deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-23
Log source: windows/process_creation

Description:
Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

Detection logic:
{
  "selection": {
    "OriginalFileName": [
      "Cmd.Exe",
      "powershell_ise.EXE",
      "powershell.exe"
    ],
    "Image|endswith": "\\wermgr.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/Wh04m1001/CVE-2023-36874
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
Sigma Detection Rule: CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)
Date: 2023-11-28
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs.

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-stem|contains": "/oauth/idp/.well-known/openid-configuration",
    "sc-status": 200
  },
  "condition": "selection"
}

References:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
Sigma Detection Rule: CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Webserver
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-28
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via webserver logs by looking for a very long host header string.

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-stem|contains": "/oauth/idp/.well-known/openid-configuration",
    "cs-host|re": ".{150}"
  },
  "condition": "selection"
}

References:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
Sigma Detection Rule: CVE-2023-4966 Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-28
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs by looking for a very long host header string.

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri|contains": "/oauth/idp/.well-known/openid-configuration",
    "cs-host|re": ".{150}"
  },
  "condition": "selection"
}

References:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
Sigma Detection Rule: CVE-2023-4966 Potential Exploitation Attempt - Citrix ADC Sensitive Information Disclosure - Proxy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Michael Haag (STRT)
Date: 2023-11-28
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects potential exploitation attempt of CVE-2023-4966 a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability via proxy logs.

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri|contains": "/oauth/idp/.well-known/openid-configuration",
    "sc-status": 200
  },
  "condition": "selection"
}

References:
  - https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
  - https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
  - https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
  - https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
  - https://github.com/assetnote/exploits/tree/main/citrix/CVE-2023-4966
Sigma Detection Rule: Potential CVE-2023-36884 Exploitation Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: X__Junior
Date: 2023-07-12
Log source: /proxy

Description:
Detects a unique pattern seen being used by RomCom potentially exploiting CVE-2023-36884

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "c-uri|contains": "/MSHTML_C7/",
    "c-uri|re": "\\?d=[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: Potential CVE-2023-36884 Exploitation - Share Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-13
Log source: windows/

Description:
Detects access to a file share with a naming schema seen being used during exploitation of CVE-2023-36884

Detection logic:
{
  "selection_eid": {
    "EventID": 5140
  },
  "selection_share_name": {
    "ShareName|contains": "\\MSHTML_C7\\",
    "ShareName|re": "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "selection_share_path": {
    "ShareLocalPath|contains": "\\MSHTML_C7\\",
    "ShareLocalPath|re": "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "condition": "selection_eid and 1 of selection_share_*"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: Potential CVE-2303-36884 URL Request Pattern Traffic
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior
Date: 2023-07-12
Log source: /proxy

Description:
Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "c-uri|re": "\\.(zip|asp|htm|url|xml|chm|mht|vbs|search-ms)\\?d=[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: Potential CVE-2023-36884 Exploitation - File Downloads
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior
Date: 2023-07-12
Log source: /proxy

Description:
Detects files seen being requested by RomCom while potentially exploiting CVE-2023-36884

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "c-uri|contains": [
      "/ex001.url",
      "/file001.search-ms",
      "/file001.url",
      "/file001.vbs",
      "/file1.mht",
      "/o2010.asp",
      "/redir_obj.html",
      "/RFile.asp",
      "/zip_k.asp",
      "/zip_k2.asp",
      "/zip_k3.asp"
    ]
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: Potential CVE-2023-36884 Exploitation Dropped File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2023-07-13
Log source: windows/file_event

Description:
Detects a specific file being created in the recent folder of Office. These files have been seen being dropped during potential exploitations of CVE-2023-36884

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\Office\\Recent\\",
    "TargetFilename|endswith": "\\file001.url"
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
  - https://twitter.com/wdormann/status/[PII_REDACTED]77130755
  - https://twitter.com/r00tbsd/status/[PII_REDACTED]77338114/photo/1
Sigma Detection Rule: Potential CVE-2023-36884 Exploitation - URL Marker
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior
Date: 2023-07-12
Log source: /proxy

Description:
Detects a unique URL marker seen being used by RomCom potentially exploiting CVE-2023-36884

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "c-uri|contains": "/MSHTML_C7/"
  },
  "condition": "selection"
}

References:
  - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit
Sigma Detection Rule: CVE-2023-46747 Exploitation Activity - Webserver
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-08
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-stem|contains": "/mgmt/tm/util/bash"
  },
  "keywords_hex": {
    "|all": [
      "2f746d75692f436f6e74726f6c2f666f726d",
      "666f726d5f706167653d253266746d[PII_REDACTED][PII_REDACTED]6d[PII_REDACTED][PII_REDACTED][PII_REDACTED]652e6a7370"
    ]
  },
  "keywords_plain": {
    "|all": [
      "/tmui/Control/form",
      "form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp"
    ]
  },
  "condition": "selection and (keywords_hex or keywords_plain)"
}

References:
  - https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
  - https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
  - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
  - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
Sigma Detection Rule: CVE-2023-46747 Exploitation Activity - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-08
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects exploitation activity of CVE-2023-46747 an unauthenticated remote code execution vulnerability in F5 BIG-IP.

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "c-uri|contains": "/mgmt/tm/util/bash"
  },
  "keywords_hex": {
    "|all": [
      "2f746d75692f436f6e74726f6c2f666f726d",
      "666f726d5f706167653d253266746d[PII_REDACTED][PII_REDACTED]6d[PII_REDACTED][PII_REDACTED][PII_REDACTED]652e6a7370"
    ]
  },
  "keywords_plain": {
    "|all": [
      "/tmui/Control/form",
      "form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp"
    ]
  },
  "condition": "selection and (keywords_hex or keywords_plain)"
}

References:
  - https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
  - https://github.com/0xorOne/nuclei-templates/blob/2fef4270ec6e5573d0a1732cb18bcfc4b1580a88/http/cves/2023/CVE-2023-46747.yaml
  - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
  - https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/
Sigma Detection Rule: Potential CVE-2023-23752 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2023-02-23
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the potential exploitation attempt of CVE-2023-23752 an Improper access check, in web service endpoints in Joomla

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "/api/index.php/v1/",
      "public=true"
    ]
  },
  "condition": "selection"
}

References:
  - https://xz.aliyun.com/t/12175
  - https://twitter.com/momika233/status/[PII_REDACTED]61942786
Sigma Detection Rule: Okta 2023 Breach Indicator Of Compromise
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf)
Date: 2023-10-25
Log source: okta/

Description:
Detects new user account creation or activation with specific names related to the Okta Support System 2023 breach.
This rule can be enhanced by filtering out known and legitimate username used in your environnement.


Detection logic:
{
  "selection": {
    "eventType": [
      "user.lifecycle.create",
      "user.lifecycle.activate"
    ],
    "target.displayName|contains": "svc_network_backup"
  },
  "condition": "selection"
}

References:
  - https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
  - https://developer.okta.com/docs/reference/api/event-types/
Sigma Detection Rule: Potential APT FIN7 Reconnaissance/POWERTRASH Related Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/process_creation

Description:
Detects specific command line execution used by FIN7 as reported by WithSecureLabs for reconnaissance and POWERTRASH execution

Detection logic:
{
  "selection_1": {
    "CommandLine|contains|all": [
      "-noni -nop -exe bypass -f \\\\\\\\",
      "ADMIN$"
    ]
  },
  "selection_2": {
    "CommandLine|contains|all": [
      "-ex bypass -noprof -nolog -nonint -f",
      "C:\\Windows\\Temp\\"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers/jcr:content/root/responsivegrid/responsivegrid/responsivegrid/image_253944286.img.png/[PII_REDACTED]00.png
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
Sigma Detection Rule: Potential APT FIN7 Related PowerShell Script Created
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/file_event

Description:
Detects PowerShell script file creation with specific name or suffix which was seen being used often by FIN7 PowerShell scripts

Detection logic:
{
  "selection": [
    {
      "TargetFilename|endswith": "_64refl.ps1"
    },
    {
      "TargetFilename": "host_ip.ps1"
    }
  ],
  "condition": "selection"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Potential POWERTRASH Script Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects potential execution of the PowerShell script POWERTRASH

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "IO.Compression.DeflateStream",
      "IO.MemoryStream",
      "::FromBase64String",
      "GetDelegateForFunctionPointer",
      ".Invoke()",
      "GlobalAssemblyCache"
    ]
  },
  "condition": "selection"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Potential APT FIN7 POWERHOLD Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "$env:APPDATA",
      "function MainPayload",
      "::WriteAllBytes",
      "wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Potential Compromised 3CXDesktopApp Beaconing Activity - DNS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-29
Log source: windows/dns_query

Description:
Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Detection logic:
{
  "selection": {
    "QueryName|contains": [
      "akamaicontainer.com",
      "akamaitechcloudservices.com",
      "azuredeploystore.com",
      "azureonlinecloud.com",
      "azureonlinestorage.com",
      "dunamistrd.com",
      "glcloudservice.com",
      "journalide.org",
      "msedgepackageinfo.com",
      "msedgeupdate.net",
      "msstorageazure.com",
      "msstorageboxes.com",
      "officeaddons.com",
      "officestoragebox.com",
      "pbxcloudeservices.com",
      "pbxphonenetwork.com",
      "pbxsources.com",
      "qwepoi123098.com",
      "sbmsa.wiki",
      "sourceslabs.com",
      "visualstudiofactory.com",
      "zacharryblogs.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
Sigma Detection Rule: Potential Compromised 3CXDesktopApp Update Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-29
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software

Detection logic:
{
  "selection": {
    "Image|endswith": "\\3CXDesktopApp\\app\\update.exe",
    "CommandLine|contains|all": [
      "--update",
      "http",
      "/electron/update/win32/18.12"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.linkedin.com/feed/update/urn:li:activity:[PII_REDACTED]834198529/
  - https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats
Sigma Detection Rule: Potential Compromised 3CXDesktopApp Beaconing Activity - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-29
Log source: /proxy

Description:
Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Detection logic:
{
  "selection": {
    "cs-host|contains": [
      "akamaicontainer.com",
      "akamaitechcloudservices.com",
      "azuredeploystore.com",
      "azureonlinecloud.com",
      "azureonlinestorage.com",
      "dunamistrd.com",
      "glcloudservice.com",
      "journalide.org",
      "msedgepackageinfo.com",
      "msstorageazure.com",
      "msstorageboxes.com",
      "officeaddons.com",
      "officestoragebox.com",
      "pbxcloudeservices.com",
      "pbxphonenetwork.com",
      "pbxsources.com",
      "qwepoi123098.com",
      "sbmsa.wiki",
      "sourceslabs.com",
      "visualstudiofactory.com",
      "zacharryblogs.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
Sigma Detection Rule: Potential Compromised 3CXDesktopApp Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-29
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of known compromised version of 3CXDesktopApp

Detection logic:
{
  "selection_hashes": {
    "Hashes|contains": [
      "SHA256=DDE[PII_REDACTED][PII_REDACTED]DFEA5560C20A3D2A2EAC95C894E7BBED5E85A0ACC",
      "SHA256=54004DFAA48CA5FA91E3304FB99559A2395301C[PII_REDACTED]82D6AAD89132A02",
      "SHA256=D45674F941BE3CCA2FBC1AF42778043CC18CD86D95A2ECB9E6F0E212ED4C74AE",
      "SHA1=480DC408EF50BE69EBCF84B95750F7E93A8A1859",
      "SHA1=3B43A5D8B83C637D00D769660D01333E88F5A187",
      "SHA1=6285FFB5F98D35CD98E78D48B63A05AF6E4E4DEA",
      "MD5=BB915073385DD16A846DFA318AFA3C19",
      "MD5=08D79E1FFFA244CC0DC61F7D2036ACA9",
      "MD5=4965EDF659753E3C05D800C6C8A23A7A",
      "SHA256=FAD482DED2E25CE9E1DD3D3ECC3227AF714BDFBBDE04347DBC1B21D6A3670405",
      "SHA256=5D99EFA36F34AA6B43CD81E77544961C5C8D692C96059FEF92C2DF[PII_REDACTED]",
      "SHA256=A60A61BF844BC181D4540C9FAC53203250A982E7C3AD6153869F01E19CC36203",
      "SHA1=E272715737B51C01DC2BED0F0AEE2BF6FEEF25F1",
      "SHA1=8433A94AEDB6380AC8D4610AF643FB0E5220C5CB",
      "SHA1=413D9CBFCBF8D1E8304EAB0AA5484F5EEC5185F5",
      "MD5=9833A4779B69B38E3E51F04E395674C6",
      "MD5=704DB[PII_REDACTED]A56E5100FB56496CE",
      "MD5=8EE6802F085F7A9DF7E0303E65722DC0",
      "SHA256=AA124A4B4DF12B34E74EE7F6C683B2EBEC4CE9A8EDCF9BE345823B4FDCF5D868",
      "SHA256=59E1EDF4D82FAE4978E97512B0331B7EB21DD4B838B850BA46794D9C7A2C0983",
      "SHA1=BEA77D1E59CF18DCE22AD9A2FAD52948FD7A9EFA",
      "SHA1=BFECB8CE89A312D2EF4AFC64A63847AE11C6F69E",
      "MD5=F3D4144860CA10BA60F7EF4D176CC736",
      "MD5=0EEB1C0133EB4D571178B2D9D14C

References:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
Sigma Detection Rule: Malicious DLL Load By Compromised 3CXDesktopApp
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-31
Log source: windows/image_load

Description:
Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp

Detection logic:
{
  "selection": {
    "Hashes|contains": [
      "SHA256=7986BBAEE8940DA11CE089383521AB420C443AB7B15ED42AED91FD31CE833896",
      "SHA1=BF939C9C261D27EE7BB92325CC588624FCA75429",
      "MD5=74BC2D0B6680FAA1A5A76B27E5479CBC",
      "SHA256=11BE1803E2E307B647A8A7E02D128335C448FF741BF06BF52B332E0BBF423B03",
      "SHA1=20D554A80D759C50D6537DD7097FED84DD258B3E",
      "MD5=82187AD3F0C6C225E2FBA0C867280CC9",
      "SHA256=F79C3B0ADB6EC7BCC8BC9AE955A1571AAED6755A28C8B17B1D7595EE86840952",
      "SHA1=894E7D4FFD764BB458809C7F0643694B036EAD30",
      "MD5=11BC82A9BD8297BD0823BCE5D6202082",
      "SHA256=8AB3A5EAAF8C296080FADF56B265194681D7DA5DA7C02562953A4CB60E147423",
      "SHA1=3B3E778B[PII_REDACTED]20A523EB873C20BB82BEAF",
      "MD5=7FAEA2B01796B80D180399040BB69835"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/
Sigma Detection Rule: Potential Suspicious Child Process Of 3CXDesktopApp
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-29
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\3CXDesktopApp.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
  - https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/