deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Possible PrintNightmare Print Driver Install - CVE-2021-1675
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: @neu5ron (Nate Guagenti)
Date: 2021-08-23
Log source: zeek/

Description:
Detects the remote installation of a print driver which is possible indication of the exploitation of PrintNightmare (CVE-2021-1675).
The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally and or through group policy.


Detection logic:
{
  "selection": {
    "operation": [
      "RpcAsyncInstallPrinterDriverFromPackage",
      "RpcAsyncAddPrintProcessor",
      "RpcAddPrintProcessor",
      "RpcAddPrinterDriverEx",
      "RpcAddPrinterDriver",
      "RpcAsyncAddPrinterDriver"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29
  - https://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
  - https://github.com/corelight/CVE-2021-1675
  - https://old.zeek.org/zeekweek2019/slides/bzar.pdf
Sigma Detection Rule: CVE-2021-1675 Print Spooler Exploitation IPC Access
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: INIT_6
Date: 2021-07-02
ATT&CK techniques: T1569
Log source: windows/

Description:
Detects remote printer driver load from Detailed File Share in Security logs that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675 and CVE-2021-34527

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$",
    "RelativeTargetName": "spoolss",
    "AccessMask": "0x3",
    "ObjectType": "File"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/INIT_3/status/[PII_REDACTED]41731075
Sigma Detection Rule: CVE-2021-1675 Print Spooler Exploitation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-01
ATT&CK techniques: T1569
Log source: windows/

Description:
Detects driver load events print service operational log that are a sign of successful exploitation attempts against print spooler vulnerability CVE-2021-1675

Detection logic:
{
  "selection": {
    "EventID": 316
  },
  "keywords": [
    "UNIDRV.DLL, kernelbase.dll, ",
    " 123 ",
    " 1234 ",
    "mimispool"
  ],
  "condition": "selection and keywords"
}

References:
  - https://twitter.com/MalwareJake/status/[PII_REDACTED]63731200
Sigma Detection Rule: Suspicious RazerInstaller Explorer Subprocess
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Maxime Thiebaut
Date: 2021-08-23
ATT&CK techniques: T1553
Log source: windows/process_creation

Description:
Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\RazerInstaller.exe",
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "filter_main_razer": {
    "Image|startswith": "C:\\Windows\\Installer\\Razer\\Installer\\"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/j0nh4t/status/[PII_REDACTED]21138437
  - https://streamable.com/q2dsji
Sigma Detection Rule: VMware vCenter Server File Upload CVE-2021-22005
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sittikorn S
Date: 2021-09-24
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts using file upload vulnerability CVE-2021-22005 in the VMWare vCenter Server.

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains": "/analytics/telemetry/ph/api/hyper/send?"
  },
  "condition": "selection"
}

References:
  - https://kb.vmware.com/s/article/85717
  - https://www.tenable.com/blog/cve-2021-22005-critical-file-upload-vulnerability-in-vmware-vcenter-server
Sigma Detection Rule: Arcadyan Router Exploitations
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj
Date: 2021-08-24
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation of vulnerabilities in Arcadyan routers as reported in CVE-2021-20090 and CVE-2021-20091.

Detection logic:
{
  "path_traversal": {
    "cs-uri-query|contains": "..%2f"
  },
  "config_file_inj": {
    "cs-uri-query|contains|all": [
      "..%2f",
      "apply_abstract.cgi"
    ]
  },
  "noauth_list": {
    "cs-uri-query|contains": [
      "/images/",
      "/js/",
      "/css/",
      "/setup_top_login.htm",
      "/login.html",
      "/loginerror.html",
      "/loginexclude.html",
      "/loginlock.html"
    ]
  },
  "condition": "(path_traversal or config_file_inj) and noauth_list"
}

References:
  - https://medium.com/tenable-techblog/bypassing-authentication-on-arcadyan-routers-with-cve-2021-20090-and-rooting-some-buffalo-ea1dd30980c2
  - https://www.tenable.com/security/research/tra-2021-13
  - https://blogs.juniper.net/en-us/security/freshly-disclosed-vulnerability-cve-2021-20090-exploited-in-the-wild
Sigma Detection Rule: Oracle WebLogic Exploit CVE-2021-2109
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj
Date: 2021-01-20
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of the WebLogic server vulnerability described in CVE-2021-2109

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "com.bea.console.handles.JndiBindingHandle",
      "ldap://",
      "AdminServer"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/pyn3rd/status/[PII_REDACTED]65409026
  - https://mp.weixin.qq.com/s/wX9TMXl1KVWwB_k6EZOklw
Sigma Detection Rule: Fortinet CVE-2021-22123 Exploitation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj, Florian Roth
Date: 2021-08-19
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects CVE-2021-22123 exploitation attempt against Fortinet WAFs

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "/api/v2.0/user/remoteserver.saml",
    "cs-method": "POST"
  },
  "filter1": {
    "cs-referer|contains": "/root/user/remote-user/saml-user/"
  },
  "filter2": {
    "cs-referer": null
  },
  "condition": "selection and not filter1 and not filter2"
}

References:
  - https://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection
Sigma Detection Rule: CVE-2021-31979 CVE-2021-33771 Exploits
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Sittikorn S, frack113
Date: 2021-07-16
ATT&CK techniques: T1566, T1203
Log source: windows/registry_set

Description:
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Detection logic:
{
  "selection": {
    "TargetObject|endswith": [
      "CLSID\\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\\InprocServer32\\(Default)",
      "CLSID\\{7C[PII_REDACTED]-11CF-884D-00AA004B2E24}\\InProcServer32\\(Default)"
    ]
  },
  "filter": {
    "Details|endswith": [
      "system32\\wbem\\wmiutils.dll",
      "system32\\wbem\\wbemsvc.dll"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
  - https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
Sigma Detection Rule: CVE-2021-31979 CVE-2021-33771 Exploits by Sourgum
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Sittikorn S
Date: 2021-07-16
ATT&CK techniques: T1566, T1203
Log source: windows/file_event

Description:
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum

Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "C:\\Windows\\system32\\physmem.sys",
      "C:\\Windows\\System32\\IME\\IMEJP\\imjpueact.dll",
      "C:\\Windows\\system32\\ime\\IMETC\\IMTCPROT.DLL",
      "C:\\Windows\\system32\\ime\\SHARED\\imecpmeid.dll",
      "C:\\Windows\\system32\\config\\spp\\ServiceState\\Recovery\\pac.dat",
      "C:\\Windows\\system32\\config\\cy-GB\\Setup\\SKB\\InputMethod\\TupTask.dat",
      "C:\\Windows\\system32\\config\\config\\startwus.dat",
      "C:\\Windows\\system32\\ime\\SHARED\\WimBootConfigurations.ini",
      "C:\\Windows\\system32\\ime\\IMEJP\\WimBootConfigurations.ini",
      "C:\\Windows\\system32\\ime\\IMETC\\WimBootConfigurations.ini"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
  - https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/
Sigma Detection Rule: CVE-2021-21972 VSphere Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-02-24
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of VSphere Remote Code Execution vulnerability as described in CVE-2021-21972

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query": "/ui/vropspluginui/rest/services/uploadova"
  },
  "condition": "selection"
}

References:
  - https://www.vmware.com/security/advisories/VMSA-2021-0002.html
  - https://f5.pm/go-59627.html
  - https://swarm.ptsecurity.com/unauth-rce-vmware
Sigma Detection Rule: HAFNIUM Exchange Exploitation Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-09
ATT&CK techniques: T1546, T1053
Log source: windows/process_creation

Description:
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers

Detection logic:
{
  "selection_attrib": {
    "CommandLine|contains|all": [
      "attrib",
      " +h ",
      " +s ",
      " +r ",
      ".aspx"
    ]
  },
  "selection_vsperfmon": [
    {
      "Image|contains": "\\ProgramData\\VSPerfMon\\"
    },
    {
      "CommandLine|contains|all": [
        "schtasks",
        "VSPerfMon"
      ]
    }
  ],
  "selection_opera_1": {
    "Image|endswith": "Opera_browser.exe",
    "ParentImage|endswith": [
      "\\services.exe",
      "\\svchost.exe"
    ]
  },
  "selection_opera_2": {
    "Image|endswith": "Users\\Public\\opera\\Opera_browser.exe"
  },
  "selection_vssadmin": {
    "CommandLine|contains|all": [
      "vssadmin list shadows",
      "Temp\\__output"
    ]
  },
  "selection_makecab_1": {
    "Image|endswith": "\\makecab.exe",
    "CommandLine|contains|all": [
      "inetpub\\wwwroot\\",
      ".dmp.zip"
    ]
  },
  "selection_makecab_2": {
    "Image|endswith": "\\makecab.exe",
    "CommandLine|contains": [
      "Microsoft\\Exchange Server\\",
      "compressionmemory",
      ".gif"
    ]
  },
  "selection_7zip": {
    "CommandLine|contains|all": [
      " -t7z ",
      "C:\\Programdata\\pst",
      "\\it.zip"
    ]
  },
  "selection_rundll32": {
    "CommandLine|contains|all": [
      "\\comsvcs.dll",
      "Minidump",
      "full ",
      "\\inetpub\\wwwroot"
    ]
  },
  "selection_other": {
    "CommandLine|contains": [
      "Windows\\Temp\\xx.bat",
      "Windows\\WwanSvcdcs",
      "Windows\\Temp\\cw.exe"
    ]
  },
  "conditi

References:
  - https://blog.truesec.com/2021/03/07/exchange-zero-day-proxylogon-and-hafnium/
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
  - https://twitter.com/GadixCRK/status/[PII_REDACTED]69834753?s=20
  - https://twitter.com/BleepinComputer/status/[PII_REDACTED]49617161
Sigma Detection Rule: Exchange Exploitation Used by HAFNIUM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-03
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts in Exchange server logs as described in blog posts reporting on HAFNIUM group activity

Detection logic:
{
  "selection_1": {
    "cs-method": "POST",
    "cs-uri-query|contains": "/owa/auth/Current/themes/resources/"
  },
  "selection_2": {
    "cs-method": "POST",
    "cs-uri-query|contains": "/owa/auth/Current/",
    "cs-user-agent": [
      "DuckDuckBot/1.0;+(+http://duckduckgo.com/duckduckbot.html)",
      "facebookexternalhit/1.1+(+http://www.facebook.com/externalhit_uatext.php)",
      "Mozilla/5.0+(compatible;+Baiduspider/2.0;++http://www.baidu.com/search/spider.html)",
      "Mozilla/5.0+(compatible;+Bingbot/2.0;++http://www.bing.com/bingbot.htm)",
      "Mozilla/5.0+(compatible;+Googlebot/2.1;++http://www.google.com/bot.html",
      "Mozilla/5.0+(compatible;+Konqueror/3.5;+Linux)+KHTML/3.5.5+(like+Gecko)+(Exabot-Thumbnails)",
      "Mozilla/5.0+(compatible;+Yahoo!+Slurp;+http://help.yahoo.com/help/us/ysearch/slurp)",
      "Mozilla/5.0+(compatible;+YandexBot/3.0;++http://yandex.com/bots)",
      "Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36"
    ]
  },
  "selection_3": {
    "cs-uri-query|contains": "/ecp/",
    "cs-method": "POST",
    "cs-user-agent": [
      "ExchangeServicesClient/0.0.0.0",
      "python-requests/2.19.1",
      "python-requests/2.25.1"
    ]
  },
  "selection_4": {
    "cs-uri-query|contains": [
      "/aspnet_client/",
      "/owa/"
    ],
    "cs-method": "POST",
    "cs-user-agent": [
      "antSword/v2.1",
      "Googlebot/2.1+(+http://www.googlebot.com/bot.html)",
      "Mozilla/5.0+

References:
  - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
Sigma Detection Rule: DEWMODE Webshell Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-02-22
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Detects access to DEWMODE webshell as described in FIREEYE report

Detection logic:
{
  "selection1": {
    "cs-uri-query|contains|all": [
      "?dwn=",
      "&fn=",
      ".html?"
    ]
  },
  "selection2": {
    "cs-uri-query|contains|all": [
      "&dwn=",
      "?fn=",
      ".html?"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://www.mandiant.com/resources/blog/accellion-fta-exploited-for-data-theft-and-extortion
Sigma Detection Rule: REvil Kaseya Incident Malware Patterns
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-03
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "C:\\Windows\\cert.exe",
      "del /q /f c:\\kworking\\agent.crt",
      "Kaseya VSA Agent Hot-fix",
      "\\AppData\\Local\\Temp\\MsMpEng.exe",
      "rmdir /s /q %SystemDrive%\\inetpub\\logs",
      "del /s /q /f %SystemDrive%\\\\*.log",
      "c:\\kworking1\\agent.exe",
      "c:\\kworking1\\agent.crt"
    ]
  },
  "selection2": {
    "Image": [
      "C:\\Windows\\MsMpEng.exe",
      "C:\\Windows\\cert.exe",
      "C:\\kworking\\agent.exe",
      "C:\\kworking1\\agent.exe"
    ]
  },
  "selection3": {
    "CommandLine|contains|all": [
      "del /s /q /f",
      "WebPages\\Errors\\webErrorLog.txt"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://community.sophos.com/b/security-blog/posts/active-ransomware-attack-on-kaseya-customers
  - https://www.joesandbox.com/analysis/443736/0/html
  - https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
  - https://therecord.media/revil-ransomware-executes-supply-chain-attack-via-malicious-kaseya-update/
  - https://blog.truesec.com/2021/07/04/kaseya-supply-chain-attack-targeting-msps-to-deliver-revil-ransomware/
Sigma Detection Rule: SOURGUM Actor Behaviours
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: MSTIC, FPT.EagleEye
Date: 2021-06-15
ATT&CK techniques: T1546, T1546.015
Log source: windows/process_creation

Description:
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM

Detection logic:
{
  "selection": {
    "Image|contains": [
      "windows\\system32\\Physmem.sys",
      "Windows\\system32\\ime\\SHARED\\WimBootConfigurations.ini",
      "Windows\\system32\\ime\\IMEJP\\WimBootConfigurations.ini",
      "Windows\\system32\\ime\\IMETC\\WimBootConfigurations.ini"
    ]
  },
  "registry_image": {
    "Image|contains": [
      "windows\\system32\\filepath2",
      "windows\\system32\\ime"
    ],
    "CommandLine|contains": "reg add"
  },
  "registry_key": {
    "CommandLine|contains": [
      "HKEY_LOCAL_MACHINE\\software\\classes\\clsid\\{7c[PII_REDACTED]-11cf-884d-00aa004b2e24}\\inprocserver32",
      "HKEY_LOCAL_MACHINE\\software\\classes\\clsid\\{cf4cc405-e2c5-4ddd-b3ce-5e7582d8c9fa}\\inprocserver32"
    ]
  },
  "condition": "selection or all of registry_*"
}

References:
  - https://www.virustotal.com/gui/file/c299063e3eae8ddc15839767e83b9808fd43418dc5a1af7e4f44b97ba53fbd3d/detection
  - https://github.com/Azure/Azure-Sentinel/blob/43e9be273dca321295190bfc4902858e009d4a35/Detections/MultipleDataSources/SOURGUM_IOC.yaml
  - https://www.microsoft.com/security/blog/2021/07/15/protecting-customers-from-a-private-sector-offensive-actor-using-0-day-exploits-and-devilstongue-malware/
Sigma Detection Rule: APT PRIVATELOG Image Load Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-09-07
ATT&CK techniques: T1055
Log source: windows/image_load

Description:
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe",
    "ImageLoaded|endswith": "\\clfsw32.dll"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4449/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html
Sigma Detection Rule: Potential Ke3chang/TidePool Malware Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Swisscom
Date: 2020-06-18
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects registry modifications potentially related to the Ke3chang/TidePool malware as seen in campaigns running in 2019 and 2020

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "-Property DWORD -name DisableFirstRunCustomize -value 2 -Force",
      "-Property String -name Check_Associations -value",
      "-Property DWORD -name IEHarden -value 0 -Force"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0300/https://www.verfassungsschutz.de/embed/broschuere-2020-06-bfv-cyber-brief-2020-01.pdf
  - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/
Sigma Detection Rule: Potential Emotet Rundll32 Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: FPT.EagleEye
Date: 2020-12-25
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detecting Emotet DLL loading by looking for rundll32.exe processes with command lines ending in ,RunDLL or ,Control_RunDLL

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      ",RunDLL",
      ",Control_RunDLL"
    ]
  },
  "filter_legitimate_dll": {
    "CommandLine|endswith": [
      ".dll,Control_RunDLL",
      ".dll\",Control_RunDLL",
      ".dll',Control_RunDLL"
    ]
  },
  "filter_ide": {
    "ParentImage|endswith": "\\tracker.exe"
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://paste.cryptolaemus.com/emotet/2020/12/22/emotet-malware-IoCs_12-22-20.html
  - https://cyber.wtf/2021/11/15/guess-whos-back/
Sigma Detection Rule: Potential Maze Ransomware Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-05-08
ATT&CK techniques: T1204.002, T1047, T1490
Log source: windows/process_creation

Description:
Detects specific process characteristics of Maze ransomware word document droppers

Detection logic:
{
  "selection1": {
    "ParentImage|endswith": "\\WINWORD.exe",
    "Image|endswith": ".tmp"
  },
  "selection2": {
    "Image|endswith": "\\wmic.exe",
    "ParentImage|contains": "\\Temp\\",
    "CommandLine|endswith": "shadowcopy delete"
  },
  "selection3": {
    "CommandLine|endswith": "shadowcopy delete",
    "CommandLine|contains": "\\..\\..\\system32"
  },
  "condition": "1 of selection*"
}

References:
  - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
  - https://app.any.run/tasks/51e7185c-52d7-4efb-ac0d-e[PII_REDACTED]3/
  - https://app.any.run/tasks/65a79440-373a-4725-8d74-77db9f2abda4/
Sigma Detection Rule: Blue Mockingbird
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Trent Liffick (@tliffick)
Date: 2020-05-14
ATT&CK techniques: T1112, T1047
Log source: windows/process_creation

Description:
Attempts to detect system changes made by Blue Mockingbird

Detection logic:
{
  "sc_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "sc config",
      "wercplsupporte.dll"
    ]
  },
  "wmic_cmd": {
    "Image|endswith": "\\wmic.exe",
    "CommandLine|endswith": "COR_PROFILER"
  },
  "condition": "sc_cmd or wmic_cmd"
}

References:
  - https://redcanary.com/blog/blue-mockingbird-cryptominer/
Sigma Detection Rule: Blue Mockingbird - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Trent Liffick (@tliffick)
Date: 2020-05-14
ATT&CK techniques: T1112, T1047
Log source: windows/registry_set

Description:
Attempts to detect system changes made by Blue Mockingbird

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\CurrentControlSet\\Services\\wercplsupport\\Parameters\\ServiceDll"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/blue-mockingbird-cryptominer/
Sigma Detection Rule: Trickbot Malware Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2020-11-26
ATT&CK techniques: T1559
Log source: windows/process_creation

Description:
Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"

Detection logic:
{
  "selection": {
    "Image|endswith": "\\wermgr.exe",
    "ParentImage|endswith": "\\rundll32.exe",
    "ParentCommandLine|contains": "DllRegisterServer"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/swisscom_csirt/status/[PII_REDACTED]22521602?s=20
  - https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/