deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential ReflectDebugger Content Execution Via WerFault.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-30
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WerFault.exe"
    },
    {
      "OriginalFileName": "WerFault.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -pr "
  },
  "condition": "all of selection_*"
}

References:
  - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
  - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
Sigma Detection Rule: Local Groups Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-12
ATT&CK techniques: T1069.001
Log source: windows/process_creation

Description:
Detects the execution of "wmic" with the "group" flag.
Adversaries may attempt to find local system groups and permission settings.
The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " group"
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
Sigma Detection Rule: Unusual Child Process of dns.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1133
Log source: windows/process_creation

Description:
Detects an unexpected process spawning from dns.exe which may indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\dns.exe"
  },
  "filter": {
    "Image|endswith": "\\conhost.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.elastic.co/guide/en/security/current/unusual-child-process-of-dns-exe.html
Sigma Detection Rule: UAC Bypass Using MSConfig Token Modification - Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ],
    "ParentImage|endswith": "\\AppData\\Local\\Temp\\pkgmgr.exe",
    "CommandLine": "\"C:\\Windows\\system32\\msconfig.exe\" -5"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious Process Start Locations
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: juju4, Jonhnathan Ribeiro, oscd.community
Date: 2019-01-16
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects suspicious process run from unusual locations

Detection logic:
{
  "selection": [
    {
      "Image|contains": [
        ":\\RECYCLER\\",
        ":\\SystemVolumeInformation\\"
      ]
    },
    {
      "Image|startswith": [
        "C:\\Windows\\Tasks\\",
        "C:\\Windows\\debug\\",
        "C:\\Windows\\fonts\\",
        "C:\\Windows\\help\\",
        "C:\\Windows\\drivers\\",
        "C:\\Windows\\addins\\",
        "C:\\Windows\\cursors\\",
        "C:\\Windows\\system32\\tasks\\"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://car.mitre.org/wiki/CAR-2013-05-002
Sigma Detection Rule: Obfuscated IP Via CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2022-08-03
Log source: windows/process_creation

Description:
Detects usage of an encoded/obfuscated version of an IP address (hex, octal, etc.) via command line

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\ping.exe",
      "\\arp.exe"
    ]
  },
  "selection_ip_1": {
    "CommandLine|contains": [
      " 0x",
      "//0x",
      ".0x",
      ".00x"
    ]
  },
  "selection_ip_2": {
    "CommandLine|contains|all": [
      "http://%",
      "%2e"
    ]
  },
  "selection_ip_3": [
    {
      "CommandLine|re": "https?://[0-9]{1,3}\\.[0-9]{1,3}\\.0[0-9]{3,4}"
    },
    {
      "CommandLine|re": "https?://[0-9]{1,3}\\.0[0-9]{3,7}"
    },
    {
      "CommandLine|re": "https?://0[0-9]{3,11}"
    },
    {
      "CommandLine|re": "https?://(?:0[0-9]{1,11}\\.){3}0[0-9]{1,11}"
    },
    {
      "CommandLine|re": "https?://0[0-9]{1,11}"
    },
    {
      "CommandLine|re": " [0-7]{7,13}"
    }
  ],
  "filter_main_valid_ip": {
    "CommandLine|re": "https?://(?:(?:25[0-5]|(?:2[0-4]|1\\d|[1-9])?\\d)(?:\\.|\\b)){4}"
  },
  "condition": "selection_img and 1 of selection_ip_* and not 1 of filter_main_*"
}

References:
  - https://h.43z.one/ipconverter/
  - https://twitter.com/Yasser_Elsnbary/status/[PII_REDACTED]54564608
Sigma Detection Rule: Potential AMSI Bypass Using NULL Bits
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-04
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "if(0){{{0}}}' -f $(0 -as [char]) +",
      "#<NULL>"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi
Sigma Detection Rule: Potential Persistence Via Netsh Helper DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2019-10-25
ATT&CK techniques: T1546.007
Log source: windows/process_creation

Description:
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.


Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "netsh.exe"
    },
    {
      "Image|endswith": "\\netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "add",
      "helper"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md
  - https://github.com/outflanknl/NetshHelperBeacon
  - https://web.archive.org/web/[PII_REDACTED]2230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/
Sigma Detection Rule: Webshell Detection With Command Line Keywords
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
Date: 2017-01-01
ATT&CK techniques: T1505.003, T1018, T1033, T1087
Log source: windows/process_creation

Description:
Detects certain command line parameters often used during reconnaissance activity via web shells

Detection logic:
{
  "selection_webserver_image": {
    "ParentImage|endswith": [
      "\\w3wp.exe",
      "\\php-cgi.exe",
      "\\nginx.exe",
      "\\httpd.exe",
      "\\caddy.exe",
      "\\ws_tomcatservice.exe"
    ]
  },
  "selection_webserver_characteristics_tomcat1": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "ParentImage|contains": [
      "-tomcat-",
      "\\tomcat"
    ]
  },
  "selection_webserver_characteristics_tomcat2": {
    "ParentImage|endswith": [
      "\\java.exe",
      "\\javaw.exe"
    ],
    "CommandLine|contains": [
      "catalina.jar",
      "CATALINA_HOME"
    ]
  },
  "selection_susp_net_utility": {
    "OriginalFileName": [
      "net.exe",
      "net1.exe"
    ],
    "CommandLine|contains": [
      " user ",
      " use ",
      " group "
    ]
  },
  "selection_susp_ping_utility": {
    "OriginalFileName": "ping.exe",
    "CommandLine|contains": " -n "
  },
  "selection_susp_change_dir": {
    "CommandLine|contains": [
      "&cd&echo",
      "cd /d "
    ]
  },
  "selection_susp_wmic_utility": {
    "OriginalFileName": "wmic.exe",
    "CommandLine|contains": " /node:"
  },
  "selection_susp_powershell_cli": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      " -enc ",
      " -EncodedCommand ",
      " -w hidden ",
      " -windowstyle hidden",
      ".WebClient).Download"
    ]
  },
  "selection_susp_misc_discovery_binaries": [
    {
 

References:
  - https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html
  - https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/
  - https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
Sigma Detection Rule: Firewall Configuration Discovery Via Netsh.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
Date: 2021-12-07
ATT&CK techniques: T1016
Log source: windows/process_creation

Description:
Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\netsh.exe"
    },
    {
      "OriginalFileName": "netsh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "netsh",
      "show ",
      "firewall "
    ],
    "CommandLine|contains": [
      "config ",
      "state ",
      "rule ",
      "name=all"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules
  - https://ss64.com/nt/netsh.html
Sigma Detection Rule: Suspicious Process Execution From Fake Recycle.Bin Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-07-12
Log source: windows/process_creation

Description:
Detects process execution from a fake recycle bin folder, often used to avoid security solution.

Detection logic:
{
  "selection": {
    "Image|contains": [
      "RECYCLERS.BIN\\",
      "RECYCLER.BIN\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets
  - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
Sigma Detection Rule: DumpMinitool Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-04-06
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\DumpMinitool.exe",
        "\\DumpMinitool.x86.exe",
        "\\DumpMinitool.arm64.exe"
      ]
    },
    {
      "OriginalFileName": [
        "DumpMinitool.exe",
        "DumpMinitool.x86.exe",
        "DumpMinitool.arm64.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " Full",
      " Mini",
      " WithHeap"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]88131586
  - https://twitter.com/mrd0x/status/[PII_REDACTED]47684615
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/
  - https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f
Sigma Detection Rule: Suspicious PowerShell Parameter Substring
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)
Date: 2019-01-16
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious PowerShell invocation with a parameter substring

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      " -windowstyle h ",
      " -windowstyl h",
      " -windowsty h",
      " -windowst h",
      " -windows h",
      " -windo h",
      " -wind h",
      " -win h",
      " -wi h",
      " -win h ",
      " -win hi ",
      " -win hid ",
      " -win hidd ",
      " -win hidde ",
      " -NoPr ",
      " -NoPro ",
      " -NoProf ",
      " -NoProfi ",
      " -NoProfil ",
      " -nonin ",
      " -nonint ",
      " -noninte ",
      " -noninter ",
      " -nonintera ",
      " -noninterac ",
      " -noninteract ",
      " -noninteracti ",
      " -noninteractiv ",
      " -ec ",
      " -encodedComman ",
      " -encodedComma ",
      " -encodedComm ",
      " -encodedCom ",
      " -encodedCo ",
      " -encodedC ",
      " -encoded ",
      " -encode ",
      " -encod ",
      " -enco ",
      " -en ",
      " -executionpolic ",
      " -executionpoli ",
      " -executionpol ",
      " -executionpo ",
      " -executionp ",
      " -execution bypass",
      " -executio bypass",
      " -executi bypass",
      " -execut bypass",
      " -execu bypass",
      " -exec bypass",
      " -exe bypass",
      " -ex bypass",
      " -ep bypass",
      " /windowstyle h ",
      " /windowstyl h",
      " /windowsty h",
      " /windowst h",
      " /windows h",
      " /windo h",
      " /wind h",
      " /win h",
      " /wi h",
      " /win h ",
     

References:
  - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
Sigma Detection Rule: Using SettingSyncHost.exe as LOLBin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Anton Kutepov, oscd.community
Date: 2020-02-05
ATT&CK techniques: T1574.008
Log source: windows/process_creation

Description:
Detects using SettingSyncHost.exe to run hijacked binary

Detection logic:
{
  "system_utility": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "parent_is_settingsynchost": {
    "ParentCommandLine|contains|all": [
      "cmd.exe /c",
      "RoamDiag.cmd",
      "-outputpath"
    ]
  },
  "condition": "not system_utility and parent_is_settingsynchost"
}

References:
  - https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
Sigma Detection Rule: Potential Adplus.EXE Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-09
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects execution of "AdPlus.exe", a binary that is part of the Windows SDK that can be used as a LOLBIN in order to dump process memory and execute arbitrary commands.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\adplus.exe"
    },
    {
      "OriginalFileName": "Adplus.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -hang ",
      " -pn ",
      " -pmn ",
      " -p ",
      " -po ",
      " -c ",
      " -sc "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/
  - https://twitter.com/nas_bench/status/[PII_REDACTED]76422152
  - https://twitter.com/nas_bench/status/[PII_REDACTED]56917506
Sigma Detection Rule: Remote CHM File Download/Execution Via HH.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-29
ATT&CK techniques: T1218.001
Log source: windows/process_creation

Description:
Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "HH.exe"
    },
    {
      "Image|endswith": "\\hh.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "http://",
      "https://",
      "\\\\\\\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html
  - https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md
  - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
Sigma Detection Rule: Use Icacls to Hide File to Everyone
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-07-18
ATT&CK techniques: T1564.001
Log source: windows/process_creation

Description:
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Detection logic:
{
  "selection_icacls": [
    {
      "OriginalFileName": "iCACLS.EXE"
    },
    {
      "Image|endswith": "\\icacls.exe"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|all": [
      "/deny",
      "*S-1-1-0:"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/
Sigma Detection Rule: Dumping Process via Sqldumper.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kirill Kiryanov, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects process dump via legitimate sqldumper.exe binary

Detection logic:
{
  "selection": {
    "Image|endswith": "\\sqldumper.exe",
    "CommandLine|contains": [
      "0x0110",
      "0x01100:40"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/countuponsec/status/[PII_REDACTED]53068800
  - https://twitter.com/countuponsec/status/[PII_REDACTED]15232518
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/
Sigma Detection Rule: Wlrmdr.EXE Uncommon Argument Or Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: frack113, manasmbellani
Date: 2022-02-16
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries.
This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\wlrmdr.exe"
  },
  "selection_child_img": [
    {
      "Image|endswith": "\\wlrmdr.exe"
    },
    {
      "OriginalFileName": "WLRMNDR.EXE"
    }
  ],
  "selection_child_cli_flags_s": {
    "CommandLine|contains|windash": "-s "
  },
  "selection_child_cli_flags_f": {
    "CommandLine|contains|windash": "-f "
  },
  "selection_child_cli_flags_t": {
    "CommandLine|contains|windash": "-t "
  },
  "selection_child_cli_flags_m": {
    "CommandLine|contains|windash": "-m "
  },
  "selection_child_cli_flags_a": {
    "CommandLine|contains|windash": "-a "
  },
  "selection_child_cli_flags_u": {
    "CommandLine|contains|windash": "-u "
  },
  "filter_main_winlogon": {
    "ParentImage": "C:\\Windows\\System32\\winlogon.exe"
  },
  "filter_main_empty": {
    "ParentImage": [
      "",
      "-"
    ]
  },
  "filter_main_null": {
    "ParentImage": null
  },
  "condition": "selection_parent or (all of selection_child_* and not 1 of filter_main_*)"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]45220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ
  - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/
Sigma Detection Rule: HackTool - WinPwn Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-12-04
ATT&CK techniques: T1046, T1082, T1106, T1518, T1548.002, T1552.001, T1555, T1555.003
Log source: windows/process_creation

Description:
Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "Offline_Winpwn",
      "WinPwn ",
      "WinPwn.exe",
      "WinPwn.ps1"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/S3cur3Th1sSh1t/WinPwn
  - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?[PII_REDACTED]
  - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
  - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
  - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
Sigma Detection Rule: Potential Windows Defender AV Bypass Via Dump64.EXE Rename
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer @austinsonger, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-11-26
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects when a user is potentially trying to bypass the Windows Defender AV by renaming a tool to dump64.exe and placing it in the Visual Studio folder.
Currently the rule is covering only usage of procdump but other utilities can be added in order to increase coverage.


Detection logic:
{
  "selection_dump": {
    "Image|startswith": ":\\Program Files",
    "Image|contains": "\\Microsoft Visual Studio\\",
    "Image|endswith": "\\dump64.exe"
  },
  "selection_tools_procdump": [
    {
      "OriginalFileName": "procdump"
    },
    {
      "CommandLine|contains": [
        " -ma ",
        " -mp "
      ]
    }
  ],
  "condition": "selection_dump and 1 of selection_tools_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]17251595
Sigma Detection Rule: UAC Bypass Using IEInstal - Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using IEInstal.exe (UACMe 64)

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ],
    "ParentImage|endswith": "\\ieinstal.exe",
    "Image|contains": "\\AppData\\Local\\Temp\\",
    "Image|endswith": "consent.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME