deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth (Nextron Systems), Christian Burkard (Nextron Systems)
Date: 2020-10-23
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects attackers using tooling with bad opsec defaults.
E.g. spawning a sacrificial process to inject a capability into the process without taking into account how the process is normally run.
One trivial example of this is using rundll32.exe without arguments as a sacrificial process (default in CS, now highlighted by c2lint), running WerFault without arguments (Kraken - credit am0nsec), and other examples.


Detection logic:
{
  "selection_werfault": {
    "Image|endswith": "\\WerFault.exe",
    "CommandLine|endswith": "WerFault.exe"
  },
  "selection_rundll32": {
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|endswith": "rundll32.exe"
  },
  "selection_regsvcs": {
    "Image|endswith": "\\regsvcs.exe",
    "CommandLine|endswith": "regsvcs.exe"
  },
  "selection_regasm": {
    "Image|endswith": "\\regasm.exe",
    "CommandLine|endswith": "regasm.exe"
  },
  "selection_regsvr32": {
    "Image|endswith": "\\regsvr32.exe",
    "CommandLine|endswith": "regsvr32.exe"
  },
  "filter_optional_edge_update": {
    "ParentImage|contains": "\\AppData\\Local\\Microsoft\\EdgeUpdate\\Install\\{",
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|endswith": "rundll32.exe"
  },
  "filter_optional_chromium_installer": {
    "ParentImage|contains": [
      "\\AppData\\Local\\BraveSoftware\\Brave-Browser\\Application\\",
      "\\AppData\\Local\\Google\\Chrome\\Application\\"
    ],
    "ParentImage|endswith": "\\Installer\\setup.exe",
    "ParentCommandLine|contains": "--uninstall ",
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|endswith": "rundll32.exe"
  },
  "condition": "1 of selection_* and not 1 of filter_optional_*"
}

References:
  - https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/
  - https://www.cobaltstrike.com/help-opsec
  - https://twitter.com/CyberRaiju/status/[PII_REDACTED]78983169
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32
Sigma Detection Rule: PowerShell MSI Install via WindowsInstaller COM From Remote Location
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Meroujan Antonyan (vx3r)
Date: 2025-06-05
ATT&CK techniques: T1059.001, T1218, T1105
Log source: windows/process_creation

Description:
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell_ISE.EXE",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "-ComObject",
      "InstallProduct("
    ]
  },
  "selection_remote": {
    "CommandLine|contains": [
      "http",
      "\\\\\\\\"
    ]
  },
  "filter_main_localhost": {
    "CommandLine|contains": [
      "://127.0.0.1",
      "://localhost"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
  - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
  - https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
Sigma Detection Rule: Suspicious Command Patterns In Scheduled Task Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-23
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects scheduled task creation using "schtasks" that contain potentially suspicious or uncommon commands

Detection logic:
{
  "selection_schtasks": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": "/Create "
  },
  "selection_pattern_1": {
    "CommandLine|contains": [
      "/sc minute ",
      "/ru system "
    ]
  },
  "selection_pattern_2": {
    "CommandLine|contains": [
      "cmd /c",
      "cmd /k",
      "cmd /r",
      "cmd.exe /c ",
      "cmd.exe /k ",
      "cmd.exe /r "
    ]
  },
  "selection_uncommon": {
    "CommandLine|contains": [
      " -decode ",
      " -enc ",
      " -w hidden ",
      " bypass ",
      " IEX",
      ".DownloadData",
      ".DownloadFile",
      ".DownloadString",
      "/c start /min ",
      "FromBase64String",
      "mshta http",
      "mshta.exe http"
    ]
  },
  "selection_anomaly_1": {
    "CommandLine|contains": [
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Tmp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\",
      "%AppData%",
      "%Temp%",
      "%tmp%"
    ]
  },
  "selection_anomaly_2": {
    "CommandLine|contains": [
      "cscript",
      "curl",
      "wscript"
    ]
  },
  "condition": "selection_schtasks and ( all of selection_pattern_* or selection_uncommon or all of selection_anomaly_* )"
}

References:
  - https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/
  - https://twitter.com/RedDrip7/status/[PII_REDACTED]27467785
  - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf
Sigma Detection Rule: Suspicious Eventlog Clearing or Configuration Change Activity
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2019-09-26
ATT&CK techniques: T1685.005, T1685.001
Log source: windows/process_creation

Description:
Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".
This technique were seen used by threat actors and ransomware strains in order to evade defenses.


Detection logic:
{
  "selection_wevtutil_img": [
    {
      "Image|endswith": "\\wevtutil.exe"
    },
    {
      "OriginalFileName": "wevtutil.exe"
    }
  ],
  "selection_wevtutil_cmd": {
    "CommandLine|contains": [
      "clear-log ",
      " cl ",
      "set-log ",
      " sl ",
      "lfn:"
    ]
  },
  "selection_other_ps_img": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe"
    ]
  },
  "selection_other_ps_cmd": [
    {
      "CommandLine|contains": [
        "Clear-EventLog ",
        "Remove-EventLog ",
        "Limit-EventLog ",
        "Clear-WinEvent "
      ]
    },
    {
      "CommandLine|contains|all": [
        "Eventing.Reader.EventLogSession",
        "ClearLog"
      ]
    },
    {
      "CommandLine|contains|all": [
        "Diagnostics.EventLog",
        "Clear"
      ]
    }
  ],
  "selection_other_wmi": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe",
      "\\wmic.exe"
    ],
    "CommandLine|contains": "ClearEventLog"
  },
  "filter_main_msiexec": {
    "ParentImage": [
      "C:\\Windows\\SysWOW64\\msiexec.exe",
      "C:\\Windows\\System32\\msiexec.exe"
    ],
    "CommandLine|contains": " sl "
  },
  "condition": "(all of selection_wevtutil_*) or (all of selection_other_ps_*) or (selection_other_wmi) and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
  - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee
  - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/
Sigma Detection Rule: Potential Amazon SSM Agent Hijacking
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Muhammad Faisal
Date: 2023-08-02
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\amazon-ssm-agent.exe",
    "CommandLine|contains|all": [
      "-register ",
      "-code ",
      "-id ",
      "-region "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan
  - https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/
  - https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/
Sigma Detection Rule: PUA - Mouse Lock Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Cian Heasley
Date: 2020-08-13
ATT&CK techniques: T1056.002
Log source: windows/process_creation

Description:
In Kaspersky's 2020 Incident Response Analyst Report they listed legitimate tool "Mouse Lock" as being used for both credential access and collection in security incidents.

Detection logic:
{
  "selection": [
    {
      "Product|contains": "Mouse Lock"
    },
    {
      "Company|contains": "Misc314"
    },
    {
      "CommandLine|contains": "Mouse Lock_"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf
  - https://sourceforge.net/projects/mouselock/
Sigma Detection Rule: Compress Data and Lock With Password for Exfiltration With 7-ZIP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-27
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities

Detection logic:
{
  "selection_img": [
    {
      "Description|contains": "7-Zip"
    },
    {
      "Image|endswith": [
        "\\7z.exe",
        "\\7zr.exe",
        "\\7za.exe"
      ]
    },
    {
      "OriginalFileName": [
        "7z.exe",
        "7za.exe"
      ]
    }
  ],
  "selection_password": {
    "CommandLine|contains": " -p"
  },
  "selection_action": {
    "CommandLine|contains": [
      " a ",
      " u "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md
Sigma Detection Rule: Enable LM Hash Storage - ProcCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-12-15
ATT&CK techniques: T1112
Log source: windows/process_creation

Description:
Detects changes to the "NoLMHash" registry value in order to allow Windows to store LM Hashes.
By setting this registry value to "0" (DWORD), Windows will be allowed to store a LAN manager hash of your password in Active Directory and local SAM databases.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\System\\CurrentControlSet\\Control\\Lsa",
      "NoLMHash",
      " 0"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
  - https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
Sigma Detection Rule: Change PowerShell Policies to an Insecure Level
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-11-01
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "powershell_ise.exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    }
  ],
  "selection_option": {
    "CommandLine|contains": [
      "-executionpolicy ",
      " -ep ",
      " -exec "
    ]
  },
  "selection_level": {
    "CommandLine|contains": [
      "Bypass",
      "Unrestricted"
    ]
  },
  "filter_main_powershell_core": {
    "ParentImage": [
      "C:\\Windows\\SysWOW64\\msiexec.exe",
      "C:\\Windows\\System32\\msiexec.exe"
    ],
    "CommandLine|contains": [
      "-NoProfile -ExecutionPolicy Bypass -File \"C:\\Program Files\\PowerShell\\7\\",
      "-NoProfile -ExecutionPolicy Bypass -File \"C:\\Program Files (x86)\\PowerShell\\7\\"
    ]
  },
  "filter_optional_avast": {
    "ParentImage|contains": [
      "C:\\Program Files\\Avast Software\\Avast\\",
      "C:\\Program Files (x86)\\Avast Software\\Avast\\",
      "\\instup.exe"
    ],
    "CommandLine|contains": [
      "-ExecutionPolicy ByPass -File \"C:\\Program Files\\Avast Software\\Avast",
      "-ExecutionPolicy ByPass -File \"C:\\Program Files (x86)\\Avast Software\\Avast\\"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
  - https://adsecurity.org/?p=2604
  - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
Sigma Detection Rule: Base64 Encoded PowerShell Command Detected
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-01-29
ATT&CK techniques: T1027, T1140, T1059.001
Log source: windows/process_creation

Description:
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

Detection logic:
{
  "selection": {
    "CommandLine|contains": "::FromBase64String("
  },
  "condition": "selection"
}

References:
  - https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
Sigma Detection Rule: Suspicious Group And Account Reconnaissance Activity Using Net.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1087.001, T1087.002
Log source: windows/process_creation

Description:
Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE
Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM)


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_group_root": {
    "CommandLine|contains": [
      " group ",
      " localgroup "
    ]
  },
  "selection_group_flags": {
    "CommandLine|contains": [
      "domain admins",
      " administrator",
      " administrateur",
      "enterprise admins",
      "Exchange Trusted Subsystem",
      "Remote Desktop Users",
      "Utilisateurs du Bureau \u00e0 distance",
      "Usuarios de escritorio remoto",
      " /do"
    ]
  },
  "filter_group_add": {
    "CommandLine|contains": " /add"
  },
  "selection_accounts_root": {
    "CommandLine|contains": " accounts "
  },
  "selection_accounts_flags": {
    "CommandLine|contains": " /do"
  },
  "condition": "selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*)"
}

References:
  - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/
  - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
Sigma Detection Rule: Potential PowerShell Downgrade Attack
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Harish Segar (rule)
Date: 2020-03-20
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Detection logic:
{
  "selection": {
    "Image|endswith": "\\powershell.exe",
    "CommandLine|contains": [
      " -version 2 ",
      " -versio 2 ",
      " -versi 2 ",
      " -vers 2 ",
      " -ver 2 ",
      " -ve 2 ",
      " -v 2 "
    ]
  },
  "condition": "selection"
}

References:
  - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/
  - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade-
Sigma Detection Rule: Wusa.EXE Executed By Parent Process Located In Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-11-26
Log source: windows/process_creation

Description:
Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location.
Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges.


Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\wusa.exe"
  },
  "selection_paths_1": {
    "ParentImage|contains": [
      ":\\Perflogs\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\Appdata\\Local\\Temp\\",
      "\\Temporary Internet"
    ]
  },
  "selection_paths_2": [
    {
      "ParentImage|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "ParentImage|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "ParentImage|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "ParentImage|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "filter_main_msu": {
    "CommandLine|contains": ".msu"
  },
  "condition": "selection_img and 1 of selection_paths_* and not 1 of filter_main_*"
}

References:
  - https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
Sigma Detection Rule: MSDT Execution Via Answer File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).


Detection logic:
{
  "selection": {
    "Image|endswith": "\\msdt.exe",
    "CommandLine|contains": "\\WINDOWS\\diagnostics\\index\\PCWDiagnostic.xml",
    "CommandLine|contains|windash": " -af "
  },
  "filter_main_pcwrun": {
    "ParentImage|endswith": "\\pcwrun.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
Sigma Detection Rule: Execute Code with Pester.bat as Parent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-20
ATT&CK techniques: T1059.001, T1216
Log source: windows/process_creation

Description:
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Detection logic:
{
  "selection_module": {
    "ParentImage|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "ParentCommandLine|contains": "\\WindowsPowerShell\\Modules\\Pester\\"
  },
  "selection_cli": {
    "ParentCommandLine|contains": [
      "{ Invoke-Pester -EnableExit ;",
      "{ Get-Help \""
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Oddvarmoe/status/[PII_REDACTED]44258816
  - https://twitter.com/_st0pp3r_/status/[PII_REDACTED]87525378
Sigma Detection Rule: Local File Read Using Curl.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-27
Log source: windows/process_creation

Description:
Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "file:///"
  },
  "condition": "all of selection_*"
}

References:
  - https://curl.se/docs/manpage.html
Sigma Detection Rule: Potential Defense Evasion Via Right-to-Left Override
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Micah Babinski, @micahbabinski, Swachchhanda Shrawan Poudel (Nextron Systems), Luc Génaux
Date: 2023-02-15
ATT&CK techniques: T1036.002
Log source: windows/process_creation

Description:
Detects the presence of the "u202+E" character, which causes a terminal, browser, or operating system to render text in a right-to-left sequence.
This character is used as an obfuscation and masquerading techniques by adversaries to trick users into opening malicious files.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\\u202e",
      "[U+202E]",
      "\u202e"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/right-to-left-override/
  - https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
  - https://unicode-explorer.com/c/202E
  - https://tria.ge/241015-l98snsyeje/behavioral2
  - https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/
Sigma Detection Rule: Potential Powershell ReverseShell Connection
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: FPT.EagleEye, wagga, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-03-03
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    },
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " Net.Sockets.TCPClient",
      ".GetStream(",
      ".Write("
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/
  - https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
  - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Shells/Invoke-PowerShellTcpOneLine.ps1
Sigma Detection Rule: Insecure Transfer Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2023-06-30
Log source: windows/process_creation

Description:
Detects execution of "curl.exe" with the "--insecure" flag.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|re": "\\s-k\\s"
    },
    {
      "CommandLine|contains": "--insecure"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://curl.se/docs/manpage.html