deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Invoke-Obfuscation RUNDLL LAUNCHER - System
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via RUNDLL LAUNCHER

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "rundll32.exe",
      "shell32.dll",
      "shellexec_rundll",
      "powershell"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation CLIP+ Launcher - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated use of Clip.exe to execute PowerShell

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "cmd",
      "&&",
      "clipboard]::"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: TacticalRMM Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-28
ATT&CK techniques: T1219.002
Log source: windows/

Description:
Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.

Detection logic:
{
  "selection_root": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ImagePath|contains": "tacticalrmm.exe"
    },
    {
      "ServiceName|contains": "TacticalRMM Agent Service"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
Sigma Detection Rule: Invoke-Obfuscation Via Use Rundll32 - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via use Rundll32 in Scripts

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "&&",
      "rundll32",
      "shell32.dll",
      "shellexec_rundll"
    ],
    "ImagePath|contains": [
      "value",
      "invoke",
      "comspec",
      "iex"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: ProcessHacker Privilege Elevation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-05-27
ATT&CK techniques: T1543.003, T1569.002
Log source: windows/

Description:
Detects a ProcessHacker tool that elevated privileges to a very high level

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName|startswith": "ProcessHacker",
    "AccountName": "LocalSystem"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/1kwpeter/status/[PII_REDACTED]55765504
Sigma Detection Rule: New PDQDeploy Service - Server Side
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-22
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects a PDQDeploy service installation which indicates that PDQDeploy was installed on the machines.
PDQDeploy can be abused by attackers to remotely install packages or execute commands on target machines


Detection logic:
{
  "selection_root": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ImagePath|contains": "PDQDeployService.exe"
    },
    {
      "ServiceName": [
        "PDQDeploy",
        "PDQ Deploy"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm
Sigma Detection Rule: CobaltStrike Service Installations - System
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Wojciech Lesicki
Date: 2021-05-26
ATT&CK techniques: T1021.002, T1543.003, T1569.002
Log source: windows/

Description:
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Detection logic:
{
  "selection_id": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection1": {
    "ImagePath|contains|all": [
      "ADMIN$",
      ".exe"
    ]
  },
  "selection2": {
    "ImagePath|contains|all": [
      "%COMSPEC%",
      "start",
      "powershell"
    ]
  },
  "selection3": {
    "ImagePath|contains": "powershell -nop -w hidden -encodedcommand"
  },
  "selection4": {
    "ImagePath|base64offset|contains": "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:"
  },
  "condition": "selection_id and (selection1 or selection2 or selection3 or selection4)"
}

References:
  - https://www.sans.org/webcasts/119395
  - https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
Sigma Detection Rule: Important Windows Service Terminated With Error
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-14
Log source: windows/

Description:
Detects important or interesting Windows services that got terminated for whatever reason

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7023
  },
  "selection_name": [
    {
      "param1|contains": [
        " Antivirus",
        " Firewall",
        "Application Guard",
        "BitLocker Drive Encryption Service",
        "Encrypting File System",
        "Microsoft Defender",
        "Threat Protection",
        "Windows Event Log"
      ]
    },
    {
      "Binary|contains": [
        "770069006e[PII_REDACTED]660065006e006400",
        "[PII_REDACTED]006e0074004c006f006700",
        "6d[PII_REDACTED][PII_REDACTED]00",
        "530065006e[PII_REDACTED]",
        "[PII_REDACTED]00",
        "[PII_REDACTED][PII_REDACTED]4300"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
Sigma Detection Rule: PAExec Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-26
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects PAExec service installation

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_image": [
    {
      "ServiceName|startswith": "PAExec-"
    },
    {
      "ImagePath|startswith": "C:\\WINDOWS\\PAExec-"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.poweradmin.com/paexec/
Sigma Detection Rule: RTCore Suspicious Service Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-30
Log source: windows/

Description:
Detects the installation of RTCore service. Which could be an indication of Micro-Star MSI Afterburner vulnerable driver abuse

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ServiceName": "RTCore64"
  },
  "condition": "selection"
}

References:
  - https://github.com/br-sn/CheekyBlinder/blob/e1764a8a0e7cda8a3716aefa35799f560686e01c/CheekyBlinder/CheekyBlinder.cpp
Sigma Detection Rule: Uncommon Service Installation Image Path
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-18
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects uncommon service installation commands by looking at suspicious or uncommon image path values containing references to encoded powershell commands, temporary paths, etc.


Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "suspicious_paths": {
    "ImagePath|contains": [
      "\\\\\\\\.\\\\pipe",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ]
  },
  "suspicious_encoded_flag": {
    "ImagePath|contains": " -e"
  },
  "suspicious_encoded_keywords": {
    "ImagePath|contains": [
      " aQBlAHgA",
      " aWV4I",
      " IAB",
      " JAB",
      " PAA",
      " SQBFAFgA",
      " SUVYI"
    ]
  },
  "filter_optional_thor_remote": {
    "ImagePath|startswith": "C:\\WINDOWS\\TEMP\\thor10-remote\\thor64.exe"
  },
  "filter_main_defender_def_updates": {
    "ImagePath|startswith": "C:\\ProgramData\\Microsoft\\Windows Defender\\Definition Updates\\"
  },
  "condition": "selection and ( suspicious_paths or all of suspicious_encoded_* ) and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Internal Research
Sigma Detection Rule: Invoke-Obfuscation STDIN+ Launcher - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated use of stdin to execute PowerShell

Detection logic:
{
  "selection_main": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "cmd",
      "powershell"
    ],
    "ImagePath|contains": [
      "/c",
      "/r"
    ]
  },
  "selection_other": [
    {
      "ImagePath|contains": "noexit"
    },
    {
      "ImagePath|contains|all": [
        "input",
        "$"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: PsExec Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Thomas Patzke
Date: 2017-06-12
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects PsExec service installation and execution events

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ServiceName": "PSEXESVC"
    },
    {
      "ImagePath|endswith": "\\PSEXESVC.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
Sigma Detection Rule: Service Installed By Unusual Client - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch (Nextron Systems), Elastic (idea)
Date: 2022-09-15
ATT&CK techniques: T1543
Log source: windows/

Description:
Detects a service installed by a client which has PID 0 or whose parent has PID 0

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ProcessId": 0
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html
Sigma Detection Rule: RemCom Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-07
ATT&CK techniques: T1569.002
Log source: windows/

Description:
Detects RemCom service installation and execution events

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ServiceName": "RemComSvc"
    },
    {
      "ImagePath|endswith": "\\RemComSvc.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/kavika13/RemCom/
Sigma Detection Rule: Important Windows Service Terminated Unexpectedly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-14
Log source: windows/

Description:
Detects important or interesting Windows services that got terminated unexpectedly.

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7034
  },
  "selection_name": [
    {
      "param1|contains": "Message Queuing"
    },
    {
      "Binary|contains": [
        "4d0053004d005100",
        "6d0073006d007100"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/
Sigma Detection Rule: Mesh Agent Service Installation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-28
ATT&CK techniques: T1219.002
Log source: windows/

Description:
Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers

Detection logic:
{
  "selection_root": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ImagePath|contains": "MeshAgent.exe"
    },
    {
      "ServiceName|contains": "Mesh Agent"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
Sigma Detection Rule: Invoke-Obfuscation Obfuscated IEX Invocation - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Date: 2019-11-08
ATT&CK techniques: T1027
Log source: windows/

Description:
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Detection logic:
{
  "selection_eid": {
    "EventID": 7045
  },
  "selection_imagepath": [
    {
      "ImagePath|re": "\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\["
    },
    {
      "ImagePath|re": "\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\["
    },
    {
      "ImagePath|re": "\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\["
    },
    {
      "ImagePath|re": "\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}"
    },
    {
      "ImagePath|re": "\\\\*mdr\\*\\W\\s*\\)\\.Name"
    },
    {
      "ImagePath|re": "\\$VerbosePreference\\.ToString\\("
    },
    {
      "ImagePath|re": "\\String\\]\\s*\\$VerbosePreference"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
Sigma Detection Rule: Sliver C2 Default Service Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-25
ATT&CK techniques: T1543.003, T1569.002
Log source: windows/

Description:
Detects known malicious service installation that appear in cases in which a Sliver implants execute the PsExec commands

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service_1": {
    "ImagePath|re": "^[a-zA-Z]:\\\\windows\\\\temp\\\\[a-zA-Z0-9]{10}\\.exe"
  },
  "selection_service_2": {
    "ServiceName": [
      "Sliver",
      "Sliver implant"
    ]
  },
  "condition": "selection_eid and 1 of selection_service_*"
}

References:
  - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231
  - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
Sigma Detection Rule: Remote Utilities Host Service Install
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-31
Log source: windows/

Description:
Detects Remote Utilities Host service installation on the target system.

Detection logic:
{
  "selection_root": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ImagePath|contains|all": [
        "\\rutserv.exe",
        "-service"
      ]
    },
    {
      "ServiceName": "Remote Utilities - Host"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.remoteutilities.com/support/kb/host-service-won-t-start/
Sigma Detection Rule: Service Installation with Suspicious Folder Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-03-18
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects service installation with suspicious folder patterns

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_img_paths": [
    {
      "ImagePath|re": "^[Cc]:\\\\[Pp]rogram[Dd]ata\\\\.{1,9}\\.exe"
    },
    {
      "ImagePath|re": "^[Cc]:\\\\.{1,9}\\.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - Internal Research
Sigma Detection Rule: Windows Defender Threat Detection Service Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Ján Trenčanský, frack113
Date: 2020-07-28
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects when the "Windows Defender Threat Protection" service is disabled.

Detection logic:
{
  "selection": {
    "EventID": 7036,
    "Provider_Name": "Service Control Manager",
    "param1": [
      "Windows Defender Antivirus Service",
      "Service antivirus Microsoft Defender"
    ],
    "param2": [
      "stopped",
      "arr\u00eat\u00e9"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Remote Access Tool Services Have Been Installed - System
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Connor Martin, Nasreddine Bencherchali
Date: 2022-12-23
ATT&CK techniques: T1543.003, T1569.002
Log source: windows/

Description:
Detects service installation of different remote access tools software. These software are often abused by threat actors to perform

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": [
      7045,
      7036
    ],
    "ServiceName|contains": [
      "AmmyyAdmin",
      "Atera",
      "BASupportExpressSrvcUpdater",
      "BASupportExpressStandaloneService",
      "chromoting",
      "GoToAssist",
      "GoToMyPC",
      "jumpcloud",
      "LMIGuardianSvc",
      "LogMeIn",
      "monblanking",
      "Parsec",
      "RManService",
      "RPCPerformanceService",
      "RPCService",
      "SplashtopRemoteService",
      "SSUService",
      "TeamViewer",
      "TightVNC",
      "vncserver",
      "Zoho"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
Sigma Detection Rule: Windows Service Terminated With Error
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-14
Log source: windows/

Description:
Detects Windows services that got terminated for whatever reason

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7023
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
Sigma Detection Rule: NetSupport Manager Service Install
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-31
Log source: windows/

Description:
Detects NetSupport Manager service installation on the target system.

Detection logic:
{
  "selection_root": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_service": [
    {
      "ImagePath|contains": "\\NetSupport Manager\\client32.exe"
    },
    {
      "ServiceName": "Client32"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf
Sigma Detection Rule: Suspicious Service Installation Script
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-03-18
ATT&CK techniques: T1543.003
Log source: windows/

Description:
Detects suspicious service installation scripts

Detection logic:
{
  "selection_eid": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_cmd_flags": {
    "ImagePath|contains|windash": [
      " -c ",
      " -r ",
      " -k "
    ]
  },
  "selection_binaries": {
    "ImagePath|contains": [
      "cscript",
      "mshta",
      "powershell",
      "pwsh",
      "regsvr32",
      "rundll32",
      "wscript"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research
Sigma Detection Rule: Invoke-Obfuscation VAR+ Launcher - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated use of Environment Variables to execute PowerShell

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "cmd",
      "\"set",
      "-f"
    ],
    "ImagePath|contains": [
      "/c",
      "/r"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation Via Use Clip - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via use Clip.exe in Scripts

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains": "(Clipboard|i"
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation Via Use MSHTA - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via use MSHTA in Scripts

Detection logic:
{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath|contains|all": [
      "mshta",
      "vbscript:createobject"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Meterpreter or Cobalt Strike Getsystem Service Installation - System
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov, Ecco, Florian Roth (Nextron Systems)
Date: 2019-10-26
ATT&CK techniques: T1134.001, T1134.002
Log source: windows/

Description:
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Detection logic:
{
  "selection_id": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045
  },
  "selection_cli_cmd": {
    "ImagePath|contains|all": [
      "/c",
      "echo",
      "\\pipe\\"
    ],
    "ImagePath|contains": [
      "cmd",
      "%COMSPEC%"
    ]
  },
  "selection_cli_rundll": {
    "ImagePath|contains|all": [
      "rundll32",
      ".dll,a",
      "/p:"
    ]
  },
  "selection_cli_share": {
    "ImagePath|startswith": "\\\\\\\\127.0.0.1\\\\ADMIN$\\"
  },
  "condition": "selection_id and 1 of selection_cli_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/