": [
      "\\AppData\\Local\\Temp\\",
      "npp.",
      ".Installer.",
      ".exe"
    ]
  },
  "filter_main_temp_generic_zip": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains|all": [
      "\\AppData\\Local\\Temp\\",
      ".zip"
    ]
  },
  "filter_main_recycle_bin": {
    "TargetFilename|startswith": "C:\\$Recycle.Bin\\S-1-5-21"
  },
  "filter_main_plugins": [
    {
      "TargetFilename|contains": [
        "\\plugins\\JsonTools\\testfiles\\",
        "\\Notepad++\\plugins\\ComparePlugin\\"
      ]
    },
    {
      "TargetFilename|contains|all": [
        "npp.",
        ".portable.",
        "\\plugins\\"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
Sigma Detection Rule: Visual Studio Code Tunnel Remote File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-25
Log source: windows/file_event

Description:
Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature


Detection logic:
{
  "selection": {
    "Image|contains": "\\servers\\Stable-",
    "Image|endswith": "\\server\\node.exe",
    "TargetFilename|contains": "\\.vscode-server\\data\\User\\History\\"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Self Extraction Directive File Created In Potentially Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-02-05
ATT&CK techniques: T1218
Log source: windows/file_event

Description:
Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.


Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Local\\Temp\\"
    ],
    "TargetFilename|endswith": ".sed"
  },
  "condition": "selection"
}

References:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
Sigma Detection Rule: PowerShell Module File Created
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-09
Log source: windows/file_event

Description:
Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetFilename|contains": [
      "\\WindowsPowerShell\\Modules\\",
      "\\PowerShell\\7\\Modules\\"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
  - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
Sigma Detection Rule: PowerShell Script Dropped Via PowerShell.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2023-05-09
Log source: windows/file_event

Description:
Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "TargetFilename|endswith": ".ps1"
  },
  "filter_main_psscriptpolicytest": {
    "TargetFilename|contains": "__PSScriptPolicyTest_"
  },
  "filter_main_appdata": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\"
  },
  "filter_main_windows_temp": {
    "TargetFilename|startswith": "C:\\Windows\\Temp\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Sigma Detection Rule: UAC Bypass Using IEInstal - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Detection logic:
{
  "selection": {
    "Image": "C:\\Program Files\\Internet Explorer\\IEInstal.exe",
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\",
    "TargetFilename|endswith": "consent.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME