deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious File Created in Outlook Temporary Directory
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-22
ATT&CK techniques: T1566.001
Log source: windows/file_event

Description:
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments.
This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.


Detection logic:
{
  "selection_extension": {
    "TargetFilename|endswith": [
      ".cpl",
      ".hta",
      ".iso",
      ".rdp",
      ".svg",
      ".vba",
      ".vbe",
      ".vbs"
    ]
  },
  "selection_location": [
    {
      "TargetFilename|contains": [
        "\\AppData\\Local\\Packages\\Microsoft.Outlook_",
        "\\AppData\\Local\\Microsoft\\Olk\\Attachments\\"
      ]
    },
    {
      "TargetFilename|contains|all": [
        "\\AppData\\Local\\Microsoft\\Windows\\",
        "\\Content.Outlook\\"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
  - https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
  - https://www.microsoft.com/en-us/security/blog/2024/10/29/midnight-blizzard-conducts-large-scale-spear-phishing-campaign-using-rdp-files/
Sigma Detection Rule: HackTool - Inveigh Execution Artefacts
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-24
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
Detects the presence and execution of Inveigh via dropped artefacts

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\Inveigh-Log.txt",
      "\\Inveigh-Cleartext.txt",
      "\\Inveigh-NTLMv1Users.txt",
      "\\Inveigh-NTLMv2Users.txt",
      "\\Inveigh-NTLMv1.txt",
      "\\Inveigh-NTLMv2.txt",
      "\\Inveigh-FormInput.txt",
      "\\Inveigh.dll",
      "\\Inveigh.exe",
      "\\Inveigh.ps1",
      "\\Inveigh-Relay.ps1"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs
  - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs
  - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/
Sigma Detection Rule: UAC Bypass Using EventVwr
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems)
Date: 2022-04-27
Log source: windows/file_event

Description:
Detects the pattern of a UAC bypass using Windows Event Viewer

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\Microsoft\\Event Viewer\\RecentViews",
      "\\Microsoft\\EventV~1\\RecentViews"
    ]
  },
  "filter": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://twitter.com/orange_8361/status/[PII_REDACTED]68626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw
  - https://twitter.com/splinter_code/status/[PII_REDACTED]96006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
  - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute
Sigma Detection Rule: Files With System DLL Name In Unsuspected Locations
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-24
ATT&CK techniques: T1036.005
Log source: windows/file_event

Description:
Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.).
It is highly recommended to perform an initial baseline before using this rule in production.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\secur32.dll",
      "\\tdh.dll"
    ]
  },
  "filter_main_generic": {
    "TargetFilename|contains": [
      "C:\\$WINDOWS.~BT\\",
      "C:\\$WinREAgent\\",
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\",
      "C:\\Windows\\uus\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research
Sigma Detection Rule: Potential Persistence Via Microsoft Office Startup Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-02
ATT&CK techniques: T1137
Log source: windows/file_event

Description:
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.

Detection logic:
{
  "selection_word_paths": [
    {
      "TargetFilename|contains": "\\Microsoft\\Word\\STARTUP"
    },
    {
      "TargetFilename|contains|all": [
        "\\Office",
        "\\Program Files",
        "\\STARTUP"
      ]
    }
  ],
  "selection_word_extension": {
    "TargetFilename|endswith": [
      ".doc",
      ".docm",
      ".docx",
      ".dot",
      ".dotm",
      ".rtf"
    ]
  },
  "selection_excel_paths": [
    {
      "TargetFilename|contains": "\\Microsoft\\Excel\\XLSTART"
    },
    {
      "TargetFilename|contains|all": [
        "\\Office",
        "\\Program Files",
        "\\XLSTART"
      ]
    }
  ],
  "selection_excel_extension": {
    "TargetFilename|endswith": [
      ".xls",
      ".xlsm",
      ".xlsx",
      ".xlt",
      ".xltm"
    ]
  },
  "filter_main_office": {
    "Image|endswith": [
      "\\WINWORD.exe",
      "\\EXCEL.exe"
    ]
  },
  "condition": "(all of selection_word_* or all of selection_excel_*) and not filter_main_office"
}

References:
  - https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies
  - https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders
Sigma Detection Rule: UAC Bypass Using .NET Code Profiler on MMC
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using .NET Code Profiler and mmc.exe DLL hijacking (UACMe 39)

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|endswith": "\\AppData\\Local\\Temp\\pe386.dll"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Malicious PowerShell Scripts - FileCreation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein
Date: 2018-04-07
ATT&CK techniques: T1059.001
Log source: windows/file_event

Description:
Detects the creation of known offensive powershell scripts used for exploitation

Detection logic:
{
  "selection_generic": {
    "TargetFilename|endswith": [
      "\\Add-ConstrainedDelegationBackdoor.ps1",
      "\\Add-Exfiltration.ps1",
      "\\Add-Persistence.ps1",
      "\\Add-RegBackdoor.ps1",
      "\\Add-RemoteRegBackdoor.ps1",
      "\\Add-ScrnSaveBackdoor.ps1",
      "\\ADRecon.ps1",
      "\\AzureADRecon.ps1",
      "\\BadSuccessor.ps1",
      "\\Check-VM.ps1",
      "\\ConvertTo-ROT13.ps1",
      "\\Copy-VSS.ps1",
      "\\Create-MultipleSessions.ps1",
      "\\DNS_TXT_Pwnage.ps1",
      "\\dnscat2.ps1",
      "\\Do-Exfiltration.ps1",
      "\\DomainPasswordSpray.ps1",
      "\\Download_Execute.ps1",
      "\\Download-Execute-PS.ps1",
      "\\Enable-DuplicateToken.ps1",
      "\\Enabled-DuplicateToken.ps1",
      "\\Execute-Command-MSSQL.ps1",
      "\\Execute-DNSTXT-Code.ps1",
      "\\Execute-OnTime.ps1",
      "\\ExetoText.ps1",
      "\\Exploit-Jboss.ps1",
      "\\Find-AVSignature.ps1",
      "\\Find-Fruit.ps1",
      "\\Find-GPOLocation.ps1",
      "\\Find-TrustedDocuments.ps1",
      "\\FireBuster.ps1",
      "\\FireListener.ps1",
      "\\Get-ApplicationHost.ps1",
      "\\Get-ChromeDump.ps1",
      "\\Get-ClipboardContents.ps1",
      "\\Get-ComputerDetail.ps1",
      "\\Get-FoxDump.ps1",
      "\\Get-GPPAutologon.ps1",
      "\\Get-GPPPassword.ps1",
      "\\Get-IndexedItem.ps1",
      "\\Get-Keystrokes.ps1",
      "\\Get-LSASecret.ps1",
      "\\Get-MicrophoneAudio.ps1",
      "\\Get-PassHashes.ps1",
      "\\Get-PassHints.ps1",
      "\\Get-RegAlw

References:
  - https://github.com/PowerShellMafia/PowerSploit
  - https://github.com/NetSPI/PowerUpSQL
  - https://github.com/CsEnox/EventViewer-UACBypass
  - https://web.archive.org/web/[PII_REDACTED]4621/https://github.com/AlsidOfficial/WSUSpendu
  - https://github.com/nettitude/Invoke-PowerThIEf
Sigma Detection Rule: Creation Exe for Service with Unquoted Path
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1547.009
Log source: windows/file_event

Description:
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.


Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\program.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.009/T1574.009.md
Sigma Detection Rule: HackTool - RemoteKrbRelay SMB Relay Secrets Dump Module Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-27
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ":\\windows\\temp\\sam.tmp",
      ":\\windows\\temp\\sec.tmp",
      ":\\windows\\temp\\sys.tmp"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/CICADA8-Research/RemoteKrbRelay/blob/19ec76ba7aa50c2722b23359bc4541c0a9b2611c/Exploit/RemoteKrbRelay/Relay/Attacks/RemoteRegistry.cs#L31-L40
Sigma Detection Rule: Potential DCOM InternetExplorer.Application DLL Hijack
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga
Date: 2020-10-12
ATT&CK techniques: T1021.002, T1021.003
Log source: windows/file_event

Description:
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network

Detection logic:
{
  "selection": {
    "Image": "System",
    "TargetFilename|endswith": "\\Internet Explorer\\iertutil.dll"
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html
Sigma Detection Rule: Suspicious Binary Writes Via AnyDesk
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-28
ATT&CK techniques: T1219.002
Log source: windows/file_event

Description:
Detects AnyDesk writing binary files to disk other than "gcapi.dll".
According to RedCanary research it is highly abnormal for AnyDesk to write executable files to disk besides gcapi.dll,
which is a legitimate DLL that is part of the Google Chrome web browser used to interact with the Google Cloud API. (See reference section for more details)


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\AnyDesk.exe",
      "\\AnyDeskMSI.exe"
    ],
    "TargetFilename|endswith": [
      ".dll",
      ".exe"
    ]
  },
  "filter_dlls": {
    "TargetFilename|endswith": "\\gcapi.dll"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://redcanary.com/blog/misbehaving-rats/
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
Sigma Detection Rule: Publisher Attachment File Dropped In Suspicious Location
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-08
Log source: windows/file_event

Description:
Detects creation of files with the ".pub" extension in suspicious or uncommon locations. This could be a sign of attackers abusing Publisher documents

Detection logic:
{
  "selection": {
    "TargetFilename|contains": [
      "\\AppData\\Local\\Temp\\",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\",
      "C:\\Temp\\"
    ],
    "TargetFilename|endswith": ".pub"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/EmericNasi/status/[PII_REDACTED]20804098
Sigma Detection Rule: Potential SAM Database Dump
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-11
ATT&CK techniques: T1003.002
Log source: windows/file_event

Description:
Detects the creation of files that look like exports of the local SAM (Security Account Manager)

Detection logic:
{
  "selection": [
    {
      "TargetFilename|endswith": [
        "\\Temp\\sam",
        "\\sam.sav",
        "\\Intel\\sam",
        "\\sam.hive",
        "\\Perflogs\\sam",
        "\\ProgramData\\sam",
        "\\Users\\Public\\sam",
        "\\AppData\\Local\\sam",
        "\\AppData\\Roaming\\sam",
        "_ShadowSteal.zip",
        "\\Documents\\SAM.export",
        ":\\sam"
      ]
    },
    {
      "TargetFilename|contains": [
        "\\hive_sam_",
        "\\sam.save",
        "\\sam.export",
        "\\~reg_sam.save",
        "\\sam_backup",
        "\\sam.bck",
        "\\sam.backup"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/search?q=CVE-2021-36934
  - https://web.archive.org/web/[PII_REDACTED]1645/https://github.com/cube0x0/CVE-2021-36934
  - https://www.google.com/search?q=%22reg.exe+save%22+sam
  - https://github.com/HuskyHacks/ShadowSteal
  - https://github.com/FireFart/hivenightmare
Sigma Detection Rule: Octopus Scanner Malware
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: NVISO
Date: 2020-06-09
ATT&CK techniques: T1195, T1195.001
Log source: windows/file_event

Description:
Detects Octopus Scanner Malware.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\AppData\\Local\\Microsoft\\Cache134.dat",
      "\\AppData\\Local\\Microsoft\\ExplorerSync.db"
    ]
  },
  "condition": "selection"
}

References:
  - https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain
Sigma Detection Rule: PCRE.NET Package Temp Files
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-10-29
ATT&CK techniques: T1059
Log source: windows/file_event

Description:
Detects processes creating temp files related to PCRE.NET package

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\AppData\\Local\\Temp\\ba9ea7344a4a5f591d6e5dc32a13494b\\"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/rbmaslen/status/[PII_REDACTED]91970051
  - https://twitter.com/tifkin_/status/[PII_REDACTED]57365248
Sigma Detection Rule: Suspicious LNK Double Extension File Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2022-11-07
ATT&CK techniques: T1036.007
Log source: windows/file_event

Description:
Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".lnk",
    "TargetFilename|contains": [
      ".doc.",
      ".docx.",
      ".jpg.",
      ".pdf.",
      ".ppt.",
      ".pptx.",
      ".xls.",
      ".xlsx."
    ]
  },
  "filter_main_recent": {
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\"
  },
  "filter_optional_office_recent": {
    "Image|endswith": [
      "\\excel.exe",
      "\\powerpnt.exe",
      "\\winword.exe"
    ],
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\Office\\Recent\\"
  },
  "filter_optional_office_excel": {
    "Image|endswith": "\\excel.exe",
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\Excel"
  },
  "filter_optional_office_powerpoint": {
    "Image|endswith": "\\powerpnt.exe",
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\PowerPoint"
  },
  "filter_optional_office_word": {
    "Image|endswith": "\\winword.exe",
    "TargetFilename|contains": "\\AppData\\Roaming\\Microsoft\\Word"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
  - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles
  - https://twitter.com/malwrhunterteam/status/[PII_REDACTED]11960321
  - https://twitter.com/luc4m/status/[PII_REDACTED]26254080
Sigma Detection Rule: UAC Bypass Using NTFS Reparse Point - File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-30
ATT&CK techniques: T1548.002
Log source: windows/file_event

Description:
Detects the pattern of UAC Bypass using NTFS reparse point and wusa.exe DLL hijacking (UACMe 36)

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Users\\",
    "TargetFilename|endswith": "\\AppData\\Local\\Temp\\api-ms-win-core-kernel32-legacy-l1.DLL"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious Files in Default GPO Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: elhoim
Date: 2022-04-28
ATT&CK techniques: T1036.005
Log source: windows/file_event

Description:
Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder

Detection logic:
{
  "selection": {
    "TargetFilename|contains": "\\Policies\\{31B2F340-016D-11D2-945F-00C04FB984F9}\\",
    "TargetFilename|endswith": [
      ".dll",
      ".exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/intelligence-insights-november-2021/
Sigma Detection Rule: Creation of WerFault.exe/Wer.dll in Unusual Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-05-09
ATT&CK techniques: T1574.001
Log source: windows/file_event

Description:
Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\WerFault.exe",
      "\\wer.dll"
    ]
  },
  "filter_main_known_locations": {
    "TargetFilename|startswith": [
      "C:\\Windows\\SoftwareDistribution\\",
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\",
      "C:\\Windows\\UUS\\arm64\\"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/
Sigma Detection Rule: HackTool - NPPSpy Hacktool Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-29
Log source: windows/file_event

Description:
Detects the use of NPPSpy hacktool that stores cleartext passwords of users that logged in to a local file

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      "\\NPPSpy.txt",
      "\\NPPSpy.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md#atomic-test-2---credential-dumping-with-nppspy
  - https://twitter.com/0gtweet/status/[PII_REDACTED]94487554
Sigma Detection Rule: HackTool - Dumpert Process Dumper Default File
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-02-04
ATT&CK techniques: T1003.001
Log source: windows/file_event

Description:
Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "dumpert.dmp"
  },
  "condition": "selection"
}

References:
  - https://github.com/outflanknl/Dumpert
  - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/
Sigma Detection Rule: New Outlook Macro Created
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @ScoubiMtl
Date: 2021-04-05
ATT&CK techniques: T1137, T1008, T1546
Log source: windows/file_event

Description:
Detects the creation of a macro file for Outlook.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\outlook.exe",
    "TargetFilename|endswith": "\\Microsoft\\Outlook\\VbaProject.OTM"
  },
  "condition": "selection"
}

References:
  - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/
Sigma Detection Rule: Windows Terminal Profile Settings Modification By Uncommon Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-22
ATT&CK techniques: T1547.015
Log source: windows/file_event

Description:
Detects the creation or modification of the Windows Terminal Profile settings file "settings.json" by an uncommon process.

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\wscript.exe"
    ],
    "TargetFilename|endswith": "\\AppData\\Local\\Packages\\Microsoft.WindowsTerminal_8wekyb3d8bbwe\\LocalState\\settings.json"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1547.015/T1547.015.md#atomic-test-1---persistence-by-modifying-windows-terminal-profile
  - https://twitter.com/nas_bench/status/[PII_REDACTED]52686848
Sigma Detection Rule: Suspicious Screensaver Binary File Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-29
ATT&CK techniques: T1546.002
Log source: windows/file_event

Description:
Adversaries may establish persistence by executing malicious content triggered by user inactivity.
Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".scr"
  },
  "filter_generic": {
    "Image|endswith": [
      "\\Kindle.exe",
      "\\Bin\\ccSvcHst.exe"
    ]
  },
  "filter_tiworker": {
    "Image|endswith": "\\TiWorker.exe",
    "TargetFilename|endswith": "\\uwfservicingscr.scr"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md
Sigma Detection Rule: LiveKD Driver Creation By Uncommon Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-16
Log source: windows/file_event

Description:
Detects the creation of the LiveKD driver by a process image other than "livekd.exe".

Detection logic:
{
  "selection": {
    "TargetFilename": "C:\\Windows\\System32\\drivers\\LiveKdD.SYS"
  },
  "filter_main_legit_name": {
    "Image|endswith": [
      "\\livekd.exe",
      "\\livek64.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - Internal Research