deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Script Interpreter Execution From Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-08
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity.
Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.


Detection logic:
{
  "selection_proc_image": {
    "Image|endswith": [
      "\\cscript.exe",
      "\\mshta.exe",
      "\\wscript.exe"
    ]
  },
  "selection_proc_flags": {
    "CommandLine|contains": [
      " -ep bypass ",
      " -ExecutionPolicy bypass ",
      " -w hidden ",
      "/e:javascript ",
      "/e:Jscript ",
      "/e:vbscript "
    ]
  },
  "selection_proc_original": {
    "OriginalFileName": [
      "cscript.exe",
      "mshta.exe",
      "wscript.exe"
    ]
  },
  "selection_folders_1": {
    "CommandLine|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      "\\%Public%",
      "\\AppData\\Local\\Temp",
      "\\AppData\\Roaming\\Temp",
      "\\Temporary Internet",
      "\\Windows\\Temp",
      "\\Start Menu\\Programs\\Startup\\",
      "%TEMP%",
      "%TMP%",
      "%LocalAppData%\\Temp"
    ]
  },
  "selection_folders_2": [
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Documents\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Music\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    },
    {
      "CommandLine|

References:
  - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military
  - https://learn.microsoft.com/en-us/windows/win32/shell/csidl
Sigma Detection Rule: Potential Suspicious Windows Feature Enabled - ProcCreation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-29
Log source: windows/process_creation

Description:
Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images


Detection logic:
{
  "selection_cmd": {
    "CommandLine|contains|all": [
      "Enable-WindowsOptionalFeature",
      "-Online",
      "-FeatureName"
    ]
  },
  "selection_feature": {
    "CommandLine|contains": [
      "TelnetServer",
      "Internet-Explorer-Optional-amd64",
      "TFTP",
      "SMB1Protocol",
      "Client-ProjFS",
      "Microsoft-Windows-Subsystem-Linux"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
  - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
Sigma Detection Rule: PUA - Chisel Tunneling Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-13
ATT&CK techniques: T1090.001
Log source: windows/process_creation

Description:
Detects usage of the Chisel tunneling tool via the commandline arguments

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\chisel.exe"
  },
  "selection_param1": {
    "CommandLine|contains": [
      "exe client ",
      "exe server "
    ]
  },
  "selection_param2": {
    "CommandLine|contains": [
      "-socks5",
      "-reverse",
      " r:",
      ":127.0.0.1:",
      "-tls-skip-verify ",
      ":socks"
    ]
  },
  "condition": "selection_img or all of selection_param*"
}

References:
  - https://github.com/jpillora/chisel/
  - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/
  - https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/
Sigma Detection Rule: Potentially Suspicious Regsvr32 HTTP IP Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects regsvr32 execution to download and install DLLs located remotely where the address is an IP address.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "selection_ip": {
    "CommandLine|contains": [
      " /i:http://1",
      " /i:http://2",
      " /i:http://3",
      " /i:http://4",
      " /i:http://5",
      " /i:http://6",
      " /i:http://7",
      " /i:http://8",
      " /i:http://9",
      " /i:https://1",
      " /i:https://2",
      " /i:https://3",
      " /i:https://4",
      " /i:https://5",
      " /i:https://6",
      " /i:https://7",
      " /i:https://8",
      " /i:https://9",
      " -i:http://1",
      " -i:http://2",
      " -i:http://3",
      " -i:http://4",
      " -i:http://5",
      " -i:http://6",
      " -i:http://7",
      " -i:http://8",
      " -i:http://9",
      " -i:https://1",
      " -i:https://2",
      " -i:https://3",
      " -i:https://4",
      " -i:https://5",
      " -i:https://6",
      " -i:https://7",
      " -i:https://8",
      " -i:https://9"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]14623491
  - https://twitter.com/tccontre18/status/[PII_REDACTED]50832903
  - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/
Sigma Detection Rule: Copy From Or To Admin Share Or Sysvol Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali
Date: 2019-12-30
ATT&CK techniques: T1039, T1048, T1021.002
Log source: windows/process_creation

Description:
Detects a copy command or a copy utility execution to or from an Admin share or remote

Detection logic:
{
  "selection_target": {
    "CommandLine|contains": [
      "\\\\\\\\*\\\\*$",
      "\\Sysvol\\"
    ]
  },
  "selection_other_tools": [
    {
      "Image|endswith": [
        "\\robocopy.exe",
        "\\xcopy.exe"
      ]
    },
    {
      "OriginalFileName": [
        "robocopy.exe",
        "XCOPY.EXE"
      ]
    }
  ],
  "selection_cmd_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cmd_cli": {
    "CommandLine|contains": "copy"
  },
  "selection_pwsh_img": [
    {
      "Image|contains": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell_ise.exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_pwsh_cli": {
    "CommandLine|contains": [
      "copy-item",
      "copy ",
      "cpi ",
      " cp ",
      "move ",
      " move-item",
      " mi ",
      " mv "
    ]
  },
  "condition": "selection_target and (selection_other_tools or all of selection_cmd_* or all of selection_pwsh_*)"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]86339073
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
  - https://www.elastic.co/guide/en/security/current/remote-file-copy-to-a-hidden-share.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
Sigma Detection Rule: Remote Access Tool - Team Viewer Session Started On Windows Host
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Josh Nickels, Qi Nan
Date: 2024-03-11
ATT&CK techniques: T1133
Log source: windows/process_creation

Description:
Detects the command line executed when TeamViewer starts a session started by a remote host.
Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.


Detection logic:
{
  "selection": {
    "Image": "TeamViewer_Desktop.exe",
    "ParentImage": "TeamViewer_Service.exe",
    "CommandLine|endswith": "TeamViewer_Desktop.exe --IPCport 5939 --Module 1"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: New Kernel Driver Via SC.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-14
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects creation of a new service (kernel driver) with the type "kernel"

Detection logic:
{
  "selection": {
    "Image|endswith": "\\sc.exe",
    "CommandLine|contains": [
      "create",
      "config"
    ],
    "CommandLine|contains|all": [
      "binPath",
      "type",
      "kernel"
    ]
  },
  "filter_optional_avira_driver": [
    {
      "CommandLine|contains|all": [
        "create netprotection_network_filter",
        "type= kernel start= ",
        "binPath= System32\\drivers\\netprotection_network_filter",
        "DisplayName= netprotection_network_filter",
        "group= PNP_TDI tag= yes"
      ]
    },
    {
      "CommandLine|contains|all": [
        "create avelam binpath=C:\\Windows\\system32\\drivers\\avelam.sys",
        "type=kernel start=boot error=critical group=Early-Launch"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
Sigma Detection Rule: Regsvr32 DLL Execution With Uncommon Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-07-17
ATT&CK techniques: T1574
Log source: windows/process_creation

Description:
Detects a "regsvr32" execution where the DLL doesn't contain a common file extension.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "filter_main_legit_ext": {
    "CommandLine|contains": [
      ".ax",
      ".cpl",
      ".dll",
      ".ocx"
    ]
  },
  "filter_optional_pascal": {
    "CommandLine|contains": ".ppl"
  },
  "filter_optional_avg": {
    "CommandLine|contains": ".bav"
  },
  "filter_main_null_4688": {
    "CommandLine": null
  },
  "filter_main_empty_4688": {
    "CommandLine": ""
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/
Sigma Detection Rule: HackTool - Hashcat Password Cracker Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-27
ATT&CK techniques: T1110.002
Log source: windows/process_creation

Description:
Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\hashcat.exe"
  },
  "selection_cli": {
    "CommandLine|contains|all": [
      "-a ",
      "-m 1000 ",
      "-r "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat
  - https://hashcat.net/wiki/doku.php?id=hashcat
Sigma Detection Rule: PsExec Service Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Thomas Patzke, Romaissa Adjailia, Florian Roth (Nextron Systems)
Date: 2017-06-12
Log source: windows/process_creation

Description:
Detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution

Detection logic:
{
  "selection": [
    {
      "Image": "C:\\Windows\\PSEXESVC.exe"
    },
    {
      "OriginalFileName": "psexesvc.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.youtube.com/watch?v=ro2QuZTIMBM
Sigma Detection Rule: Suspicious Mstsc.EXE Execution With Local RDP File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-18
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\mstsc.exe"
    },
    {
      "OriginalFileName": "mstsc.exe"
    }
  ],
  "selection_extension": {
    "CommandLine|endswith": [
      ".rdp",
      ".rdp\""
    ]
  },
  "selection_paths": {
    "CommandLine|contains": [
      ":\\Users\\Public\\",
      ":\\Windows\\System32\\spool\\drivers\\color",
      ":\\Windows\\System32\\Tasks_Migrated ",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      ":\\Windows\\Tracing\\",
      "\\AppData\\Local\\Temp\\",
      "\\Downloads\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/[PII_REDACTED]4748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
Sigma Detection Rule: Potential Discovery Activity Via Dnscmd.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @gott_cyber
Date: 2022-07-31
Log source: windows/process_creation

Description:
Detects an attempt to leverage dnscmd.exe to enumerate the DNS zones of a domain. DNS zones used to host the DNS records for a particular domain.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\dnscmd.exe"
  },
  "selection_cli": {
    "CommandLine|contains": [
      "/enumrecords",
      "/enumzones",
      "/ZonePrint",
      "/info"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
  - https://learn.microsoft.com/en-us/azure/dns/dns-zones-records
  - https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/
Sigma Detection Rule: HackTool - Hydra Password Bruteforce Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Vasiliy Burov
Date: 2020-10-05
ATT&CK techniques: T1110, T1110.001
Log source: windows/process_creation

Description:
Detects command line parameters used by Hydra password guessing hack tool

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "-u ",
      "-p "
    ],
    "CommandLine|contains": [
      "^USER^",
      "^PASS^"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/vanhauser-thc/thc-hydra
Sigma Detection Rule: Potential SPN Enumeration Via Setspn.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Markus Neis, keepwatch
Date: 2018-11-14
ATT&CK techniques: T1558.003
Log source: windows/process_creation

Description:
Detects service principal name (SPN) enumeration used for Kerberoasting

Detection logic:
{
  "selection_pe": [
    {
      "Image|endswith": "\\setspn.exe"
    },
    {
      "OriginalFileName": "setspn.exe"
    },
    {
      "Description|contains|all": [
        "Query or reset the computer",
        "SPN attribute"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -q ",
      " /q "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3843/https://p16.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation
  - https://www.praetorian.com/blog/how-to-use-kerberoasting-t1208-for-privilege-escalation/?edition=2019
Sigma Detection Rule: Suspicious ShellExec_RunDLL Call Via Ordinal
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2024-12-01
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects suspicious call to the "ShellExec_RunDLL" exported function of SHELL32.DLL through the ordinal number to launch other commands.
Adversary might only use the ordinal number in order to bypass existing detection that alert on usage of ShellExec_RunDLL on CommandLine.


Detection logic:
{
  "selection_parent_img": {
    "ParentCommandLine|contains": "SHELL32.DLL"
  },
  "selection_parent_ordinal": {
    "ParentCommandLine|contains": [
      "#568",
      "#570",
      "#572",
      "#576"
    ]
  },
  "selection_susp_cli_parent": [
    {
      "ParentCommandLine|contains": [
        "comspec",
        "iex",
        "Invoke-",
        "msiexec",
        "odbcconf",
        "regsvr32"
      ]
    },
    {
      "ParentCommandLine|contains": [
        "\\Desktop\\",
        "\\ProgramData\\",
        "\\Temp\\",
        "\\Users\\Public\\"
      ]
    }
  ],
  "selection_susp_child_img": {
    "Image|endswith": [
      "\\bash.exe",
      "\\bitsadmin.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\curl.exe",
      "\\mshta.exe",
      "\\msiexec.exe",
      "\\msxsl.exe",
      "\\odbcconf.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\schtasks.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "all of selection_parent_* and 1 of selection_susp_*"
}

References:
  - https://redcanary.com/blog/raspberry-robin/
  - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://strontic.github.io/xcyclopedia/library/shell32.dll-65DA072F25DE83D9F83653E3FEA3644D.html
Sigma Detection Rule: Command Line Execution with Suspicious URL and AppData Strings
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2019-01-16
ATT&CK techniques: T1059.003, T1059.001, T1105
Log source: windows/process_creation

Description:
Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "http",
      "://",
      "%AppData%"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.hybrid-analysis.com/sample/3a1f[PII_REDACTED]0dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100
  - https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100
Sigma Detection Rule: Veeam Backup Database Suspicious Query
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
ATT&CK techniques: T1005
Log source: windows/process_creation

Description:
Detects potentially suspicious SQL queries using SQLCmd targeting the Veeam backup databases in order to steal information.

Detection logic:
{
  "selection_sql": {
    "Image|endswith": "\\sqlcmd.exe",
    "CommandLine|contains|all": [
      "VeeamBackup",
      "From "
    ]
  },
  "selection_db": {
    "CommandLine|contains": [
      "BackupRepositories",
      "Backups",
      "Credentials",
      "HostCreds",
      "SmbFileShares",
      "Ssh_creds",
      "VSphereInfo"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Microsoft IIS Service Account Password Dumped
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, Janantha Marasinghe, Elastic (original idea)
Date: 2022-11-08
ATT&CK techniques: T1003
Log source: windows/process_creation

Description:
Detects the Internet Information Services (IIS) command-line tool, AppCmd, being used to list passwords

Detection logic:
{
  "selection_base_name": [
    {
      "Image|endswith": "\\appcmd.exe"
    },
    {
      "OriginalFileName": "appcmd.exe"
    }
  ],
  "selection_base_list": {
    "CommandLine|contains": "list "
  },
  "selection_standalone": {
    "CommandLine|contains": [
      " /config",
      " /xml",
      " -config",
      " -xml"
    ]
  },
  "selection_cmd_flags": {
    "CommandLine|contains": [
      " /@t",
      " /text",
      " /show",
      " -@t",
      " -text",
      " -show"
    ]
  },
  "selection_cmd_grep": {
    "CommandLine|contains": [
      ":\\*",
      "password"
    ]
  },
  "condition": "all of selection_base_* and (selection_standalone or all of selection_cmd_*)"
}

References:
  - https://www.elastic.co/guide/en/security/current/microsoft-iis-service-account-password-dumped.html
  - https://twitter.com/0gtweet/status/[PII_REDACTED]85917186?cxt=HHwWhIDUyaDbzYwsAAAA
  - https://www.netspi.com/blog/technical/network-penetration-testing/decrypting-iis-passwords-to-break-out-of-the-dmz-part-2/
Sigma Detection Rule: PowerShell Defender Threat Severity Default Action Set to 'Allow' or 'NoAction'
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Matt Anderson (Huntress)
Date: 2025-07-11
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the use of PowerShell to execute the 'Set-MpPreference' cmdlet to configure Windows Defender's threat severity default action to 'Allow' (value '6') or 'NoAction' (value '9').
This is a highly suspicious configuration change that effectively disables Defender's ability to automatically mitigate threats of a certain severity level.
An attacker might use this technique via the command line to bypass defenses before executing payloads.


Detection logic:
{
  "selection_cmdlet": {
    "CommandLine|contains": "Set-MpPreference"
  },
  "selection_action": {
    "CommandLine|contains": [
      "-LowThreatDefaultAction",
      "-ModerateThreatDefaultAction",
      "-HighThreatDefaultAction",
      "-SevereThreatDefaultAction",
      "-ltdefac ",
      "-mtdefac ",
      "-htdefac ",
      "-stdefac "
    ]
  },
  "selection_value": {
    "CommandLine|contains": [
      "Allow",
      "6",
      "NoAction",
      "9"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
  - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-threatseveritydefaultaction
  - https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952
  - https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
Sigma Detection Rule: Potentially Suspicious Ping/Copy Command Combination
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-18
ATT&CK techniques: T1070.004
Log source: windows/process_creation

Description:
Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.


Detection logic:
{
  "selection_cmd": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_action": {
    "CommandLine|contains|all": [
      "ping",
      "copy "
    ]
  },
  "selection_cli_1": {
    "CommandLine|contains|windash": " -n "
  },
  "selection_cli_2": {
    "CommandLine|contains|windash": " -y "
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research