deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Whoami.EXE Execution Anomaly
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-12
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects the execution of whoami.exe with suspicious parent processes.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\whoami.exe"
    },
    {
      "OriginalFileName": "whoami.exe"
    }
  ],
  "filter_main_known_parents": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\powershell_ise.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_optional_ms_monitoring_agent": {
    "ParentImage|endswith": ":\\Program Files\\Microsoft Monitoring Agent\\Agent\\MonitoringHost.exe"
  },
  "filter_main_parent_null": {
    "ParentImage": null
  },
  "filter_main_parent_empty": {
    "ParentImage": [
      "",
      "-"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
  - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s
Sigma Detection Rule: New Service Creation Using Sc.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
Date: 2023-02-20
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects the creation of a new service using the "sc.exe" utility.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\sc.exe",
    "CommandLine|contains|all": [
      "create",
      "binPath"
    ]
  },
  "filter_optional_dropbox": {
    "ParentImage|startswith": [
      "C:\\Program Files (x86)\\Dropbox\\Client\\",
      "C:\\Program Files\\Dropbox\\Client\\"
    ],
    "ParentImage|endswith": "\\Dropbox.exe"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
Sigma Detection Rule: PUA - NimScan Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-02-05
ATT&CK techniques: T1046
Log source: windows/process_creation

Description:
Detects usage of NimScan, a portscanner utility.
In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment.
This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\NimScan.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C",
        "IMPHASH=B1B6ADACB[PII_REDACTED]9EFD18A29549",
        "IMPHASH=0D1F896DC7642AD8384F9042F30279C2"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://x.com/cyberfeeddigest/status/[PII_REDACTED]97587859
  - https://github.com/elddy/NimScan
Sigma Detection Rule: RunDLL32 Spawning Explorer
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: elhoim, CD_ROM_
Date: 2022-04-27
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects RunDLL32.exe spawning explorer.exe as child, which is very uncommon, often observes Gamarue spawning the explorer.exe process in an unusual way

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\rundll32.exe",
    "Image|endswith": "\\explorer.exe"
  },
  "filter": {
    "ParentCommandLine|contains": "\\shell32.dll,Control_RunDLL"
  },
  "condition": "selection and not filter"
}

References:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
Sigma Detection Rule: Visual Studio Code Tunnel Shell Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-25
ATT&CK techniques: T1071.001
Log source: windows/process_creation

Description:
Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

Detection logic:
{
  "selection_parent": {
    "ParentImage|contains": "\\servers\\Stable-",
    "ParentImage|endswith": "\\server\\node.exe",
    "ParentCommandLine|contains": ".vscode-server"
  },
  "selection_child_1": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": "\\terminal\\browser\\media\\shellIntegration.ps1"
  },
  "selection_child_2": {
    "Image|endswith": [
      "\\wsl.exe",
      "\\bash.exe"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://ipfyx.fr/post/visual-studio-code-tunnel/
  - https://badoption.eu/blog/2023/01/31/code_c2.html
  - https://code.visualstudio.com/docs/remote/tunnels
Sigma Detection Rule: DumpStack.log Defender Evasion
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-06
Log source: windows/process_creation

Description:
Detects the use of the filename DumpStack.log to evade Microsoft Defender

Detection logic:
{
  "selection": {
    "Image|endswith": "\\DumpStack.log"
  },
  "selection_download": {
    "CommandLine|contains": " -o DumpStack.log"
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]48713219
Sigma Detection Rule: HackTool - CoercedPotato Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-10-11
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects the use of CoercedPotato, a tool for privilege escalation

Detection logic:
{
  "selection_loader_img": {
    "Image|endswith": "\\CoercedPotato.exe"
  },
  "selection_params": {
    "CommandLine|contains": " --exploitId "
  },
  "selection_loader_imphash": {
    "Hashes|contains": [
      "IMPHASH=A75D7669DB6B2E107A44C4057FF7F7D6",
      "IMPHASH=F91624350E2C678C5DCBE5E1F24E22C9",
      "IMPHASH=14C81850A079A87E83D50CA41C709A15"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/hackvens/CoercedPotato
  - https://blog.hackvens.fr/articles/CoercedPotato.html
Sigma Detection Rule: Cloudflared Tunnel Connections Cleanup
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-17
ATT&CK techniques: T1102, T1090, T1572
Log source: windows/process_creation

Description:
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      " tunnel ",
      "cleanup "
    ],
    "CommandLine|contains": [
      "-config ",
      "-connector-id "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/cloudflare/cloudflared
  - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps
Sigma Detection Rule: Data Export From MSSQL Table Via BCP.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Omar Khaled (@beacon_exe), MahirAli Khan (in/mahiralikhan), Nasreddine Bencherchali (Nextron Systems)
Date: 2024-08-20
ATT&CK techniques: T1048
Log source: windows/process_creation

Description:
Detects the execution of the BCP utility in order to export data from the database.
Attackers were seen saving their malware to a database column or table and then later extracting it via "bcp.exe" into a file.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bcp.exe"
    },
    {
      "OriginalFileName": "BCP.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " out ",
      " queryout "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://docs.microsoft.com/en-us/sql/tools/bcp-utility
  - https://asec.ahnlab.com/en/61000/
  - https://asec.ahnlab.com/en/78944/
  - https://www.huntress.com/blog/attacking-mssql-servers
  - https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
Sigma Detection Rule: Obfuscated PowerShell OneLiner Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-05-09
ATT&CK techniques: T1059.001, T1685
Log source: windows/process_creation

Description:
Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\powershell.exe",
    "CommandLine|contains|all": [
      "http://127.0.0.1",
      "%{(IRM $_)}",
      "Invoke"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38
Sigma Detection Rule: Security Event Logging Disabled via MiniNt Registry Key - Process
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-09
ATT&CK techniques: T1685.001, T1112
Log source: windows/process_creation

Description:
Detects attempts to disable security event logging by adding the `MiniNt` registry key.
This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications.
Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities.


Detection logic:
{
  "selection_reg_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_reg_cmd": {
    "CommandLine|contains|all": [
      " add ",
      "\\SYSTEM\\CurrentControlSet\\Control\\MiniNt"
    ]
  },
  "selection_powershell_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\powershell_ise.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_powershell_cmd1": {
    "CommandLine|contains": [
      "New-Item ",
      "ni "
    ]
  },
  "selection_powershell_cmd2": {
    "CommandLine|contains": "\\SYSTEM\\CurrentControlSet\\Control\\MiniNt"
  },
  "condition": "all of selection_reg_* or all of selection_powershell_*"
}

References:
  - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
Sigma Detection Rule: PUA - Restic Backup Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Nounou Mbeiri, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-17
ATT&CK techniques: T1048, T1567.002
Log source: windows/process_creation

Description:
Detects the execution of the Restic backup tool, which can be used for data exfiltration.
Threat actors may leverage Restic to back up and exfiltrate sensitive data to remote storage locations, including cloud services.
If not legitimately used in the enterprise environment, its presence may indicate malicious activity.


Detection logic:
{
  "selection_specific": [
    {
      "CommandLine|contains|all": [
        "--password-file",
        "init",
        " -r "
      ]
    },
    {
      "CommandLine|contains|all": [
        "--use-fs-snapshot",
        "backup",
        " -r "
      ]
    }
  ],
  "selection_restic": {
    "CommandLine|contains": [
      "sftp:",
      "rest:http",
      "s3:s3.",
      "s3.http",
      "azure:",
      " gs:",
      "rclone:",
      "swift:",
      " b2:"
    ],
    "CommandLine|contains|all": [
      " init ",
      " -r "
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
  - https://restic.net/
  - https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
Sigma Detection Rule: Renamed FTP.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

Detection logic:
{
  "selection_original": {
    "OriginalFileName": "ftp.exe"
  },
  "filter_img": {
    "Image|endswith": "\\ftp.exe"
  },
  "condition": "selection_original and not filter_img"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ftp/
Sigma Detection Rule: Suspicious Processes Spawned by Java.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Hunkeler (@Karneades), Florian Roth
Date: 2021-12-17
Log source: windows/process_creation

Description:
Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\java.exe",
    "Image|endswith": [
      "\\AppVLP.exe",
      "\\bitsadmin.exe",
      "\\certutil.exe",
      "\\cscript.exe",
      "\\curl.exe",
      "\\forfiles.exe",
      "\\hh.exe",
      "\\mftrace.exe",
      "\\mshta.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\query.exe",
      "\\reg.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\scrcons.exe",
      "\\scriptrunner.exe",
      "\\sh.exe",
      "\\systeminfo.exe",
      "\\whoami.exe",
      "\\wmic.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0738/https://www.lunasec.io/docs/blog/log4j-zero-day/
Sigma Detection Rule: File Download with Headless Browser
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sreeman, Florian Roth (Nextron Systems)
Date: 2022-01-04
ATT&CK techniques: T1105, T1564.003
Log source: windows/process_creation

Description:
Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ],
    "CommandLine|contains|all": [
      "--headless",
      "dump-dom",
      "http"
    ]
  },
  "filter_optional_edge_1": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\",
      "C:\\Program Files (x86)\\Microsoft\\EdgeCore\\",
      "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\",
      "C:\\Program Files\\Microsoft\\Edge\\Application\\",
      "C:\\Program Files\\Microsoft\\EdgeCore\\",
      "C:\\Program Files\\Microsoft\\EdgeWebView\\",
      "C:\\Program Files\\WindowsApps\\Microsoft.MicrosoftEdge"
    ],
    "Image|endswith": [
      "\\msedge.exe",
      "\\msedgewebview2.exe",
      "\\MicrosoftEdge.exe"
    ],
    "CommandLine|contains": "--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom"
  },
  "filter_optional_edge_2": {
    "Image|contains": [
      "\\AppData\\Local\\Microsoft\\WindowsApps\\",
      "\\Windows\\SystemApps\\Microsoft.MicrosoftEdge"
    ],
    "Image|endswith": [
      "\\msedge.exe",
      "\\MicrosoftEdge.exe"
    ],
    "CommandLine|contains": "--headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]81436672?s=12
  - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html
Sigma Detection Rule: UAC Bypass Tools Using ComputerDefaults
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-31
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects tools such as UACMe used to bypass UAC with computerdefaults.exe (UACMe 59)

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ],
    "Image": "C:\\Windows\\System32\\ComputerDefaults.exe"
  },
  "filter": {
    "ParentImage|contains": [
      ":\\Windows\\System32",
      ":\\Program Files"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\Microsoft.NodejsTools.PressAnyKey.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]18854661
  - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5
Sigma Detection Rule: Arbitrary Binary Execution Using GUP Utility
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-10
Log source: windows/process_creation

Description:
Detects execution of the Notepad++ updater (gup) to launch other commands or executables

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\gup.exe",
    "Image|endswith": "\\explorer.exe"
  },
  "filter": {
    "Image|endswith": "\\explorer.exe",
    "CommandLine|contains": "\\Notepad++\\notepad++.exe"
  },
  "filter_parent": {
    "ParentImage|contains": "\\Notepad++\\updater\\"
  },
  "filter_null": {
    "CommandLine": null
  },
  "condition": "selection and not 1 of filter*"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]39180803
Sigma Detection Rule: Phishing Pattern ISO in Archive
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-06-07
ATT&CK techniques: T1566
Log source: windows/process_creation

Description:
Detects cases in which an ISO files is opend within an archiver like 7Zip or Winrar, which is a sign of phishing as threat actors put small ISO files in archives as email attachments to bypass certain filters and protective measures (mark of web)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\Winrar.exe",
      "\\7zFM.exe",
      "\\peazip.exe"
    ],
    "Image|endswith": [
      "\\isoburn.exe",
      "\\PowerISO.exe",
      "\\ImgBurn.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/1ZRR4H/status/[PII_REDACTED]59787783
  - https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/
Sigma Detection Rule: Scheduled Task Executing Payload from Registry
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-18
ATT&CK techniques: T1053.005, T1059.001
Log source: windows/process_creation

Description:
Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_create": {
    "CommandLine|contains": "/Create"
  },
  "selection_cli_get": {
    "CommandLine|contains": [
      "Get-ItemProperty",
      " gp "
    ]
  },
  "selection_cli_hive": {
    "CommandLine|contains": [
      "HKCU:",
      "HKLM:",
      "registry::",
      "HKEY_"
    ]
  },
  "filter_main_encoding": {
    "CommandLine|contains": [
      "FromBase64String",
      "encodedcommand"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Sigma Detection Rule: Cscript/Wscript Uncommon Script Extension Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-15
ATT&CK techniques: T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "wscript.exe",
        "cscript.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\wscript.exe",
        "\\cscript.exe"
      ]
    }
  ],
  "selection_extension": {
    "CommandLine|contains": [
      ".csv",
      ".dat",
      ".doc",
      ".gif",
      ".jpeg",
      ".jpg",
      ".png",
      ".ppt",
      ".txt",
      ".xls",
      ".xml"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research
Sigma Detection Rule: Renamed Vmnat.exe Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: elhoim
Date: 2022-09-09
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects renamed vmnat.exe or portable version that can be used for DLL side-loading

Detection logic:
{
  "selection": {
    "OriginalFileName": "vmnat.exe"
  },
  "filter_rename": {
    "Image|endswith": "vmnat.exe"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]47845376
Sigma Detection Rule: Uninstall Crowdstrike Falcon Sensor
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-07-12
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\WindowsSensor.exe",
      " /uninstall",
      " /quiet"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Suspicious Remote Child Process From Outlook
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
Date: 2018-12-27
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\outlook.exe",
    "Image|startswith": "\\\\\\\\"
  },
  "condition": "selection"
}

References:
  - https://github.com/sensepost/ruler
  - https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49
Sigma Detection Rule: Potential Rundll32 Execution With DLL Stored In ADS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Harjot Singh, '@cyb3rjy0t'
Date: 2023-01-21
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|re": "[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\\.[Ee][Xx][Ee])? \\S+?\\w:\\S+?:"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Rundll32