deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Uncommon Child Process Of Setres.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @gott_cyber, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-11
ATT&CK techniques: T1218, T1202
Log source: windows/process_creation

Description:
Detects uncommon child process of Setres.EXE.
Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution.
It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\setres.exe",
    "Image|contains": "\\choice"
  },
  "filter_main_legit_location": {
    "Image|endswith": [
      "C:\\Windows\\System32\\choice.exe",
      "C:\\Windows\\SysWOW64\\choice.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Setres/
  - https://twitter.com/0gtweet/status/[PII_REDACTED]40870144
  - https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)
Sigma Detection Rule: Sysinternals PsSuspend Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-23
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects usage of Sysinternals PsSuspend which can be abused to suspend critical processes

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "pssuspend.exe"
    },
    {
      "Image|endswith": [
        "\\pssuspend.exe",
        "\\pssuspend64.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend
  - https://twitter.com/0gtweet/status/[PII_REDACTED]17975046
Sigma Detection Rule: User Shell Folders Registry Modification via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-05
ATT&CK techniques: T1547.001, T1112
Log source: windows/process_creation

Description:
Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.
Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.
This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\reg.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell.exe",
        "pwsh.dll",
        "reg.exe"
      ]
    }
  ],
  "selection_cli_action": {
    "CommandLine|contains": [
      " add ",
      "New-ItemProperty",
      "Set-ItemProperty",
      "si "
    ]
  },
  "selection_cli_paths_root": {
    "CommandLine|contains": [
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",
      "\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
    ]
  },
  "selection_cli_paths_suffix": {
    "CommandLine|contains": "Startup"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
Sigma Detection Rule: Potential Unquoted Service Path Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects known WMI recon method to look for unquoted service paths using wmic. Often used by pentester and attacker enumeration scripts

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Image|endswith": "\\WMIC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " service get ",
      "name,displayname,pathname,startmode"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
  - https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Boot Configuration Tampering Via Bcdedit.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bcdedit.exe"
    },
    {
      "OriginalFileName": "bcdedit.exe"
    }
  ],
  "selection_set": {
    "CommandLine|contains": "set"
  },
  "selection_cli": [
    {
      "CommandLine|contains|all": [
        "bootstatuspolicy",
        "ignoreallfailures"
      ]
    },
    {
      "CommandLine|contains|all": [
        "recoveryenabled",
        "no"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md
  - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html
Sigma Detection Rule: PowerShell Set-Acl On Windows Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-18
Log source: windows/process_creation

Description:
Detects PowerShell scripts to set the ACL to a file in the Windows folder

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    }
  ],
  "selection_cmdlet": {
    "CommandLine|contains|all": [
      "Set-Acl ",
      "-AclObject "
    ]
  },
  "selection_paths": {
    "CommandLine|contains": [
      "-Path \"C:\\Windows",
      "-Path 'C:\\Windows",
      "-Path %windir%",
      "-Path $env:windir"
    ]
  },
  "selection_permissions": {
    "CommandLine|contains": [
      "FullControl",
      "Allow"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1505.005/T1505.005.md
Sigma Detection Rule: Suspicious Regsvr32 Execution From Remote Share
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-31
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects REGSVR32.exe to execute DLL hosted on remote shares

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "\\REGSVR32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " \\\\\\\\"
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
Sigma Detection Rule: Stop Windows Service Via PowerShell Stop-Service
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-05
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects the stopping of a Windows service via the PowerShell Cmdlet "Stop-Service"

Detection logic:
{
  "selection_sc_net_img": [
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "Stop-Service "
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-service?view=powershell-7.4
Sigma Detection Rule: Potential Arbitrary DLL Load Using Winword
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WINWORD.exe"
    },
    {
      "OriginalFileName": "WinWord.exe"
    }
  ],
  "selection_dll": {
    "CommandLine|contains|all": [
      "/l ",
      ".dll"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/D4Vinci/One-Lin3r/blob/9fdfa5f0b9c698dfbd4cdfe7d[PII_REDACTED]ae1c6/one_lin3r/core/liners/windows/cmd/dll_loader_word.py
Sigma Detection Rule: HackTool - Certipy Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems), Sittikorn Sangrattanapitak
Date: 2023-04-17
ATT&CK techniques: T1649
Log source: windows/process_creation

Description:
Detects Certipy execution, a tool for Active Directory Certificate Services enumeration and abuse based on PE metadata characteristics and common command line arguments.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\Certipy.exe"
    },
    {
      "OriginalFileName": "Certipy.exe"
    },
    {
      "Description|contains": "Certipy"
    }
  ],
  "selection_cli_commands": {
    "CommandLine|contains": [
      " account ",
      " auth ",
      " cert ",
      " find ",
      " forge ",
      " ptt ",
      " relay ",
      " req ",
      " shadow ",
      " template "
    ]
  },
  "selection_cli_flags": {
    "CommandLine|contains": [
      " -bloodhound",
      " -ca-pfx ",
      " -dc-ip ",
      " -kirbi",
      " -old-bloodhound",
      " -pfx ",
      " -target",
      " -template",
      " -username ",
      " -vulnerable",
      "auth -pfx",
      "shadow auto",
      "shadow list"
    ]
  },
  "condition": "selection_img or all of selection_cli_*"
}

References:
  - https://github.com/ly4k/Certipy
  - https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
Sigma Detection Rule: Root Certificate Installed From Susp Locations
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1553.004
Log source: windows/process_creation

Description:
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "Import-Certificate",
      " -FilePath ",
      "Cert:\\LocalMachine\\Root"
    ],
    "CommandLine|contains": [
      "\\AppData\\Local\\Temp\\",
      ":\\Windows\\TEMP\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Perflogs\\",
      ":\\Users\\Public\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/
  - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps
Sigma Detection Rule: HackTool - XORDump Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-28
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects suspicious use of XORDump process memory dumping utility

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\xordump.exe"
    },
    {
      "CommandLine|contains": [
        " -process lsass.exe ",
        " -m comsvcs ",
        " -m dbghelp ",
        " -m dbgcore "
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/audibleblink/xordump
Sigma Detection Rule: Gpscript Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-16
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\gpscript.exe"
    },
    {
      "OriginalFileName": "GPSCRIPT.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /logon",
      " /startup"
    ]
  },
  "filter_main_svchost": {
    "ParentCommandLine": "C:\\windows\\system32\\svchost.exe -k netsvcs -p -s gpsvc"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
  - https://lolbas-project.github.io/lolbas/Binaries/Gpscript/
Sigma Detection Rule: Use Short Name Path in Image
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-07
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

Detection logic:
{
  "selection": {
    "Image|contains": [
      "~1\\",
      "~2\\"
    ]
  },
  "filter_main_system_process": {
    "ParentImage": [
      "C:\\Windows\\System32\\Dism.exe",
      "C:\\Windows\\System32\\cleanmgr.exe"
    ]
  },
  "filter_main_installers": [
    {
      "Image|contains|all": [
        "\\AppData\\",
        "\\Temp\\"
      ]
    },
    {
      "Image|endswith": [
        "~1\\unzip.exe",
        "~1\\7zG.exe"
      ]
    }
  ],
  "filter_optional_webex": {
    "ParentImage|endswith": "\\WebEx\\WebexHost.exe"
  },
  "filter_optional_thor": {
    "ParentImage|endswith": "\\thor\\thor64.exe"
  },
  "filter_optional_installshield": [
    {
      "Product": "InstallShield (R)"
    },
    {
      "Description": "InstallShield (R) Setup Engine"
    },
    {
      "Company": "InstallShield Software Corporation"
    }
  ],
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/frack113/status/[PII_REDACTED]33375232
Sigma Detection Rule: PowerShell Download and Execution Cradles
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-24
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects PowerShell download and execution cradles.

Detection logic:
{
  "selection_download": {
    "CommandLine|contains": [
      ".DownloadString(",
      ".DownloadFile(",
      "Invoke-WebRequest ",
      "iwr ",
      "Invoke-RestMethod ",
      "irm "
    ]
  },
  "selection_iex": {
    "CommandLine|contains": [
      ";iex $",
      "| IEX",
      "|IEX ",
      "I`E`X",
      "I`EX",
      "IE`X",
      "iex ",
      "IEX (",
      "IEX(",
      "Invoke-Expression"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Potentially Suspicious Usage Of Qemu
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)
Date: 2024-06-03
ATT&CK techniques: T1090, T1572
Log source: windows/process_creation

Description:
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "-m 1M",
      "-m 2M",
      "-m 3M"
    ],
    "CommandLine|contains|all": [
      "restrict=off",
      "-netdev ",
      "connect=",
      "-nographic"
    ]
  },
  "filter_main_normal_usecase": {
    "CommandLine|contains": [
      " -cdrom ",
      " type=virt ",
      " -blockdev "
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://securelist.com/network-tunneling-with-qemu/111803/
  - https://www.qemu.org/docs/master/system/invocation.html#hxtool-5
Sigma Detection Rule: Potential Crypto Mining Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2021-10-26
ATT&CK techniques: T1496
Log source: windows/process_creation

Description:
Detects command line parameters or strings often used by crypto miners

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      " --cpu-priority=",
      "--donate-level=0",
      " -o pool.",
      " --nicehash",
      " --algo=rx/0 ",
      "stratum+tcp://",
      "stratum+udp://",
      "LS1kb25hdGUtbGV2ZWw9",
      "0tZG9uYXRlLWxldmVsP",
      "tLWRvbmF0ZS1sZXZlbD",
      "c3RyYXR1bSt0Y3A6Ly",
      "N0cmF0dW0rdGNwOi8v",
      "zdHJhdHVtK3RjcDovL",
      "c3RyYXR1bSt1ZHA6Ly",
      "N0cmF0dW0rdWRwOi8v",
      "zdHJhdHVtK3VkcDovL"
    ]
  },
  "filter": {
    "CommandLine|contains": [
      " pool.c ",
      " pool.o ",
      "gcc -"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.poolwatch.io/coin/monero
Sigma Detection Rule: Suspicious PowerShell Invocations - Specific - ProcessCreation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-05
Log source: windows/process_creation

Description:
Detects suspicious PowerShell invocation command parameters

Detection logic:
{
  "selection_convert_b64": {
    "CommandLine|contains|all": [
      "-nop",
      " -w ",
      "hidden",
      " -c ",
      "[Convert]::FromBase64String"
    ]
  },
  "selection_iex": {
    "CommandLine|contains|all": [
      " -w ",
      "hidden",
      "-noni",
      "-nop",
      " -c ",
      "iex",
      "New-Object"
    ]
  },
  "selection_enc": {
    "CommandLine|contains|all": [
      " -w ",
      "hidden",
      "-ep",
      "bypass",
      "-Enc"
    ]
  },
  "selection_reg": {
    "CommandLine|contains|all": [
      "powershell",
      "reg",
      "add",
      "\\software\\"
    ]
  },
  "selection_webclient": {
    "CommandLine|contains|all": [
      "bypass",
      "-noprofile",
      "-windowstyle",
      "hidden",
      "new-object",
      "system.net.webclient",
      ".download"
    ]
  },
  "selection_iex_webclient": {
    "CommandLine|contains|all": [
      "iex",
      "New-Object",
      "Net.WebClient",
      ".Download"
    ]
  },
  "filter_chocolatey": {
    "CommandLine|contains": [
      "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1",
      "Write-ChocolateyWarning"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_*"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - CrackMapExec Process Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-12
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects suspicious process patterns found in logs when CrackMapExec is used

Detection logic:
{
  "selection_lsass_dump1": {
    "CommandLine|contains|all": [
      "tasklist /fi ",
      "Imagename eq lsass.exe"
    ],
    "CommandLine|contains": [
      "cmd.exe /c ",
      "cmd.exe /r ",
      "cmd.exe /k ",
      "cmd /c ",
      "cmd /r ",
      "cmd /k "
    ],
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "selection_lsass_dump2": {
    "CommandLine|contains|all": [
      "do rundll32.exe C:\\windows\\System32\\comsvcs.dll, MiniDump",
      "\\Windows\\Temp\\",
      " full",
      "%%B"
    ]
  },
  "selection_procdump": {
    "CommandLine|contains|all": [
      "tasklist /v /fo csv",
      "findstr /i \"lsass\""
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass
Sigma Detection Rule: Suspicious Parent Double Extension File Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-06
ATT&CK techniques: T1036.007
Log source: windows/process_creation

Description:
Detect execution of suspicious double extension files in ParentCommandLine

Detection logic:
{
  "selection": [
    {
      "ParentImage|endswith": [
        ".doc.lnk",
        ".docx.lnk",
        ".xls.lnk",
        ".xlsx.lnk",
        ".ppt.lnk",
        ".pptx.lnk",
        ".rtf.lnk",
        ".pdf.lnk",
        ".txt.lnk",
        ".doc.js",
        ".docx.js",
        ".xls.js",
        ".xlsx.js",
        ".ppt.js",
        ".pptx.js",
        ".rtf.js",
        ".pdf.js",
        ".txt.js"
      ]
    },
    {
      "ParentCommandLine|contains": [
        ".doc.lnk",
        ".docx.lnk",
        ".xls.lnk",
        ".xlsx.lnk",
        ".ppt.lnk",
        ".pptx.lnk",
        ".rtf.lnk",
        ".pdf.lnk",
        ".txt.lnk",
        ".doc.js",
        ".docx.js",
        ".xls.js",
        ".xlsx.js",
        ".ppt.js",
        ".pptx.js",
        ".rtf.js",
        ".pdf.js",
        ".txt.js"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://www.virustotal.com/gui/file/7872d8845a332dce517adae9c3389fde5313ff2fed38c2577f3b498da786db68/behavior
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa
Sigma Detection Rule: PowerShell Download Pattern
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
Date: 2019-01-16
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects a Powershell process that contains download commands in its command line string

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell_ISE.EXE",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "new-object",
      "net.webclient).",
      "download"
    ],
    "CommandLine|contains": [
      "string(",
      "file("
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html
  - https://lab52.io/blog/winter-vivern-all-summer/
  - https://hatching.io/blog/powershell-analysis/
Sigma Detection Rule: JScript Compiler Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-05-02
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\jsc.exe"
    },
    {
      "OriginalFileName": "jsc.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Jsc/
  - https://www.phpied.com/make-your-javascript-a-windows-exe/
  - https://twitter.com/DissectMalware/status/[PII_REDACTED]07046913