deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: System Restore Registry Modification via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-11
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects system restore registry modification via command line, which can be used by adversaries to disable system restore on the computer.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\reg.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell.exe",
        "pwsh.dll",
        "reg.exe"
      ]
    }
  ],
  "selection_cli_action": {
    "CommandLine|contains": [
      " add ",
      "Set-ItemProperty",
      "New-ItemProperty"
    ]
  },
  "selection_cli_reg_root": {
    "CommandLine|contains": [
      "\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\SystemRestore",
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore"
    ]
  },
  "selection_cli_reg_key": {
    "CommandLine|contains": [
      "DisableConfig",
      "DisableSR"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-9---disable-system-restore-through-registry
Sigma Detection Rule: Potential UAC Bypass Via Sdclt.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
A General detection for sdclt being spawned as an elevated process. This could be an indicator of sdclt being used for bypass UAC techniques.

Detection logic:
{
  "selection": {
    "Image|endswith": "sdclt.exe",
    "IntegrityLevel": [
      "High",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/6
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md
Sigma Detection Rule: Suspicious Service Path Modification
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Victor Sergeev, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-21
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects service path modification via the "sc" binary to a suspicious command or path

Detection logic:
{
  "selection": {
    "Image|endswith": "\\sc.exe",
    "CommandLine|contains|all": [
      "config",
      "binPath"
    ],
    "CommandLine|contains": [
      "powershell",
      "cmd ",
      "mshta",
      "wscript",
      "cscript",
      "rundll32",
      "svchost",
      "dllhost",
      "cmd.exe /c",
      "cmd.exe /k",
      "cmd.exe /r",
      "cmd /c",
      "cmd /k",
      "cmd /r",
      "C:\\Users\\Public",
      "\\Downloads\\",
      "\\Desktop\\",
      "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
      "C:\\Windows\\TEMP\\",
      "\\AppData\\Local\\Temp"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
  - https://web.archive.org/web/[PII_REDACTED]4337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
Sigma Detection Rule: Potentially Suspicious Child Process Of DiskShadow.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-15
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\diskshadow.exe",
    "Image|endswith": [
      "\\certutil.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
  - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
Sigma Detection Rule: Private Keys Reconnaissance Via CommandLine Tools
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-07-20
ATT&CK techniques: T1552.004
Log source: windows/process_creation

Description:
Adversaries may search for private key certificate files on compromised systems for insecurely stored credential

Detection logic:
{
  "selection_cmd_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cmd_cli": {
    "CommandLine|contains": "dir "
  },
  "selection_pwsh_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_pwsh_cli": {
    "CommandLine|contains": "Get-ChildItem "
  },
  "selection_findstr": [
    {
      "Image|endswith": "\\findstr.exe"
    },
    {
      "OriginalFileName": "FINDSTR.EXE"
    }
  ],
  "selection_ext": {
    "CommandLine|contains": [
      ".key",
      ".pgp",
      ".gpg",
      ".ppk",
      ".p12",
      ".pem",
      ".pfx",
      ".cer",
      ".p7b",
      ".asc"
    ]
  },
  "condition": "selection_ext and (all of selection_cmd_* or all of selection_pwsh_* or selection_findstr)"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.004/T1552.004.md
Sigma Detection Rule: Suspicious Redirection to Local Admin Share
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-16
ATT&CK techniques: T1048
Log source: windows/process_creation

Description:
Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers

Detection logic:
{
  "selection_redirect": {
    "CommandLine|contains": ">"
  },
  "selection_share": {
    "CommandLine|contains": [
      "\\\\\\\\127.0.0.1\\\\admin$\\\\",
      "\\\\\\\\localhost\\\\admin$\\\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Sigma Detection Rule: WMI Backdoor Exchange Transport Agent
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-11
ATT&CK techniques: T1546.003
Log source: windows/process_creation

Description:
Detects a WMI backdoor in Exchange Transport Agents via WMI event filters

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\EdgeTransport.exe"
  },
  "filter_conhost": {
    "Image": "C:\\Windows\\System32\\conhost.exe"
  },
  "filter_oleconverter": {
    "Image|startswith": "C:\\Program Files\\Microsoft\\Exchange Server\\",
    "Image|endswith": "\\Bin\\OleConverter.exe"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/cglyer/status/[PII_REDACTED]76980224
  - https://twitter.com/cglyer/status/[PII_REDACTED]33029120
Sigma Detection Rule: HackTool - SharpView Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-10
ATT&CK techniques: T1049, T1069.002, T1482, T1135, T1033
Log source: windows/process_creation

Description:
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "SharpView.exe"
    },
    {
      "Image|endswith": "\\SharpView.exe"
    },
    {
      "CommandLine|contains": [
        "Add-RemoteConnection",
        "Convert-ADName",
        "ConvertFrom-SID",
        "ConvertFrom-UACValue",
        "Convert-SidToName",
        "Export-PowerViewCSV",
        "Find-DomainObjectPropertyOutlier",
        "Find-DomainProcess",
        "Find-DomainShare",
        "Find-DomainUserEvent",
        "Find-DomainUserLocation",
        "Find-ForeignGroup",
        "Find-ForeignUser",
        "Find-GPOComputerAdmin",
        "Find-GPOLocation",
        "Find-Interesting",
        "Find-LocalAdminAccess",
        "Find-ManagedSecurityGroups",
        "Get-CachedRDPConnection",
        "Get-DFSshare",
        "Get-DomainComputer",
        "Get-DomainController",
        "Get-DomainDFSShare",
        "Get-DomainDNSRecord",
        "Get-DomainFileServer",
        "Get-DomainForeign",
        "Get-DomainGPO",
        "Get-DomainGroup",
        "Get-DomainGUIDMap",
        "Get-DomainManagedSecurityGroup",
        "Get-DomainObject",
        "Get-DomainOU",
        "Get-DomainPolicy",
        "Get-DomainSID",
        "Get-DomainSite",
        "Get-DomainSPNTicket",
        "Get-DomainSubnet",
        "Get-DomainTrust",
        "Get-DomainUserEvent",
        "Get-ForestDomain",
        "Get-ForestGlobalCatalog",
        "Get-ForestTrust",
        "Get-GptTmpl",
        "Get-GroupsXML",
        "Get-LastL

References:
  - https://github.com/tevora-threat/SharpView/
  - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview
Sigma Detection Rule: Suspicious Usage of For Loop with Recursive Directory Search in CMD
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2025-11-12
ATT&CK techniques: T1059.003, T1027.010
Log source: windows/process_creation

Description:
Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing.
This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection.
This behavior has been observed in various malicious lnk files.


Detection logic:
{
  "selection_tokens": {
    "CommandLine|contains|all": [
      "for /f",
      "tokens=",
      "in (",
      "dir"
    ]
  },
  "selection_tokens_parent": {
    "ParentCommandLine|contains|all": [
      "for /f",
      "tokens=",
      "in (",
      "dir"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/29837d0d[PII_REDACTED]185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3
Sigma Detection Rule: HH.EXE Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Dan Beavin), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1218.001
Log source: windows/process_creation

Description:
Detects the execution of "hh.exe" to open ".chm" files.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "HH.exe"
    },
    {
      "Image|endswith": "\\hh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": ".chm"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
Sigma Detection Rule: Suspicious Debugger Registration Cmdline
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
Date: 2019-09-06
ATT&CK techniques: T1546.008
Log source: windows/process_creation

Description:
Detects the registration of a debugger for a program that is available in the logon screen (sticky key backdoor).

Detection logic:
{
  "selection1": {
    "CommandLine|contains": "\\CurrentVersion\\Image File Execution Options\\"
  },
  "selection2": {
    "CommandLine|contains": [
      "sethc.exe",
      "utilman.exe",
      "osk.exe",
      "magnify.exe",
      "narrator.exe",
      "displayswitch.exe",
      "atbroker.exe",
      "HelpPane.exe"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://blogs.technet.microsoft.com/jonathantrull/2016/10/03/detecting-sticky-key-backdoors/
  - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/
Sigma Detection Rule: HackTool - SharpChisel Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-05
ATT&CK techniques: T1090.001
Log source: windows/process_creation

Description:
Detects usage of the Sharp Chisel via the commandline arguments

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\SharpChisel.exe"
    },
    {
      "Product": "SharpChisel"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/shantanu561993/SharpChisel
  - https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/
Sigma Detection Rule: UAC Bypass via Windows Firewall Snap-In Hijack
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1548
Log source: windows/process_creation

Description:
Detects attempts to bypass User Account Control (UAC) by hijacking the Microsoft Management Console (MMC) Windows Firewall snap-in

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\mmc.exe",
    "ParentCommandLine|contains": "WF.msc"
  },
  "filter": {
    "Image|endswith": "\\WerFault.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.elastic.co/guide/en/security/current/uac-bypass-via-windows-firewall-snap-in-hijack.html#uac-bypass-via-windows-firewall-snap-in-hijack
Sigma Detection Rule: HackTool - winPEAS Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Georg Lauenstein (sure[secure])
Date: 2022-09-19
ATT&CK techniques: T1082, T1087, T1046
Log source: windows/process_creation

Description:
WinPEAS is a script that search for possible paths to escalate privileges on Windows hosts. The checks are explained on book.hacktricks.xyz

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "winPEAS.exe"
    },
    {
      "Image|endswith": [
        "\\winPEASany_ofs.exe",
        "\\winPEASany.exe",
        "\\winPEASx64_ofs.exe",
        "\\winPEASx64.exe",
        "\\winPEASx86_ofs.exe",
        "\\winPEASx86.exe"
      ]
    }
  ],
  "selection_cli_option": {
    "CommandLine|contains": [
      " applicationsinfo",
      " browserinfo",
      " eventsinfo",
      " fileanalysis",
      " filesinfo",
      " processinfo",
      " servicesinfo",
      " windowscreds"
    ]
  },
  "selection_cli_dl": {
    "CommandLine|contains": "https://github.com/carlospolop/PEASS-ng/releases/latest/download/"
  },
  "selection_cli_specific": [
    {
      "ParentCommandLine|endswith": " -linpeas"
    },
    {
      "CommandLine|endswith": " -linpeas"
    }
  ],
  "condition": "1 of selection_*"
}

References:
  - https://github.com/carlospolop/PEASS-ng
  - https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation
Sigma Detection Rule: Uncommon  Assistive Technology Applications Execution Via AtBroker.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mateusz Wydra, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\AtBroker.exe"
    },
    {
      "OriginalFileName": "AtBroker.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "start"
  },
  "filter_main_builtin": {
    "CommandLine|contains": [
      "animations",
      "audiodescription",
      "caretbrowsing",
      "caretwidth",
      "colorfiltering",
      "cursorindicator",
      "cursorscheme",
      "filterkeys",
      "focusborderheight",
      "focusborderwidth",
      "highcontrast",
      "keyboardcues",
      "keyboardpref",
      "livecaptions",
      "magnifierpane",
      "messageduration",
      "minimumhitradius",
      "mousekeys",
      "Narrator",
      "osk",
      "overlappedcontent",
      "showsounds",
      "soundsentry",
      "speechreco",
      "stickykeys",
      "togglekeys",
      "voiceaccess",
      "windowarranging",
      "windowtracking",
      "windowtrackingtimeout",
      "windowtrackingzorder"
    ]
  },
  "filter_optional_java": {
    "CommandLine|contains": "Oracle_JavaAccessBridge"
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
  - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/
Sigma Detection Rule: Suspicious Program Location Whitelisted In Firewall Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sander Wiebing, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2020-05-25
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Detects Netsh command execution that whitelists a program located in a suspicious location in the Windows Firewall

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|contains|all": [
        "firewall",
        "add",
        "allowedprogram"
      ]
    },
    {
      "CommandLine|contains|all": [
        "advfirewall",
        "firewall",
        "add",
        "rule",
        "action=allow",
        "program="
      ]
    }
  ],
  "selection_paths": {
    "CommandLine|contains": [
      ":\\$Recycle.bin\\",
      ":\\RECYCLER.BIN\\",
      ":\\RECYCLERS.BIN\\",
      ":\\SystemVolumeInformation\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Desktop\\",
      ":\\Users\\Public\\",
      ":\\Windows\\addins\\",
      ":\\Windows\\cursors\\",
      ":\\Windows\\debug\\",
      ":\\Windows\\drivers\\",
      ":\\Windows\\fonts\\",
      ":\\Windows\\help\\",
      ":\\Windows\\system32\\tasks\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\Downloads\\",
      "\\Local Settings\\Temporary Internet Files\\",
      "\\Temporary Internet Files\\Content.Outlook\\",
      "%Public%\\",
      "%TEMP%",
      "%TMP%"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virusradar.com/en/Win32_Kasidet.AD/description
  - https://www.hybrid-analysis.com/sample/07e789f4f2f3259e7559fdccb36e96814c2dbff872a21e1fa03de9ee377d581f?environmentId=100
Sigma Detection Rule: Remote Access Tool - ScreenConnect Potential Suspicious Remote Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale
Date: 2022-02-25
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes launched via the ScreenConnect client service.


Detection logic:
{
  "selection": {
    "ParentCommandLine|contains|all": [
      ":\\Windows\\TEMP\\ScreenConnect\\",
      "run.cmd"
    ],
    "Image|endswith": [
      "\\bitsadmin.exe",
      "\\cmd.exe",
      "\\curl.exe",
      "\\dllhost.exe",
      "\\net.exe",
      "\\nltest.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\rundll32.exe",
      "\\wevtutil.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/telegram-malware-iranian-espionage
  - https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://www.trendmicro.com/en_us/research/24/b/threat-actor-groups-including-black-basta-are-exploiting-recent-.html
Sigma Detection Rule: Potentially Suspicious Regsvr32 HTTP/FTP Pattern
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-05-24
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "selection_flag": {
    "CommandLine|contains": [
      " /i",
      " -i"
    ]
  },
  "selection_protocol": {
    "CommandLine|contains": [
      "ftp",
      "http"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]14623491
  - https://twitter.com/tccontre18/status/[PII_REDACTED]50832903
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
Sigma Detection Rule: Potential Suspicious Mofcomp Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-12
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.
The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
Attackers abuse this utility to install malicious MOF scripts


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mofcomp.exe"
    },
    {
      "OriginalFileName": "mofcomp.exe"
    }
  ],
  "selection_case": [
    {
      "ParentImage|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wsl.exe",
        "\\wscript.exe",
        "\\cscript.exe"
      ]
    },
    {
      "CommandLine|contains": [
        "\\AppData\\Local\\Temp",
        "\\Users\\Public\\",
        "\\WINDOWS\\Temp\\",
        "%temp%",
        "%tmp%",
        "%appdata%"
      ]
    }
  ],
  "filter_main_wmiprvse": {
    "ParentImage": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
    "CommandLine|contains": "C:\\Windows\\TEMP\\",
    "CommandLine|endswith": ".mof"
  },
  "filter_optional_null_parent": {
    "CommandLine|contains": "C:\\Windows\\TEMP\\",
    "CommandLine|endswith": ".mof"
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml
  - https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp