deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Rundll32 Execution With Uncommon DLL Extension
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou
Date: 2022-01-13
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects the execution of rundll32 with a command line that doesn't contain a common extension

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "filter_main_null": {
    "CommandLine": null
  },
  "filter_main_empty": {
    "CommandLine": ""
  },
  "filter_main_known_extension": [
    {
      "CommandLine|contains": [
        ".cpl ",
        ".cpl,",
        ".cpl\"",
        ".cpl'",
        ".dll ",
        ".dll,",
        ".dll\"",
        ".dll'",
        ".inf ",
        ".inf,",
        ".inf\"",
        ".inf'"
      ]
    },
    {
      "CommandLine|endswith": [
        ".cpl",
        ".dll",
        ".inf"
      ]
    }
  ],
  "filter_main_localserver": {
    "CommandLine|contains": " -localserver "
  },
  "filter_main_zzzzInvokeManagedCustomActionOutOfProc": {
    "ParentImage|endswith": "\\msiexec.exe",
    "CommandLine|contains|all": [
      ":\\Windows\\Installer\\",
      ".tmp",
      "zzzzInvokeManagedCustomActionOutOfProc"
    ]
  },
  "filter_optional_EdgeUpdate": {
    "ParentCommandLine|contains|all": [
      ":\\Users\\",
      "\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{",
      "\\EDGEMITMP_",
      ".tmp\\setup.exe",
      "--install-archive=",
      "--previous-version=",
      "--msedgewebview --verbose-logging --do-not-launch-msedge --user-level"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]95139841?s=12
Sigma Detection Rule: Writing Of Malicious Files To The Fonts Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman
Date: 2020-04-21
ATT&CK techniques: T1211, T1059
Log source: windows/process_creation

Description:
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

Detection logic:
{
  "selection_1": {
    "CommandLine|contains": [
      "echo",
      "copy",
      "type",
      "file createnew",
      "cacls"
    ]
  },
  "selection_2": {
    "CommandLine|contains": "C:\\Windows\\Fonts\\"
  },
  "selection_3": {
    "CommandLine|contains": [
      ".sh",
      ".exe",
      ".dll",
      ".bin",
      ".bat",
      ".cmd",
      ".js",
      ".msh",
      ".reg",
      ".scr",
      ".ps",
      ".vb",
      ".jar",
      ".pl",
      ".inf",
      ".cpl",
      ".hta",
      ".msi",
      ".vbs"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
Sigma Detection Rule: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-12-05
Log source: windows/process_creation

Description:
Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\ud83e\udd86",
      "\ud83e\udd85",
      "\ud83e\udd89",
      "\ud83e\udd87",
      "\ud83d\udc3a",
      "\ud83d\udc17",
      "\ud83d\udc34",
      "\ud83e\udd84",
      "\ud83d\udc1d",
      "\ud83e\udeb1",
      "\ud83d\udc1b",
      "\ud83e\udd8b",
      "\ud83d\udc0c",
      "\ud83d\udc1e",
      "\ud83d\udc1c",
      "\ud83e\udeb0",
      "\ud83e\udeb2",
      "\ud83e\udeb3",
      "\ud83e\udd9f",
      "\ud83e\udd97",
      "\ud83d\udd77",
      "\ud83d\udd78",
      "\ud83e\udd82",
      "\ud83d\udc22",
      "\ud83d\udc0d",
      "\ud83e\udd8e",
      "\ud83e\udd96",
      "\ud83e\udd95",
      "\ud83d\udc19",
      "\ud83e\udd91",
      "\ud83e\udd90",
      "\ud83e\udd9e",
      "\ud83e\udd80",
      "\ud83e\udeb8",
      "\ud83d\udc21",
      "\ud83d\udc20",
      "\ud83d\udc1f",
      "\ud83d\udc2c",
      "\ud83d\udc33",
      "\ud83d\udc0b",
      "\ud83e\udd88",
      "\ud83d\udc0a",
      "\ud83d\udc05",
      "\ud83d\udc06",
      "\ud83e\udd93",
      "\ud83e\udd8d",
      "\ud83e\udda7",
      "\ud83e\udda3",
      "\ud83d\udc18",
      "\ud83e\udd9b",
      "\ud83e\udd8f",
      "\ud83d\udc2a",
      "\ud83d\udc2b",
      "\ud83e\udd92",
      "\ud83e\udd98",
      "\ud83e\uddac",
      "\ud83d\udc03",
      "\ud83d\udc02",
      "\ud83d\udc04",
      "\ud83d\udc0e",
      "\ud83d\udc16",
      "\ud83d\udc0f",
      "\ud83d\udc11",
      "\ud83e\udd99",
      "\ud83d\udc10",
      "\ud83e\udd8c",

References:
  - Internal Research
Sigma Detection Rule: Msiexec Quiet Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-16
ATT&CK techniques: T1218.007
Log source: windows/process_creation

Description:
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\msiexec.exe"
    },
    {
      "OriginalFileName": "msiexec.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": [
      "-i",
      "-package",
      "-a",
      "-j"
    ]
  },
  "selection_quiet": {
    "CommandLine|contains|windash": "-q"
  },
  "filter_user_temp": {
    "ParentImage|startswith": "C:\\Users\\",
    "ParentImage|contains": "\\AppData\\Local\\Temp\\"
  },
  "filter_system_temp": {
    "ParentImage|startswith": "C:\\Windows\\Temp\\"
  },
  "filter_ccm": {
    "ParentImage": "C:\\Windows\\CCM\\Ccm32BitLauncher.exe",
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://twitter.com/_st0pp3r_/status/[PII_REDACTED]44799235
Sigma Detection Rule: Suspicious Schtasks Execution AppData Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-03-15
ATT&CK techniques: T1053.005, T1059.001
Log source: windows/process_creation

Description:
Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local

Detection logic:
{
  "selection": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      "/Create",
      "/RU",
      "/TR",
      "C:\\Users\\",
      "\\AppData\\Local\\"
    ],
    "CommandLine|contains": [
      "NT AUT",
      " SYSTEM "
    ]
  },
  "filter": {
    "ParentImage|contains|all": [
      "\\AppData\\Local\\Temp\\",
      "TeamViewer_.exe"
    ],
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": "/TN TVInstallRestore"
  },
  "condition": "selection and not filter"
}

References:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Sigma Detection Rule: PowerShell Get-Process LSASS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-04-23
ATT&CK techniques: T1552.004
Log source: windows/process_creation

Description:
Detects a "Get-Process" cmdlet and it's aliases on lsass process, which is in almost all cases a sign of malicious activity

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Get-Process lsas",
      "ps lsas",
      "gps lsas"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3028/https://twitter.com/PythonResponder/status/[PII_REDACTED]49630211
Sigma Detection Rule: Uncommon Child Process Of Conhost.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: omkar72
Date: 2020-10-25
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\conhost.exe"
  },
  "filter_main_conhost": {
    "Image|endswith": ":\\Windows\\System32\\conhost.exe"
  },
  "filter_main_null": {
    "Image": null
  },
  "filter_main_empty": {
    "Image": ""
  },
  "filter_optional_provider": {
    "Provider_Name": "SystemTraceProvider-Process"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
Sigma Detection Rule: HackTool - SharpLDAPmonitor Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-30
Log source: windows/process_creation

Description:
Detects execution of the SharpLDAPmonitor. Which can monitor the creation, deletion and changes to LDAP objects.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SharpLDAPmonitor.exe"
    },
    {
      "OriginalFileName": "SharpLDAPmonitor.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/user:",
      "/pass:",
      "/dcip:"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/p0dalirius/LDAPmonitor
Sigma Detection Rule: Suspicious Invoke-WebRequest Execution With DirectIP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-21
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects calls to PowerShell with Invoke-WebRequest cmdlet using direct IP access

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell_ise.EXE",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_commands": {
    "CommandLine|contains": [
      "curl ",
      "Invoke-RestMethod",
      "Invoke-WebRequest",
      " irm ",
      "iwr ",
      "wget "
    ]
  },
  "selection_ip": {
    "CommandLine|contains": [
      "://1",
      "://2",
      "://3",
      "://4",
      "://5",
      "://6",
      "://7",
      "://8",
      "://9"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
Sigma Detection Rule: Suspicious Schtasks Schedule Type With High Privileges
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-31
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_time": {
    "CommandLine|contains": [
      " ONLOGON ",
      " ONSTART ",
      " ONCE ",
      " ONIDLE "
    ]
  },
  "selection_privs": {
    "CommandLine|contains": [
      "NT AUT",
      " SYSTEM",
      "HIGHEST"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
Sigma Detection Rule: Suspicious Driver/DLL Installation Via Odbcconf.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-23
ATT&CK techniques: T1218.008
Log source: windows/process_creation

Description:
Detects execution of "odbcconf" with the "INSTALLDRIVER" action where the driver doesn't contain a ".dll" extension. This is often used as a defense evasion method.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\odbcconf.exe"
    },
    {
      "OriginalFileName": "odbcconf.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "INSTALLDRIVER "
  },
  "filter_main_dll_ext": {
    "CommandLine|contains": ".dll"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/
  - https://web.archive.org/web/[PII_REDACTED]2753/https://twitter.com/Hexacorn/status/[PII_REDACTED]73330176
  - https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
Sigma Detection Rule: Code Execution via Pcwutl.dll
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-05
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "pcwutl",
      "LaunchApplication"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/
  - https://twitter.com/harr0ey/status/[PII_REDACTED]49876488
Sigma Detection Rule: HackTool - Quarks PwDump Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-05
ATT&CK techniques: T1003.002
Log source: windows/process_creation

Description:
Detects usage of the Quarks PwDump tool via commandline arguments

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\QuarksPwDump.exe"
  },
  "selection_cli": {
    "CommandLine": [
      " -dhl",
      " --dump-hash-local",
      " -dhdc",
      " --dump-hash-domain-cached",
      " --dump-bitlocker",
      " -dhd ",
      " --dump-hash-domain ",
      "--ntds-file"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/quarkslab/quarkspwdump
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east
Sigma Detection Rule: LSASS Dump Keyword In CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus, Tony Lambert, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-24
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the presence of the keywords "lsass" and ".dmp" in the commandline, which could indicate a potential attempt to dump or create a dump of the lsass process.


Detection logic:
{
  "selection": [
    {
      "CommandLine|contains": [
        "lsass.dmp",
        "lsass.zip",
        "lsass.rar",
        "Andrew.dmp",
        "Coredump.dmp",
        "NotLSASS.zip",
        "lsass_2",
        "lsassdump",
        "lsassdmp"
      ]
    },
    {
      "CommandLine|contains|all": [
        "lsass",
        ".dmp"
      ]
    },
    {
      "CommandLine|contains|all": [
        "SQLDmpr",
        ".mdmp"
      ]
    },
    {
      "CommandLine|contains|all": [
        "nanodump",
        ".dmp"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/Hackndo/lsassy
  - https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf
  - https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml
  - https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/
  - https://github.com/helpsystems/nanodump
Sigma Detection Rule: Rebuild Performance Counter Values Via Lodctr.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-15
Log source: windows/process_creation

Description:
Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions.

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\lodctr.exe",
    "OriginalFileName": "LODCTR.EXE"
  },
  "selection_cli": {
    "CommandLine|contains|windash": " -r"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr
Sigma Detection Rule: Suspicious IIS URL GlobalRules Rewrite Via AppCmd
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-22
Log source: windows/process_creation

Description:
Detects usage of "appcmd" to create new global URL rewrite rules. This behaviour has been observed being used by threat actors to add new rules so they can access their webshells.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\appcmd.exe"
    },
    {
      "OriginalFileName": "appcmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "set",
      "config",
      "section:system.webServer/rewrite/globalRules",
      "commit:"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]42971144
  - https://learn.microsoft.com/en-us/answers/questions/739120/how-to-add-re-write-global-rule-with-action-type-r
Sigma Detection Rule: User Added to Local Administrators Group
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1098
Log source: windows/process_creation

Description:
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".

Detection logic:
{
  "selection_main": [
    {
      "CommandLine|contains|all": [
        "localgroup ",
        " /add"
      ]
    },
    {
      "CommandLine|contains|all": [
        "Add-LocalGroupMember ",
        " -Group "
      ]
    }
  ],
  "selection_group": {
    "CommandLine|contains": [
      " administrators ",
      " administrateur"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1
Sigma Detection Rule: Computer System Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-08
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects execution of wmic utility with the "computersystem" flag in order to obtain information about the machine such as the domain, username, model, etc.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "computersystem"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
Sigma Detection Rule: Suspicious Rundll32 Execution With Image Extension
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Hieu Tran
Date: 2023-03-13
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects the execution of Rundll32.exe with DLL files masquerading as image files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      ".bmp",
      ".cr2",
      ".eps",
      ".gif",
      ".ico",
      ".jpeg",
      ".jpg",
      ".nef",
      ".orf",
      ".png",
      ".raw",
      ".sr2",
      ".tif",
      ".tiff"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
Sigma Detection Rule: UAC Bypass WSReset
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass via WSReset usable by default sysmon-config

Detection logic:
{
  "selection": {
    "Image|endswith": "\\wsreset.exe",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Wsreset/
  - https://github.com/hfiref0x/UACME
  - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
Sigma Detection Rule: DllUnregisterServer Function Call Via Msiexec.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-24
ATT&CK techniques: T1218.007
Log source: windows/process_creation

Description:
Detects MsiExec loading a DLL and calling its DllUnregisterServer function

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\msiexec.exe"
    },
    {
      "OriginalFileName": "\\msiexec.exe"
    }
  ],
  "selection_flag": {
    "CommandLine|contains|windash": " -z "
  },
  "selection_dll": {
    "CommandLine|contains": ".dll"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
  - https://lolbas-project.github.io/lolbas/Binaries/Msiexec/
  - https://twitter.com/_st0pp3r_/status/[PII_REDACTED]96897281
Sigma Detection Rule: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1027, T1105
Log source: windows/process_creation

Description:
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      "urlcache ",
      "verifyctl ",
      "URL "
    ]
  },
  "selection_http": {
    "CommandLine|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://forensicitguy.github.io/agenttesla-vba-certutil-download/
  - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/
  - https://twitter.com/egre55/status/[PII_REDACTED]16193025
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/