deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Renamed Msdt.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2022-06-03
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed "Msdt.exe" binary

Detection logic:
{
  "selection": {
    "OriginalFileName": "msdt.exe"
  },
  "filter": {
    "Image|endswith": "\\msdt.exe"
  },
  "condition": "selection and not filter"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
Sigma Detection Rule: Potential Lateral Movement via Windows Remote Shell
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Liran Ravich
Date: 2025-10-22
ATT&CK techniques: T1021.006
Log source: windows/process_creation

Description:
Detects a child process spawned by 'winrshost.exe', which suggests remote command execution through Windows Remote Shell (WinRs) and may indicate potential lateral movement activity.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\winrshost.exe"
  },
  "filter_main_conhost": {
    "Image": "C:\\Windows\\System32\\conhost.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
  - https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
Sigma Detection Rule: Potential Mftrace.EXE Abuse
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-09
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\mftrace.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Mftrace/
Sigma Detection Rule: Suspicious TSCON Start as SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-03-17
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects a tscon.exe start as LOCAL SYSTEM

Detection logic:
{
  "selection": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ],
    "Image|endswith": "\\tscon.exe"
  },
  "condition": "selection"
}

References:
  - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
  - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
  - https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement
Sigma Detection Rule: Potential Application Whitelisting Bypass via Dnx.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community
Date: 2019-10-26
ATT&CK techniques: T1218, T1027.004
Log source: windows/process_creation

Description:
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\dnx.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
  - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/
Sigma Detection Rule: Uncommon System Information Discovery Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: TropChaud
Date: 2023-01-26
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information,
including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS,
and GPU driver products/versions.
Some of these commands were used by Aurora Stealer in late 2022/early 2023.


Detection logic:
{
  "selection_wmic": [
    {
      "Description": "WMI Commandline Utility"
    },
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Image|endswith": "\\WMIC.exe"
    }
  ],
  "selection_commands": {
    "CommandLine|contains": [
      "LOGICALDISK get Name,Size,FreeSpace",
      "os get Caption,OSArchitecture,Version"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic
  - https://nwgat.ninja/getting-system-information-with-wmic-on-windows/
  - https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar
  - https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/
  - https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/
Sigma Detection Rule: File Download From IP URL Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-18
Log source: windows/process_creation

Description:
Detects file downloads directly from IP address URL using curl.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_ip": {
    "CommandLine|re": "://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_flag": {
    "CommandLine|contains": [
      " -O",
      "--remote-name",
      "--output"
    ]
  },
  "filter_main_ext": {
    "CommandLine|endswith": [
      ".bat",
      ".bat\"",
      ".dat",
      ".dat\"",
      ".dll",
      ".dll\"",
      ".exe",
      ".exe\"",
      ".gif",
      ".gif\"",
      ".hta",
      ".hta\"",
      ".jpeg",
      ".jpeg\"",
      ".log",
      ".log\"",
      ".msi",
      ".msi\"",
      ".png",
      ".png\"",
      ".ps1",
      ".ps1\"",
      ".psm1",
      ".psm1\"",
      ".vbe",
      ".vbe\"",
      ".vbs",
      ".vbs\"",
      ".bat'",
      ".dat'",
      ".dll'",
      ".exe'",
      ".gif'",
      ".hta'",
      ".jpeg'",
      ".log'",
      ".msi'",
      ".png'",
      ".ps1'",
      ".psm1'",
      ".vbe'",
      ".vbs'"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
  - https://github.com/pr0xylife/IcedID/blob/8dd1e218460db4f750d955b4c65b2f918a1db906/icedID_09.28.2023.txt
Sigma Detection Rule: Password Provided In Command Line Of Net.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Shelton (HAWK.IO)
Date: 2021-12-09
ATT&CK techniques: T1021.002, T1078
Log source: windows/process_creation

Description:
Detects a when net.exe is called with a password in the command line

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " use ",
      ":*\\\\",
      "/USER:* *"
    ]
  },
  "filter_main_empty": {
    "CommandLine|endswith": " "
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Suspicious Csi.exe Usage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Konstantin Grishchenko, oscd.community
Date: 2020-10-17
ATT&CK techniques: T1072, T1218
Log source: windows/process_creation

Description:
Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\csi.exe",
        "\\rcsi.exe"
      ]
    },
    {
      "OriginalFileName": [
        "csi.exe",
        "rcsi.exe"
      ]
    }
  ],
  "selection_cli": {
    "Company": "Microsoft Corporation"
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/
  - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
  - https://twitter.com/Z3Jpa29z/status/[PII_REDACTED]81324801
Sigma Detection Rule: Potentially Suspicious Child Process Of ClickOnce Application
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-12
Log source: windows/process_creation

Description:
Detects potentially suspicious child processes of a ClickOnce deployment application

Detection logic:
{
  "selection": {
    "ParentImage|contains": "\\AppData\\Local\\Apps\\2.0\\",
    "Image|endswith": [
      "\\calc.exe",
      "\\cmd.exe",
      "\\cscript.exe",
      "\\explorer.exe",
      "\\mshta.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\nltest.exe",
      "\\notepad.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\reg.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\werfault.exe",
      "\\wscript.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5
Sigma Detection Rule: Potential Process Injection Via Msra.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Alexander McDonald
Date: 2022-06-24
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\msra.exe",
    "ParentCommandLine|endswith": "msra.exe",
    "Image|endswith": [
      "\\arp.exe",
      "\\cmd.exe",
      "\\net.exe",
      "\\netstat.exe",
      "\\nslookup.exe",
      "\\route.exe",
      "\\schtasks.exe",
      "\\whoami.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
  - https://www.fortinet.com/content/dam/fortinet/assets/analyst-reports/ar-qakbot.pdf
Sigma Detection Rule: Suspicious RunAs-Like Flag Combination
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-11-11
Log source: windows/process_creation

Description:
Detects suspicious command line flags that let the user set a target user and command as e.g. seen in PsExec-like tools

Detection logic:
{
  "selection_user": {
    "CommandLine|contains": [
      " -u system ",
      " --user system ",
      " -u NT",
      " -u \"NT",
      " -u 'NT",
      " --system ",
      " -u administrator "
    ]
  },
  "selection_command": {
    "CommandLine|contains": [
      " -c cmd",
      " -c \"cmd",
      " -c powershell",
      " -c \"powershell",
      " --command cmd",
      " --command powershell",
      " -c whoami",
      " -c wscript",
      " -c cscript"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/k/hack-the-real-box-apt41-new-subgroup-earth-longzhi.html
Sigma Detection Rule: Suspicious MSDT Parent Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nextron Systems
Date: 2022-06-01
ATT&CK techniques: T1036, T1218
Log source: windows/process_creation

Description:
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\wmic.exe",
      "\\wscript.exe",
      "\\wsl.exe"
    ]
  },
  "selection_msdt": [
    {
      "Image|endswith": "\\msdt.exe"
    },
    {
      "OriginalFileName": "msdt.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/nao_sec/status/[PII_REDACTED]79401984
  - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/
Sigma Detection Rule: Windows Hotfix Updates Reconnaissance Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects the execution of wmic with the "qfe" flag in order to obtain information about installed hotfix updates on the system. This is often used by pentester and attacker enumeration scripts

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "wmic.exe"
    },
    {
      "Image|endswith": "\\WMIC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " qfe"
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat
  - https://sushant747.gitbooks.io/total-oscp-guide/content/privilege_escalation_windows.html
Sigma Detection Rule: PUA - Crassus Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: pH-T (Nextron Systems)
Date: 2023-04-17
ATT&CK techniques: T1590.001
Log source: windows/process_creation

Description:
Detects Crassus, a Windows privilege escalation discovery tool, based on PE metadata characteristics.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Crassus.exe"
    },
    {
      "OriginalFileName": "Crassus.exe"
    },
    {
      "Description|contains": "Crassus"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/vu-ls/Crassus
Sigma Detection Rule: AddinUtil.EXE Execution From Uncommon Directory
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\addinutil.exe"
    },
    {
      "OriginalFileName": "AddInUtil.exe"
    }
  ],
  "filter_main_legit_location": {
    "Image|contains": [
      ":\\Windows\\Microsoft.NET\\Framework\\",
      ":\\Windows\\Microsoft.NET\\Framework64\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm64\\",
      ":\\Windows\\WinSxS\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Sigma Detection Rule: Suspicious PowerShell Invocation From Script Engines
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects suspicious powershell invocations from interpreters or unusual programs

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\wscript.exe",
      "\\cscript.exe"
    ],
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "filter_health_service": {
    "CurrentDirectory|contains": "\\Health Service State\\"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://www.securitynewspaper.com/2017/03/20/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/
Sigma Detection Rule: New Process Created Via Taskmgr.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-03-13
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects the creation of a process via the Windows task manager. This might be an attempt to bypass UAC

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\taskmgr.exe"
  },
  "filter_main_generic": {
    "Image|endswith": [
      ":\\Windows\\System32\\mmc.exe",
      ":\\Windows\\System32\\resmon.exe",
      ":\\Windows\\System32\\Taskmgr.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/ReneFreingruber/status/[PII_REDACTED]35810049
Sigma Detection Rule: ManageEngine Endpoint Central Dctask64.EXE Potential Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-01-28
ATT&CK techniques: T1055.001
Log source: windows/process_creation

Description:
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dctask64.exe"
    },
    {
      "Hashes|contains": [
        "IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD",
        "IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA",
        "IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3",
        "IMPHASH=F1039CED4B91572AB7847D26032E6BBF"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " executecmd64 ",
      " invokeexe ",
      " injectDll "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]81825540
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]89111296
  - https://twitter.com/gN3mes1s/status/[PII_REDACTED]75911424
Sigma Detection Rule: Use of UltraVNC Remote Access Software
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-10-02
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks

Detection logic:
{
  "selection": [
    {
      "Description": "VNCViewer"
    },
    {
      "Product": "UltraVNC VNCViewer"
    },
    {
      "Company": "UltraVNC"
    },
    {
      "OriginalFileName": "VNCViewer.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1219/T1219.md
Sigma Detection Rule: Potential Tampering With Security Products Via WMIC
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-01-30
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects uninstallation or termination of security products using the WMIC utility

Detection logic:
{
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "wmic",
      "product where ",
      "call",
      "uninstall",
      "/nointeractive"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "wmic",
      "caption like "
    ],
    "CommandLine|contains": [
      "call delete",
      "call terminate"
    ]
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      "process ",
      "where ",
      "delete"
    ]
  },
  "selection_product": {
    "CommandLine|contains": [
      "%carbon%",
      "%cylance%",
      "%endpoint%",
      "%eset%",
      "%malware%",
      "%Sophos%",
      "%symantec%",
      "Antivirus",
      "AVG ",
      "Carbon Black",
      "CarbonBlack",
      "Cb Defense Sensor 64-bit",
      "Crowdstrike Sensor",
      "Cylance ",
      "Dell Threat Defense",
      "DLP Endpoint",
      "Endpoint Detection",
      "Endpoint Protection",
      "Endpoint Security",
      "Endpoint Sensor",
      "ESET File Security",
      "LogRhythm System Monitor Service",
      "Malwarebytes",
      "McAfee Agent",
      "Microsoft Security Client",
      "Sophos Anti-Virus",
      "Sophos AutoUpdate",
      "Sophos Credential Store",
      "Sophos Management Console",
      "Sophos Management Database",
      "Sophos Management Server",
      "Sophos Remote Management System",
      "Sophos Update Manager",
      "Threat Protection",
      "VirusScan",
      "Webroot SecureAnywhere",
      "Windows Defender"
    ]
  },
  "con

References:
  - https://twitter.com/cglyer/status/[PII_REDACTED]54709249
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/
  - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html
Sigma Detection Rule: Execution of Powershell Script in Public Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-06
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      "-f C:\\Users\\Public",
      "-f \"C:\\Users\\Public",
      "-f %Public%",
      "-fi C:\\Users\\Public",
      "-fi \"C:\\Users\\Public",
      "-fi %Public%",
      "-fil C:\\Users\\Public",
      "-fil \"C:\\Users\\Public",
      "-fil %Public%",
      "-file C:\\Users\\Public",
      "-file \"C:\\Users\\Public",
      "-file %Public%"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/evolution-of-fin7
Sigma Detection Rule: Potential Recon Activity Via Nltest.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Craig Young, oscd.community, Georg Lauenstein
Date: 2021-07-24
ATT&CK techniques: T1016, T1482
Log source: windows/process_creation

Description:
Detects nltest commands that can be used for information discovery

Detection logic:
{
  "selection_nltest": [
    {
      "Image|endswith": "\\nltest.exe"
    },
    {
      "OriginalFileName": "nltestrk.exe"
    }
  ],
  "selection_recon": [
    {
      "CommandLine|contains|all": [
        "server",
        "query"
      ]
    },
    {
      "CommandLine|contains": [
        "/user",
        "all_trusts",
        "dclist:",
        "dnsgetdc:",
        "domain_trusts",
        "dsgetdc:",
        "parentdomain",
        "trusted_domains"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
  - https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/
  - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/
  - https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters
  - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/