deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: UNC4841 - Download Tar File From Untrusted Direct IP Via Wget
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
ATT&CK techniques: T1140
Log source: linux/process_creation

Description:
Detects execution of "wget" to download a "tar" from an IP address that doesn't have a trusted certificate. As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Detection logic:
{
  "selection": {
    "Image|endswith": "/wget",
    "CommandLine|re": "https://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
    "CommandLine|contains": "--no-check-certificate",
    "CommandLine|endswith": ".tar"
  },
  "filter_main_local_ips": {
    "CommandLine|contains": [
      "https://10.",
      "https://192.168.",
      "https://172.16.",
      "https://172.17.",
      "https://172.18.",
      "https://172.19.",
      "https://172.20.",
      "https://172.21.",
      "https://172.22.",
      "https://172.23.",
      "https://172.24.",
      "https://172.25.",
      "https://172.26.",
      "https://172.27.",
      "https://172.28.",
      "https://172.29.",
      "https://172.30.",
      "https://172.31.",
      "https://127.",
      "https://169.254."
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: UNC4841 - SSL Certificate Exfiltration Via Openssl
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
ATT&CK techniques: T1140
Log source: linux/process_creation

Description:
Detects the execution of "openssl" to connect to an IP address. This techniques was used by UNC4841 to exfiltrate SSL certificates and as a C2 channel with named pipes. Investigate commands executed in the temporal vicinity of this command.

Detection logic:
{
  "selection": {
    "Image|endswith": "/openssl",
    "CommandLine|re": "[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}",
    "CommandLine|contains|all": [
      "s_client",
      "-quiet",
      "-connect"
    ],
    "CommandLine|contains": [
      ":443",
      ":8080"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: UNC4841 - Email Exfiltration File Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
Log source: linux/file_event

Description:
Detects filename pattern of email related data used by UNC4841 for staging and exfiltration

Detection logic:
{
  "selection": {
    "TargetFilename|re": "/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}\\.tar\\.gz"
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: UNC4841 - Download Compressed Files From Temp.sh Using Wget
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
ATT&CK techniques: T1140
Log source: linux/process_creation

Description:
Detects execution of "wget" to download a ".zip" or ".rar" files from "temp.sh". As seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Detection logic:
{
  "selection": {
    "Image|endswith": "/wget",
    "CommandLine|contains": "https://temp.sh/",
    "CommandLine|endswith": [
      ".rar",
      ".zip"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: UNC4841 - Barracuda ESG Exploitation Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
Log source: linux/file_event

Description:
Detects file indicators as seen used by UNC4841 during their Barracuda ESG zero day exploitation.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "/11111.tar",
      "/aacore.sh",
      "/appcheck.sh",
      "/autoins",
      "/BarracudaMailService",
      "/etc/cron.daily/core_check.sh",
      "/etc/cron.daily/core.sh",
      "/etc/cron.hourly/aacore.sh",
      "/etc/cron.hourly/appcheck.sh",
      "/etc/cron.hourly/core.sh",
      "/get_fs_info.pl",
      "/imgdata.jpg",
      "/install_att_v2.tar",
      "/install_bvp74_auth.tar",
      "/install_helo.tar",
      "/install_reuse.tar",
      "/intent_helo",
      "/intent_reuse",
      "/intentbas",
      "/mod_attachment.lua",
      "/mod_content.lua",
      "/mod_require_helo.lua",
      "/mod_rtf",
      "/mod_sender.lua",
      "/mod_udp.so",
      "/nfsd_stub.ko",
      "/resize_reisertab",
      "/resize_risertab",
      "/resize2fstab",
      "/rverify",
      "/saslautchd",
      "/sendscd",
      "/snapshot.tar",
      "/tmp/p",
      "/tmp/p7",
      "/tmp/t",
      "/update_v2.sh",
      "/update_v31.sh",
      "/update_v35.sh",
      "/update_version"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
Sigma Detection Rule: Onyx Sleet APT File Creation Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
Log source: windows/file_event

Description:
Detects file creation activity that is related to Onyx Sleet APT activity

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ":\\Windows\\ADFS\\bg\\inetmgr.exe"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: Lazarus APT DLL Sideloading Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thurein Oo, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-18
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company

Detection logic:
{
  "selection_mscoree": {
    "Image": "C:\\ProgramShared\\PresentationHost.exe",
    "ImageLoaded": ":\\ProgramShared\\mscoree.dll"
  },
  "selection_colorui": {
    "Image": "C:\\ProgramData\\Adobe\\colorcpl.exe",
    "ImageLoaded": "C:\\ProgramData\\Adobe\\colorui.dll"
  },
  "selection_mapistub": {
    "Image": "C:\\ProgramData\\Oracle\\Java\\fixmapi.exe",
    "ImageLoaded": "C:\\ProgramData\\Oracle\\Java\\mapistub.dll"
  },
  "selection_hid": {
    "Image": "C:\\ProgramData\\Adobe\\ARM\\tabcal.exe",
    "ImageLoaded": "C:\\ProgramData\\Adobe\\ARM\\HID.dll"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/
  - https://www.bleepingcomputer.com/news/security/lazarus-hackers-breach-aerospace-firm-with-new-lightlesscan-malware/
Sigma Detection Rule: PaperCut MF/NG Exploitation Related Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-25
Log source: windows/process_creation

Description:
Detects exploitation indicators related to PaperCut MF/NG Exploitation

Detection logic:
{
  "selection_1": {
    "CommandLine|contains|all": [
      " /c ",
      "powershell",
      "-nop -w hidden",
      "Invoke-WebRequest",
      "setup.msi",
      "-OutFile"
    ]
  },
  "selection_2": {
    "CommandLine|contains|all": [
      "msiexec ",
      "/i ",
      "setup.msi ",
      "/qn ",
      "IntegratorLogin=fimaribahundq"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
  - https://www.papercut.com/kb/Main/PO-1216-and-PO-1219
Sigma Detection Rule: PaperCut MF/NG Potential Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)
Date: 2023-04-20
Log source: windows/process_creation

Description:
Detects suspicious child processes of "pc-app.exe". Which could indicate potential exploitation of PaperCut

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\pc-app.exe",
    "Image|endswith": [
      "\\bash.exe",
      "\\calc.exe",
      "\\certutil.exe",
      "\\cmd.exe",
      "\\csc.exe",
      "\\cscript.exe",
      "\\dllhost.exe",
      "\\mshta.exe",
      "\\msiexec.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\scriptrunner.exe",
      "\\wmic.exe",
      "\\wscript.exe",
      "\\wsl.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software
  - https://github.com/huntresslabs/threat-intel/blob/3bad6b0fadfcca3ff5680923e74e39edd72f32da/2023/2023-04/20-PaperCut/win_susp_papercut_code_execution.yml
Sigma Detection Rule: Potential APT Mustang Panda Activity Against Australian Gov
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/process_creation

Description:
Detects specific command line execution used by Mustang Panda in a targeted attack against the Australian government as reported by Lab52

Detection logic:
{
  "selection_1": {
    "CommandLine|contains|all": [
      "copy SolidPDFCreator.dll",
      "C:\\Users\\Public\\Libraries\\PhotoTvRHD\\SolidPDFCreator.dll"
    ]
  },
  "selection_2": {
    "CommandLine|contains|all": [
      "reg ",
      "\\Windows\\CurrentVersion\\Run",
      "SolidPDF",
      "C:\\Users\\Public\\Libraries\\PhotoTvRHD\\"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/
Sigma Detection Rule: Blackbyte Ransomware Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-24
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects specific windows registry modifications made by BlackByte ransomware variants.
BlackByte set three different registry values to escalate privileges and begin setting the stage for lateral movement and encryption.
This rule triggers when any of the following registry keys are set to DWORD 1, however all three should be investigated as part of a larger BlackByte ransomware detection and response effort.


Detection logic:
{
  "selection": {
    "TargetObject": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\LocalAccountTokenFilterPolicy",
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\EnableLinkedConnections",
      "HKLM\\SYSTEM\\CurrentControlSet\\Control\\FileSystem\\LongPathsEnabled"
    ],
    "Details": "DWORD (0x00000001)"
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/blackbyte-ransomware/?utm_source=twitter&utm_medium=social
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/
Sigma Detection Rule: Potential BlackByte Ransomware Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-25
ATT&CK techniques: T1485, T1498, T1059.001, T1140
Log source: windows/process_creation

Description:
Detects command line patterns used by BlackByte ransomware in different operations

Detection logic:
{
  "selection_1": {
    "Image|startswith": "C:\\Users\\Public\\",
    "CommandLine|contains": " -single "
  },
  "selection_2": {
    "CommandLine|contains": [
      "del C:\\Windows\\System32\\Taskmgr.exe",
      ";Set-Service -StartupType Disabled $",
      "powershell -command \"$x =[System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String(",
      " do start wordpad.exe /p "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://redcanary.com/blog/blackbyte-ransomware/
Sigma Detection Rule: Small Sieve Malware File Indicator Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2023-05-19
ATT&CK techniques: T1036.005
Log source: windows/file_event

Description:
Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.

Detection logic:
{
  "selection_typo_path": {
    "TargetFilename|contains|all": [
      ":\\Users\\",
      "\\AppData\\"
    ],
    "TargetFilename|contains": [
      "\\Roaming\\",
      "\\Local\\"
    ]
  },
  "selection_typo_keyword": {
    "TargetFilename|contains": "Microsift"
  },
  "selection_ioc": {
    "TargetFilename|endswith": "\\AppData\\Local\\MicrosoftWindowsOutlookDataPlus.txt"
  },
  "condition": "all of selection_typo_* or selection_ioc"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
Sigma Detection Rule: Small Sieve Malware Registry Persistence
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-19
Log source: windows/registry_set

Description:
Detects registry value with specific intentional typo and strings seen used by the Small Sieve malware

Detection logic:
{
  "selection_path": {
    "TargetObject|contains": "\\Microsoft\\Windows\\CurrentVersion\\Run\\"
  },
  "selection_value": [
    {
      "TargetObject|contains": "Microsift"
    },
    {
      "Details|contains": ".exe Platypus"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
Sigma Detection Rule: Small Sieve Malware Potential C2 Communication
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-19
Log source: /proxy

Description:
Detects potential C2 communication related to Small Sieve malware

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-host": "api.telegram.org",
    "cs-uri|contains|all": [
      "chat_id=[PII_REDACTED]",
      "text=com/"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Small Sieve Malware CommandLine Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-19
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects specific command line argument being passed to a binary as seen being used by the malware Small Sieve.

Detection logic:
{
  "selection": {
    "CommandLine|endswith": ".exe Platypus"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf
Sigma Detection Rule: Pingback Backdoor File Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-05-05
ATT&CK techniques: T1574.001
Log source: windows/file_event

Description:
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Detection logic:
{
  "selection": {
    "Image|endswith": "updata.exe",
    "TargetFilename": "C:\\Windows\\oci.dll"
  },
  "condition": "selection"
}

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
  - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
Sigma Detection Rule: Pingback Backdoor DLL Loading Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-05-05
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Detection logic:
{
  "selection": {
    "Image|endswith": "\\msdtc.exe",
    "ImageLoaded": "C:\\Windows\\oci.dll"
  },
  "condition": "selection"
}

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
  - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
Sigma Detection Rule: Pingback Backdoor Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-05-05
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\updata.exe",
    "CommandLine|contains|all": [
      "config",
      "msdtc",
      "start",
      "auto"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/backdoor-at-the-end-of-the-icmp-tunnel
  - https://app.any.run/tasks/4a54c651-b70b-4b72-84d7-f34d301d6406
Sigma Detection Rule: Potential Goofy Guineapig Backdoor Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-05-14
Log source: windows/process_creation

Description:
Detects a specific broken command that was used by Goofy-Guineapig as described by the NCSC report.

Detection logic:
{
  "selection": {
    "CommandLine|contains": "choice /t %d /d y /n >nul"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Goofy Guineapig Backdoor IOC
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-14
Log source: windows/file_event

Description:
Detects malicious indicators seen used by the Goofy Guineapig malware

Detection logic:
{
  "selection": {
    "TargetFilename": [
      "C:\\ProgramData\\GoogleUpdate\\config.dat",
      "C:\\ProgramData\\GoogleUpdate\\GoogleUpdate.exe",
      "C:\\ProgramData\\GoogleUpdate\\GoogleUpdate\\tmp.bat",
      "C:\\ProgramData\\GoogleUpdate\\goopdate.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Goofy Guineapig Backdoor Service Creation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/

Description:
Detects service creation persistence used by the Goofy Guineapig backdoor

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": "GoogleUpdate",
    "ImagePath|contains|all": [
      "rundll32",
      "FileProtocolHandler",
      "\\ProgramData\\GoogleUpdate\\GoogleUpdate.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Goofy Guineapig Backdoor Potential C2 Communication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-14
Log source: /proxy

Description:
Detects potential C2 communication related to Goofy Guineapig backdoor

Detection logic:
{
  "selection": {
    "c-useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36",
    "cs-host": "static.tcplog.com"
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Potential Goofy Guineapig GoolgeUpdate Process Anomaly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/process_creation

Description:
Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location as seen used by the Goofy Guineapig backdoor

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\GoogleUpdate.exe",
    "Image|endswith": "\\GoogleUpdate.exe"
  },
  "filter_main_legit_paths": [
    {
      "Image|startswith": [
        "C:\\Program Files\\Google\\",
        "C:\\Program Files (x86)\\Google\\"
      ]
    },
    {
      "Image|contains": "\\AppData\\Local\\Google\\Update\\"
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf
Sigma Detection Rule: Potential Devil Bait Malware Reconnaissance
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), NCSC (Idea)
Date: 2023-05-15
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects specific process behavior observed with Devil Bait samples

Detection logic:
{
  "selection_redirect": {
    "ParentImage|endswith": "\\wscript.exe",
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": ">>%APPDATA%\\Microsoft\\",
    "CommandLine|endswith": [
      ".xml",
      ".txt"
    ]
  },
  "selection_recon_cmd": [
    {
      "CommandLine|re": "ipconfig\\s+/all"
    },
    {
      "CommandLine|contains": [
        "dir",
        "systeminfo",
        "tasklist"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
  - https://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b/behavior
Sigma Detection Rule: Potential Devil Bait Related Indicator
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: windows/file_event

Description:
Detects the creation of ".xml" and ".txt" files in folders of the "\AppData\Roaming\Microsoft" directory by uncommon processes. This behavior was seen common across different Devil Bait samples and stages as described by the NCSC

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\schtasks.exe",
      "\\wscript.exe",
      "\\mshta.exe"
    ],
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\",
    "TargetFilename|endswith": [
      ".txt",
      ".xml"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
Sigma Detection Rule: Devil Bait Potential C2 Communication Traffic
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
Log source: /proxy

Description:
Detects potential C2 communication related to Devil Bait malware

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri|contains|all": [
      "/cross.php?op=",
      "&dt=",
      "&uid="
    ]
  },
  "condition": "selection"
}

References:
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf