deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Windows Credential Manager Access via VaultCmd
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-08
ATT&CK techniques: T1555.004
Log source: windows/process_creation

Description:
List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\VaultCmd.exe"
    },
    {
      "OriginalFileName": "VAULTCMD.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "/listcreds:"
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd
Sigma Detection Rule: New Process Created Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community
Date: 2019-01-16
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects new process creation using WMIC via the "process call create" flag

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "process",
      "call",
      "create"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.sans.org/blog/wmic-for-incident-response/
  - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process
Sigma Detection Rule: Suspicious Scheduled Task Creation Involving Temp Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-11
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects the creation of scheduled tasks that involves a temporary folder and runs only once

Detection logic:
{
  "selection": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      " /create ",
      " /sc once ",
      "\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://discuss.elastic.co/t/detection-and-response-for-hafnium-activity/266289/3
Sigma Detection Rule: Cmd Launched with Hidden Start Flags to Suspicious Targets
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Vladan Sekulic, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-24
ATT&CK techniques: T1564.003
Log source: windows/process_creation

Description:
Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags.
To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories.
This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.


Detection logic:
{
  "selection_cmd_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cmd_hidden_start_1": {
    "CommandLine|contains|windash": [
      "start ",
      "start/b",
      "start/min"
    ]
  },
  "selection_cmd_hidden_start_2": {
    "CommandLine|contains|windash": [
      "/b ",
      "/b\"",
      "/min ",
      "/min\""
    ]
  },
  "selection_cli_uncommon_location": {
    "CommandLine|contains": [
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Roaming\\",
      "\\Contacts\\",
      "\\Documents\\",
      "\\Downloads\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\inetpub\\",
      "\\Music\\",
      "\\Photos\\",
      "\\Temporary Internet\\",
      "\\Users\\Public\\",
      "\\Videos\\"
    ]
  },
  "selection_cli_susp_extension": {
    "CommandLine|contains": [
      ".bat",
      ".cmd",
      ".cpl",
      ".hta",
      ".js",
      ".ps1",
      ".scr",
      ".vbe",
      ".vbs"
    ]
  },
  "selection_cli_susp_pattern": {
    "CommandLine|contains": [
      " -nop ",
      " -sta ",
      ".downloadfile(",
      ".downloadstring(",
      "-noni ",
      "-w hidden "
    ]
  },
  "condition": "all of selection_cmd_* and 1 of selection_cli_*"
}

References:
  - https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
  - https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
  - https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
Sigma Detection Rule: Potentially Suspicious Windows App Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-12
Log source: windows/process_creation

Description:
Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution

Detection logic:
{
  "selection_parent": {
    "ParentImage|contains": "C:\\Program Files\\WindowsApps\\"
  },
  "selection_susp_img": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\wscript.exe"
    ]
  },
  "selection_susp_cli": {
    "CommandLine|contains": [
      "cmd /c",
      "Invoke-",
      "Base64"
    ]
  },
  "filter_optional_terminal": {
    "ParentImage|contains": ":\\Program Files\\WindowsApps\\Microsoft.WindowsTerminal",
    "ParentImage|endswith": "\\WindowsTerminal.exe",
    "Image|endswith": [
      "\\powershell.exe",
      "\\cmd.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_optional_sysinternals": {
    "ParentImage|startswith": "C:\\Program Files\\WindowsApps\\Microsoft.SysinternalsSuite",
    "Image|endswith": "\\cmd.exe"
  },
  "condition": "selection_parent and 1 of selection_susp_* and not 1 of filter_optional_*"
}

References:
  - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
Sigma Detection Rule: Node Process Executions
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-06
ATT&CK techniques: T1127, T1059.007
Log source: windows/process_creation

Description:
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

Detection logic:
{
  "selection": {
    "Image|endswith": "\\Adobe Creative Cloud Experience\\libs\\node.exe"
  },
  "filter": {
    "CommandLine|contains": "Adobe Creative Cloud Experience\\js"
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/mttaggart/status/[PII_REDACTED]93784064
Sigma Detection Rule: Sysprep on AppData Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-06-22
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\sysprep.exe",
    "CommandLine|contains": "\\AppData\\"
  },
  "condition": "selection"
}

References:
  - https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets
  - https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
Sigma Detection Rule: Interactive AT Job
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1053.002
Log source: windows/process_creation

Description:
Detects an interactive AT job, which may be used as a form of privilege escalation.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\at.exe",
    "CommandLine|contains": "interactive"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.002/T1053.002.md
  - https://eqllib.readthedocs.io/en/latest/analytics/d8db43cf-ed52-4f5c-9fb3-c9a4b95a0b56.html
Sigma Detection Rule: SafeBoot Registry Key Deleted Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton
Date: 2022-08-08
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_delete": {
    "CommandLine|contains|all": [
      " delete ",
      "\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html
Sigma Detection Rule: Windows Firewall Disabled via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-14
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects attempts to disable the Windows Firewall using PowerShell

Detection logic:
{
  "selection_name": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\powershell_ise.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_args": {
    "CommandLine|contains|all": [
      "Set-NetFirewallProfile ",
      " -Enabled ",
      " False"
    ]
  },
  "selection_opt": {
    "CommandLine|contains": [
      " -All ",
      "Public",
      "Domain",
      "Private"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html
Sigma Detection Rule: Operator Bloopers Cobalt Strike Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: _pete_0, TheDFIRReport
Date: 2022-05-06
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detects use of Cobalt Strike commands accidentally entered in the CMD shell

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "Cmd.Exe"
    },
    {
      "Image|endswith": "\\cmd.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|startswith": [
      "cmd ",
      "cmd.exe",
      "c:\\windows\\system32\\cmd.exe"
    ],
    "CommandLine|contains": [
      "psinject",
      "spawnas",
      "make_token",
      "remote-exec",
      "rev2self",
      "dcsync",
      "logonpasswords",
      "execute-assembly",
      "getsystem"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf
  - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/
  - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/
Sigma Detection Rule: Suspicious Advpack Call Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-17
Log source: windows/process_creation

Description:
Detects execution of "rundll32" calling "advpack.dll" with potential obfuscated ordinal calls in order to leverage the "RegisterOCX" function

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine|contains": "rundll32"
    }
  ],
  "selection_cli_dll": {
    "CommandLine|contains": "advpack"
  },
  "selection_cli_ordinal": [
    {
      "CommandLine|contains|all": [
        "#+",
        "12"
      ]
    },
    {
      "CommandLine|contains": "#-"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]95552769
  - http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/
Sigma Detection Rule: Remote Access Tool - Potential MeshAgent Execution - Windows
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Norbert Jaśniewicz (AlphaSOC)
Date: 2025-05-19
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects potential execution of MeshAgent which is a tool used for remote access.
Historical data shows that threat actors rename MeshAgent binary to evade detection.
Matching command lines with the '--meshServiceName' argument can indicate that the MeshAgent is being used for remote access.


Detection logic:
{
  "selection": {
    "CommandLine|contains": "--meshServiceName"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
  - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/
  - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
  - https://www.security.com/threat-intelligence/medusa-ransomware-attacks
Sigma Detection Rule: Proxy Execution via Vshadow
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: David Faiss
Date: 2025-05-26
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects the invocation of vshadow.exe with the -exec parameter that executes a specified script or command after the shadow copies are created but before the VShadow tool exits.
VShadow is a command-line tool that you can use to create and manage volume shadow copies. While legitimate backup or administrative scripts may use this flag,
attackers can leverage this parameter to proxy the execution of malware.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\vshadow.exe"
    },
    {
      "OriginalFileName": "vshadow.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "-exec"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
  - https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
Sigma Detection Rule: Potential Product Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali
Date: 2023-02-14
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects the execution of WMIC in order to get a list of firewall and antivirus products

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "Product"
  },
  "filter_main_call_operations": {
    "CommandLine|contains": [
      " uninstall",
      " install"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2023/03/06/2022-year-in-review/
  - https://www.yeahhub.com/list-installed-programs-version-path-windows/
  - https://learn.microsoft.com/en-us/answers/questions/253555/software-list-inventory-wmic-product
Sigma Detection Rule: Suspicious Obfuscated PowerShell Code
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-11
Log source: windows/process_creation

Description:
Detects suspicious UTF16 and base64 encoded and often obfuscated PowerShell code often used in command lines

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "IAAtAGIAeABvAHIAIAAwAHgA",
      "AALQBiAHgAbwByACAAMAB4A",
      "gAC0AYgB4AG8AcgAgADAAeA",
      "AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg",
      "AuAEkAbgB2AG8AawBlACgAKQAgAHwAI",
      "ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC",
      "AHsAMQB9AHsAMAB9ACIAIAAtAGYAI",
      "B7ADEAfQB7ADAAfQAiACAALQBmAC",
      "AewAxAH0AewAwAH0AIgAgAC0AZgAg",
      "AHsAMAB9AHsAMwB9ACIAIAAtAGYAI",
      "B7ADAAfQB7ADMAfQAiACAALQBmAC",
      "AewAwAH0AewAzAH0AIgAgAC0AZgAg",
      "AHsAMgB9AHsAMAB9ACIAIAAtAGYAI",
      "B7ADIAfQB7ADAAfQAiACAALQBmAC",
      "AewAyAH0AewAwAH0AIgAgAC0AZgAg",
      "AHsAMQB9AHsAMAB9ACcAIAAtAGYAI",
      "B7ADEAfQB7ADAAfQAnACAALQBmAC",
      "AewAxAH0AewAwAH0AJwAgAC0AZgAg",
      "AHsAMAB9AHsAMwB9ACcAIAAtAGYAI",
      "B7ADAAfQB7ADMAfQAnACAALQBmAC",
      "AewAwAH0AewAzAH0AJwAgAC0AZgAg",
      "AHsAMgB9AHsAMAB9ACcAIAAtAGYAI",
      "B7ADIAfQB7ADAAfQAnACAALQBmAC",
      "AewAyAH0AewAwAH0AJwAgAC0AZgAg"
    ]
  },
  "condition": "selection"
}

References:
  - https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/
Sigma Detection Rule: Potential ShellDispatch.DLL Functionality Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-20
Log source: windows/process_creation

Description:
Detects potential "ShellDispatch.dll" functionality abuse to execute arbitrary binaries via "ShellExecute"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "RunDll_ShellExecuteW"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
Sigma Detection Rule: Share And Session Enumeration Using Net.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Endgame, JHasenbusch (ported for oscd.community)
Date: 2018-10-30
ATT&CK techniques: T1018
Log source: windows/process_creation

Description:
Detects attempts to enumerate file shares, printer shares and sessions using "net.exe" with the "view" flag.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "view"
  },
  "filter": {
    "CommandLine|contains": "\\\\\\\\"
  },
  "condition": "all of selection_* and not filter"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
Sigma Detection Rule: Suspicious Use of PsLogList
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-18
ATT&CK techniques: T1087, T1087.001, T1087.002
Log source: windows/process_creation

Description:
Detects usage of the PsLogList utility to dump event log in order to extract admin accounts and perform account discovery or delete events logs

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "psloglist.exe"
    },
    {
      "Image|endswith": [
        "\\psloglist.exe",
        "\\psloglist64.exe"
      ]
    }
  ],
  "selection_cli_eventlog": {
    "CommandLine|contains": [
      " security",
      " application",
      " system"
    ]
  },
  "selection_cli_flags": {
    "CommandLine|contains|windash": [
      " -d",
      " -x",
      " -s",
      " -c",
      " -g"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/
  - https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList
  - https://twitter.com/EricaZelic/status/[PII_REDACTED]27874817
Sigma Detection Rule: Potentially Suspicious Child Process Of WinRAR.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-31
ATT&CK techniques: T1203
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of WinRAR.exe.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\WinRAR.exe"
  },
  "selection_binaries": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "cscript.exe",
        "mshta.exe",
        "PowerShell.EXE",
        "pwsh.dll",
        "regsvr32.exe",
        "RUNDLL32.EXE",
        "wscript.exe"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
  - https://github.com/knight0x07/WinRAR-Code-Execution-Vulnerability-CVE-2023-38831/blob/26ab6c40b6d2c09bb4fc60feaa4a3a90cfd20c23/Part-1-Overview.md
Sigma Detection Rule: Renamed PAExec Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jason Lynch
Date: 2021-05-22
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects execution of renamed version of PAExec. Often used by attackers

Detection logic:
{
  "selection": [
    {
      "Description": "PAExec Application"
    },
    {
      "OriginalFileName": "PAExec.exe"
    },
    {
      "Product|contains": "PAExec"
    },
    {
      "Hashes|contains": [
        "IMPHASH=11D40A7B7876288F919AB819CC2D9802",
        "IMPHASH=6444f8a34e99b8f7d9647de66aabe516",
        "IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f",
        "IMPHASH=1a6cca4d5460b1710a12dea39e4a592c"
      ]
    }
  ],
  "filter_main_known_location": [
    {
      "Image|endswith": "\\paexec.exe"
    },
    {
      "Image|startswith": "C:\\Windows\\PAExec-"
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.poweradmin.com/paexec/
  - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf
Sigma Detection Rule: Potential Arbitrary File Download Via Cmdl32.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-03
ATT&CK techniques: T1218, T1202
Log source: windows/process_creation

Description:
Detects execution of Cmdl32 with the "/vpn" and "/lan" flags.
Attackers can abuse this utility in order to download arbitrary files via a configuration file.
Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmdl32.exe"
    },
    {
      "OriginalFileName": "CMDL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/vpn",
      "/lan"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/
  - https://twitter.com/SwiftOnSecurity/status/[PII_REDACTED]63074824
  - https://github.com/LOLBAS-Project/LOLBAS/pull/151
Sigma Detection Rule: Virtualbox Driver Installation or Starting of VMs
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Janantha Marasinghe
Date: 2020-09-26
ATT&CK techniques: T1564.006, T1564
Log source: windows/process_creation

Description:
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

Detection logic:
{
  "selection_1": {
    "CommandLine|contains": [
      "VBoxRT.dll,RTR3Init",
      "VBoxC.dll",
      "VBoxDrv.sys"
    ]
  },
  "selection_2": {
    "CommandLine|contains": [
      "startvm",
      "controlvm"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
  - https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/