deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious DumpMinitool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-06
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects suspicious ways to use the "DumpMinitool.exe" binary

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\DumpMinitool.exe",
        "\\DumpMinitool.x86.exe",
        "\\DumpMinitool.arm64.exe"
      ]
    },
    {
      "OriginalFileName": [
        "DumpMinitool.exe",
        "DumpMinitool.x86.exe",
        "DumpMinitool.arm64.exe"
      ]
    }
  ],
  "filter_folder": {
    "Image|contains": [
      "\\Microsoft Visual Studio\\",
      "\\Extensions\\"
    ]
  },
  "susp_flags": {
    "CommandLine|contains": ".txt"
  },
  "cmd_has_flags": {
    "CommandLine|contains": [
      " Full",
      " Mini",
      " WithHeap"
    ]
  },
  "filter_cmd_misses_flags": {
    "CommandLine|contains": "--dumpType"
  },
  "condition": "selection and ( ( not filter_folder ) or susp_flags or ( cmd_has_flags and not filter_cmd_misses_flags ) )"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]88131586
  - https://twitter.com/mrd0x/status/[PII_REDACTED]47684615
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
Sigma Detection Rule: Suspicious BitLocker Access Agent Update Utility Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-18
ATT&CK techniques: T1218, T1021.003
Log source: windows/process_creation

Description:
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes.
Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\baaupdate.exe",
    "Image|endswith": [
      "\\bitsadmin.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/rtecCyberSec/BitlockMove
Sigma Detection Rule: Uncommon Sigverif.EXE Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\sigverif.exe"
  },
  "filter_main_werfault": {
    "Image": [
      "C:\\Windows\\System32\\WerFault.exe",
      "C:\\Windows\\SysWOW64\\WerFault.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]09330184
Sigma Detection Rule: Email Exifiltration Via Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems),  Azure-Sentinel (idea)
Date: 2022-09-09
Log source: windows/process_creation

Description:
Detects email exfiltration via powershell cmdlets

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains|all": [
      "Add-PSSnapin",
      "Get-Recipient",
      "-ExpandProperty",
      "EmailAddresses",
      "SmtpAddress",
      "-hidetableheaders"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
  - https://github.com/Azure/Azure-Sentinel/blob/7e6aa438e254d468feec061618a7877aa528ee9f/Hunting%20Queries/Microsoft%20365%20Defender/Ransomware/DEV-0270/Email%20data%20exfiltration%20via%20PowerShell.yaml
Sigma Detection Rule: Application Terminated Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-09-11
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects calls to the "terminate" function via wmic in order to kill an application

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "call",
      "terminate"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://cyble.com/blog/lockfile-ransomware-using-proxyshell-attack-to-deploy-ransomware/
  - https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
Sigma Detection Rule: User Discovery And Export Via Get-ADUser Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "Get-ADUser ",
      " -Filter \\*"
    ],
    "CommandLine|contains": [
      " > ",
      " | Select ",
      "Out-File",
      "Set-Content",
      "Add-Content"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
Sigma Detection Rule: Cloudflared Quick Tunnel Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sajid Nawaz Khan
Date: 2023-12-20
ATT&CK techniques: T1090.001
Log source: windows/process_creation

Description:
Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB.
The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com.
The tool has been observed in use by threat groups including Akira ransomware.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\cloudflared.exe",
        "\\cloudflared-windows-386.exe",
        "\\cloudflared-windows-amd64.exe"
      ]
    },
    {
      "Hashes|contains": [
        "SHA256=2fb6c04c4f95fb8d158af94c137f90ac820716deaf88d8ebec956254e046cb29",
        "SHA256=b3d21940a10fdef5e415ad70331ce257c24fe3bcf[PII_REDACTED]e0421791f87e8",
        "SHA256=1fbd8362b2d2d2e6a5750ae3db69cd1815e6c1d31da48a98b796450971a8e039",
        "SHA256=0409c9b12f9d0eda86e461ed9bdabeefb00172b[PII_REDACTED]1a0bdf48e68dc28",
        "SHA256=7cfb411d04bac42ef93d1f0c93c0a481e38c6f4612b97ae89d[PII_REDACTED]edc7",
        "SHA256=5b3c2d846ab162dc6bc595cce3a49de5731afde5d6060be7066d21b013a28373",
        "SHA256=ce95df7f69664c3df19b76028e115931919a71517b776da7b42d353e2ff4a670",
        "SHA256=1293525a19cfe3bc8296b62fbfe19f083632ed644a1c18c10b045a1d3030d81a",
        "SHA256=af2b9161cfcb654b16408cd6b098afe9d1fb61a037d18d7090a119d4c0c8e0f0",
        "SHA256=39ddceb56a15798826a5fc4892fa2b474c444bb4d7a8bf2fa95e41cab10fa7a1",
        "SHA256=ccd11f2328023a0e7929e845d5b6e7bc783fb4650d65faef3ae090239d4bbce2",
        "SHA256=b6e5c5d2567ae8c69cc012ebcae30e6c9b5359d64a58d17ba75ec89f8bce71ac",
        "SHA256=f813484ea441404f18caad96f28138e8aaf0cb256163c09c2ab8a3acab87f69f",
        "SHA256=fc4a0802ab9c7409b892ca00636bec61e2acfc911bccfdeb9978b8ab5a2f828d",
        "SHA256=083150724b49604c8765c1ba19541fa260b133be0acb0647fcd936d81f054499",
        "SHA256=44303d6572956f28a0f2e4b1

References:
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
  - https://github.com/cloudflare/cloudflared
  - https://www.intrinsec.com/akira_ransomware/
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
Sigma Detection Rule: Audio Capture via SoundRecorder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1123
Log source: windows/process_creation

Description:
Detect attacker collecting audio via SoundRecorder application.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\SoundRecorder.exe",
    "CommandLine|contains": "/FILE"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md
  - https://eqllib.readthedocs.io/en/latest/analytics/f72a98cb-7b3d-4100-99c3-a138b6e9ff6e.html
Sigma Detection Rule: Potentially Suspicious Child Process Of VsCode
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-26
ATT&CK techniques: T1218, T1202
Log source: windows/process_creation

Description:
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\code.exe"
  },
  "selection_children_images": {
    "Image|endswith": [
      "\\calc.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\cscript.exe",
      "\\wscript.exe"
    ]
  },
  "selection_children_cli": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\cmd.exe"
    ],
    "CommandLine|contains": [
      "Invoke-Expressions",
      "IEX",
      "Invoke-Command",
      "ICM",
      "DownloadString",
      "rundll32",
      "regsvr32",
      "wscript",
      "cscript"
    ]
  },
  "selection_children_paths": {
    "Image|contains": [
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      ":\\Temp\\"
    ]
  },
  "condition": "selection_parent and 1 of selection_children_*"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]07495681
  - https://twitter.com/nas_bench/status/[PII_REDACTED]52335105
Sigma Detection Rule: Wscript Shell Run In CommandLine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-31
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "Wscript.",
      ".Shell",
      ".Run"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]2045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html
  - https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/
Sigma Detection Rule: Potential Provisioning Registry Key Abuse For Binary Proxy Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
Date: 2023-08-08
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".

Detection logic:
{
  "selection": {
    "CommandLine|contains": "SOFTWARE\\Microsoft\\Provisioning\\Commands\\"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]62153472
Sigma Detection Rule: Renamed Jusched.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Swisscom
Date: 2019-06-04
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed "jusched.exe" as seen used by the cobalt group

Detection logic:
{
  "selection": {
    "Description": [
      "Java Update Scheduler",
      "Java(TM) Update Scheduler"
    ]
  },
  "filter": {
    "Image|endswith": "\\jusched.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
Sigma Detection Rule: Potential Suspicious Browser Launch From Document Reader Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseph Kamau
Date: 2024-05-27
ATT&CK techniques: T1204.002
Log source: windows/process_creation

Description:
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.


Detection logic:
{
  "selection": {
    "ParentImage|contains": [
      "Acrobat Reader",
      "Microsoft Office",
      "PDF Reader"
    ],
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\firefox.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\maxthon.exe",
      "\\seamonkey.exe",
      "\\vivaldi.exe"
    ],
    "CommandLine|contains": "http"
  },
  "filter_main_microsoft_help": {
    "CommandLine|contains": "https://go.microsoft.com/fwlink/"
  },
  "filter_optional_foxit": {
    "CommandLine|contains": [
      "http://ad.foxitsoftware.com/adlog.php?",
      "https://globe-map.foxitservice.com/go.php?do=redirect"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
  - https://app.any.run/tasks/64043a79-165f-4052-bcba-e6e49f847ec1/
Sigma Detection Rule: PUA - Fast Reverse Proxy (FRP) Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Florian Roth
Date: 2022-09-02
ATT&CK techniques: T1090
Log source: windows/process_creation

Description:
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\frpc.exe",
      "\\frps.exe"
    ]
  },
  "selection_cli": {
    "CommandLine|contains": "\\frpc.ini"
  },
  "selection_hashes": {
    "Hashes|contains": [
      "MD5=7D9C233B8C9E3F0EA290D2B84593C842",
      "SHA1=06DDC9280E1F[PII_REDACTED]A[PII_REDACTED]905942F",
      "SHA256=57B0936B8D336D8E981C169466A15A5FD21A7D5A2C7DAF62D5E142EE860E387C"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://asec.ahnlab.com/en/38156/
  - https://github.com/fatedier/frp
Sigma Detection Rule: New DLL Registered Via Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kirill Kiryanov, Beyu Denis, Daniil Yugoslavskiy, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-22
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" with "REGSVR" in order to register a new DLL (equivalent to running regsvr32). Attackers abuse this to install and run malicious DLLs.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "REGSVR ",
      ".dll"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://redcanary.com/blog/raspberry-robin/
  - https://web.archive.org/web/[PII_REDACTED]2753/https://twitter.com/Hexacorn/status/[PII_REDACTED]73330176
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Sigma Detection Rule: Direct Autorun Keys Modification
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2019-10-25
ATT&CK techniques: T1547.001
Log source: windows/process_creation

Description:
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_cli_add": {
    "CommandLine|contains": "add"
  },
  "selection_cli_keys": {
    "CommandLine|contains": [
      "\\software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run",
      "\\software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run",
      "\\software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit",
      "\\software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell",
      "\\software\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
      "\\system\\CurrentControlSet\\Control\\SafeBoot\\AlternateShell"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: Powershell Defender Disable Scan Feature
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-03
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects requests to disable Microsoft Defender features using PowerShell commands

Detection logic:
{
  "selection_cli_cmdlet": {
    "CommandLine|contains": [
      "Add-MpPreference ",
      "Set-MpPreference "
    ]
  },
  "selection_cli_option": {
    "CommandLine|contains": [
      "DisableArchiveScanning ",
      "DisableRealtimeMonitoring ",
      "DisableIOAVProtection ",
      "DisableBehaviorMonitoring ",
      "DisableBlockAtFirstSeen ",
      "DisableCatchupFullScan ",
      "DisableCatchupQuickScan "
    ]
  },
  "selection_cli_value": {
    "CommandLine|contains": [
      "$true",
      " 1 "
    ]
  },
  "selection_encoded_modifier": {
    "CommandLine|base64offset|contains": [
      "disablearchivescanning ",
      "DisableArchiveScanning ",
      "disablebehaviormonitoring ",
      "DisableBehaviorMonitoring ",
      "disableblockatfirstseen ",
      "DisableBlockAtFirstSeen ",
      "disablecatchupfullscan ",
      "DisableCatchupFullScan ",
      "disablecatchupquickscan ",
      "DisableCatchupQuickScan ",
      "disableioavprotection ",
      "DisableIOAVProtection ",
      "disablerealtimemonitoring ",
      "DisableRealtimeMonitoring "
    ]
  },
  "selection_encoded_direct": {
    "CommandLine|contains": [
      "RABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgA",
      "QAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAIA",
      "EAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACAA",
      "RABpAHMAYQBiAGwAZQBJAE8AQQBWAFAAcgBvAHQAZQBjAHQAaQBvAG4AIA",
      "QAaQBzAGEAYgBsAGUASQBPAEEAVgBQAHIAbwB0A

References:
  - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
  - https://www.virustotal.com/gui/file/d[PII_REDACTED]31d83d75ec5d1f030571af20c45efeeb94840b67ea09a3283ab65/behavior/C2AE
  - https://www.virustotal.com/gui/search/content%253A%2522Set-MpPreference%2520-Disable%2522/files
Sigma Detection Rule: Recon Information for Export with Command Prompt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-30
ATT&CK techniques: T1119
Log source: windows/process_creation

Description:
Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Detection logic:
{
  "selection_image": [
    {
      "Image|endswith": [
        "\\tree.com",
        "\\WMIC.exe",
        "\\doskey.exe",
        "\\sc.exe"
      ]
    },
    {
      "OriginalFileName": [
        "wmic.exe",
        "DOSKEY.EXE",
        "sc.exe"
      ]
    }
  ],
  "selection_redirect": {
    "ParentCommandLine|contains": [
      " > %TEMP%\\",
      " > %TMP%\\"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
Sigma Detection Rule: Deletion of Volume Shadow Copies via WMI with PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-20
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Detection logic:
{
  "selection_get": {
    "CommandLine|contains": [
      "Get-WmiObject",
      "gwmi",
      "Get-CimInstance",
      "gcim"
    ]
  },
  "selection_shadowcopy": {
    "CommandLine|contains": "Win32_ShadowCopy"
  },
  "selection_delete": {
    "CommandLine|contains": [
      ".Delete()",
      "Remove-WmiObject",
      "rwmi",
      "Remove-CimInstance",
      "rcim"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
Sigma Detection Rule: PUA - Nmap/Zenmap Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-10
ATT&CK techniques: T1046
Log source: windows/process_creation

Description:
Detects usage of namp/zenmap. Adversaries may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\nmap.exe",
        "\\zennmap.exe"
      ]
    },
    {
      "OriginalFileName": [
        "nmap.exe",
        "zennmap.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://nmap.org/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-3---port-scan-nmap-for-windows
Sigma Detection Rule: Renamed Sysinternals Sdelete Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-06
ATT&CK techniques: T1485
Log source: windows/process_creation

Description:
Detects the use of a renamed SysInternals Sdelete, which is something an administrator shouldn't do (the renaming)

Detection logic:
{
  "selection": {
    "OriginalFileName": "sdelete.exe"
  },
  "filter": {
    "Image|endswith": [
      "\\sdelete.exe",
      "\\sdelete64.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sdelete
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md