deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious Rejected SMB Guest Logon From IP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), KevTheHermit, fuzzyf10w
Date: 2021-06-30
ATT&CK techniques: T1110.001
Log source: windows/

Description:
Detect Attempt PrintNightmare (CVE-2021-1675) Remote code execution in Windows Spooler Service

Detection logic:
{
  "selection": {
    "EventID": 31017,
    "UserName": "",
    "ServerName|startswith": "\\1"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/KevTheHermit/status/[PII_REDACTED]64301056
  - https://web.archive.org/web/[PII_REDACTED]5600/https://github.com/hhlxf/PrintNightmare/
  - https://web.archive.org/web/[PII_REDACTED]2336/https://github.com/afwu/PrintNightmare
Sigma Detection Rule: Loading Diagcab Package From Remote Path
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-14
Log source: windows/

Description:
Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability

Detection logic:
{
  "selection": {
    "EventID": 101,
    "PackagePath|contains": "\\\\\\\\"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]08141061
  - https://twitter.com/j00sean/status/[PII_REDACTED]01225472
Sigma Detection Rule: Sysinternals Tools AppX Versions Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
Log source: windows/

Description:
Detects execution of Sysinternals tools via an AppX package.
Attackers could install the Sysinternals Suite to get access to tools such as psexec and procdump to avoid detection based on System paths.


Detection logic:
{
  "selection": {
    "EventID": 201,
    "ImageName": [
      "procdump.exe",
      "psloglist.exe",
      "psexec.exe",
      "livekd.exe",
      "ADExplorer.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
Sigma Detection Rule: Previously Installed IIS Module Was Removed
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali
Date: 2024-10-06
ATT&CK techniques: T1685.001, T1505.004
Log source: windows/

Description:
Detects the removal of a previously installed IIS module.

Detection logic:
{
  "selection": {
    "EventID": 29,
    "Configuration|contains": "/system.webServer/modules/remove"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Sigma Detection Rule: ETW Logging/Processing Option Disabled On IIS Server
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2024-10-06
ATT&CK techniques: T1685.001, T1505.004
Log source: windows/

Description:
Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.

Detection logic:
{
  "selection": {
    "EventID": 29,
    "Configuration|endswith": "@logTargetW3C",
    "OldValue|contains": "ETW"
  },
  "filter_main_etw_added": {
    "NewValue|contains": "ETW"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
Sigma Detection Rule: New Module Module Added To IIS Server
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2024-10-06
ATT&CK techniques: T1685.001, T1505.004
Log source: windows/

Description:
Detects the addition of a new module to an IIS server.

Detection logic:
{
  "selection": {
    "EventID": 29,
    "Configuration|contains": "/system.webServer/modules/add"
  },
  "filter_main_builtin": {
    "NewValue": [
      "AnonymousAuthenticationModule",
      "CustomErrorModule",
      "DefaultDocumentModule",
      "DirectoryListingModule",
      "FileCacheModule",
      "HttpCacheModule",
      "HttpLoggingModule",
      "ProtocolSupportModule",
      "RequestFilteringModule",
      "StaticCompressionModule",
      "StaticFileModule",
      "TokenCacheModule",
      "UriCacheModule"
    ]
  },
  "filter_main_remove": {
    "NewValue": ""
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
  - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview
Sigma Detection Rule: HTTP Logging Disabled On IIS Server
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2024-10-06
ATT&CK techniques: T1685.001, T1505.004
Log source: windows/

Description:
Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.

Detection logic:
{
  "selection": {
    "EventID": 29,
    "Configuration": "/system.webServer/httpLogging/@dontLog",
    "NewValue": "true"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
  - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
  - https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
Sigma Detection Rule: Certificate Exported From Local Certificate Store
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Zach Mathis
Date: 2023-05-13
ATT&CK techniques: T1649
Log source: windows/

Description:
Detects when an application exports a certificate (and potentially the private key as well) from the local Windows certificate store.

Detection logic:
{
  "selection": {
    "EventID": 1007
  },
  "condition": "selection"
}

References:
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
Sigma Detection Rule: USB Device Plugged
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-11-09
ATT&CK techniques: T1200
Log source: windows/

Description:
Detects plugged/unplugged USB devices

Detection logic:
{
  "selection": {
    "EventID": [
      2003,
      2100,
      2102
    ]
  },
  "condition": "selection"
}

References:
  - https://df-stream.com/2014/01/the-windows-7-event-log-and-usb-device/
  - https://www.techrepublic.com/article/how-to-track-down-usb-flash-drive-usage-in-windows-10s-event-viewer/
Sigma Detection Rule: WMI Persistence
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Gleb Sukhodolskiy, Timur Zinniatullin oscd.community
Date: 2017-08-22
ATT&CK techniques: T1546.003
Log source: windows/

Description:
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.

Detection logic:
{
  "wmi_filter_to_consumer_binding": {
    "EventID": 5861
  },
  "consumer_keywords": [
    "ActiveScriptEventConsumer",
    "CommandLineEventConsumer",
    "CommandLineTemplate"
  ],
  "wmi_filter_registration": {
    "EventID": 5859
  },
  "filter_scmevent": {
    "Provider": "SCM Event Provider",
    "Query": "select * from MSFT_SCMEventLogEvent",
    "User": "S-1-5-32-544",
    "PossibleCause": "Permanent"
  },
  "condition": "( (wmi_filter_to_consumer_binding and consumer_keywords) or (wmi_filter_registration) ) and not filter_scmevent"
}

References:
  - https://twitter.com/mattifestation/status/[PII_REDACTED]48539397
  - https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
Sigma Detection Rule: Certificate Private Key Acquired
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Zach Mathis
Date: 2023-05-13
ATT&CK techniques: T1649
Log source: windows/

Description:
Detects when an application acquires a certificate private key

Detection logic:
{
  "selection": {
    "EventID": 70
  },
  "condition": "selection"
}

References:
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
Sigma Detection Rule: HybridConnectionManager Service Running
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2021-04-12
ATT&CK techniques: T1554
Log source: windows/

Description:
Rule to detect the Hybrid Connection Manager service running on an endpoint.

Detection logic:
{
  "selection": {
    "EventID": [
      40300,
      40301,
      40302
    ]
  },
  "keywords": [
    "HybridConnection",
    "sb://",
    "servicebus.windows.net",
    "HybridConnectionManage"
  ],
  "condition": "selection and keywords"
}

References:
  - https://twitter.com/Cyb3rWard0g/status/[PII_REDACTED]69286662
Sigma Detection Rule: Windows Defender Real-Time Protection Failure/Restart
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Nasreddine Bencherchali (Nextron Systems), Christopher Peacock '@securepeacock' (Update)
Date: 2023-03-28
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects issues with Windows Defender Real-Time Protection features

Detection logic:
{
  "selection": {
    "EventID": [
      3002,
      3007
    ]
  },
  "filter_optional_network_inspection": {
    "Feature_Name": "%%886",
    "Reason": [
      "%%892",
      "%%858"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - Internal Research
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
  - https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346
Sigma Detection Rule: Win Defender Restored Quarantine File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-06
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects the restoration of files from the defender quarantine

Detection logic:
{
  "selection": {
    "EventID": 1009
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
Sigma Detection Rule: Windows Defender Threat Detected
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ján Trenčanský
Date: 2020-07-28
ATT&CK techniques: T1059
Log source: windows/

Description:
Detects actions taken by Windows Defender malware detection engines

Detection logic:
{
  "selection": {
    "EventID": [
      1006,
      1015,
      1116,
      1117
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
Sigma Detection Rule: Windows Defender Submit Sample Feature Disabled
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-06
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects disabling of the "Automatic Sample Submission" feature of Windows Defender.

Detection logic:
{
  "selection": {
    "EventID": 5007,
    "NewValue|contains": "\\Real-Time Protection\\SubmitSamplesConsent = 0x0"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware
Sigma Detection Rule: Windows Defender AMSI Trigger Detected
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Bhabesh Raj
Date: 2020-09-14
ATT&CK techniques: T1059
Log source: windows/

Description:
Detects triggering of AMSI by Windows Defender.

Detection logic:
{
  "selection": {
    "EventID": 1116,
    "SourceName": "AMSI"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
Sigma Detection Rule: LSASS Access Detected via Attack Surface Reduction
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis
Date: 2018-08-26
ATT&CK techniques: T1003.001
Log source: windows/

Description:
Detects Access to LSASS Process

Detection logic:
{
  "selection": {
    "EventID": 1121,
    "Path|endswith": "\\lsass.exe"
  },
  "filter_thor": {
    "ProcessName|startswith": "C:\\Windows\\Temp\\asgard2-agent\\",
    "ProcessName|endswith": [
      "\\thor64.exe",
      "\\thor.exe"
    ]
  },
  "filter_exact": {
    "ProcessName": [
      "C:\\Windows\\System32\\atiesrxx.exe",
      "C:\\Windows\\System32\\CompatTelRunner.exe",
      "C:\\Windows\\System32\\msiexec.exe",
      "C:\\Windows\\System32\\nvwmi64.exe",
      "C:\\Windows\\System32\\svchost.exe",
      "C:\\Windows\\System32\\Taskmgr.exe",
      "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
      "C:\\Windows\\SysWOW64\\msiexec.exe"
    ]
  },
  "filter_begins": {
    "ProcessName|startswith": [
      "C:\\Windows\\System32\\DriverStore\\",
      "C:\\WINDOWS\\Installer\\",
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction
Sigma Detection Rule: Windows Defender Exploit Guard Tamper
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects when someone is adding or removing applications or folders from exploit guard "ProtectedFolders" or "AllowedApplications"


Detection logic:
{
  "allowed_apps_key": {
    "EventID": 5007,
    "NewValue|contains": "\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\AllowedApplications\\"
  },
  "allowed_apps_path": {
    "NewValue|contains": [
      "\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\Desktop\\",
      "\\PerfLogs\\",
      "\\Windows\\Temp\\"
    ]
  },
  "protected_folders": {
    "EventID": 5007,
    "OldValue|contains": "\\Windows Defender\\Windows Defender Exploit Guard\\Controlled Folder Access\\ProtectedFolders\\"
  },
  "condition": "all of allowed_apps* or protected_folders"
}

References:
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
Sigma Detection Rule: Windows Defender Virus Scanning Feature Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ján Trenčanský, frack113
Date: 2020-07-28
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects disabling of the Windows Defender virus scanning feature

Detection logic:
{
  "selection": {
    "EventID": 5012
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
Sigma Detection Rule: Windows Defender Malware And PUA Scanning Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ján Trenčanský, frack113
Date: 2020-07-28
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects disabling of the Windows Defender feature of scanning for malware and other potentially unwanted software

Detection logic:
{
  "selection": {
    "EventID": 5010
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
Sigma Detection Rule: Microsoft Defender Tamper Protection Trigger
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Bhabesh Raj, Nasreddine Bencherchali
Date: 2021-07-05
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"

Detection logic:
{
  "selection": {
    "EventID": 5013,
    "Value|endswith": [
      "\\Windows Defender\\DisableAntiSpyware",
      "\\Windows Defender\\DisableAntiVirus",
      "\\Windows Defender\\Scan\\DisableArchiveScanning",
      "\\Windows Defender\\Scan\\DisableScanningNetworkFiles",
      "\\Real-Time Protection\\DisableRealtimeMonitoring",
      "\\Real-Time Protection\\DisableBehaviorMonitoring",
      "\\Real-Time Protection\\DisableIOAVProtection",
      "\\Real-Time Protection\\DisableScriptScanning"
    ]
  },
  "condition": "selection"
}

References:
  - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
Sigma Detection Rule: PSExec and WMI Process Creations Block
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2020-07-14
ATT&CK techniques: T1047, T1569.002
Log source: windows/

Description:
Detects blocking of process creations originating from PSExec and WMI commands

Detection logic:
{
  "selection": {
    "EventID": 1121,
    "ProcessName|endswith": [
      "\\wmiprvse.exe",
      "\\psexesvc.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
  - https://twitter.com/duff22b/status/[PII_REDACTED]60497920
Sigma Detection Rule: Windows Defender Exclusions Added
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Christian Burkard (Nextron Systems)
Date: 2021-07-06
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects the Setting of Windows Defender Exclusions

Detection logic:
{
  "selection": {
    "EventID": 5007,
    "NewValue|contains": "\\Microsoft\\Windows Defender\\Exclusions"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/_nullbind/status/[PII_REDACTED]10543109
Sigma Detection Rule: Windows Defender Malware Detection History Deletion
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Cian Heasley
Date: 2020-08-13
Log source: windows/

Description:
Windows Defender logs when the history of detected infections is deleted.

Detection logic:
{
  "selection": {
    "EventID": 1013
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
  - https://web.archive.org/web/[PII_REDACTED]3019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
Sigma Detection Rule: Windows Defender Configuration Changes
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-06
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects suspicious changes to the Windows Defender configuration

Detection logic:
{
  "selection": {
    "EventID": 5007,
    "NewValue|contains": [
      "\\Windows Defender\\DisableAntiSpyware ",
      "\\Windows Defender\\Scan\\DisableRemovableDriveScanning ",
      "\\Windows Defender\\Scan\\DisableScanningMappedNetworkDrivesForFullScan ",
      "\\Windows Defender\\SpyNet\\DisableBlockAtFirstSeen ",
      "\\Real-Time Protection\\SpyNetReporting "
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware
Sigma Detection Rule: Windows Defender Real-time Protection Disabled
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ján Trenčanský, frack113
Date: 2020-07-28
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment


Detection logic:
{
  "selection": {
    "EventID": 5001
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
Sigma Detection Rule: Windows Defender Grace Period Expired
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Ján Trenčanský, frack113
Date: 2020-07-28
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects the expiration of the grace period of Windows Defender. This means protection against viruses, spyware, and other potentially unwanted software is disabled.


Detection logic:
{
  "selection": {
    "EventID": 5101
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/
Sigma Detection Rule: AppLocker Prevented Application or Script from Running
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pushkarev Dmitry
Date: 2020-06-28
ATT&CK techniques: T1204.002, T1059.001, T1059.003, T1059.005, T1059.006, T1059.007
Log source: windows/

Description:
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.


Detection logic:
{
  "selection": {
    "EventID": [
      8004,
      8007,
      8022,
      8025
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker
  - https://nxlog.co/documentation/nxlog-user-guide/applocker.html
Sigma Detection Rule: Windows AppX Deployment Unsigned Package Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-03
ATT&CK techniques: T1204.002, T1553.005
Log source: windows/

Description:
Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events

Detection logic:
{
  "selection": {
    "EventID": 603,
    "Flags": "8388608"
  },
  "condition": "selection"
}

References:
  - https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage
  - https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html