deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potentially Suspicious Execution Of PDQDeployRunner
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-22
Log source: windows/process_creation

Description:
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines

Detection logic:
{
  "selection_parent": {
    "ParentImage|contains": "\\PDQDeployRunner-"
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\bash.exe",
        "\\certutil.exe",
        "\\cmd.exe",
        "\\csc.exe",
        "\\cscript.exe",
        "\\dllhost.exe",
        "\\mshta.exe",
        "\\msiexec.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\scriptrunner.exe",
        "\\wmic.exe",
        "\\wscript.exe",
        "\\wsl.exe"
      ]
    },
    {
      "Image|contains": [
        ":\\ProgramData\\",
        ":\\Users\\Public\\",
        ":\\Windows\\TEMP\\",
        "\\AppData\\Local\\Temp"
      ]
    },
    {
      "CommandLine|contains": [
        " -decode ",
        " -enc ",
        " -encodedcommand ",
        " -w hidden",
        "DownloadString",
        "FromBase64String",
        "http",
        "iex ",
        "Invoke-"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]72432128
Sigma Detection Rule: System Disk And Volume Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Stephen Lincoln '@slincoln-aiq' (AttackIQ)
Date: 2024-02-02
ATT&CK techniques: T1047, T1082
Log source: windows/process_creation

Description:
An adversary might use WMI to discover information about the system, such as the volume name, size,
free space, and other disk information. This can be done using the 'wmic' command-line utility and has been
observed being used by threat actors such as Volt Typhoon.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\WMIC.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|contains": [
        " volumename",
        " logicaldisk"
      ]
    },
    {
      "CommandLine|contains|all": [
        "path",
        "win32_logicaldisk"
      ]
    },
    {
      "CommandLine|contains|all": [
        " volume",
        " list "
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
Sigma Detection Rule: Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
ATT&CK techniques: T1615, T1059.005
Log source: windows/process_creation

Description:
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Detection logic:
{
  "selection": {
    "CommandLine|contains": "gatherNetworkInfo.vbs"
  },
  "filter": {
    "Image|endswith": [
      "\\cscript.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
Sigma Detection Rule: Suspicious Windows Service Tampering
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)
Date: 2022-09-01
ATT&CK techniques: T1489, T1685
Log source: windows/process_creation

Description:
Detects the usage of binaries such as 'net', 'sc' or 'powershell' in order to stop, pause, disable or delete critical or important Windows services such as AV, Backup, etc. As seen being used in some ransomware scripts


Detection logic:
{
  "selection_tools_img": [
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe",
        "PowerShell_ISE.EXE",
        "PowerShell.EXE",
        "psservice.exe",
        "pwsh.dll",
        "sc.exe",
        "wmic.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe",
        "\\PowerShell_ISE.EXE",
        "\\powershell.exe",
        "\\PsService.exe",
        "\\PsService64.exe",
        "\\pwsh.exe",
        "\\sc.exe",
        "\\wmic.exe"
      ]
    }
  ],
  "selection_tools_cli": [
    {
      "CommandLine|contains": [
        " delete ",
        ".delete()",
        " pause ",
        " stop ",
        "Stop-Service ",
        "Remove-Service "
      ]
    },
    {
      "CommandLine|contains|all": [
        "config",
        "start=disabled"
      ]
    }
  ],
  "selection_services": {
    "CommandLine|contains": [
      "143Svc",
      "Acronis VSS Provider",
      "AcronisAgent",
      "AcrSch2Svc",
      "AdobeARMservice",
      "AHS Service",
      "Antivirus",
      "Apache4",
      "ARSM",
      "aswBcc",
      "AteraAgent",
      "Avast Business Console Client Antivirus Service",
      "avast! Antivirus",
      "AVG Antivirus",
      "avgAdminClient",
      "AvgAdminServer",
      "AVP1",
      "BackupExec",
      "bedbg",
      "BITS",
      "BrokerInfrastructure",
      "CASLicenceServer",
      "CASWebServer",
      "Client Agent 7.60",
      "Core Browsing Protection",
      "Core Mail Protection

References:
  - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg
  - https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
  - https://www.virustotal.com/gui/file/38283b775552da[PII_REDACTED]ea74191aa0d203edd3f61fb2dee7b0aea3514955
Sigma Detection Rule: UAC Bypass Abusing Winsat Path Parsing - Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52)

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ],
    "ParentImage|endswith": "\\AppData\\Local\\Temp\\system32\\winsat.exe",
    "ParentCommandLine|contains": "C:\\Windows \\system32\\winsat.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Audio Capture via PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-24
ATT&CK techniques: T1123
Log source: windows/process_creation

Description:
Detects audio capture via PowerShell Cmdlet.

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "WindowsAudioDevice-Powershell-Cmdlet",
      "Toggle-AudioDevice",
      "Get-AudioDevice ",
      "Set-AudioDevice ",
      "Write-AudioDevice "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md
  - https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html
  - https://github.com/frgnca/AudioDeviceCmdlets
Sigma Detection Rule: IIS WebServer Log Deletion via CommandLine Utilities
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-09-02
ATT&CK techniques: T1070
Log source: windows/process_creation

Description:
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks.
Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "cmd.exe",
        "powershell.exe",
        "powershell_ise.exe",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli_del": {
    "CommandLine|contains": [
      "del ",
      "erase ",
      "rm ",
      "remove-item ",
      "rmdir "
    ]
  },
  "selection_cli_iis_dir": {
    "CommandLine|contains": "\\inetpub\\logs\\"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
Sigma Detection Rule: Uncommon FileSystem Load Attempt By Format.com
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-04
Log source: windows/process_creation

Description:
Detects the execution of format.com with an uncommon filesystem selection that could indicate a defense evasion activity in which "format.com" is used to load malicious DLL files or other programs.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\format.com",
    "CommandLine|contains": "/fs:"
  },
  "filter_main_known_fs": {
    "CommandLine|contains": [
      "/fs:exFAT",
      "/fs:FAT",
      "/fs:NTFS",
      "/fs:ReFS",
      "/fs:UDF"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]61209344
  - https://twitter.com/wdormann/status/[PII_REDACTED]30459653?s=20
Sigma Detection Rule: Suspicious Workstation Locking via Rundll32
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-06-04
Log source: windows/process_creation

Description:
Detects a suspicious call to the user32.dll function that locks the user workstation

Detection logic:
{
  "selection_call_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    }
  ],
  "selection_call_parent": {
    "ParentImage|endswith": "\\cmd.exe"
  },
  "selection_call_cli": {
    "CommandLine|contains": "user32.dll,"
  },
  "selection_function": {
    "CommandLine|contains": "LockWorkStation"
  },
  "condition": "all of selection_*"
}

References:
  - https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/
Sigma Detection Rule: Potential AMSI Bypass Via .NET Reflection
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, @Kostastsale
Date: 2018-08-17
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects Request to "amsiInitFailed" that can be used to disable AMSI Scanning

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains|all": [
        "System.Management.Automation.AmsiUtils",
        "amsiInitFailed"
      ]
    },
    {
      "CommandLine|contains|all": [
        "[Ref].Assembly.GetType",
        "SetValue($null,$true)",
        "NonPublic,Static"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/
  - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
Sigma Detection Rule: PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-13
ATT&CK techniques: T1087.002
Log source: windows/process_creation

Description:
Detects active directory enumeration activity using known AdFind CLI flags

Detection logic:
{
  "selection_password": {
    "CommandLine|contains": [
      "lockoutduration",
      "lockoutthreshold",
      "lockoutobservationwindow",
      "maxpwdage",
      "minpwdage",
      "minpwdlength",
      "pwdhistorylength",
      "pwdproperties"
    ]
  },
  "selection_enum_ad": {
    "CommandLine|contains": "-sc admincountdmp"
  },
  "selection_enum_exchange": {
    "CommandLine|contains": "-sc exchaddresses"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.joeware.net/freetools/tools/adfind/
  - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md
Sigma Detection Rule: Arbitrary File Download Via Squirrel.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
Date: 2022-06-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)


Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\squirrel.exe",
      "\\update.exe"
    ]
  },
  "selection_download_cli": {
    "CommandLine|contains": [
      " --download ",
      " --update ",
      " --updateRollback="
    ]
  },
  "selection_download_http_keyword": {
    "CommandLine|contains": "http"
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/
  - http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
  - http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
Sigma Detection Rule: PUA - Advanced Port Scanner Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-18
ATT&CK techniques: T1046, T1135
Log source: windows/process_creation

Description:
Detects the use of Advanced Port Scanner.

Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\advanced_port_scanner"
    },
    {
      "OriginalFileName|contains": "advanced_port_scanner"
    },
    {
      "Description|contains": "Advanced Port Scanner"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/portable",
      "/lng"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner
Sigma Detection Rule: Delete Important Scheduled Task
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_delete": {
    "CommandLine|contains|windash": "/delete"
  },
  "selection_cli_task": {
    "CommandLine|contains": [
      "\\Windows\\BitLocker",
      "\\Windows\\ExploitGuard",
      "\\Windows\\SystemRestore\\SR",
      "\\Windows\\UpdateOrchestrator\\",
      "\\Windows\\Windows Defender\\",
      "\\Windows\\WindowsBackup\\",
      "\\Windows\\WindowsUpdate\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - Internal Research
Sigma Detection Rule: Tasks Folder Evasion
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sreeman
Date: 2020-01-13
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
The Tasks folder in system32 and syswow64 are globally writable paths.
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr


Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "echo ",
      "copy ",
      "type ",
      "file createnew"
    ]
  },
  "selection2": {
    "CommandLine|contains": [
      " C:\\Windows\\System32\\Tasks\\",
      " C:\\Windows\\SysWow64\\Tasks\\"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://twitter.com/subTee/status/[PII_REDACTED]46563073
  - https://gist.github.com/am0nsec/8378da08f848424e4ab0cc5b317fdd26
Sigma Detection Rule: Suspicious AgentExecutor PowerShell Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), memory-shards
Date: 2022-12-24
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\AgentExecutor.exe"
    },
    {
      "OriginalFileName": "AgentExecutor.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -powershell",
      " -remediationScript"
    ]
  },
  "filter_main_pwsh": {
    "CommandLine|contains": [
      "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\",
      "C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\"
    ]
  },
  "filter_main_intune": {
    "ParentImage|endswith": "\\Microsoft.Management.Services.IntuneWindowsAgent.exe"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://twitter.com/lefterispan/status/[PII_REDACTED]36514816
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
  - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
  - https://twitter.com/jseerden/status/[PII_REDACTED]67066373/photo/1
Sigma Detection Rule: HackTool - Sliver C2 Implant Activity Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2022-08-25
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects process activity patterns as seen being used by Sliver C2 framework implants

Detection logic:
{
  "selection": {
    "CommandLine|contains": "-NoExit -Command [Console]::OutputEncoding=[Text.UTF8Encoding]::UTF8"
  },
  "condition": "selection"
}

References:
  - https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/implant/sliver/shell/shell_windows.go#L36
  - https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/
Sigma Detection Rule: DriverQuery.EXE Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-19
Log source: windows/process_creation

Description:
Detect usage of the "driverquery" utility. Which can be used to perform reconnaissance on installed drivers

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "driverquery.exe"
    },
    {
      "OriginalFileName": "drvqry.exe"
    }
  ],
  "filter_main_other": [
    {
      "ParentImage|endswith": [
        "\\cscript.exe",
        "\\mshta.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "ParentImage|contains": [
        "\\AppData\\Local\\",
        "\\Users\\Public\\",
        "\\Windows\\Temp\\"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/
  - https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/
  - https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
Sigma Detection Rule: Suspicious File Download From File Sharing Domain Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
Log source: windows/process_creation

Description:
Detects potentially suspicious file download from file sharing domains using curl.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_websites": {
    "CommandLine|contains": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_flag": {
    "CommandLine|contains": [
      " -O",
      "--remote-name",
      "--output"
    ]
  },
  "selection_ext": {
    "CommandLine|endswith": [
      ".ps1",
      ".ps1'",
      ".ps1\"",
      ".dat",
      ".dat'",
      ".dat\"",
      ".msi",
      ".msi'",
      ".msi\"",
      ".bat",
      ".bat'",
      ".bat\"",
      ".exe",
      ".exe'",
      ".exe\"",
      ".vbs",
      ".vbs'",
      ".vbs\"",
      ".vbe",
      ".vbe'",
      ".vbe\"",
      ".hta",
      ".hta'",
      ".hta\

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
Sigma Detection Rule: Renamed Whoami Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-12
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects the execution of whoami that has been renamed to a different name to avoid detection

Detection logic:
{
  "selection": {
    "OriginalFileName": "whoami.exe"
  },
  "filter": {
    "Image|endswith": "\\whoami.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/
  - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
Sigma Detection Rule: PUA - NPS Tunneling Tool Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-10-08
ATT&CK techniques: T1090
Log source: windows/process_creation

Description:
Detects the use of NPS, a port forwarding and intranet penetration proxy server

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\npc.exe"
  },
  "selection_cli_1": {
    "CommandLine|contains|all": [
      " -server=",
      " -vkey=",
      " -password="
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains": " -config=npc"
  },
  "selection_hashes": {
    "Hashes|contains": [
      "MD5=AE8ACF66BFE3A[PII_REDACTED]8B826D005",
      "SHA1=CEA49E9B9B67F3A13AD0BE1C2655293EA3C18181",
      "SHA256=5A456283392FFCEEEACA3D3426C306EB[PII_REDACTED]20D72FED1CC1FEBBBD6856"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/ehang-io/nps