deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Python Spawning Pretty TTY on Windows
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nextron Systems
Date: 2022-06-03
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects python spawning a pretty tty

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "python.exe",
      "python3.exe",
      "python2.exe"
    ]
  },
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "import pty",
      ".spawn("
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains": "from pty import spawn"
  },
  "condition": "selection_img and 1 of selection_cli_*"
}

References:
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Sigma Detection Rule: Pubprn.vbs Proxy Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-28
ATT&CK techniques: T1216.001
Log source: windows/process_creation

Description:
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\pubprn.vbs",
      "script:"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Scripts/Pubprn/
Sigma Detection Rule: Uncommon Svchost Command Line Parameter
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Liran Ravich
Date: 2025-11-14
ATT&CK techniques: T1036.005, T1055, T1055.012
Log source: windows/process_creation

Description:
Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe"
  },
  "filter_main_flags": {
    "CommandLine|re": "-k\\s\\w{1,64}(?:\\s?(?:-p|-s))?"
  },
  "filter_main_empty": {
    "CommandLine": ""
  },
  "filter_main_null": {
    "CommandLine": null
  },
  "filter_optional_defender": {
    "ParentImage|endswith": "\\MsMpEng.exe",
    "CommandLine|contains": "svchost.exe"
  },
  "filter_optional_mrt": {
    "ParentImage|endswith": "\\MRT.exe",
    "CommandLine": "svchost.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
  - https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
  - https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
Sigma Detection Rule: Suspicious ClickFix/FileFix Execution Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: montysecurity, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-19
ATT&CK techniques: T1204.001, T1204.004
Log source: windows/process_creation

Description:
Detects suspicious execution patterns where users are tricked into running malicious commands via clipboard manipulation, either through the Windows Run dialog (ClickFix) or File Explorer address bar (FileFix).
Attackers leverage social engineering campaigns—such as fake CAPTCHA challenges or urgent alerts—encouraging victims to paste clipboard contents, often executing mshta.exe, powershell.exe, or similar commands to infect systems.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\explorer.exe",
    "CommandLine|contains": "#"
  },
  "selection_cli_captcha": {
    "CommandLine|contains": [
      "account",
      "anti-bot",
      "botcheck",
      "captcha",
      "challenge",
      "confirmation",
      "fraud",
      "human",
      "identification",
      "identificator",
      "identity",
      "robot",
      "validation",
      "verification",
      "verify"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/JohnHammond/recaptcha-phish
  - https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
  - https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
  - https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
  - https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
Sigma Detection Rule: Webshell Tool Reconnaissance Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Cian Heasley, Florian Roth (Nextron Systems)
Date: 2020-07-22
ATT&CK techniques: T1505.003
Log source: windows/process_creation

Description:
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands


Detection logic:
{
  "selection_webserver_image": {
    "ParentImage|endswith": [
      "\\caddy.exe",
      "\\httpd.exe",
      "\\nginx.exe",
      "\\php-cgi.exe",
      "\\w3wp.exe",
      "\\ws_tomcatservice.exe"
    ]
  },
  "selection_webserver_characteristics_tomcat1": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentImage|contains": [
      "-tomcat-",
      "\\tomcat"
    ]
  },
  "selection_webserver_characteristics_tomcat2": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "CommandLine|contains": [
      "CATALINA_HOME",
      "catalina.jar"
    ]
  },
  "selection_recon": {
    "CommandLine|contains": [
      "perl --help",
      "perl -h",
      "python --help",
      "python -h",
      "python3 --help",
      "python3 -h",
      "wget --help"
    ]
  },
  "condition": "1 of selection_webserver_* and selection_recon"
}

References:
  - https://ragged-lab.blogspot.com/2020/07/webshells-automating-reconnaissance.html
Sigma Detection Rule: Suspicious Chromium Browser Instance Executed With Custom Extension
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Aedan Russell, frack113, X__Junior (Nextron Systems)
Date: 2022-06-19
ATT&CK techniques: T1176.001
Log source: windows/process_creation

Description:
Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ],
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ],
    "CommandLine|contains": "--load-extension="
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/chromeloader/
  - https://emkc.org/s/RJjuLa
  - https://www.mandiant.com/resources/blog/lnk-between-browsers
Sigma Detection Rule: Renamed Microsoft Teams Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-07-12
Log source: windows/process_creation

Description:
Detects the execution of a renamed Microsoft Teams binary.

Detection logic:
{
  "selection": {
    "OriginalFileName": [
      "msteams.exe",
      "teams.exe"
    ]
  },
  "filter_main_legit_names": {
    "Image|endswith": [
      "\\msteams.exe",
      "\\teams.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - ADCSPwn Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-31
ATT&CK techniques: T1557.001
Log source: windows/process_creation

Description:
Detects command line parameters used by ADCSPwn, a tool to escalate privileges in an active directory network by coercing authenticate from machine accounts and relaying to the certificate service

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      " --adcs ",
      " --port "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/bats3c/ADCSPwn
Sigma Detection Rule: Potential Persistence Via Powershell Search Order Hijacking - Task
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-04-08
ATT&CK techniques: T1053.005, T1059.001
Log source: windows/process_creation

Description:
Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Detection logic:
{
  "selection": {
    "ParentImage": "C:\\WINDOWS\\System32\\svchost.exe",
    "ParentCommandLine|contains|all": [
      "-k netsvcs",
      "-s Schedule"
    ],
    "CommandLine|endswith": [
      " -windowstyle hidden",
      " -w hidden",
      " -ep bypass",
      " -noni"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
Sigma Detection Rule: Driver/DLL Installation Via Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" with "INSTALLDRIVER" which installs a new ODBC driver. Attackers abuse this to install and run malicious DLLs.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "INSTALLDRIVER ",
      ".dll"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://web.archive.org/web/[PII_REDACTED]2753/https://twitter.com/Hexacorn/status/[PII_REDACTED]73330176
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Sigma Detection Rule: Use of OpenConsole
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-16
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "OpenConsole.exe"
    },
    {
      "Image|endswith": "\\OpenConsole.exe"
    }
  ],
  "filter": {
    "Image|startswith": "C:\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]78645252
Sigma Detection Rule: Potentially Suspicious Child Process of KeyScrambler.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-05-13
ATT&CK techniques: T1203, T1574.001
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of KeyScrambler.exe

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\KeyScrambler.exe"
  },
  "selection_binaries": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "cscript.exe",
        "mshta.exe",
        "PowerShell.EXE",
        "pwsh.dll",
        "regsvr32.exe",
        "RUNDLL32.EXE",
        "wscript.exe"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/DTCERT/status/[PII_REDACTED]45790799
Sigma Detection Rule: AADInternals PowerShell Cmdlets Execution - ProccessCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-12-23
Log source: windows/process_creation

Description:
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\powershell_ise.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.Exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "Add-AADInt",
      "ConvertTo-AADInt",
      "Disable-AADInt",
      "Enable-AADInt",
      "Export-AADInt",
      "Find-AADInt",
      "Get-AADInt",
      "Grant-AADInt",
      "Initialize-AADInt",
      "Install-AADInt",
      "Invoke-AADInt",
      "Join-AADInt",
      "New-AADInt",
      "Open-AADInt",
      "Read-AADInt",
      "Register-AADInt",
      "Remove-AADInt",
      "Reset-AADInt",
      "Resolve-AADInt",
      "Restore-AADInt",
      "Save-AADInt",
      "Search-AADInt",
      "Send-AADInt",
      "Set-AADInt",
      "Start-AADInt",
      "Unprotect-AADInt",
      "Update-AADInt"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://o365blog.com/aadinternals/
  - https://github.com/Gerenios/AADInternals
Sigma Detection Rule: PUA - Advanced IP Scanner Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), @ROxPinTeddy
Date: 2020-05-12
ATT&CK techniques: T1046, T1135
Log source: windows/process_creation

Description:
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\advanced_ip_scanner"
    },
    {
      "OriginalFileName|contains": "advanced_ip_scanner"
    },
    {
      "Description|contains": "Advanced IP Scanner"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/portable",
      "/lng"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
  - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
  - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc
  - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
  - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
Sigma Detection Rule: Installation of WSL Kali-Linux
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-10
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL).
Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.


Detection logic:
{
  "selection_wsl_img": [
    {
      "Image|endswith": "\\wsl.exe"
    },
    {
      "OriginalFileName": "wsl"
    }
  ],
  "selection_wsl_install": {
    "CommandLine|contains": [
      " --install ",
      " -i "
    ]
  },
  "selection_wsl_kali": {
    "CommandLine|contains": "kali"
  },
  "condition": "all of selection_wsl_*"
}

References:
  - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
  - https://learn.microsoft.com/en-us/windows/wsl/install
Sigma Detection Rule: HackTool - F-Secure C3 Load by Rundll32
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Alfie Champion (ajpc500)
Date: 2021-06-02
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
F-Secure C3 produces DLLs with a default exported StartNodeRelay function.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "rundll32.exe",
      ".dll",
      "StartNodeRelay"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12
Sigma Detection Rule: Rundll32 InstallScreenSaver Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io, TactiKoolSec
Date: 2022-04-28
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
An attacker may execute an application as a SCR File using rundll32.exe desk.cpl,InstallScreenSaver

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "InstallScreenSaver"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Libraries/Desk/
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1218.011/T1218.011.md#atomic-test-13---rundll32-with-deskcpl
Sigma Detection Rule: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2021-07-20
ATT&CK techniques: T1074.001
Log source: windows/process_creation

Description:
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Compress-Archive -Path*-DestinationPath $env:TEMP",
      "Compress-Archive -Path*-DestinationPath*\\AppData\\Local\\Temp\\",
      "Compress-Archive -Path*-DestinationPath*:\\Windows\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: Remote Access Tool - TacticalRMM Agent Registration to Potentially Attacker-Controlled Server
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ahmed Nosir (@egycondor)
Date: 2025-05-29
ATT&CK techniques: T1219, T1105
Log source: windows/process_creation

Description:
Detects TacticalRMM agent installations where the --api, --auth, and related flags are used on the command line.
These parameters configure the agent to connect to a specific RMM server with authentication, client ID, and site ID.
This technique could indicate a threat actor attempting to register the agent with an attacker-controlled RMM infrastructure silently.


Detection logic:
{
  "selection": {
    "Image|contains": "\\TacticalAgent\\tacticalrmm.exe",
    "CommandLine|contains|all": [
      "--api",
      "--auth",
      "--client-id",
      "--site-id",
      "--agent-type"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/amidaware/tacticalrmm
  - https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3
Sigma Detection Rule: WebDav Client Execution Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1048.003
Log source: windows/process_creation

Description:
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie".
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\svchost.exe"
  },
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "C:\\windows\\system32\\davclnt.dll,DavSetCookie"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/17
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.B.4_C10730EA-6345-4934-AA0F-B0EFCA0C4BA6.md
Sigma Detection Rule: Console CodePage Lookup Via CHCP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: _pete_0, TheDFIRReport
Date: 2022-02-21
ATT&CK techniques: T1614.001
Log source: windows/process_creation

Description:
Detects use of chcp to look up the system locale value as part of host discovery

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\cmd.exe",
    "ParentCommandLine|contains|windash": [
      " -c ",
      " -r ",
      " -k "
    ],
    "Image|endswith": "\\chcp.com",
    "CommandLine|endswith": [
      "chcp",
      "chcp ",
      "chcp  "
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
Sigma Detection Rule: PUA - DIT Snapshot Viewer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Furkan Caliskan (@caliskanfurkan_)
Date: 2020-07-04
ATT&CK techniques: T1003.003
Log source: windows/process_creation

Description:
Detects the use of Ditsnap tool, an inspection tool for Active Directory database, ntds.dit.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\ditsnap.exe"
    },
    {
      "CommandLine|contains": "ditsnap.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2020/06/21/snatch-ransomware/
  - https://web.archive.org/web/[PII_REDACTED]2207/https://github.com/yosqueoy/ditsnap
Sigma Detection Rule: HackTool - Certify Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2023-04-17
ATT&CK techniques: T1649
Log source: windows/process_creation

Description:
Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\Certify.exe"
    },
    {
      "OriginalFileName": "Certify.exe"
    },
    {
      "Description|contains": "Certify"
    }
  ],
  "selection_cli_commands": {
    "CommandLine|contains": [
      ".exe cas ",
      ".exe find ",
      ".exe pkiobjects ",
      ".exe request ",
      ".exe download "
    ]
  },
  "selection_cli_options": {
    "CommandLine|contains": [
      " /vulnerable",
      " /template:",
      " /altname:",
      " /domain:",
      " /path:",
      " /ca:"
    ]
  },
  "condition": "selection_img or all of selection_cli_*"
}

References:
  - https://github.com/GhostPack/Certify