deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Fireball Archer Install
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-06-03
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects Archer malware invocation via rundll32

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "rundll32.exe",
      "InstallArcherSvc"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.virustotal.com/en/file/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022/analysis/
  - https://www.hybrid-analysis.com/sample/9b4971349ae85aa09c0a69852ed3e626c954954a3927b3d1b6646f139b930022?environmentId=100
Sigma Detection Rule: StoneDrill Service Install
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-07
ATT&CK techniques: T1543.003
Log source: windows/

Description:
This method detects a service install of the malicious Microsoft Network Realtime Inspection Service service described in StoneDrill report by Kaspersky

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": "NtsSrv",
    "ImagePath|endswith": " LocalService"
  },
  "condition": "selection"
}

References:
  - https://securelist.com/blog/research/77725/from-shamoon-to-stonedrill/
Sigma Detection Rule: NotPetya Ransomware Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Tom Ueltschi
Date: 2019-01-16
ATT&CK techniques: T1218.011, T1685.005, T1003.001
Log source: windows/process_creation

Description:
Detects NotPetya ransomware activity in which the extracted passwords are passed back to the main module via named pipe, the file system journal of drive C is deleted and Windows eventlogs are cleared using wevtutil

Detection logic:
{
  "selection_specific_pattern": {
    "CommandLine|contains": [
      "wevtutil cl Application & fsutil usn deletejournal /D C:",
      "dllhost.dat %WINDIR%\\ransoms"
    ]
  },
  "selection_rundll32": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|endswith": [
      ".dat,#1",
      ".dat #1",
      ".zip.dll\",#1"
    ]
  },
  "selection_perfc_keyword": [
    "\\perfc.dat"
  ],
  "condition": "1 of selection_*"
}

References:
  - https://securelist.com/schroedingers-petya/78870/
  - https://www.hybrid-analysis.com/sample/64b0b58a2c030c77fdb2b537b2fcc4af432bc55ffb36599a31d418c7c69e94b1?environmentId=100
Sigma Detection Rule: Exploit for CVE-2017-0261
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-02-22
ATT&CK techniques: T1203, T1204.002, T1566.001
Log source: windows/process_creation

Description:
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\WINWORD.EXE",
    "Image|contains": "\\FLTLDR.exe"
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2017/05/eps-processing-zero-days.html
Sigma Detection Rule: Exploit for CVE-2017-8759
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-09-15
ATT&CK techniques: T1203, T1204.002, T1566.001
Log source: windows/process_creation

Description:
Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\WINWORD.EXE",
    "Image|endswith": "\\csc.exe"
  },
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
  - https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
Sigma Detection Rule: Droppers Exploiting CVE-2017-11882
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2017-11-23
ATT&CK techniques: T1203, T1204.002, T1566.001
Log source: windows/process_creation

Description:
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\EQNEDT32.EXE"
  },
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/2a4ae284c76f868fc51d3bb65da8caa6efacb707f265b25c30f34250b76b7507?environmentId=100
  - https://www.linkedin.com/pulse/exploit-available-dangerous-ms-office-rce-vuln-called-thebenygreen-
  - https://github.com/embedi/CVE-2017-11882
Sigma Detection Rule: Ps.exe Renamed SysInternals Tool
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-10-22
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects renamed SysInternals tool execution with a binary named ps.exe as used by Dragonfly APT group and documented in TA17-293A report

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "ps.exe -accepteula",
      "-s cmd /c netstat"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.us-cert.gov/ncas/alerts/TA17-293A
Sigma Detection Rule: Turla Group Named Pipes
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Markus Neis
Date: 2017-11-06
ATT&CK techniques: T1106
Log source: windows/pipe_created

Description:
Detects a named pipe used by Turla group samples

Detection logic:
{
  "selection": {
    "PipeName": [
      "\\atctl",
      "\\comnap",
      "\\iehelper",
      "\\sdlrpc",
      "\\userpipe"
    ]
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: Turla Service Install
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-31
ATT&CK techniques: T1543.003
Log source: windows/

Description:
This method detects a service install of malicious services mentioned in Carbon Paper - Turla report by ESET

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": [
      "srservice",
      "ipvpn",
      "hkmsvc"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.welivesecurity.com/2017/03/30/carbon-paper-peering-turlas-second-stage-backdoor/
Sigma Detection Rule: Turla PNG Dropper Service
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-11-23
ATT&CK techniques: T1543.003
Log source: windows/

Description:
This method detects malicious services mentioned in Turla PNG dropper report by NCC Group in November 2018

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": "WerFaultSvc"
  },
  "condition": "selection"
}

References:
  - https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/
Sigma Detection Rule: Potential APT10 Cloud Hopper Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-04-07
ATT&CK techniques: T1059.005
Log source: windows/process_creation

Description:
Detects potential process and execution activity related to APT10 Cloud Hopper operation

Detection logic:
{
  "selection_cscript": {
    "Image|endswith": "\\cscript.exe",
    "CommandLine|contains": ".vbs /shell "
  },
  "selection_csvde": {
    "CommandLine|contains|all": [
      "csvde -f C:\\windows\\web\\",
      ".log"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
Sigma Detection Rule: Pandemic Registry Key
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-06-01
ATT&CK techniques: T1105
Log source: windows/registry_event

Description:
Detects Pandemic Windows Implant

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\SYSTEM\\CurrentControlSet\\services\\null\\Instance"
  },
  "condition": "selection"
}

References:
  - https://wikileaks.org/vault7/#Pandemic
  - https://twitter.com/MalwareJake/status/[PII_REDACTED]56454401
Sigma Detection Rule: Equation Group C2 Communication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-04-15
ATT&CK techniques: T1041
Log source: /firewall

Description:
Detects communication to C2 servers mentioned in the operational notes of the ShadowBroker leak of EquationGroup C2 tools

Detection logic:
{
  "selection": [
    {
      "dst_ip": [
        "69.42.98.86",
        "89.185.234.145"
      ]
    },
    {
      "src_ip": [
        "69.42.98.86",
        "89.185.234.145"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation
  - https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
Sigma Detection Rule: Lazarus System Binary Masquerading
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)
Date: 2020-06-03
ATT&CK techniques: T1036.005
Log source: windows/process_creation

Description:
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\msdtc.exe",
      "\\gpsvc.exe"
    ]
  },
  "filter": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf
Sigma Detection Rule: Axios NPM Compromise File Creation Indicators - MacOS
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1195.002, T1105
Log source: macos/file_event

Description:
Detects file creation events linked to the Axios NPM supply chain compromise on macOS devices. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.


Detection logic:
{
  "selection_curl_download": {
    "Image|endswith": "/curl",
    "TargetFilename": "/Library/Caches/com.apple.act.mond"
  },
  "selection_node_shell": {
    "Image|endswith": "/node",
    "TargetFilename": "/tmp/6202033"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: Axios NPM Compromise Indicators - macOS
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1195.002, T1059.002, T1059.004, T1105
Log source: macos/process_creation

Description:
Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.


Detection logic:
{
  "selection_osascript": {
    "CommandLine|contains|all": [
      "nohup ",
      "osascript ",
      "/tmp/6202033"
    ]
  },
  "selection_curl_download": {
    "CommandLine|contains|all": [
      "curl ",
      "packages.npm.org/product",
      "/Library/Caches/com.apple.act.mond"
    ]
  },
  "selection_cleanup": {
    "CommandLine|contains|all": [
      "rm ",
      "-rf ",
      "/tmp/6202033"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: Axios NPM Compromise File Creation Indicators - Windows
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1195.002
Log source: windows/file_event

Description:
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\node.exe",
      "\\powershell.exe"
    ]
  },
  "selection_fils": [
    {
      "TargetFilename": [
        "C:\\ProgramData\\wt.exe",
        "C:\\ProgramData\\system.bat"
      ]
    },
    {
      "TargetFilename|contains|all": [
        "C:\\Users\\",
        "\\AppData\\Local\\Temp\\6202033.vbs"
      ]
    },
    {
      "TargetFilename|contains|all": [
        "C:\\Users\\",
        "\\AppData\\Local\\Temp\\6202033.ps1"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: Axios NPM Compromise Indicators - Windows
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1195.002, T1059.003, T1059.005, T1105
Log source: windows/process_creation

Description:
Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.
The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.


Detection logic:
{
  "selection_cscript": {
    "ParentImage|endswith": [
      "\\node.exe",
      "\\bun.exe"
    ],
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "cscript",
      "AppData\\Local\\Temp",
      "//nologo && del",
      "6202033.vbs"
    ]
  },
  "selection_curl": {
    "Image|endswith": [
      "\\curl.exe",
      "\\powershell.exe"
    ],
    "CommandLine|contains": "http://sfrclak.com"
  },
  "selection_susp_cli": {
    "OriginalFileName": "PowerShell.EXE",
    "CommandLine|contains": "\"C:\\ProgramData\\wt.exe\" -w hidden -ep bypass -file"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: Axios NPM Compromise Indicators - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1195.002, T1059.006, T1059.004, T1105
Log source: linux/process_creation

Description:
Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.


Detection logic:
{
  "selection_node_shell": {
    "ParentImage|endswith": [
      "/node",
      "/bun"
    ],
    "CommandLine|contains|all": [
      "curl ",
      "/tmp/ld.py",
      "python3 ",
      "nohup ",
      "6202033"
    ]
  },
  "selection_curl_download": {
    "Image|endswith": "/curl",
    "CommandLine|contains": "http://sfrclak.com"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: Axios NPM Compromise Malicious C2 Domain DNS Query
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1071.001, T1568
Log source: /dns

Description:
Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.
This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.


Detection logic:
{
  "selection": {
    "query": [
      "sfrclak.com",
      "calltan.com",
      "callnrwise.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: Axios NPM Compromise File Creation Indicators - Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-04-01
ATT&CK techniques: T1195.002, T1105
Log source: linux/file_event

Description:
Detects file creation events linked to the Axios NPM supply chain compromise. Axios is a popular JavaScript HTTP client.
On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper.


Detection logic:
{
  "selection": {
    "Image|endswith": "/curl",
    "TargetFilename": "/tmp/ld.py"
  },
  "condition": "selection"
}

References:
  - https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan
  - https://www.derp.ca/research/axios-npm-supply-chain-rat/
  - https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html
  - https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections
  - https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b[PII_REDACTED]0d4e0e7769e7491e5f4d894c2e0e09
Sigma Detection Rule: RedSun - Conhost.exe Spawned by TieringEngineService.exe
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost
Date: 2026-04-17
ATT&CK techniques: T1134.002, T1036.005
Log source: windows/process_creation

Description:
Detects two stages of the RedSun post-exploitation process chain that deliver a SYSTEM-level shell to the attacker's interactive session.
Observed process chain
  services.exe
    → TieringEngineService.exe
      → conhost.exe             (SYSTEM, CommandLine: bare path, no arguments)
        → cmd.exe / shell       (SYSTEM, TerminalSessionId = attacker's session)

Stage 1 — TieringEngineService.exe spawns argument-less conhost.exe:
  After winning the oplock + Cloud Files mount point race, the malicious TieringEngineService.exe (RedSun.exe copied to System32, started via CoCreateInstance
  / services.exe) detects it is NT AUTHORITY\SYSTEM and calls LaunchConsoleInSessionId().
  This opens \\.\pipe\REDSUN, reads the attacker's session ID, duplicates the SYSTEM token, re-stamps it with that session ID via SetTokenInformation(TokenSessionId), then
  calls CreateProcessAsUser to spawn conhost.exe with no arguments.

Stage 2 — Shell spawned from rogue conhost.exe (EDR sources with GrandParentImage):
  The rogue SYSTEM conhost.exe spawns a shell (cmd.exe, PowerShell, etc.) as SYSTEM in the attacker's interactive session.
  On EDR sources that expose GrandParentImage, the full three-level chain (TieringEngineService.exe → conhost.exe → shell) can be matched directly.
  The legitimate TieringEngineService.exe is a headless COM server that is unlikely to spawn conhost.exe under normal conditions.


Detection logic:
{
  "selection_tiering_to_conhost": {
    "ParentImage|endswith": "\\TieringEngineService.exe",
    "Image|endswith": "\\conhost.exe",
    "CommandLine|endswith": "conhost.exe\"",
    "User|contains": [
      "AUTHORI",
      "AUTORI",
      "$"
    ]
  },
  "selection_shell_full_chain": {
    "GrandParentImage|endswith": "\\TieringEngineService.exe",
    "ParentImage|endswith": "\\conhost.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI",
      "$"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/Nightmare-Eclipse/RedSun