deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential AS-REP Roasting via Kerberos TGT Requests
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: ANosir
Date: 2025-05-22
Log source: windows/

Description:
Detects suspicious Kerberos TGT requests with pre-authentication disabled (Pre-Authentication Type = 0) and Ticket Encryption Type (0x17) i.e, RC4-HMAC.
This may indicate an AS-REP Roasting attack, where attackers request AS-REP messages for accounts without pre-authentication and attempt to crack the encrypted ticket offline to recover user passwords.


Detection logic:
{
  "selection": {
    "EventID": 4768,
    "TicketEncryptionType": "0x17",
    "ServiceName": "krbtgt",
    "PreAuthType": 0
  },
  "condition": "selection"
}

References:
  - https://medium.com/system-weakness/detecting-as-rep-roasting-attacks-b5b3965f9714
  - https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004
Sigma Detection Rule: DPAPI Domain Backup Key Extraction
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-06-20
ATT&CK techniques: T1003.004
Log source: windows/

Description:
Detects tools extracting LSA secret DPAPI domain backup key from Domain Controllers

Detection logic:
{
  "selection": {
    "EventID": 4662,
    "ObjectType": "SecretObject",
    "AccessMask": "0x2",
    "ObjectName|contains": "BCKUPKEY"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190620-DomainDPAPIBackupKeyExtraction/notebook.html
Sigma Detection Rule: Transferring Files with Credential Data via Network Shares
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Teymur Kheirkhabarov, oscd.community
Date: 2019-10-22
ATT&CK techniques: T1003.002, T1003.001, T1003.003
Log source: windows/

Description:
Transferring files with well-known filenames (sensitive files with credential data) using network shares

Detection logic:
{
  "selection_eid": {
    "EventID": 5145
  },
  "selection_object": [
    {
      "RelativeTargetName|contains": [
        "\\mimidrv",
        "\\lsass",
        "\\windows\\minidump\\",
        "\\hiberfil",
        "\\sqldmpr"
      ]
    },
    {
      "RelativeTargetName": [
        "Windows\\NTDS\\ntds.dit",
        "Windows\\System32\\config\\SAM",
        "Windows\\System32\\config\\SECURITY",
        "Windows\\System32\\config\\SYSTEM"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: Local User Creation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Patrick Bareiss
Date: 2019-04-18
ATT&CK techniques: T1136.001
Log source: windows/

Description:
Detects local user creation on Windows servers, which shouldn't happen in an Active Directory environment. Apply this Sigma Use Case on your Windows server logs and not on your DC logs.


Detection logic:
{
  "selection": {
    "EventID": 4720
  },
  "condition": "selection"
}

References:
  - https://patrick-bareiss.com/detecting-local-user-creation-in-ad-with-sigma/
Sigma Detection Rule: Possible DC Shadow Attack
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, oscd.community, Chakib Gzenayi (@Chak092), Hosni Mribah
Date: 2019-10-25
ATT&CK techniques: T1207
Log source: windows/

Description:
Detects DCShadow via create new SPN

Detection logic:
{
  "selection1": {
    "EventID": 4742,
    "ServicePrincipalNames|contains": "GC/"
  },
  "selection2": {
    "EventID": 5136,
    "AttributeLDAPDisplayName": "servicePrincipalName",
    "AttributeValue|startswith": "GC/"
  },
  "condition": "1 of selection*"
}

References:
  - https://twitter.com/gentilkiwi/status/[PII_REDACTED]25413376
  - https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2
  - https://web.archive.org/web/[PII_REDACTED]4709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
Sigma Detection Rule: User Logoff Event
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: frack113
Date: 2022-10-14
ATT&CK techniques: T1531
Log source: windows/

Description:
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations

Detection logic:
{
  "selection": {
    "EventID": [
      4634,
      4647
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647
Sigma Detection Rule: Denied Access To Remote Desktop
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Pushkarev Dmitry
Date: 2020-06-27
ATT&CK techniques: T1021.001
Log source: windows/

Description:
This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop.
Often, this event can be generated by attackers when searching for available windows servers in the network.


Detection logic:
{
  "selection": {
    "EventID": 4825
  },
  "condition": "selection"
}

References:
  - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825
Sigma Detection Rule: Suspicious LDAP-Attributes Used
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: xknow @xknow_infosec
Date: 2019-03-24
ATT&CK techniques: T1001.003
Log source: windows/

Description:
Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.

Detection logic:
{
  "selection": {
    "EventID": 5136,
    "AttributeValue|contains": "*",
    "AttributeLDAPDisplayName": [
      "primaryInternationalISDNNumber",
      "otherFacsimileTelephoneNumber",
      "primaryTelexNumber"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961
  - https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/
  - https://github.com/fox-it/LDAPFragger
Sigma Detection Rule: VSSAudit Security Event Source Registration
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
Date: 2020-10-20
ATT&CK techniques: T1003.002
Log source: windows/

Description:
Detects the registration of the security event source VSSAudit. It would usually trigger when volume shadow copy operations happen.

Detection logic:
{
  "selection": {
    "AuditSourceName": "VSSAudit",
    "EventID": [
      4904,
      4905
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy
Sigma Detection Rule: Remote PowerShell Sessions Network Connections (WinRM)
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-09-12
ATT&CK techniques: T1059.001
Log source: windows/

Description:
Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

Detection logic:
{
  "selection": {
    "EventID": 5156,
    "DestPort": [
      5985,
      5986
    ],
    "LayerRTID": 44
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
Sigma Detection Rule: Startup/Logon Script Added to Group Policy Object
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Elastic, Josh Nickels, Marius Rothenbücher
Date: 2024-09-06
ATT&CK techniques: T1484.001, T1547
Log source: windows/

Description:
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.


Detection logic:
{
  "selection_eventid": {
    "EventID": [
      5136,
      5145
    ]
  },
  "selection_attributes_main": {
    "AttributeLDAPDisplayName": [
      "gPCMachineExtensionNames",
      "gPCUserExtensionNames"
    ],
    "AttributeValue|contains": "42B5FAAE-6536-11D2-AE5A-0000F87571E3"
  },
  "selection_attributes_optional": {
    "AttributeValue|contains": [
      "40B6664F-4972-11D1-A7CA-0000F87571E3",
      "40B66650-4972-11D1-A7CA-0000F87571E3"
    ]
  },
  "selection_share": {
    "ShareName|endswith": "\\SYSVOL",
    "RelativeTargetName|endswith": [
      "\\scripts.ini",
      "\\psscripts.ini"
    ],
    "AccessList|contains": "%%4417"
  },
  "condition": "selection_eventid and (all of selection_attributes_* or selection_share)"
}

References:
  - https://www.elastic.co/guide/en/security/current/startup-logon-script-added-to-group-policy-object.html
Sigma Detection Rule: Hacktool Ruler
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-31
ATT&CK techniques: T1087, T1114, T1059, T1550.002
Log source: windows/

Description:
This events that are generated when using the hacktool Ruler by Sensepost

Detection logic:
{
  "selection1": {
    "EventID": 4776,
    "Workstation": "RULER"
  },
  "selection2": {
    "EventID": [
      4624,
      4625
    ],
    "WorkstationName": "RULER"
  },
  "condition": "(1 of selection*)"
}

References:
  - https://github.com/sensepost/ruler
  - https://github.com/sensepost/ruler/issues/47
  - https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4624
Sigma Detection Rule: Invoke-Obfuscation RUNDLL LAUNCHER - Security
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/

Description:
Detects Obfuscated Powershell via RUNDLL LAUNCHER

Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains|all": [
      "rundll32.exe",
      "shell32.dll",
      "shellexec_rundll",
      "powershell"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: T1047 Wmiprvse Wbemcomn DLL Hijack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)
Date: 2020-10-12
ATT&CK techniques: T1047, T1021.002
Log source: windows/

Description:
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.

Detection logic:
{
  "selection": {
    "EventID": 5145,
    "RelativeTargetName|endswith": "\\wbem\\wbemcomn.dll"
  },
  "filter": {
    "SubjectUserName|endswith": "$"
  },
  "condition": "selection and not filter"
}

References:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html
Sigma Detection Rule: Invoke-Obfuscation Obfuscated IEX Invocation - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Date: 2019-11-08
ATT&CK techniques: T1027
Log source: windows/

Description:
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references

Detection logic:
{
  "selection_eid": {
    "EventID": 4697
  },
  "selection_servicefilename": [
    {
      "ServiceFileName|re": "\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\["
    },
    {
      "ServiceFileName|re": "\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\["
    },
    {
      "ServiceFileName|re": "\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\["
    },
    {
      "ServiceFileName|re": "\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}"
    },
    {
      "ServiceFileName|re": "\\\\*mdr\\*\\W\\s*\\)\\.Name"
    },
    {
      "ServiceFileName|re": "\\$VerbosePreference\\.ToString\\("
    },
    {
      "ServiceFileName|re": "\\String\\]\\s*\\$VerbosePreference"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
Sigma Detection Rule: Hidden Local User Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-05-03
ATT&CK techniques: T1136.001
Log source: windows/

Description:
Detects the creation of a local hidden user account which should not happen for event ID 4720.

Detection logic:
{
  "selection": {
    "EventID": 4720,
    "TargetUserName|endswith": "$"
  },
  "filter_main_homegroup": {
    "TargetUserName": "HomeGroupUser$"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]63958021
Sigma Detection Rule: Potentially Suspicious AccessMask Requested From LSASS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez, Teymur Kheirkhabarov, Dimitrios Slamaris, Mark Russinovich, Aleksey Potapov, oscd.community (update)
Date: 2019-11-01
ATT&CK techniques: T1003.001
Log source: windows/

Description:
Detects process handle on LSASS process with certain access mask

Detection logic:
{
  "selection_1": {
    "EventID": 4656,
    "ObjectName|endswith": "\\lsass.exe",
    "AccessMask|contains": [
      "0x40",
      "0x1400",
      "0x100000",
      "0x1410",
      "0x1010",
      "0x1438",
      "0x143a",
      "0x1418",
      "0x1f0fff",
      "0x1f1fff",
      "0x1f2fff",
      "0x1f3fff"
    ]
  },
  "selection_2": {
    "EventID": 4663,
    "ObjectName|endswith": "\\lsass.exe",
    "AccessList|contains": [
      "4484",
      "4416"
    ]
  },
  "filter_main_specific": {
    "ProcessName|endswith": [
      "\\csrss.exe",
      "\\GamingServices.exe",
      "\\lsm.exe",
      "\\MicrosoftEdgeUpdate.exe",
      "\\minionhost.exe",
      "\\MRT.exe",
      "\\MsMpEng.exe",
      "\\perfmon.exe",
      "\\procexp.exe",
      "\\procexp64.exe",
      "\\svchost.exe",
      "\\taskmgr.exe",
      "\\thor.exe",
      "\\thor64.exe",
      "\\vmtoolsd.exe",
      "\\VsTskMgr.exe",
      "\\wininit.exe",
      "\\wmiprvse.exe",
      "RtkAudUService64"
    ],
    "ProcessName|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
      ":\\Windows\\SysNative\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWow64\\",
      ":\\Windows\\Temp\\asgard2-agent\\"
    ]
  },
  "filter_main_generic": {
    "ProcessName|contains": ":\\Program Files"
  },
  "filter_main_exact": {
    "ProcessName|endswith": [
      ":\\Windows\\System32\\taskhostw.exe",
      ":\\Windows\\System

References:
  - https://web.archive.org/web/[PII_REDACTED]3920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
Sigma Detection Rule: Tap Driver Installation - Security
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Daniil Yugoslavskiy, Ian Davis, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1048
Log source: windows/

Description:
Detects the installation of a well-known TAP driver service. This could be a sign of potential preparation for data exfiltration using tunnelling techniques.


Detection logic:
{
  "selection": {
    "EventID": 4697,
    "ServiceFileName|contains": "tap0901"
  },
  "condition": "selection"
}

References:
  - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
Sigma Detection Rule: SCM Database Handle Failure
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-12
ATT&CK techniques: T1010
Log source: windows/

Description:
Detects non-system users failing to get a handle of the SCM database.

Detection logic:
{
  "selection": {
    "EventID": 4656,
    "ObjectType": "SC_MANAGER OBJECT",
    "ObjectName": "ServicesActive",
    "AccessMask": "0xf003f"
  },
  "filter": {
    "SubjectLogonId": "0x3e4"
  },
  "condition": "selection and not filter"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190826-RemoteSCMHandle/notebook.html
Sigma Detection Rule: HackTool - NoFilter Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Stamatis Chatzimangou (st0pp3r)
Date: 2024-01-05
ATT&CK techniques: T1134, T1134.001
Log source: windows/

Description:
Detects execution of NoFilter, a tool for abusing the Windows Filtering Platform for privilege escalation via hardcoded policy name indicators


Detection logic:
{
  "selection_5447": {
    "EventID": 5447,
    "FilterName|contains": "RonPolicy"
  },
  "selection_5449": {
    "EventID": 5449,
    "ProviderContextName|contains": "RonPolicy"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
  - https://github.com/deepinstinct/NoFilter
  - https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
  - https://x.com/_st0pp3r_/status/[PII_REDACTED]61128162?s=20
Sigma Detection Rule: Password Policy Enumerated
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Zach Mathis
Date: 2023-05-19
ATT&CK techniques: T1201
Log source: windows/

Description:
Detects when the password policy is enumerated.

Detection logic:
{
  "selection": {
    "EventID": 4661,
    "AccessList|contains": "%%5392",
    "ObjectServer": "Security Account Manager"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
  - https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
Sigma Detection Rule: Active Directory Replication from Non Machine Account
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-07-26
ATT&CK techniques: T1003.006
Log source: windows/

Description:
Detects potential abuse of Active Directory Replication Service (ADRS) from a non machine account to request credentials.

Detection logic:
{
  "selection": {
    "EventID": 4662,
    "AccessMask": "0x100",
    "Properties|contains": [
      "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
      "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
      "89e95b76-444d-4c62-991a-0facbeda640c"
    ]
  },
  "filter": [
    {
      "SubjectUserName|endswith": "$"
    },
    {
      "SubjectUserName|startswith": "MSOL_"
    }
  ],
  "condition": "selection and not filter"
}

References:
  - https://threathunterplaybook.com/hunts/windows/180815-ADObjectAccessReplication/notebook.html
  - https://threathunterplaybook.com/library/windows/active_directory_replication.html
  - https://threathunterplaybook.com/hunts/windows/190101-ADModDirectoryReplication/notebook.html
Sigma Detection Rule: Kerberoasting Activity - Initial Query
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2022-01-21
ATT&CK techniques: T1558.003
Log source: windows/

Description:
This rule will collect the data needed to start looking into possible kerberoasting activity.
Further analysis or computation within the query is needed focusing on requests from one specific host/IP towards multiple service names within a time period of 5 seconds.
You can then set a threshold for the number of requests and time between the requests to turn this into an alert.


Detection logic:
{
  "selection": {
    "EventID": 4769,
    "Status": "0x0",
    "TicketEncryptionType": "0x17"
  },
  "filter_main_krbtgt": {
    "ServiceName|endswith": [
      "krbtgt",
      "$"
    ]
  },
  "filter_main_machine_accounts": {
    "TargetUserName|contains": "$@"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.trustedsec.com/blog/art_of_kerberoast/
  - https://adsecurity.org/?p=3513
Sigma Detection Rule: Addition of SID History to Active Directory Object
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Thomas Patzke, @atc_project (improvements)
Date: 2017-02-19
ATT&CK techniques: T1134.005
Log source: windows/

Description:
An attacker can use the SID history attribute to gain additional privileges.

Detection logic:
{
  "selection1": {
    "EventID": [
      4765,
      4766
    ]
  },
  "selection2": {
    "EventID": 4738
  },
  "selection3": {
    "SidHistory": [
      "-",
      "%%1793"
    ]
  },
  "filter_null": {
    "SidHistory": null
  },
  "condition": "selection1 or (selection2 and not selection3 and not filter_null)"
}

References:
  - https://adsecurity.org/?p=1772
Sigma Detection Rule: ETW Logging Disabled In .NET Processes - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-06-05
ATT&CK techniques: T1112, T1685
Log source: windows/

Description:
Potential adversaries stopping ETW providers recording loaded .NET assemblies.

Detection logic:
{
  "selection_etw_enabled": {
    "EventID": 4657,
    "ObjectName|endswith": "\\SOFTWARE\\Microsoft\\.NETFramework",
    "ObjectValueName": "ETWEnabled",
    "NewValue": 0
  },
  "selection_complus": {
    "EventID": 4657,
    "ObjectName|contains": "\\Environment",
    "ObjectValueName": [
      "COMPlus_ETWEnabled",
      "COMPlus_ETWFlags"
    ],
    "NewValue": 0
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/_xpn_/status/[PII_REDACTED]28378368
  - https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr
  - https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables
  - https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38
  - https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39
Sigma Detection Rule: First Time Seen Remote Named Pipe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-04-03
ATT&CK techniques: T1021.002
Log source: windows/

Description:
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes

Detection logic:
{
  "selection1": {
    "EventID": 5145,
    "ShareName": "\\\\\\\\\\*\\\\IPC$"
  },
  "false_positives": {
    "RelativeTargetName": [
      "atsvc",
      "samr",
      "lsarpc",
      "lsass",
      "winreg",
      "netlogon",
      "srvsvc",
      "protected_storage",
      "wkssvc",
      "browser",
      "netdfs",
      "svcctl",
      "spoolss",
      "ntsvcs",
      "LSM_API_service",
      "HydraLsPipe",
      "TermSrv_API_service",
      "MsFteWds",
      "sql\\query",
      "eventlog"
    ]
  },
  "condition": "selection1 and not false_positives"
}

References:
  - https://twitter.com/menasec1/status/[PII_REDACTED]87451904