deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Data Exfiltration Via Curl.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Cedric MAURUGEON (Update)
Date: 2020-07-03
ATT&CK techniques: T1567, T1105
Log source: windows/process_creation

Description:
Detects the execution of the "curl" process with "upload" flags. Which might indicate potential data exfiltration

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "selection_cli": [
    {
      "CommandLine|contains": [
        " --form",
        " --upload-file ",
        " --data ",
        " --data-"
      ]
    },
    {
      "CommandLine|re": "\\s-[FTd]\\s"
    }
  ],
  "filter_optional_localhost": {
    "CommandLine|contains": [
      "://localhost",
      "://127.0.0.1"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/d1r4c/status/[PII_REDACTED]08081664
  - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file
  - https://curl.se/docs/manpage.html
Sigma Detection Rule: SC.EXE Query Execution
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-06
ATT&CK techniques: T1007
Log source: windows/process_creation

Description:
Detects execution of "sc.exe" to query information about registered services on the system

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\sc.exe",
    "OriginalFileName": "sc.exe"
  },
  "selection_cli": {
    "CommandLine|contains": " query"
  },
  "filter_optional_keybase": {
    "CommandLine": "sc query dokan1"
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-1---system-service-discovery
Sigma Detection Rule: New Self Extracting Package Created Via IExpress.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2024-02-05
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the "iexpress.exe" utility creating self-extracting packages.
Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.


Detection logic:
{
  "selection_1_parent": {
    "ParentImage|endswith": "\\iexpress.exe"
  },
  "selection_1_img": [
    {
      "Image|endswith": "\\makecab.exe"
    },
    {
      "OriginalFileName": "makecab.exe"
    }
  ],
  "selection_2_img": [
    {
      "Image|endswith": "\\iexpress.exe"
    },
    {
      "OriginalFileName": "IEXPRESS.exe"
    }
  ],
  "selection_2_cli": {
    "CommandLine|contains": " /n "
  },
  "condition": "all of selection_1_* or all of selection_2_*"
}

References:
  - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html
  - https://en.wikipedia.org/wiki/IExpress
  - https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
  - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior
Sigma Detection Rule: Potential DLL Sideloading Activity Via ExtExport.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-11-26
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects the execution of "Extexport.exe".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa.
It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll".
Arbitrary DLLs can also be loaded if a specific number of flags was provided.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Extexport.exe"
    },
    {
      "OriginalFileName": "extexport.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Extexport/
  - https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
  - https://www.microsoft.com/en-us/security/blog/2020/03/23/latest-astaroth-living-off-the-land-attacks-are-even-more-invisible-but-not-less-observable/
  - https://res.armor.com/resources/threat-intelligence/astaroth-banking-trojan/
  - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
Sigma Detection Rule: SMB over QUIC Via Net.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-07-21
ATT&CK techniques: T1570
Log source: windows/process_creation

Description:
Detects the mounting of Windows SMB shares over QUIC, which can be an unexpected event in some enterprise environments.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "/TRANSPORT:QUIC"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1570/T1570.md
  - https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
Sigma Detection Rule: Diskshadow Script Mode Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ivan Dyachkov, oscd.community
Date: 2020-10-07
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.


Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "diskshadow.exe"
    },
    {
      "Image|endswith": "\\diskshadow.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-s "
  },
  "condition": "all of selection_*"
}

References:
  - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration
  - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow
Sigma Detection Rule: Suspicious Tasklist Discovery Command
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: frack113
Date: 2021-12-11
ATT&CK techniques: T1057
Log source: windows/process_creation

Description:
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains": "tasklist"
    },
    {
      "Image|endswith": "\\tasklist.exe"
    },
    {
      "OriginalFileName": "tasklist.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-2---process-discovery---tasklist
Sigma Detection Rule: Execution From Webserver Root Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-01-16
ATT&CK techniques: T1505.003
Log source: windows/process_creation

Description:
Detects a program executing from a web server root folder. Use this rule to hunt for potential interesting activity such as webshell or backdoors


Detection logic:
{
  "selection": {
    "Image|contains": [
      "\\wwwroot\\",
      "\\wmpub\\",
      "\\htdocs\\"
    ]
  },
  "filter_main_generic": {
    "Image|contains": [
      "bin\\",
      "\\Tools\\",
      "\\SMSComponent\\"
    ],
    "ParentImage|endswith": "\\services.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Remote Access Tool - Action1 Arbitrary Code Execution and Remote Sessions
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2023-04-13
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
Detects the execution of Action1 in order to execute arbitrary code or establish a remote session.

Action1 is a powerful Remote Monitoring and Management tool that enables users to execute commands, scripts, and binaries.
Through the web interface of action1, the administrator must create a new policy or an app to establish remote execution and then points that the agent is installed.

Hunting Opportunity 1- Weed Out The Noise

When threat actors execute a script, a command, or a binary through these new policies and apps, the names of these become visible in the command line during the execution process. Below is an example of the command line that contains the deployment of a binary through  a policy with name "test_app_1":

ParentCommandLine: "C:\WINDOWS\Action1\action1_agent.exe schedule:Deploy_App__test_app_1_[PII_REDACTED]25 runaction:0"

After establishing a baseline, we can split the command to extract the policy name and group all the policy names and inspect the results with a list of frequency occurrences.

Hunting Opportunity 2 - Remote Sessions On Out Of Office Hours

If you have admins within your environment using remote sessions to administer endpoints, you can create a threat-hunting query and modify the time of the initiated sessions looking for abnormal activity.


Detection logic:
{
  "selection_app_deployment_exec": {
    "ParentImage|endswith": "\\action1_agent.exe",
    "Image|contains": "\\Windows\\Action1\\package_downloads\\"
  },
  "selection_command_exec": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\powershell.exe"
    ],
    "ParentCommandLine|contains": [
      "\\Action1\\scripts\\Run_Command_",
      "\\Action1\\scripts\\Run_PowerShell_"
    ]
  },
  "selection_remote_session_init": {
    "Image|endswith": "\\agent1_remote.exe"
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/Kostastsale/status/[PII_REDACTED]06605063?s=20
  - https://www.action1.com/documentation/
Sigma Detection Rule: Potential Executable Run Itself As Sacrificial Process
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: frack113
Date: 2025-10-17
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion.
Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries.
Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.


Detection logic:
{
  "selection": {
    "Image|fieldref": "ParentImage"
  },
  "filter_main_path": {
    "Image|startswith": [
      "C:\\Program Files\\",
      "C:\\Program Files (x86)\\"
    ]
  },
  "filter_main_original_fn": {
    "OriginalFileName": [
      "Cmd.Exe",
      "CompatTelRunner.exe",
      "Discord.exe",
      "electron.exe",
      "EXPLORER.EXE",
      "httpd.exe",
      "IE4UINIT.EXE",
      "mmc.exe",
      "MpCmdRun.exe",
      "mscorsvw.exe",
      "msiexec.exe",
      "NGenTask.exe",
      "OneDriveSetup.exe",
      "PowerShell.EXE",
      "REGSVR32.EXE",
      "smss.exe",
      "Spotify.exe",
      "WerMgr"
    ]
  },
  "filter_main_product": {
    "Product": [
      "Avira",
      "Evernote",
      "Firefox",
      "Microsoft Office",
      "Ninite",
      "Opera Browser Assistant Installer",
      "Opera Installer",
      "Sysinternals Sysmon"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://www.joesandbox.com/analysis/1605063/0/html
Sigma Detection Rule: Potential CommandLine Obfuscation Using Unicode Characters
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Florian Roth (Nextron Systems)
Date: 2022-01-15
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects potential CommandLine obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "\u02e3",
      "\u02ea",
      "\u02e2",
      "\u2215",
      "\u2044",
      "\u2015",
      "\u2014",
      "\u00a0",
      "\u00af",
      "\u00ae",
      "\u00b6"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http
Sigma Detection Rule: EventLog Query Requests By Builtin Utilities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ali Alwashali, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-20
ATT&CK techniques: T1552
Log source: windows/process_creation

Description:
Detect attempts to query the contents of the event log using command line utilities. Attackers use this technique in order to look for sensitive information in the logs such as passwords, usernames, IPs, etc.


Detection logic:
{
  "selection_wmi": {
    "CommandLine|contains|all": [
      "Select",
      "Win32_NTLogEvent"
    ]
  },
  "selection_wevtutil_img": [
    {
      "Image|endswith": "\\wevtutil.exe"
    },
    {
      "OriginalFileName": "wevtutil.exe"
    }
  ],
  "selection_wevtutil_cli": {
    "CommandLine|contains": [
      " qe ",
      " query-events "
    ]
  },
  "selection_wmic_img": [
    {
      "Image|endswith": "\\wmic.exe"
    },
    {
      "OriginalFileName": "wmic.exe"
    }
  ],
  "selection_wmic_cli": {
    "CommandLine|contains": " ntevent"
  },
  "selection_cmdlet": {
    "CommandLine|contains": [
      "Get-WinEvent ",
      "get-eventlog "
    ]
  },
  "condition": "selection_wmi or all of selection_wevtutil_* or all of selection_wmic_* or selection_cmdlet"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1
  - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil
Sigma Detection Rule: Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Andreas Braathen (mnemonic.io)
Date: 2023-12-01
ATT&CK techniques: T1059.001, T1027.010
Log source: windows/process_creation

Description:
Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace.
The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption.
These can be used for example in decrypting malicious payload for defense evasion.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cmdlet_namespace": {
    "CommandLine|contains": "System.Security.Cryptography."
  },
  "selection_cmdlet_classes": {
    "CommandLine|contains": [
      ".AesCryptoServiceProvider",
      ".DESCryptoServiceProvider",
      ".DSACryptoServiceProvider",
      ".RC2CryptoServiceProvider",
      ".Rijndael",
      ".RSACryptoServiceProvider",
      ".TripleDESCryptoServiceProvider"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0
  - https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html
  - https://www.virustotal.com/gui/file/39102fb7bb6a74a9c8cb6d46419f9015b381199ea8524c1376672b30fffd69d2
Sigma Detection Rule: Scheduled Task Creation From Potential Suspicious Parent Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-23
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects the execution of "schtasks.exe" from a parent that is located in a potentially suspicious location.
Multiple malware strains were seen exhibiting a similar behavior in order to achieve persistence.


Detection logic:
{
  "selection": {
    "ParentImage|contains": [
      ":\\Temp\\",
      "\\AppData\\Local\\",
      "\\AppData\\Roaming\\",
      "\\Temporary Internet",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\"
    ],
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains": "/Create "
  },
  "filter_optional_common": {
    "CommandLine|contains": [
      "update_task.xml",
      "unattended.ini"
    ]
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://app.any.run/tasks/649e7b46-9bec-4d05-98a5-dfa9a13eaae5/
Sigma Detection Rule: Microsoft Workflow Compiler Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nik Seetharaman, frack113
Date: 2019-01-16
ATT&CK techniques: T1127, T1218
Log source: windows/process_creation

Description:
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Microsoft.Workflow.Compiler.exe"
    },
    {
      "OriginalFileName": "Microsoft.Workflow.Compiler.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/
Sigma Detection Rule: Curl.EXE Execution With Custom UserAgent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-23
ATT&CK techniques: T1071.001
Log source: windows/process_creation

Description:
Detects execution of curl.exe with custom useragent options

Detection logic:
{
  "selection_curl": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "Product": "The curl executable"
    }
  ],
  "selection_opt": {
    "CommandLine|contains": [
      " -A ",
      " --user-agent "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://curl.se/docs/manpage.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#atomic-test-2---malicious-user-agents---cmd
Sigma Detection Rule: Remote Access Tool - ScreenConnect Remote Command Execution - Hunting
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-23
Log source: windows/process_creation

Description:
Detects remote binary or command execution via the ScreenConnect Service.
Use this rule in order to hunt for potentially anomalous executions originating from ScreenConnect


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\ScreenConnect.ClientService.exe"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
Sigma Detection Rule: Use Short Name Path in Command Line
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2022-08-07
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations.
Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs.
When investigating, examine:
- Commands using short paths to access sensitive directories or files
- Web servers on Windows (especially Apache) where short filenames could bypass security controls
- Correlation with other suspicious behaviors
- baseline of short name usage in your environment and look for deviations


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "~1\\",
      "~2\\"
    ]
  },
  "filter_main_system_process": {
    "ParentImage": [
      "C:\\Windows\\System32\\Dism.exe",
      "C:\\Windows\\System32\\cleanmgr.exe"
    ]
  },
  "filter_main_winget": [
    {
      "ParentImage|endswith": "\\winget.exe"
    },
    {
      "ParentImage|contains": "\\AppData\\Local\\Temp\\WinGet\\"
    }
  ],
  "filter_main_csc": {
    "ParentImage|startswith": "C:\\Windows\\Microsoft.NET\\Framework64\\v",
    "ParentImage|endswith": "\\csc.exe"
  },
  "filter_main_installers": [
    {
      "Image|contains|all": [
        "\\AppData\\",
        "\\Temp\\"
      ]
    },
    {
      "CommandLine|contains": "\\AppData\\Local\\Temp\\"
    }
  ],
  "filter_optional_dopus": {
    "ParentImage": "C:\\Program Files\\GPSoftware\\Directory Opus\\dopus.exe"
  },
  "filter_optional_aurora": {
    "ParentImage|endswith": [
      "\\aurora-agent-64.exe",
      "\\aurora-agent.exe"
    ]
  },
  "filter_optional_thor": {
    "ParentImage|endswith": "\\thor\\thor64.exe"
  },
  "filter_optional_git": {
    "CommandLine|contains": [
      "C:\\Program Files\\Git\\post-install.bat",
      "C:\\Program Files\\Git\\cmd\\scalar.exe"
    ]
  },
  "filter_optional_webex": [
    {
      "ParentImage|endswith": "\\WebEx\\webexhost.exe"
    },
    {
      "CommandLine|contains": "\\appdata\\local\\webex\\webex64\\meetings\\wbxreport.exe"
    }
  ],
  "filter_optional_veeam": {
    "ParentImage|endswith": "\\ve

References:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/frack113/status/[PII_REDACTED]33375232
Sigma Detection Rule: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Michael Haag
Date: 2019-01-16
ATT&CK techniques: T1059.005, T1059.007
Log source: windows/process_creation

Description:
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.

Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": [
        "wscript.exe",
        "cscript.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\wscript.exe",
        "\\cscript.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      ".js",
      ".jse",
      ".vba",
      ".vbe",
      ".vbs",
      ".wsf",
      ".wsh"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://redcanary.com/blog/gootloader/