deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Kubernetes Rolebinding Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: kelnage
Date: 2024-07-11
Log source: kubernetes/

Description:
Detects when a Kubernetes Rolebinding is created or modified.


Detection logic:
{
  "selection": {
    "objectRef.apiGroup": "rbac.authorization.k8s.io",
    "objectRef.resource": [
      "clusterrolebindings",
      "rolebindings"
    ],
    "verb": [
      "create",
      "delete",
      "patch",
      "replace",
      "update"
    ]
  },
  "condition": "selection"
}

References:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://medium.com/@seifeddinerajhi/kubernetes-rbac-privilege-escalation-exploits-and-mitigations-26c07629eeab
Sigma Detection Rule: Kubernetes Secrets Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: kelnage
Date: 2024-07-11
Log source: kubernetes/

Description:
Detects when Kubernetes Secrets are Modified or Deleted.


Detection logic:
{
  "selection": {
    "objectRef.resource": "secrets",
    "verb": [
      "create",
      "delete",
      "patch",
      "replace",
      "update"
    ]
  },
  "condition": "selection"
}

References:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://commandk.dev/blog/guide-to-audit-k8s-secrets-for-compliance/
Sigma Detection Rule: Kubernetes Secrets Enumeration
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1552.007
Log source: kubernetes/application

Description:
Detects enumeration of Kubernetes secrets.

Detection logic:
{
  "selection": {
    "verb": "list",
    "objectRef.resource": "secrets"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
Sigma Detection Rule: New Kubernetes Service Account Created
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1136
Log source: kubernetes/application

Description:
Detects creation of new Kubernetes service account, which could indicate an attacker's attempt to persist within a cluster.


Detection logic:
{
  "selection": {
    "verb": "create",
    "objectRef.resource": "serviceaccounts"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
Sigma Detection Rule: Kubernetes Admission Controller Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: kelnage
Date: 2024-07-11
ATT&CK techniques: T1078, T1552, T1552.007
Log source: kubernetes/

Description:
Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.


Detection logic:
{
  "selection": {
    "objectRef.apiGroup": "admissionregistration.k8s.io",
    "objectRef.resource": [
      "mutatingwebhookconfigurations",
      "validatingwebhookconfigurations"
    ],
    "verb": [
      "create",
      "delete",
      "patch",
      "replace",
      "update"
    ]
  },
  "condition": "selection"
}

References:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://security.padok.fr/en/blog/kubernetes-webhook-attackers
Sigma Detection Rule: Privileged Container Deployed
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1611
Log source: kubernetes/application

Description:
Detects the creation of a "privileged" container, an action which could be indicative of a threat actor mounting a container breakout attacks.
A privileged container is a container that can access the host with all of the root capabilities of the host machine. This allows it to view, interact and modify processes, network operations, IPC calls, the file system, mount points, SELinux configurations etc. as the root user on the host.
Various versions of "privileged" containers can be specified, e.g. by setting the securityContext.privileged flag in the resource specification, setting non-standard Linux capabilities, or configuring the hostNetwork/hostPID fields


Detection logic:
{
  "selection": {
    "verb": "create",
    "objectRef.resource": "pods",
    "capabilities": "*"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
  - https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer
  - https://www.elastic.co/guide/en/security/current/kubernetes-pod-created-with-hostnetwork.html
  - https://www.elastic.co/guide/en/security/current/kubernetes-container-created-with-excessive-linux-capabilities.html
Sigma Detection Rule: Potential Sidecar Injection Into Running Deployment
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1609
Log source: kubernetes/application

Description:
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.


Detection logic:
{
  "selection": {
    "verb": "patch",
    "apiGroup": "apps",
    "objectRef.resource": "deployments"
  },
  "condition": "selection"
}

References:
  - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
Sigma Detection Rule: Kubernetes Potential Enumeration Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: uniqu3-us3r
Date: 2026-04-28
ATT&CK techniques: T1609, T1613
Log source: kubernetes/

Description:
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.


Detection logic:
{
  "selection_status": {
    "responseStatus.code": "ALLOW"
  },
  "selection_request_uri": {
    "requestURI|contains": [
      "%2fbin%2fash",
      "%2fbin%2fbash",
      "%2fbin%2fbusybox",
      "%2fbin%2fdash",
      "%2fbin%2fsh",
      "%2fbin%2fzsh",
      "/bin/ash",
      "/bin/bash",
      "/bin/busybox",
      "/bin/dash",
      "/bin/sh",
      "/bin/zsh",
      "%2fusr%2fbin%2fcurl",
      "%2fusr%2fbin%2fkubectl",
      "%2fusr%2fbin%2fperl",
      "%2fusr%2fbin%2fpython",
      "%2fusr%2fbin%2fwget",
      "/usr/bin/curl",
      "/usr/bin/kubectl",
      "/usr/bin/perl",
      "/usr/bin/python",
      "/usr/bin/wget"
    ]
  },
  "selection_request_user_agent": {
    "userAgent|contains": [
      "access_matrix",
      "trufflehog",
      "azurehound",
      "micro-scanner"
    ]
  },
  "condition": "selection_status and 1 of selection_request_*"
}

References:
  - https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/
  - https://github.com/trufflesecurity/trufflehog
  - https://github.com/corneliusweig/rakkess
Sigma Detection Rule: Potential Remote Command Execution In Pod Container
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1609
Log source: kubernetes/application

Description:
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.


Detection logic:
{
  "selection": {
    "verb": "create",
    "objectRef.resource": "pods",
    "objectRef.subresource": "exec"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
Sigma Detection Rule: Kubernetes CronJob/Job Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: kelnage
Date: 2024-07-11
Log source: kubernetes/

Description:
Detects when a Kubernetes CronJob or Job is created or modified.
A Kubernetes Job creates one or more pods to accomplish a specific task, and a CronJob creates Jobs on a recurring schedule.
An adversary can take advantage of this Kubernetes object to schedule Jobs to run containers that execute malicious code within a cluster, allowing them to achieve persistence.


Detection logic:
{
  "selection": {
    "objectRef.apiGroup": "batch",
    "objectRef.resource": [
      "cronjobs",
      "jobs"
    ],
    "verb": [
      "create",
      "delete",
      "patch",
      "replace",
      "update"
    ]
  },
  "condition": "selection"
}

References:
  - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
  - https://www.redhat.com/en/blog/protecting-kubernetes-against-mitre-attck-persistence#technique-33-kubernetes-cronjob
Sigma Detection Rule: Kubernetes Events Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1070
Log source: kubernetes/application

Description:
Detects when events are deleted in Kubernetes.
An adversary may delete Kubernetes events in an attempt to evade detection.


Detection logic:
{
  "selection": {
    "verb": "delete",
    "objectRef.resource": "events"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
Sigma Detection Rule: Creation Of Pod In System Namespace
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Leo Tsaousis (@laripping)
Date: 2024-03-26
ATT&CK techniques: T1036.005
Log source: kubernetes/application

Description:
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.


Detection logic:
{
  "selection": {
    "verb": "create",
    "objectRef.resource": "pods",
    "objectRef.namespace": "kube-system"
  },
  "condition": "selection"
}

References:
  - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/
Sigma Detection Rule: Potential Server Side Template Injection In Velocity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: velocity/application

Description:
Detects exceptions in velocity template renderer, this most likely happens due to dynamic rendering of user input and may lead to RCE.

Detection logic:
{
  "keywords": [
    "ParseErrorException",
    "VelocityException",
    "TemplateInitException"
  ],
  "condition": "keywords"
}

References:
  - https://antgarsil.github.io/posts/velocity/
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: Ruby on Rails Framework Exceptions
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Thomas Patzke
Date: 2017-08-06
ATT&CK techniques: T1190
Log source: ruby_on_rails/application

Description:
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts

Detection logic:
{
  "keywords": [
    "ActionController::InvalidAuthenticityToken",
    "ActionController::InvalidCrossOriginRequest",
    "ActionController::MethodNotAllowed",
    "ActionController::BadRequest",
    "ActionController::ParameterMissing"
  ],
  "condition": "keywords"
}

References:
  - http://edgeguides.rubyonrails.org/security.html
  - http://guides.rubyonrails.org/action_controller_overview.html
  - https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception
  - https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb
Sigma Detection Rule: Spring Framework Exceptions
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Thomas Patzke
Date: 2017-08-06
ATT&CK techniques: T1190
Log source: spring/application

Description:
Detects suspicious Spring framework exceptions that could indicate exploitation attempts

Detection logic:
{
  "keywords": [
    "AccessDeniedException",
    "CsrfException",
    "InvalidCsrfTokenException",
    "MissingCsrfTokenException",
    "CookieTheftException",
    "InvalidCookieException",
    "RequestRejectedException"
  ],
  "condition": "keywords"
}

References:
  - https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html
Sigma Detection Rule: Potential SpEL Injection In Spring Framework
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Moti Harmats
Date: 2023-02-11
ATT&CK techniques: T1190
Log source: spring/application

Description:
Detects potential SpEL Injection exploitation, which may lead to RCE.

Detection logic:
{
  "keywords": [
    "org.springframework.expression.ExpressionException"
  ],
  "condition": "keywords"
}

References:
  - https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
Sigma Detection Rule: Django Framework Exceptions
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Thomas Patzke
Date: 2017-08-05
ATT&CK techniques: T1190
Log source: django/application

Description:
Detects suspicious Django web application framework exceptions that could indicate exploitation attempts

Detection logic:
{
  "keywords": [
    "SuspiciousOperation",
    "DisallowedHost",
    "DisallowedModelAdminLookup",
    "DisallowedModelAdminToField",
    "DisallowedRedirect",
    "InvalidSessionKey",
    "RequestDataTooBig",
    "SuspiciousFileOperation",
    "SuspiciousMultipartForm",
    "SuspiciousSession",
    "TooManyFieldsSent",
    "PermissionDenied"
  ],
  "condition": "keywords"
}

References:
  - https://docs.djangoproject.com/en/1.11/ref/exceptions/
  - https://docs.djangoproject.com/en/1.11/topics/logging/#django-security
Sigma Detection Rule: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1006
Log source: windows/raw_access_thread

Description:
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts

Detection logic:
{
  "filter_main_floppy": {
    "Device|contains": "floppy"
  },
  "filter_main_generic": {
    "Image|startswith": [
      "C:\\$WINDOWS.~BT\\",
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\Windows\\CCM\\",
      "C:\\Windows\\explorer.exe",
      "C:\\Windows\\servicing\\",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SystemApps\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\uus\\",
      "C:\\Windows\\WinSxS\\"
    ]
  },
  "filter_main_system_images": {
    "Image": [
      "Registry",
      "System"
    ]
  },
  "filter_main_windefender": {
    "Image|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "Image|endswith": [
      "\\MsMpEng.exe",
      "\\MpDefenderCoreService.exe"
    ]
  },
  "filter_main_microsoft_appdata": {
    "Image|startswith": "C:\\Users\\",
    "Image|contains|all": [
      "\\AppData\\",
      "\\Microsoft\\"
    ]
  },
  "filter_main_ssd_nvme": {
    "Image|startswith": "C:\\Windows\\Temp\\",
    "Image|endswith": [
      "\\Executables\\SSDUpdate.exe",
      "\\HostMetadata\\NVMEHostmetadata.exe"
    ]
  },
  "filter_main_null": {
    "Image": null
  },
  "filter_main_systemsettings": {
    "Image": "C:\\Windows\\ImmersiveControlPanel\\SystemSettings.exe"
  },
  "filter_main_update": {
    "Image|startswith": "C:\\$WinREAgent\\Scratch\\"
  },
  "filter_optional_github_desktop": {
    "Image|startswith": "C:\\Users\\",
    "Imag

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: Potential Suspicious Winget Package Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-18
Log source: windows/create_stream_hash

Description:
Detects potential suspicious winget package installation from a suspicious source.

Detection logic:
{
  "selection": {
    "Contents|startswith": "[ZoneTransfer]  ZoneId=3",
    "Contents|contains": [
      "://1",
      "://2",
      "://3",
      "://4",
      "://5",
      "://6",
      "://7",
      "://8",
      "://9"
    ],
    "TargetFilename|endswith": ":Zone.Identifier",
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\WinGet\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget
Sigma Detection Rule: Unusual File Download from Direct IP Address
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-09-07
ATT&CK techniques: T1564.004
Log source: windows/create_stream_hash

Description:
Detects the download of suspicious file type from URLs with IP

Detection logic:
{
  "selection": {
    "Contents|re": "http[s]?://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
    "TargetFilename|contains": [
      ".ps1:Zone",
      ".bat:Zone",
      ".exe:Zone",
      ".vbe:Zone",
      ".vbs:Zone",
      ".dll:Zone",
      ".one:Zone",
      ".cmd:Zone",
      ".hta:Zone",
      ".xll:Zone",
      ".lnk:Zone"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md
  - https://labs.withsecure.com/publications/detecting-onenote-abuse
Sigma Detection Rule: HackTool Named File Stream Created
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1564.004
Log source: windows/create_stream_hash

Description:
Detects the creation of a named file stream with the imphash of a well-known hack tool

Detection logic:
{
  "selection": {
    "Hash|contains": [
      "IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932",
      "IMPHASH=3A19059BD7688CB88E70005F18EFC439",
      "IMPHASH=bf6223a49e45d[PII_REDACTED]7eb6004ba",
      "IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6",
      "IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3",
      "IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF",
      "IMPHASH=4C1B52A19748428E51B14C278D0F58E3",
      "IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F",
      "IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A",
      "IMPHASH=672B13F4A0B6F27D29065123FE882DFC",
      "IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F",
      "IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D",
      "IMPHASH=9528A0E91E28FBB88AD433FEABCA2456",
      "IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3",
      "IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88",
      "IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4",
      "IMPHASH=D21BBC50DCC169D7B4D0F[PII_REDACTED]4",
      "IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6",
      "IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1",
      "IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC",
      "IMPHASH=F9A28C458284584A93B14216308D31BD",
      "IMPHASH=[PII_REDACTED]FC175BC7EBECFF0769B46E",
      "IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA",
      "IMPHASH=563233BFA169ACC7892451F71AD5850A",
      "IMPHASH=87575CB7A0E0700EB37F2E3668671A08",
      "IMPHASH=13F08707F759AF6003837A150A371BA1",
      "IMPHASH=1781F06048A7E58B323F0B9259BE798B",
      "IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5",
      "IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D",
      "I

References:
  - https://github.com/gentilkiwi/mimikatz
  - https://github.com/topotam/PetitPotam
  - https://github.com/ohpe/juicy-potato
  - https://github.com/antonioCoco/RoguePotato
  - https://www.tarasco.org/security/pwdump_7/
Sigma Detection Rule: Hidden Executable In NTFS Alternate Data Stream
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), @0xrawsec
Date: 2018-06-03
ATT&CK techniques: T1564.004
Log source: windows/create_stream_hash

Description:
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

Detection logic:
{
  "selection": {
    "Hash|contains": "IMPHASH="
  },
  "filter_main_null": {
    "Hash|contains": "IMPHASH=[PII_REDACTED][PII_REDACTED][PII_REDACTED]00"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/0xrawsec/status/[PII_REDACTED]05273600?s=21
Sigma Detection Rule: Unusual File Download From File Sharing Websites - File Stream
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-24
ATT&CK techniques: T1564.004
Log source: windows/create_stream_hash

Description:
Detects the download of suspicious file type from a well-known file and paste sharing domain

Detection logic:
{
  "selection_domain": {
    "Contents|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "selection_extension": {
    "TargetFilename|contains": [
      ".bat:Zone",
      ".cmd:Zone",
      ".ps1:Zone"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
  - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/