deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Deno File Written from Remote Source
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Josh Nickels, Michael Taggart
Date: 2025-05-22
ATT&CK techniques: T1204, T1059.007, T1105
Log source: windows/file_event

Description:
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.


Detection logic:
{
  "selection_path": {
    "TargetFilename|contains": [
      "\\deno\\gen\\",
      "\\deno\\remote\\https\\"
    ],
    "TargetFilename|contains|all": [
      ":\\Users\\",
      "\\AppData\\"
    ]
  },
  "condition": "selection_path"
}

References:
  - https://taggart-tech.com/evildeno/
Sigma Detection Rule: LSASS Process Dump Artefact In CrashDumps Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @pbssubhash
Date: 2022-12-08
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects the presence of an LSASS dump file in the "CrashDumps" folder. This could be a sign of LSASS credential dumping. Techniques such as the LSASS Shtinkering have been seen abusing the Windows Error Reporting to dump said process.

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\CrashDumps\\",
    "TargetFilename|contains": "lsass.exe.",
    "TargetFilename|endswith": ".dmp"
  },
  "condition": "selection"
}

References:
  - https://github.com/deepinstinct/Lsass-Shtinkering
  - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
Sigma Detection Rule: PSScriptPolicyTest Creation By Uncommon Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-01
Log source: windows/file_event

Description:
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "__PSScriptPolicyTest_"
  },
  "filter_main_powershell": {
    "Image": [
      "C:\\Program Files\\PowerShell\\7-preview\\pwsh.exe",
      "C:\\Program Files\\PowerShell\\7\\pwsh.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell_ise.exe",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe"
    ]
  },
  "filter_main_pwsh_preview": {
    "Image|contains": [
      "C:\\Program Files\\WindowsApps\\Microsoft.PowerShellPreview",
      "\\AppData\\Local\\Microsoft\\WindowsApps\\Microsoft.PowerShellPreview"
    ],
    "Image|endswith": "\\pwsh.exe"
  },
  "filter_main_generic": {
    "Image": [
      "C:\\Windows\\System32\\dsac.exe",
      "C:\\Windows\\System32\\sdiagnhost.exe",
      "C:\\Windows\\System32\\ServerManager.exe",
      "C:\\Windows\\System32\\wsmprovhost.exe",
      "C:\\Windows\\SysWOW64\\sdiagnhost.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
Sigma Detection Rule: Advanced IP Scanner - File Event
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @ROxPinTeddy
Date: 2020-05-12
ATT&CK techniques: T1046
Log source: windows/file_event

Description:
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\Advanced IP Scanner 2"
  },
  "condition": "selection"
}

References:
  - https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/
  - https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
  - https://labs.f-secure.com/blog/prelude-to-ransomware-systembc
  - https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf
  - https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer
Sigma Detection Rule: AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1216
Log source: windows/file_event

Description:
Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)

Detection logic:
{
  "system_files": {
    "TargetFilename|endswith": [
      "WsmPty.xsl",
      "WsmTxt.xsl"
    ]
  },
  "in_system_folder": {
    "TargetFilename|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "system_files and not in_system_folder"
}

References:
  - https://posts.specterops.io/application-whitelisting-bypass-and-arbitrary-unsigned-code-execution-technique-in-winrm-vbs-c8c24fb40404
Sigma Detection Rule: Potential Persistence Via Microsoft Office Add-In
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: NVISO
Date: 2020-05-11
ATT&CK techniques: T1137.006
Log source: windows/file_event

Description:
Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel).

Detection logic:
{
  "selection_wlldropped": {
    "TargetFilename|contains": "\\Microsoft\\Word\\Startup\\",
    "TargetFilename|endswith": ".wll"
  },
  "selection_xlldropped": {
    "TargetFilename|contains": "\\Microsoft\\Excel\\Startup\\",
    "TargetFilename|endswith": ".xll"
  },
  "selection_xladropped": {
    "TargetFilename|contains": "Microsoft\\Excel\\XLSTART\\",
    "TargetFilename|endswith": ".xlam"
  },
  "selection_generic": {
    "TargetFilename|contains": "\\Microsoft\\Addins\\",
    "TargetFilename|endswith": [
      ".xlam",
      ".xla",
      ".ppam"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - Internal Research
  - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence
  - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md
Sigma Detection Rule: Legitimate Application Dropped Archive
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth
Date: 2022-08-21
ATT&CK techniques: T1218
Log source: windows/file_event

Description:
Detects programs on a Windows system that should not write an archive to disk

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\winword.exe",
      "\\excel.exe",
      "\\powerpnt.exe",
      "\\msaccess.exe",
      "\\mspub.exe",
      "\\eqnedt32.exe",
      "\\visio.exe",
      "\\wordpad.exe",
      "\\wordview.exe",
      "\\certutil.exe",
      "\\certoc.exe",
      "\\CertReq.exe",
      "\\Desktopimgdownldr.exe",
      "\\esentutl.exe",
      "\\finger.exe",
      "\\notepad.exe",
      "\\AcroRd32.exe",
      "\\RdrCEF.exe",
      "\\mshta.exe",
      "\\hh.exe"
    ],
    "TargetFilename|endswith": [
      ".zip",
      ".rar",
      ".7z",
      ".diagcab",
      ".appx"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
Sigma Detection Rule: Potential RipZip Attack on Startup Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Greg (rule)
Date: 2022-07-21
ATT&CK techniques: T1547
Log source: windows/file_event

Description:
Detects a phishing attack which expands a ZIP file containing a malicious shortcut.
If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder.
Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.


Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup",
      ".lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D}"
    ],
    "Image|endswith": "\\explorer.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/jonasLyk/status/[PII_REDACTED]43534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19
Sigma Detection Rule: Windows Binaries Write Suspicious Extensions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1036
Log source: windows/file_event

Description:
Detects Windows executables that write files with suspicious extensions

Detection logic:
{
  "selection_generic": {
    "Image|endswith": [
      "\\csrss.exe",
      "\\lsass.exe",
      "\\RuntimeBroker.exe",
      "\\sihost.exe",
      "\\smss.exe",
      "\\wininit.exe",
      "\\winlogon.exe"
    ],
    "TargetFilename|endswith": [
      ".bat",
      ".dll",
      ".exe",
      ".hta",
      ".iso",
      ".ps1",
      ".txt",
      ".vbe",
      ".vbs"
    ]
  },
  "selection_special": {
    "Image|endswith": [
      "\\dllhost.exe",
      "\\rundll32.exe",
      "\\svchost.exe"
    ],
    "TargetFilename|endswith": [
      ".bat",
      ".hta",
      ".iso",
      ".ps1",
      ".vbe",
      ".vbs"
    ]
  },
  "filter_main_AppLockerPolicyTest": {
    "Image": "C:\\Windows\\System32\\dllhost.exe",
    "TargetFilename|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\Temp\\__PSScriptPolicyTest_"
    ],
    "TargetFilename|endswith": ".ps1"
  },
  "filter_main_script_gpo_machine": {
    "Image": "C:\\Windows\\system32\\svchost.exe",
    "TargetFilename|contains|all": [
      "C:\\Windows\\System32\\GroupPolicy\\DataStore\\",
      "\\sysvol\\",
      "\\Policies\\",
      "\\Machine\\Scripts\\Startup\\"
    ],
    "TargetFilename|endswith": [
      ".ps1",
      ".bat"
    ]
  },
  "filter_main_clipchamp": {
    "Image": "C:\\Windows\\system32\\svchost.exe",
    "TargetFilename|contains|all": [
      "C:\\Program Files\\WindowsApps\\Clipchamp",
      ".ps1"
    ]
  },
  "filter_main_powershell_preview": {
    "Image": [
      "C:\\Windows\\syste

References:
  - Internal Research
Sigma Detection Rule: RemCom Service File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-04
ATT&CK techniques: T1569.002
Log source: windows/file_event

Description:
Detects default RemCom service filename which indicates RemCom service installation and execution

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\RemComSvc.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/kavika13/RemCom/
Sigma Detection Rule: ISO File Created Within Temp Folders
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @sam0x90
Date: 2022-07-30
ATT&CK techniques: T1566.001
Log source: windows/file_event

Description:
Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.

Detection logic:
{
  "selection_1": {
    "TargetFilename|contains|all": [
      "\\AppData\\Local\\Temp\\",
      ".zip\\"
    ],
    "TargetFilename|endswith": ".iso"
  },
  "selection_2": {
    "TargetFilename|contains": "\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Content.Outlook\\",
    "TargetFilename|endswith": ".iso"
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/Sam0x90/status/[PII_REDACTED]74696960
  - https://securityaffairs.co/wordpress/133680/malware/dll-sideloading-spread-qakbot.html
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
Sigma Detection Rule: Cred Dump Tools Dropped Files
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-11-01
ATT&CK techniques: T1003.001, T1003.002, T1003.003, T1003.004, T1003.005
Log source: windows/file_event

Description:
Files with well-known filenames (parts of credential dump software or files produced by them) creation

Detection logic:
{
  "selection": [
    {
      "TargetFilename|contains": [
        "\\fgdump-log",
        "\\kirbi",
        "\\pwdump",
        "\\pwhashes",
        "\\wce_ccache",
        "\\wce_krbtkts"
      ]
    },
    {
      "TargetFilename|endswith": [
        "\\cachedump.exe",
        "\\cachedump64.exe",
        "\\DumpExt.dll",
        "\\DumpSvc.exe",
        "\\Dumpy.exe",
        "\\fgexec.exe",
        "\\lsremora.dll",
        "\\lsremora64.dll",
        "\\NTDS.out",
        "\\procdump.exe",
        "\\procdump64.exe",
        "\\procdump64a.exe",
        "\\pstgdump.exe",
        "\\pwdump.exe",
        "\\SAM.out",
        "\\SECURITY.out",
        "\\servpw.exe",
        "\\servpw64.exe",
        "\\SYSTEM.out",
        "\\test.pwd",
        "\\wceaux.dll"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: CSExec Service File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-04
ATT&CK techniques: T1569.002
Log source: windows/file_event

Description:
Detects default CSExec service filename which indicates CSExec service installation and execution

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\csexecsvc.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/malcomvetter/CSExec
Sigma Detection Rule: File With Uncommon Extension Created By An Office Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1204.002
Log source: windows/file_event

Description:
Detects the creation of files with an executable or script extension by an Office application.

Detection logic:
{
  "selection1": {
    "Image|endswith": [
      "\\excel.exe",
      "\\msaccess.exe",
      "\\mspub.exe",
      "\\powerpnt.exe",
      "\\visio.exe",
      "\\winword.exe"
    ]
  },
  "selection2": {
    "TargetFilename|endswith": [
      ".bat",
      ".cmd",
      ".com",
      ".dll",
      ".exe",
      ".hta",
      ".ocx",
      ".proj",
      ".ps1",
      ".scf",
      ".scr",
      ".sys",
      ".vbe",
      ".vbs",
      ".wsf",
      ".wsh"
    ]
  },
  "filter_main_localassembly": {
    "TargetFilename|contains": "\\AppData\\Local\\assembly\\tmp\\",
    "TargetFilename|endswith": ".dll"
  },
  "filter_optional_webservicecache": {
    "TargetFilename|contains|all": [
      "C:\\Users\\",
      "\\AppData\\Local\\Microsoft\\Office\\",
      "\\WebServiceCache\\AllUsers"
    ],
    "TargetFilename|endswith": ".com"
  },
  "filter_optional_webex": {
    "Image|endswith": "\\winword.exe",
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\webexdelta\\",
    "TargetFilename|endswith": [
      ".dll",
      ".exe"
    ]
  },
  "filter_optional_backstageinappnavcache": {
    "TargetFilename|contains|all": [
      "C:\\Users\\",
      "\\AppData\\Local\\Microsoft\\Office\\",
      "\\BackstageInAppNavCache\\"
    ],
    "TargetFilename|endswith": ".com"
  },
  "condition": "all of selection* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
Sigma Detection Rule: Installation of TeamViewer Desktop
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-28
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
TeamViewer_Desktop.exe is create during install

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "\\TeamViewer_Desktop.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows
Sigma Detection Rule: UAC Bypass Using IDiagnostic Profile - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-03
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the creation of a file by "dllhost.exe" in System32 directory part of "IDiagnosticProfileUAC" UAC bypass technique

Detection logic:
{
  "selection": {
    "Image|endswith": "\\DllHost.exe",
    "TargetFilename|startswith": "C:\\Windows\\System32\\",
    "TargetFilename|endswith": ".dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/Wh04m1001/IDiagnosticProfileUAC
Sigma Detection Rule: Legitimate Application Dropped Script
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-08-21
ATT&CK techniques: T1218
Log source: windows/file_event

Description:
Detects programs on a Windows system that should not write scripts to disk

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\eqnedt32.exe",
      "\\wordpad.exe",
      "\\wordview.exe",
      "\\certutil.exe",
      "\\certoc.exe",
      "\\CertReq.exe",
      "\\Desktopimgdownldr.exe",
      "\\esentutl.exe",
      "\\mshta.exe",
      "\\AcroRd32.exe",
      "\\RdrCEF.exe",
      "\\hh.exe",
      "\\finger.exe"
    ],
    "TargetFilename|endswith": [
      ".ps1",
      ".bat",
      ".vbs",
      ".scf",
      ".wsf",
      ".wsh"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326
Sigma Detection Rule: Suspicious File Created Via OneNote Application
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-09
Log source: windows/file_event

Description:
Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\onenote.exe",
      "\\onenotem.exe",
      "\\onenoteim.exe"
    ],
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\OneNote\\",
    "TargetFilename|endswith": [
      ".bat",
      ".chm",
      ".cmd",
      ".dll",
      ".exe",
      ".hta",
      ".htm",
      ".html",
      ".js",
      ".lnk",
      ".ps1",
      ".vbe",
      ".vbs",
      ".wsf"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
  - https://twitter.com/MaD_c4t/status/[PII_REDACTED]82567424
  - https://labs.withsecure.com/publications/detecting-onenote-abuse
  - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/
Sigma Detection Rule: HackTool - QuarksPwDump Dump File
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-02-10
ATT&CK techniques: T1003.002
Log source: windows/file_event

Description:
Detects a dump file written by QuarksPwDump password dumper

Detection logic:
{
  "selection": {
    "TargetFilename|contains|all": [
      "\\AppData\\Local\\Temp\\SAM-",
      ".dmp"
    ]
  },
  "condition": "selection"
}

References:
  - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/QuarksPWDump.htm
Sigma Detection Rule: LSASS Process Memory Dump Files
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-15
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects creation of files with names used by different memory dumping tools to create a memory dump of the LSASS process memory, which contains user credentials.

Detection logic:
{
  "selection_1": {
    "TargetFilename|endswith": [
      "\\Andrew.dmp",
      "\\Coredump.dmp",
      "\\lsass.dmp",
      "\\lsass.rar",
      "\\lsass.zip",
      "\\NotLSASS.zip",
      "\\PPLBlade.dmp",
      "\\rustive.dmp"
    ]
  },
  "selection_2": {
    "TargetFilename|contains": [
      "\\lsass_2",
      "\\lsassdmp",
      "\\lsassdump"
    ]
  },
  "selection_3": {
    "TargetFilename|contains|all": [
      "\\lsass",
      ".dmp"
    ]
  },
  "selection_4": {
    "TargetFilename|contains": "SQLDmpr",
    "TargetFilename|endswith": ".mdmp"
  },
  "selection_5": {
    "TargetFilename|contains": [
      "\\nanodump",
      "\\proc_"
    ],
    "TargetFilename|endswith": ".dmp"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.google.com/search?q=procdump+lsass
  - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
  - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
  - https://github.com/helpsystems/nanodump
Sigma Detection Rule: Startup Folder File Write
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1547.001
Log source: windows/file_event

Description:
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp"
  },
  "filter_main_update": [
    {
      "Image": [
        "C:\\Windows\\System32\\wuauclt.exe",
        "C:\\Windows\\uus\\ARM64\\wuaucltcore.exe"
      ]
    },
    {
      "TargetFilename|startswith": [
        "C:\\$WINDOWS.~BT\\NewOS\\",
        "C:\\$WinREAgent\\Scratch\\Mount\\"
      ]
    }
  ],
  "filter_optional_onenote": {
    "Image|endswith": "\\ONENOTE.EXE",
    "TargetFilename|endswith": "\\Send to OneNote.lnk"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/12
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/5.B.1_611FCA99-97D0-4873-9E51-1C1BA2DBB40D.md
Sigma Detection Rule: Remote Access Tool - ScreenConnect Temporary File
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Ali Alwashali
Date: 2023-10-10
ATT&CK techniques: T1059.003
Log source: windows/file_event

Description:
Detects the creation of files in a specific location by ScreenConnect RMM.
ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\ScreenConnect.WindowsClient.exe",
    "TargetFilename|contains": "\\Documents\\ConnectWiseControl\\Temp\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/pull/4467