deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Atlassian Confluence CVE-2022-26134
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-03
ATT&CK techniques: T1190, T1059
Log source: linux/process_creation

Description:
Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

Detection logic:
{
  "selection": {
    "ParentImage|startswith": "/opt/atlassian/confluence/",
    "ParentImage|endswith": "/java",
    "CommandLine|contains": [
      "/bin/sh",
      "bash",
      "dash",
      "ksh",
      "zsh",
      "csh",
      "fish",
      "curl",
      "wget",
      "python"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/
Sigma Detection Rule: Atlassian Bitbucket Command Injection Via Archive API
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-29
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects attempts to exploit the Atlassian Bitbucket Command Injection CVE-2022-36804

Detection logic:
{
  "selection": {
    "cs-uri-query|contains|all": [
      "/rest/api/latest/projects/",
      "prefix=",
      "%00--exec"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/_0xf4n9x_/status/[PII_REDACTED]38192901
  - https://www.rapid7.com/blog/post/2022/09/20/cve-2022-36804-easily-exploitable-vulnerability-in-atlassian-bitbucket-server-and-data-center/
  - https://confluence.atlassian.com/bitbucketserver/bitbucket-server-and-data-center-advisory-2022-08-24[PII_REDACTED].html
  - https://blog.assetnote.io/2022/09/14/rce-in-bitbucket-server/
Sigma Detection Rule: CVE-2022-31659 VMware Workspace ONE Access RCE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects possible exploitation of VMware Workspace ONE Access Admin Remote Code Execution vulnerability as described in CVE-2022-31659

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains": "/SAAS/jersey/manager/api/migrate/tenant"
  },
  "condition": "selection"
}

References:
  - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
Sigma Detection Rule: Potential Exploitation of CVE-2022-21919 or CVE-2021-34484 for LPE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Cybex
Date: 2022-08-16
Log source: windows/

Description:
Detects potential exploitation attempts of CVE-2022-21919 or CVE-2021-34484 leading to local privilege escalation via the User Profile Service.
During exploitation of this vulnerability, two logs (Provider_Name: Microsoft-Windows-User Profiles Service) with EventID 1511 and 1515 are created (EventID 1515 may generate many false positives).
Additionally, the directory \Users\TEMP may be created during exploitation. This behavior was observed on Windows Server 2008.


Detection logic:
{
  "selection": {
    "EventID": 1511,
    "Provider_Name": "Microsoft-Windows-User Profiles Service"
  },
  "condition": "selection"
}

References:
  - https://packetstormsecurity.com/files/166692/Windows-User-Profile-Service-Privlege-Escalation.html
Sigma Detection Rule: Apache Spark Shell Command Injection - ProcessCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-20
ATT&CK techniques: T1190
Log source: linux/process_creation

Description:
Detects attempts to exploit an apache spark server via CVE-2014-6287 from a commandline perspective

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\bash",
    "CommandLine|contains": [
      "id -Gn `",
      "id -Gn '"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
  - https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
  - https://github.com/apache/spark/pull/36315/files
Sigma Detection Rule: Apache Spark Shell Command Injection - Weblogs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-19
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects attempts to exploit an apache spark server via CVE-2014-6287 from a weblogs perspective

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "?doAs=`"
  },
  "condition": "selection"
}

References:
  - https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
  - https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
  - https://github.com/apache/spark/pull/36315/files
Sigma Detection Rule: Potential Centos Web Panel Exploitation Attempt - CVE-2022-44877
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-20
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects potential exploitation attempts that target the Centos Web Panel 7 Unauthenticated Remote Code Execution CVE-2022-44877

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains|all": [
      "/login/index.php",
      "login="
    ],
    "cs-uri-query|contains": [
      "login=$(",
      "base64",
      "subprocess",
      "socket",
      "${IFS}",
      "cHl0aG9u",
      "B5dGhvb",
      "weXRob2"
    ]
  },
  "condition": "selection"
}

References:
  - https://seclists.org/fulldisclosure/2023/Jan/1
  - https://www.rapid7.com/blog/post/2023/01/19/etr-exploitation-of-control-web-panel-cve-2022-44877/
Sigma Detection Rule: Potential CVE-2022-21587 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Isa Almannaei
Date: 2023-02-13
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects potential exploitation attempts of CVE-2022-21587 an arbitrary file upload vulnerability impacting Oracle E-Business Suite (EBS). CVE-2022-21587 can lead to unauthenticated remote code execution.

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains": [
      "/OA_HTML/BneViewerXMLService?bne:uueupload=TRUE",
      "/OA_HTML/BneUploaderService?bne:uueupload=TRUE",
      "/OA_HTML/BneDownloadService?bne:uueupload=TRUE",
      "/OA_HTML/BneOfflineLOVService?bne:uueupload=TRUE"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.rapid7.com/blog/post/2023/02/07/etr-cve-2022-21587-rapid7-observed-exploitation-of-oracle-e-business-suite-vulnerability/
  - https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis
  - https://github.com/hieuminhnv/CVE-2022-21587-POC
  - https://blog.viettelcybersecurity.com/cve-2022-21587-oracle-e-business-suite-unauth-rce/
Sigma Detection Rule: Potential ACTINIUM Persistence Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2022-02-07
ATT&CK techniques: T1053, T1053.005
Log source: windows/process_creation

Description:
Detects specific process parameters as used by ACTINIUM scheduled task persistence creation.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "schtasks",
      "create",
      "wscript",
      " /e:vbscript"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations
Sigma Detection Rule: MERCURY APT Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-26
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious command line patterns seen being used by MERCURY APT

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "-exec bypass -w 1 -enc",
      "UwB0AGEAcgB0AC0ASgBvAGIAIAAtAFMAYwByAGkAcAB0AEIAbABvAGMAawAgAHsAKABzAGEAcABzACAAKAAiAHAA"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
Sigma Detection Rule: Potential SocGholish Second Stage C2 DNS Query
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Dusty Miller
Date: 2023-02-23
ATT&CK techniques: T1219.002
Log source: windows/dns_query

Description:
Detects a DNS query initiated from a "wscript" process for domains matching a specific pattern that was seen being used by SocGholish for its Command and Control traffic

Detection logic:
{
  "selection": {
    "Image|endswith": "\\wscript.exe",
    "QueryName|re": "[a-f0-9]{4,8}\\.(?:[a-z0-9\\-]+\\.){2}[a-z0-9\\-]+"
  },
  "condition": "selection"
}

References:
  - https://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations
  - https://www.virustotal.com/gui/file/d5661009c461a8b20e1ad22f48609cc84dd90aee9182e026659dde4d46aaf25e/relations
  - https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update
Sigma Detection Rule: Pikabot Fake DLL Extension Execution Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-01-26
Log source: windows/process_creation

Description:
Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\wscript.exe"
    ],
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Installer\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "filter_main_known_extension": [
    {
      "CommandLine|contains": [
        ".cpl ",
        ".cpl,",
        ".dll ",
        ".dll,",
        ".inf ",
        ".inf,"
      ]
    },
    {
      "CommandLine|endswith": [
        ".cpl",
        ".cpl\"",
        ".dll",
        ".dll\"",
        ".inf",
        ".inf\"",
        ".cpl'",
        ".dll'",
        ".inf'"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/pr0xylife/Pikabot
  - https://tria.ge/231004-tp8k6sch9t/behavioral2
  - https://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
  - https://tria.ge/231212-r1bpgaefar/behavioral2
Sigma Detection Rule: Potential Pikabot Hollowing Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-10-27
ATT&CK techniques: T1055.012
Log source: windows/process_creation

Description:
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\rundll32.exe",
    "Image|endswith": [
      "\\SearchFilterHost.exe",
      "\\SearchProtocolHost.exe",
      "\\sndvol.exe",
      "\\wermgr.exe",
      "\\wwahost.exe"
    ]
  },
  "filter_main_legit_sndvol": {
    "Image|endswith": "\\sndvol.exe",
    "ParentCommandLine|contains": "mmsys.cpl"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c[PII_REDACTED]a62
  - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
Sigma Detection Rule: Potential Pikabot C2 Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-10-27
ATT&CK techniques: T1573
Log source: windows/network_connection

Description:
Detects the execution of rundll32 that leads to an external network connection.
The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\rundll32.exe",
    "Image|endswith": [
      "\\SearchFilterHost.exe",
      "\\SearchProtocolHost.exe",
      "\\sndvol.exe",
      "\\wermgr.exe",
      "\\wwahost.exe"
    ],
    "Protocol": "tcp",
    "Initiated": "true"
  },
  "condition": "selection"
}

References:
  - https://www.virustotal.com/gui/file/d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44
  - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
Sigma Detection Rule: Potential Pikabot Discovery Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-10-27
ATT&CK techniques: T1016, T1049, T1087
Log source: windows/process_creation

Description:
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).


Detection logic:
{
  "selection_parent": [
    {
      "GrandParentImage|endswith": "\\rundll32.exe"
    },
    {
      "ParentImage|endswith": [
        "\\SearchFilterHost.exe",
        "\\SearchProtocolHost.exe"
      ]
    }
  ],
  "selection_child": {
    "CommandLine": [
      "ipconfig.exe /all",
      "netstat.exe -aon",
      "whoami.exe /all"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242
  - https://tria.ge/231023-lpw85she57/behavioral2
Sigma Detection Rule: Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Alejandro Houspanossian ('@lekz86')
Date: 2024-01-02
ATT&CK techniques: T1059.003, T1105, T1218
Log source: windows/process_creation

Description:
Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads.
Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files.
In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.


Detection logic:
{
  "selection_cmd": {
    "CommandLine|contains|all": [
      "cmd",
      "/c"
    ]
  },
  "selection_pipes": {
    "CommandLine|contains": [
      " & ",
      " || "
    ]
  },
  "selection_commands_1": {
    "CommandLine|contains": [
      " curl",
      " wget",
      " timeout ",
      " ping "
    ]
  },
  "selection_commands_2": {
    "CommandLine|contains": [
      " rundll32",
      " mkdir "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_30.10.2023.txt
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_22.12.2023.txt
Sigma Detection Rule: Rhadamanthys Stealer Module Launch Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: TropChaud
Date: 2023-01-26
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects the use of Rundll32 to launch an NSIS module that serves as the main stealer capability of Rhadamanthys infostealer, as observed in reports and samples in early 2023

Detection logic:
{
  "selection_rundll32": [
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "Image|endswith": "\\rundll32.exe"
    }
  ],
  "selection_dll": {
    "CommandLine|contains": "nsis_uns"
  },
  "selection_export_function": {
    "CommandLine|contains": "PrintUIEntry"
  },
  "condition": "all of selection_*"
}

References:
  - https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88
  - https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/
  - https://www.joesandbox.com/analysis/790122/0/html
  - https://twitter.com/anfam17/status/[PII_REDACTED]57208835
Sigma Detection Rule: Qakbot Uninstaller Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-08-31
Log source: windows/process_creation

Description:
Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\QbotUninstall.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=E772C815072311D6FB8C3390743E6BE5",
        "SHA256=423A9D13D410E2DC38EABB9FDF3121D2072472D[PII_REDACTED]A638B822DCD5180",
        "SHA256=559CAE635F0D870652B9482EF436B31D4BB1A5A0F51750836F328D749291D0B6",
        "SHA256=855EB5481F77DDE5AD8FA6E9D953D4AEBC280DDDF9461144B16ED62817CC5071",
        "SHA256=FAB408536AA37C4ABC8BE97AB9C1F86CB33B63923D423FDC2859EB9D63FA8EA0"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources
  - https://www.virustotal.com/gui/file/7cdee5a583eacf24b1f142413aabb4e556ccf4ef3a4764ad084c1526cc90e117/community
  - https://www.virustotal.com/gui/file/fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0/community
Sigma Detection Rule: Qakbot Regsvr32 Calc Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-26
Log source: windows/process_creation

Description:
Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Detection logic:
{
  "selection": {
    "Image|endswith": "\\regsvr32.exe",
    "CommandLine|contains|windash": " -s",
    "CommandLine|endswith": " calc"
  },
  "condition": "selection"
}

References:
  - https://github.com/pr0xylife/Qakbot/
Sigma Detection Rule: Qakbot Rundll32 Exports Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-05-24
Log source: windows/process_creation

Description:
Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Detection logic:
{
  "selection_paths": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\curl.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "selection_exports": {
    "CommandLine|endswith": [
      "aslr",
      "bind",
      "DrawThemeIcon",
      "GG10",
      "GL70",
      "jhbvygftr",
      "kjhbhkjvydrt",
      "LS88",
      "Motd",
      "N115",
      "next",
      "Nikn",
      "print",
      "qqqb",
      "qqqq",
      "RS32",
      "Test",
      "Time",
      "Updt",
      "vips",
      "Wind",
      "WW50",
      "X555",
      "XL55",
      "xlAutoOpen",
      "XS88"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/pr0xylife/Qakbot/
Sigma Detection Rule: Potential Qakbot Rundll32 Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-05-24
Log source: windows/process_creation

Description:
Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

Detection logic:
{
  "selection_paths": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\curl.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "selection_extension": {
    "CommandLine|contains": ".dll"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/pr0xylife/Qakbot/
Sigma Detection Rule: Qakbot Rundll32 Fake DLL Extension Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-24
Log source: windows/process_creation

Description:
Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\curl.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Roaming\\"
    ]
  },
  "filter_main_extension": {
    "CommandLine|contains": ".dll"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/pr0xylife/Qakbot/
Sigma Detection Rule: Rorschach Ransomware Execution Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-04-04
ATT&CK techniques: T1059.003, T1059.001
Log source: windows/process_creation

Description:
Detects Rorschach ransomware execution activity

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\bcdedit.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\netsh.exe",
      "\\wevtutil.exe",
      "\\vssadmin.exe"
    ],
    "CommandLine|contains": "11111111"
  },
  "condition": "selection"
}

References:
  - https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/
Sigma Detection Rule: Potential COLDSTEEL RAT Windows User Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-02
Log source: windows/registry_set

Description:
Detects creation of a new user profile with a specific username, seen being used by some variants of the COLDSTEEL RAT.

Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-",
      "\\ProfileImagePath"
    ],
    "Details|contains": [
      "ANONYMOUS",
      "_DomainUser_"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
Sigma Detection Rule: COLDSTEEL RAT Service Persistence Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-04-30
Log source: windows/process_creation

Description:
Detects the creation of an "svchost" process with specific command line flags, that were seen present and used by ColdSteel RAT

Detection logic:
{
  "selection": {
    "Image|endswith": "\\svchost.exe",
    "CommandLine|endswith": [
      " -k msupdate",
      " -k msupdate2",
      " -k alg"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf