deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Local Accounts Discovery
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1033, T1087.001
Log source: windows/process_creation

Description:
Local accounts, System Owner/User discovery using operating systems utilities

Detection logic:
{
  "selection_other_img": [
    {
      "Image|endswith": [
        "\\whoami.exe",
        "\\quser.exe",
        "\\qwinsta.exe"
      ]
    },
    {
      "OriginalFileName": [
        "whoami.exe",
        "quser.exe",
        "qwinsta.exe"
      ]
    }
  ],
  "selection_other_wmi": {
    "Image|endswith": "\\wmic.exe",
    "CommandLine|contains|all": [
      "useraccount",
      "get"
    ]
  },
  "selection_other_cmdkey": {
    "Image|endswith": "\\cmdkey.exe",
    "CommandLine|contains": " /l"
  },
  "selection_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      " /c",
      "dir ",
      "\\Users\\"
    ]
  },
  "filter_cmd": {
    "CommandLine|contains": " rmdir "
  },
  "selection_net": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains": "user"
  },
  "filter_net": {
    "CommandLine|contains": [
      "/domain",
      "/add",
      "/delete",
      "/active",
      "/expires",
      "/passwordreq",
      "/scriptpath",
      "/times",
      "/workstations"
    ]
  },
  "condition": "(selection_cmd and not filter_cmd) or (selection_net and not filter_net) or 1 of selection_other_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md
Sigma Detection Rule: Potential Network Sniffing Activity Using Network Tools
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-21
ATT&CK techniques: T1040
Log source: windows/process_creation

Description:
Detects potential network sniffing via use of network tools such as "tshark", "windump".
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.


Detection logic:
{
  "selection_tshark": {
    "Image|endswith": "\\tshark.exe",
    "CommandLine|contains": "-i"
  },
  "selection_windump": {
    "Image|endswith": "\\windump.exe"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1040/T1040.md
Sigma Detection Rule: WSL Kali-Linux Usage
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-10
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects the use of Kali Linux through Windows Subsystem for Linux

Detection logic:
{
  "selection_img_appdata": [
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\AppData\\Local\\packages\\KaliLinux"
      ]
    },
    {
      "Image|contains|all": [
        ":\\Users\\",
        "\\AppData\\Local\\Microsoft\\WindowsApps\\kali.exe"
      ]
    }
  ],
  "selection_img_windowsapps": {
    "Image|contains": ":\\Program Files\\WindowsApps\\KaliLinux.",
    "Image|endswith": "\\kali.exe"
  },
  "selection_kali_wsl_parent": {
    "ParentImage|endswith": [
      "\\wsl.exe",
      "\\wslhost.exe"
    ]
  },
  "selection_kali_wsl_child": [
    {
      "Image|contains": [
        "\\kali.exe",
        "\\KaliLinux"
      ]
    },
    {
      "CommandLine|contains": [
        "Kali.exe",
        "Kali-linux",
        "kalilinux"
      ]
    }
  ],
  "filter_main_install_uninstall": {
    "CommandLine|contains": [
      " -i ",
      " --install ",
      " --unregister "
    ]
  },
  "condition": "1 of selection_img_* or all of selection_kali_* and not 1 of filter_main_*"
}

References:
  - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
  - https://learn.microsoft.com/en-us/windows/wsl/install
Sigma Detection Rule: Potential Remote Desktop Tunneling
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1021
Log source: windows/process_creation

Description:
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.

Detection logic:
{
  "selection": {
    "CommandLine|contains": ":3389"
  },
  "selection_opt": {
    "CommandLine|contains": [
      " -L ",
      " -P ",
      " -R ",
      " -pw ",
      " -ssh "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html
Sigma Detection Rule: Potential Active Directory Enumeration Using AD Module - ProcCreation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-01-22
Log source: windows/process_creation

Description:
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cmdlet": {
    "CommandLine|contains": [
      "Import-Module ",
      "ipmo "
    ]
  },
  "selection_dll": {
    "CommandLine|contains": "Microsoft.ActiveDirectory.Management.dll"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/samratashok/ADModule
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]66061568?s=20
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
Sigma Detection Rule: Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-03-01
ATT&CK techniques: T1059.001, T1027
Log source: windows/process_creation

Description:
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ",
      "oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA",
      "6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA",
      "OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ",
      "oAOgAoACIATABvACIAKwAiAGEAZAAiACkA",
      "6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA",
      "OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ",
      "oAOgAoACIATABvAGEAIgArACIAZAAiACkA",
      "6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA",
      "OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ",
      "oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA",
      "6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA",
      "OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ",
      "oAOgAoACcATABvACcAKwAnAGEAZAAnACkA",
      "6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA",
      "OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ",
      "oAOgAoACcATABvAGEAJwArACcAZAAnACkA",
      "6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Neo23x0/Raccine/blob/20a569fa[PII_REDACTED]3dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0
Sigma Detection Rule: Esentutl Gather Credentials
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: sam0x90
Date: 2021-08-06
ATT&CK techniques: T1003, T1003.003
Log source: windows/process_creation

Description:
Conti recommendation to its affiliates to use esentutl to access NTDS dumped file. Trickbot also uses this utilities to get MSEdge info via its module pwgrab.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "esentutl",
      " /p"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]60002816
  - https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/
Sigma Detection Rule: Suspicious GrpConv Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-19
ATT&CK techniques: T1547
Log source: windows/process_creation

Description:
Detects the suspicious execution of a utility to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "grpconv.exe -o",
      "grpconv -o"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]31200770
Sigma Detection Rule: Service DACL Abuse To Hide Services Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2021-12-20
ATT&CK techniques: T1574.011
Log source: windows/process_creation

Description:
Detects usage of the "sc.exe" utility adding a new service with special permission seen used by threat actors which makes the service hidden and unremovable.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "sdset",
      "DCLCWPDTSD"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]96828672
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
Sigma Detection Rule: NtdllPipe Like Activity Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-05
Log source: windows/process_creation

Description:
Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "type %windir%\\system32\\ntdll.dll",
      "type %systemroot%\\system32\\ntdll.dll",
      "type c:\\windows\\system32\\ntdll.dll",
      "\\\\ntdll.dll > \\\\\\\\.\\\\pipe\\\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1156/https://www.x86matthew.com/view_post?id=ntdll_pipe
Sigma Detection Rule: Disabled Volume Snapshots
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-28
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects commands that temporarily turn off Volume Snapshots

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\Services\\VSS\\Diag",
      "/d Disabled"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]66115331
Sigma Detection Rule: XBAP Execution From Uncommon Locations Via PresentationHost.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-01
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\presentationhost.exe"
    },
    {
      "OriginalFileName": "PresentationHost.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": ".xbap"
  },
  "filter_main_generic": {
    "CommandLine|contains": [
      " C:\\Windows\\",
      " C:\\Program Files"
    ]
  },
  "condition": "all of selection* and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/
Sigma Detection Rule: Always Install Elevated MSI Spawned Cmd And Powershell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community
Date: 2020-10-13
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects Windows Installer service (msiexec.exe) spawning "cmd" or "powershell"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_parent": {
    "ParentImage|contains|all": [
      "\\Windows\\Installer\\",
      "msi"
    ],
    "ParentImage|endswith": "tmp"
  },
  "condition": "all of selection_*"
}

References:
  - https://image.slidesharecdn.com/kheirkhabarovoffzonefinal[PII_REDACTED]58/95/hunting-for-privilege-escalation-in-windows-environment-50-638.jpg
Sigma Detection Rule: Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-13
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the usage of "reg.exe" to add Defender folder exclusions. Qbot has been seen using this technique to add exclusions for folders within AppData and ProgramData.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains": [
      "SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths",
      "SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths"
    ],
    "CommandLine|contains|all": [
      "ADD ",
      "/t ",
      "REG_DWORD ",
      "/v ",
      "/d ",
      "0"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
  - https://redcanary.com/threat-detection-report/threats/qbot/
Sigma Detection Rule: LOL-Binary Copied From System Directory
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-29
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations.


Detection logic:
{
  "selection_tools_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": "copy "
  },
  "selection_tools_pwsh": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      "copy-item",
      " copy ",
      "cpi ",
      " cp "
    ]
  },
  "selection_tools_other": [
    {
      "Image|endswith": [
        "\\robocopy.exe",
        "\\xcopy.exe"
      ]
    },
    {
      "OriginalFileName": [
        "robocopy.exe",
        "XCOPY.EXE"
      ]
    }
  ],
  "selection_target_path": {
    "CommandLine|contains": [
      "\\System32",
      "\\SysWOW64",
      "\\WinSxS"
    ]
  },
  "selection_target_lolbin": {
    "CommandLine|contains": [
      "\\bitsadmin.exe",
      "\\calc.exe",
      "\\certutil.exe",
      "\\cmdl32.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\rundll32.exe",
      "\\wscript.exe",
      "\\ie4uinit.exe"
    ]
  },
  "condition": "1 of selection_tools_* and all of selection_target_*"
}

References:
  - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
  - https://web.archive.org/web/[PII_REDACTED]4337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
  - https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior
Sigma Detection Rule: Uncommon AddinUtil.EXE CommandLine Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\addinutil.exe"
    },
    {
      "OriginalFileName": "AddInUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "-AddInRoot:",
      "-PipelineRoot:"
    ]
  },
  "filter_main_addinroot": {
    "CommandLine|contains": [
      "-AddInRoot:\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA",
      "-AddInRoot:C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA",
      "-PipelineRoot:\"C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA",
      "-PipelineRoot:C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTA"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Sigma Detection Rule: Logged-On User Password Change Via Ksetup.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-06
Log source: windows/process_creation

Description:
Detects password change for the logged-on user's via "ksetup.exe"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ksetup.exe"
    },
    {
      "OriginalFileName": "ksetup.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " /ChangePassword "
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup
Sigma Detection Rule: Suspicious Child Process Of SQL Server
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: FPT.EagleEye Team, wagga
Date: 2020-12-11
ATT&CK techniques: T1505.003, T1190
Log source: windows/process_creation

Description:
Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\sqlservr.exe",
    "Image|endswith": [
      "\\bash.exe",
      "\\bitsadmin.exe",
      "\\cmd.exe",
      "\\netstat.exe",
      "\\nltest.exe",
      "\\ping.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\sh.exe",
      "\\systeminfo.exe",
      "\\tasklist.exe",
      "\\wsl.exe"
    ]
  },
  "filter_optional_datev": {
    "ParentImage|startswith": "C:\\Program Files\\Microsoft SQL Server\\",
    "ParentImage|endswith": "DATEV_DBENGINE\\MSSQL\\Binn\\sqlservr.exe",
    "Image": "C:\\Windows\\System32\\cmd.exe",
    "CommandLine|startswith": "\"C:\\Windows\\system32\\cmd.exe\" "
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - Internal Research
Sigma Detection Rule: HackTool - WinRM Access Via Evil-WinRM
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1021.006
Log source: windows/process_creation

Description:
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\ruby.exe",
    "CommandLine|contains|all": [
      "-i ",
      "-u ",
      "-p "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm
  - https://github.com/Hackplayers/evil-winrm
Sigma Detection Rule: Lolbin Runexehelper Use As Proxy
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-29
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\runexehelper.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]39289344
  - https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/
Sigma Detection Rule: Hacktool - EDR-Freeze Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-24
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects execution of EDR-Freeze, a tool that exploits the MiniDumpWriteDump function and WerFaultSecure.exe to suspend EDR and Antivirus processes on Windows.
EDR-Freeze leverages a race-condition attack to put security processes into a dormant state by suspending WerFaultSecure at the moment it freezes the target process.
This technique does not require kernel-level exploits or BYOVD, but instead abuses user-mode functionality to temporarily disable monitoring by EDR or Antimalware solutions.


Detection logic:
{
  "selection_img": {
    "Image|contains": [
      "\\EDR-Freeze",
      "\\EDRFreeze"
    ],
    "Image|endswith": ".exe"
  },
  "selection_imphash": {
    "Hashes|contains": [
      "IMPHASH=1195F7935954A2CD09157390C33F8E8C",
      "IMPHASH=129F58DE3D687FB7F012BF6C3D679997",
      "IMPHASH=2C617A175D[PII_REDACTED]C6619F7CC8BA",
      "IMPHASH=8828F0B906F7844358FB92A899E9520F",
      "IMPHASH=AF76D95157EC554DC1EF178E4E66D447",
      "IMPHASH=E1B04316B61ACA31DD52ABBEC0A37FD5",
      "IMPHASH=8B2D5B54AFCFEC60D54F6B31D80ED4A0",
      "IMPHASH=AB8BB31EDD91D2A05FE7B62A535E9EB7"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
  - https://github.com/TwoSevenOneT/EDR-Freeze
Sigma Detection Rule: Suspicious File Download From IP Via Wget.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-27
Log source: windows/process_creation

Description:
Detects potentially suspicious file downloads directly from IP addresses using Wget.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wget.exe"
    },
    {
      "OriginalFileName": "wget.exe"
    }
  ],
  "selection_ip": {
    "CommandLine|re": "://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_flag": [
    {
      "CommandLine|re": "\\s-O\\s"
    },
    {
      "CommandLine|contains": "--output-document"
    }
  ],
  "selection_ext": {
    "CommandLine|endswith": [
      ".ps1",
      ".ps1'",
      ".ps1\"",
      ".dat",
      ".dat'",
      ".dat\"",
      ".msi",
      ".msi'",
      ".msi\"",
      ".bat",
      ".bat'",
      ".bat\"",
      ".exe",
      ".exe'",
      ".exe\"",
      ".vbs",
      ".vbs'",
      ".vbs\"",
      ".vbe",
      ".vbe'",
      ".vbe\"",
      ".hta",
      ".hta'",
      ".hta\"",
      ".dll",
      ".dll'",
      ".dll\"",
      ".psm1",
      ".psm1'",
      ".psm1\""
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.gnu.org/software/wget/manual/wget.html