deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Process Memory Dump Via Dotnet-Dump
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dotnet-dump.exe"
    },
    {
      "OriginalFileName": "dotnet-dump.dll"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "collect"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect
  - https://twitter.com/bohops/status/[PII_REDACTED]09966338
Sigma Detection Rule: Stop Windows Service Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-05
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects the stopping of a Windows service via the "sc.exe" utility

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "sc.exe"
    },
    {
      "Image|endswith": "\\sc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " stop "
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc742107(v=ws.11)
Sigma Detection Rule: New Capture Session Launched Via DXCap.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-26
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\DXCap.exe"
    },
    {
      "OriginalFileName": "DXCap.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -c "
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/
  - https://twitter.com/harr0ey/status/[PII_REDACTED]04419328
Sigma Detection Rule: Potential Binary Proxy Execution Via VSDiagnostics.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-03
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\VSDiagnostics.exe"
    },
    {
      "OriginalFileName": "VSDiagnostics.exe"
    }
  ],
  "selection_cli_start": {
    "CommandLine|contains": "start"
  },
  "selection_cli_launch": {
    "CommandLine|contains": [
      " /launch:",
      " -launch:"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/0xBoku/status/[PII_REDACTED]13135872
Sigma Detection Rule: Gpresult Display Group Policy Information
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-01
ATT&CK techniques: T1615
Log source: windows/process_creation

Description:
Detects cases in which a user uses the built-in Windows utility gpresult to display the Resultant Set of Policy (RSoP) information

Detection logic:
{
  "selection": {
    "Image|endswith": "\\gpresult.exe",
    "CommandLine|contains": [
      "/z",
      "/v"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
  - https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
Sigma Detection Rule: Execution via stordiag.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer (@austinsonger)
Date: 2021-10-21
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\stordiag.exe",
    "Image|endswith": [
      "\\schtasks.exe",
      "\\systeminfo.exe",
      "\\fltmc.exe"
    ]
  },
  "filter": {
    "ParentImage|startswith": [
      "c:\\windows\\system32\\",
      "c:\\windows\\syswow64\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html
  - https://twitter.com/eral4m/status/[PII_REDACTED]41911809
Sigma Detection Rule: Change Default File Association To Executable Via Assoc
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1546.001
Log source: windows/process_creation

Description:
Detects when a program changes the default file association of any extension to an executable.
When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "assoc ",
      "exefile"
    ]
  },
  "filter": {
    "CommandLine|contains": ".exe=exefile"
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
Sigma Detection Rule: Suspicious File Download From IP Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-27
Log source: windows/process_creation

Description:
Detects potentially suspicious file downloads directly from IP addresses using curl.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_ip": {
    "CommandLine|re": "://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_flag": {
    "CommandLine|contains": [
      " -O",
      "--remote-name",
      "--output"
    ]
  },
  "selection_ext": {
    "CommandLine|endswith": [
      ".bat",
      ".bat\"",
      ".dat",
      ".dat\"",
      ".dll",
      ".dll\"",
      ".exe",
      ".exe\"",
      ".gif",
      ".gif\"",
      ".hta",
      ".hta\"",
      ".jpeg",
      ".jpeg\"",
      ".log",
      ".log\"",
      ".msi",
      ".msi\"",
      ".png",
      ".png\"",
      ".ps1",
      ".ps1\"",
      ".psm1",
      ".psm1\"",
      ".vbe",
      ".vbe\"",
      ".vbs",
      ".vbs\"",
      ".bat'",
      ".dat'",
      ".dll'",
      ".exe'",
      ".gif'",
      ".hta'",
      ".jpeg'",
      ".log'",
      ".msi'",
      ".png'",
      ".ps1'",
      ".psm1'",
      ".vbe'",
      ".vbs'"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
Sigma Detection Rule: XSL Script Execution Via WMIC.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community, Swachchhanda Shrawan Poudel
Date: 2019-10-21
ATT&CK techniques: T1047, T1220, T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E",
        "IMPHASH=37777A96245A3C74EB217308F3546F4C",
        "IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206",
        "IMPHASH=B12619881D79C3ACADF45E752A58554A",
        "IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00"
      ]
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|windash": "-format:"
  },
  "filter_main_known_format": {
    "CommandLine|contains": [
      "Format:List",
      "Format:htable",
      "Format:hform",
      "Format:table",
      "Format:mof",
      "Format:value",
      "Format:rawxml",
      "Format:xml",
      "Format:csv"
    ]
  },
  "filter_main_remote_operation": {
    "CommandLine|contains": [
      "://",
      "\\\\\\\\"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1220/T1220.md
Sigma Detection Rule: RDP Connection Allowed Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sander Wiebing
Date: 2020-05-23
ATT&CK techniques: T1686.003
Log source: windows/process_creation

Description:
Detects usage of the netsh command to open and allow connections to port 3389 (RDP). As seen used by Sarwent Malware

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "firewall ",
      "add ",
      "tcp ",
      "3389"
    ],
    "CommandLine|contains": [
      "portopening",
      "allow"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://labs.sentinelone.com/sarwent-malware-updates-command-detonation/
Sigma Detection Rule: Suspicious Process By Web Server Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1505.003, T1190
Log source: windows/process_creation

Description:
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation


Detection logic:
{
  "selection_webserver_image": {
    "ParentImage|endswith": [
      "\\caddy.exe",
      "\\httpd.exe",
      "\\nginx.exe",
      "\\php-cgi.exe",
      "\\php.exe",
      "\\tomcat.exe",
      "\\UMWorkerProcess.exe",
      "\\w3wp.exe",
      "\\ws_TomcatService.exe"
    ]
  },
  "selection_webserver_characteristics_tomcat1": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentImage|contains": [
      "-tomcat-",
      "\\tomcat"
    ]
  },
  "selection_webserver_characteristics_tomcat2": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentCommandLine|contains": [
      "CATALINA_HOME",
      "catalina.home",
      "catalina.jar"
    ]
  },
  "selection_anomaly_children": {
    "Image|endswith": [
      "\\arp.exe",
      "\\at.exe",
      "\\bash.exe",
      "\\bitsadmin.exe",
      "\\certutil.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\dsget.exe",
      "\\hostname.exe",
      "\\nbtstat.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\netdom.exe",
      "\\netsh.exe",
      "\\nltest.exe",
      "\\ntdsutil.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\qprocess.exe",
      "\\query.exe",
      "\\qwinsta.exe",
      "\\reg.exe",
      "\\rundll32.exe",
      "\\sc.exe",
      "\\sh.exe",
      "\\wmic.exe",
      "\\wscript.exe",
      "\\wusa.exe"
    ]
  },
  "filter_main_fp_1": {
    "ParentImage|endswith": "\\java.exe",
    "

References:
  - https://media.defense.gov/2020/Jun/09/[PII_REDACTED]/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF
Sigma Detection Rule: UAC Bypass Using IDiagnostic Profile
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-03
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the "IDiagnosticProfileUAC" UAC bypass technique

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\DllHost.exe",
    "ParentCommandLine|contains": " /Processid:{12C21EA7-2EB8-4B55-9249-AC243DA8C666}",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Wh04m1001/IDiagnosticProfileUAC
Sigma Detection Rule: Suspicious PowerShell Mailbox Export to Share
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-07
Log source: windows/process_creation

Description:
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "New-MailboxExportRequest",
      " -Mailbox ",
      " -FilePath \\\\\\\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://youtu.be/5mqid-7zp8k?t=2481
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
  - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
Sigma Detection Rule: PUA - AdvancedRun Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-20
ATT&CK techniques: T1564.003, T1134.002, T1059.003
Log source: windows/process_creation

Description:
Detects the execution of AdvancedRun utility

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "AdvancedRun.exe"
    },
    {
      "CommandLine|contains|all": [
        " /EXEFilename ",
        " /Run"
      ]
    },
    {
      "CommandLine|contains|all": [
        " /WindowState 0",
        " /RunAs ",
        " /CommandLine "
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://twitter.com/splinter_code/status/[PII_REDACTED]79603714
  - https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3
  - https://www.elastic.co/security-labs/operation-bleeding-bear
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
Sigma Detection Rule: PsExec Service Child Process Execution as LOCAL SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-21
Log source: windows/process_creation

Description:
Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Detection logic:
{
  "selection": {
    "ParentImage": "C:\\Windows\\PSEXESVC.exe",
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
Sigma Detection Rule: Run PowerShell Script from ADS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sergey Soldatov, Kaspersky Lab, oscd.community
Date: 2019-10-30
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detects PowerShell script execution from Alternate Data Stream (ADS)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains|all": [
      "Get-Content",
      "-Stream"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/p0shkatz/Get-ADS/blob/1c3a3562e713c254edce1995a7d9879c687c7473/Get-ADS.ps1
Sigma Detection Rule: Service Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-14
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
An adversary might use WMI to check if a certain remote service is running on a remote device.
When the test completes, a service information will be displayed on the screen if it exists.
A common feedback message is that "No instance(s) Available" if the service queried is not running.
A common error message is "Node - (provided IP or default) ERROR Description =The RPC server is unavailable" if the provided remote host is unreachable


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "service"
  },
  "filter_main_win32_methods": {
    "CommandLine|contains": [
      "Change",
      "Create",
      "Delete",
      "PauseService",
      "ResumeService",
      "SetSecurityDescriptor",
      "StartService",
      "StopService",
      "UserControlService"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
  - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service
Sigma Detection Rule: Lolbin Unregmp2.exe Use As Proxy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-29
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\unregmp2.exe"
    },
    {
      "OriginalFileName": "unregmp2.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|windash": " /HideWMP"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/
Sigma Detection Rule: Use of W32tm as Timer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-09-25
ATT&CK techniques: T1124
Log source: windows/process_creation

Description:
When configured with suitable command line arguments, w32tm can act as a delay mechanism

Detection logic:
{
  "selection_w32tm": [
    {
      "Image|endswith": "\\w32tm.exe"
    },
    {
      "OriginalFileName": "w32time.dll"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|all": [
      "/stripchart",
      "/computer:",
      "/period:",
      "/dataonly",
      "/samples:"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md
  - https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains
Sigma Detection Rule: Portable Gpg.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-06
ATT&CK techniques: T1486
Log source: windows/process_creation

Description:
Detects the execution of "gpg.exe" from uncommon location. Often used by ransomware and loaders to decrypt/encrypt data.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\gpg.exe",
        "\\gpg2.exe"
      ]
    },
    {
      "OriginalFileName": "gpg.exe"
    },
    {
      "Description": "GnuPG\u2019s OpenPGP tool"
    }
  ],
  "filter_main_legit_location": {
    "Image|contains": [
      ":\\Program Files (x86)\\GNU\\GnuPG\\bin\\",
      ":\\Program Files (x86)\\GnuPG VS-Desktop\\",
      ":\\Program Files (x86)\\GnuPG\\bin\\",
      ":\\Program Files (x86)\\Gpg4win\\bin\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a
  - https://securelist.com/locked-out/68960/
  - https://github.com/redcanaryco/atomic-red-team/blob/c4097dc7ed14d7f7d08c89d148c4307097e8c294/atomics/T1486/T1486.md
Sigma Detection Rule: Suspicious Process Parents
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-21
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects suspicious parent processes that should not have any children or should only have a single possible child program

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\minesweeper.exe",
      "\\winver.exe",
      "\\bitsadmin.exe"
    ]
  },
  "selection_special": {
    "ParentImage|endswith": [
      "\\csrss.exe",
      "\\certutil.exe",
      "\\eventvwr.exe",
      "\\calc.exe",
      "\\notepad.exe"
    ]
  },
  "filter_special": {
    "Image|endswith": [
      "\\WerFault.exe",
      "\\wermgr.exe",
      "\\conhost.exe",
      "\\mmc.exe",
      "\\win32calc.exe",
      "\\notepad.exe"
    ]
  },
  "filter_null": {
    "Image": null
  },
  "condition": "selection or ( selection_special and not 1 of filter_* )"
}

References:
  - https://twitter.com/x86matthew/status/[PII_REDACTED]64607744?s=12
  - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b
Sigma Detection Rule: NodeJS Execution of JavaScript File
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-21
ATT&CK techniques: T1059.007
Log source: windows/process_creation

Description:
Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\node.exe"
    },
    {
      "OriginalFileName": "node.exe"
    },
    {
      "Product": "Node.js"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains": ".js"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/
Sigma Detection Rule: DeviceCredentialDeployment Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of DeviceCredentialDeployment to hide a process from view.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\DeviceCredentialDeployment.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/147