deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: LSASS Memory Access by Tool With Dump Keyword In Name
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-10
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects LSASS process access requests from a source process with the "dump" keyword in its image name.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "SourceImage|contains": "dump",
    "GrantedAccess|endswith": [
      "10",
      "30",
      "50",
      "70",
      "90",
      "B0",
      "D0",
      "F0",
      "18",
      "38",
      "58",
      "78",
      "98",
      "B8",
      "D8",
      "F8",
      "1A",
      "3A",
      "5A",
      "7A",
      "9A",
      "BA",
      "DA",
      "FA",
      "0x14C2",
      "FF"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/_xpn_/status/[PII_REDACTED]68178176
  - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz
Sigma Detection Rule: CMSTP Execution Process Access
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nik Seetharaman
Date: 2018-07-16
ATT&CK techniques: T1218.003, T1559.001
Log source: windows/process_access

Description:
Detects various indicators of Microsoft Connection Manager Profile Installer execution

Detection logic:
{
  "selection": {
    "CallTrace|contains": "cmlua.dll"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
Sigma Detection Rule: HackTool - Generic Process Access
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
Date: 2023-11-27
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects process access requests from hacktool processes based on their default image name

Detection logic:
{
  "selection": [
    {
      "SourceImage|endswith": [
        "\\Akagi.exe",
        "\\Akagi64.exe",
        "\\atexec_windows.exe",
        "\\Certify.exe",
        "\\Certipy.exe",
        "\\CoercedPotato.exe",
        "\\crackmapexec.exe",
        "\\CreateMiniDump.exe",
        "\\dcomexec_windows.exe",
        "\\dpapi_windows.exe",
        "\\findDelegation_windows.exe",
        "\\GetADUsers_windows.exe",
        "\\GetNPUsers_windows.exe",
        "\\getPac_windows.exe",
        "\\getST_windows.exe",
        "\\getTGT_windows.exe",
        "\\GetUserSPNs_windows.exe",
        "\\gmer.exe",
        "\\hashcat.exe",
        "\\htran.exe",
        "\\ifmap_windows.exe",
        "\\impersonate.exe",
        "\\Inveigh.exe",
        "\\LocalPotato.exe",
        "\\mimikatz_windows.exe",
        "\\mimikatz.exe",
        "\\netview_windows.exe",
        "\\nmapAnswerMachine_windows.exe",
        "\\opdump_windows.exe",
        "\\PasswordDump.exe",
        "\\Potato.exe",
        "\\PowerTool.exe",
        "\\PowerTool64.exe",
        "\\psexec_windows.exe",
        "\\PurpleSharp.exe",
        "\\pypykatz.exe",
        "\\QuarksPwDump.exe",
        "\\rdp_check_windows.exe",
        "\\Rubeus.exe",
        "\\SafetyKatz.exe",
        "\\sambaPipe_windows.exe",
        "\\SelectMyParent.exe",
        "\\SharpChisel.exe",
        "\\SharPersist.exe",
        "\\SharpEvtMute.exe",
        "\\SharpImpersonation.exe",
        "\\SharpLDAPmonitor.exe",
        "\\SharpLdap

References:
  - https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb641c158
  - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
Sigma Detection Rule: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-27
ATT&CK techniques: T1003.001, T1685
Log source: windows/process_access

Description:
Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace.
These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll,
dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques.


Detection logic:
{
  "selection_lsass_calltrace": {
    "TargetImage|endswith": "\\lsass.exe",
    "CallTrace|contains": [
      "dbgcore.dll",
      "dbghelp.dll"
    ]
  },
  "selection_susp_location": {
    "SourceImage|contains": [
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      "\\$Recycle.Bin\\",
      "\\AppData\\Roaming\\",
      "\\Contacts\\",
      "\\Desktop\\",
      "\\Documents\\",
      "\\Downloads\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\inetpub\\wwwroot\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\Start Menu\\Programs\\Startup\\",
      "\\Users\\Default\\",
      "\\Videos\\",
      "\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
  - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump
Sigma Detection Rule: UAC Bypass Using WOW64 Logger DLL Hijack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/process_access

Description:
Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)

Detection logic:
{
  "selection": {
    "SourceImage|contains": ":\\Windows\\SysWOW64\\",
    "GrantedAccess": "0x1fffff",
    "CallTrace|startswith": "UNKNOWN([PII_REDACTED])|UNKNOWN([PII_REDACTED])|"
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious LSASS Access Via MalSecLogon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-29
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "SourceImage|endswith": "\\svchost.exe",
    "GrantedAccess": "0x14c0",
    "CallTrace|contains": "seclogon.dll"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]35912196
  - https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml
  - https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html
Sigma Detection Rule: HackTool - HandleKatz Duplicating LSASS Handle
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj (rule), @thefLinkk
Date: 2022-06-27
ATT&CK techniques: T1106, T1003.001
Log source: windows/process_access

Description:
Detects HandleKatz opening LSASS to duplicate its handle to later dump the memory without opening any new handles

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "GrantedAccess": "0x1440",
    "CallTrace|startswith": "C:\\Windows\\System32\\ntdll.dll+",
    "CallTrace|contains": "|UNKNOWN(",
    "CallTrace|endswith": ")"
  },
  "condition": "selection"
}

References:
  - https://github.com/codewhitesec/HandleKatz
Sigma Detection Rule: HackTool - SysmonEnte Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-07
ATT&CK techniques: T1685.001
Log source: windows/process_access

Description:
Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon

Detection logic:
{
  "selection_sysmon": {
    "TargetImage|contains": [
      ":\\Windows\\Sysmon.exe",
      ":\\Windows\\Sysmon64.exe"
    ],
    "GrantedAccess": "0x1400"
  },
  "selection_calltrace": {
    "CallTrace": "Ente"
  },
  "filter_main_generic": {
    "SourceImage|contains": [
      ":\\Program Files (x86)\\",
      ":\\Program Files\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\"
    ]
  },
  "filter_main_msdefender": {
    "SourceImage|contains": ":\\ProgramData\\Microsoft\\Windows Defender\\Platform\\",
    "SourceImage|endswith": "\\MsMpEng.exe"
  },
  "condition": "( selection_sysmon and not 1 of filter_main_* ) or selection_calltrace"
}

References:
  - https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html
  - https://github.com/codewhitesec/SysmonEnte/
  - https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda[PII_REDACTED]a30451d9099/screens/1.png
Sigma Detection Rule: Credential Dumping Attempt Via WerFault
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2012-06-27
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects process LSASS memory dump using Mimikatz, NanoDump, Invoke-Mimikatz, Procdump or Taskmgr based on the CallTrace pointing to ntdll.dll, dbghelp.dll or dbgcore.dll for win10, server2016 and up.

Detection logic:
{
  "selection": {
    "SourceImage|endswith": "\\WerFault.exe",
    "TargetImage|endswith": "\\lsass.exe",
    "GrantedAccess": "0x1FFFFF"
  },
  "condition": "selection"
}

References:
  - https://github.com/helpsystems/nanodump/commit/578116faea3d278d53d70ea932e2bbfe42569507
Sigma Detection Rule: Remote LSASS Process Access Through Windows Remote Management
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Patryk Prauze - ING Tech
Date: 2019-05-20
ATT&CK techniques: T1003.001, T1059.001, T1021.006
Log source: windows/process_access

Description:
Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "SourceImage|endswith": ":\\Windows\\system32\\wsmprovhost.exe"
  },
  "filter_main_access": {
    "GrantedAccess": "0x80000000"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://pentestlab.blog/2018/05/15/lateral-movement-winrm/
Sigma Detection Rule: HackTool - CobaltStrike BOF Injection Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-04
ATT&CK techniques: T1106, T1685
Log source: windows/process_access

Description:
Detects a typical pattern of a CobaltStrike BOF which inject into other processes

Detection logic:
{
  "selection": {
    "CallTrace|re": "^C:\\\\Windows\\\\SYSTEM32\\\\ntdll\\.dll\\+[a-z0-9]{4,6}\\|C:\\\\Windows\\\\System32\\\\KERNELBASE\\.dll\\+[a-z0-9]{4,6}\\|UNKNOWN\\([A-Z0-9]{16}\\)$",
    "GrantedAccess": [
      "0x1028",
      "0x1fffff"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/boku7/injectAmsiBypass
  - https://github.com/boku7/spawn
Sigma Detection Rule: Credential Dumping Activity By Python Based Tool
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Bhabesh Raj, Jonhnathan Ribeiro
Date: 2023-11-27
ATT&CK techniques: T1003.001
Log source: windows/process_access

Description:
Detects LSASS process access for potential credential dumping by a Python-like tool such as LaZagne or Pypykatz.

Detection logic:
{
  "selection": {
    "TargetImage|endswith": "\\lsass.exe",
    "CallTrace|contains|all": [
      "_ctypes.pyd+",
      ":\\Windows\\System32\\KERNELBASE.dll+",
      ":\\Windows\\SYSTEM32\\ntdll.dll+"
    ],
    "CallTrace|contains": [
      "python27.dll+",
      "python3*.dll+"
    ],
    "GrantedAccess": "0x1FFFFF"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/bh4b3sh/status/[PII_REDACTED]19081728
  - https://github.com/skelsec/pypykatz
Sigma Detection Rule: Suspicious Process Access of MsMpEng by WerFaultSecure - EDR-Freeze
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-27
ATT&CK techniques: T1685
Log source: windows/process_access

Description:
Detects process access events where WerFaultSecure accesses MsMpEng.exe with dbgcore.dll or dbghelp.dll in the call trace, indicating potential EDR freeze techniques.
This technique leverages WerFaultSecure.exe running as a Protected Process Light (PPL) with WinTCB protection level to call MiniDumpWriteDump and suspend EDR/AV processes, allowing malicious activity to execute undetected during the suspension period.


Detection logic:
{
  "selection": {
    "SourceImage|endswith": "\\WerFaultSecure.exe",
    "TargetImage|endswith": "\\MsMpEng.exe",
    "CallTrace|contains": [
      "\\dbgcore.dll",
      "\\dbghelp.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.axelarator.net/hunting-for-edr-freeze/
Sigma Detection Rule: Host Without Firewall
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Alexandr Yampolskyi, SOC Prime
Date: 2019-03-19
Log source: qualys/

Description:
Host Without Firewall. Alert means not complied. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.

Detection logic:
{
  "selection": {
    "event.category": "Security Policy",
    "host.scan.vuln_name|contains": "Firewall Product Not Detected"
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
Sigma Detection Rule: Default Credentials Usage
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Alexandr Yampolskyi, SOC Prime
Date: 2019-03-26
Log source: qualys/

Description:
Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts.
Sigma detects default credentials usage. Sigma for Qualys vulnerability scanner. Scan type - Vulnerability Management.


Detection logic:
{
  "selection": {
    "host.scan.vuln": [
      10693,
      11507,
      11633,
      11804,
      11821,
      11847,
      11867,
      11931,
      11935,
      11950,
      12541,
      12558,
      12559,
      12560,
      12562,
      12563,
      12565,
      12587,
      12590,
      12599,
      12702,
      12705,
      12706,
      12907,
      12928,
      12929,
      13053,
      13178,
      13200,
      13218,
      13241,
      13253,
      13274,
      13296,
      13301,
      13327,
      13373,
      13374,
      13409,
      13530,
      13532,
      20065,
      20073,
      20081,
      27202,
      27358,
      38702,
      38719,
      42045,
      42417,
      43029,
      43220,
      43221,
      43222,
      43223,
      43225,
      43246,
      43431,
      43484,
      86857,
      87098,
      87106
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
  - https://community.qualys.com/docs/DOC-6406-reporting-toolbox-focused-search-lists
Sigma Detection Rule: Cleartext Protocol Usage Via Netflow
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Alexandr Yampolskyi, SOC Prime
Date: 2019-03-26
Log source: /

Description:
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels
Ensure that an encryption is used for all sensitive information in transit.
Ensure that an encrypted channels is used for all administrative account access.


Detection logic:
{
  "selection": {
    "destination.port": [
      8080,
      21,
      80,
      23,
      50000,
      1521,
      27017,
      1433,
      11211,
      3306,
      15672,
      5900,
      5901,
      5902,
      5903,
      5904
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
Sigma Detection Rule: AWS Console Login Monitoring
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Ivan Saakov
Date: 2025-10-19
ATT&CK techniques: T1078.004
Log source: aws/

Description:
Detects AWS console logins from countries and IP addresses that are not recognized as legitimate for the organization.
This alert can help identify potential unauthorized access attempts from unusual locations, which may indicate compromised credentials or malicious activity.


Detection logic:
{
  "selection": {
    "eventName": "ConsoleLogin",
    "responseElements.ConsoleLogin": "Success"
  },
  "filter_main_country": {
    "src_country|expand": "%Legitimate_Countries%"
  },
  "filter_main_ip": {
    "src_ip|expand": "%Legitimate_IP_Ranges%"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
Sigma Detection Rule: Privilege Role Sign-In Outside Of Normal Hours
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects account sign ins outside of normal hours or uncommon locations. Administrator accounts should be investigated

Detection logic:
{
  "selection": {
    "Status": "Sucess",
    "Location|expand": "%LegitCountries%",
    "Date|expand": "%ClosingTime%",
    "Initiatied.By|expand": "%ApprovedUserUpn%"
  },
  "condition": "selection"
}

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor
Sigma Detection Rule: Privilege Role Sign-In Outside Expected Controls
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects failed sign-in due to user not meeting expected controls for adminitrators

Detection logic:
{
  "selection": {
    "Status": "failure",
    "Location|expand": "%UnLegitCountries%",
    "IPaddress|expand": "%UnApprovedIp%",
    "DeviceInfo|expand": "%UnApprovedDevice%"
  },
  "condition": "selection"
}

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor
Sigma Detection Rule: Authentication Occuring Outside Normal Business Hours
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects user signs ins outside of normal business hours.

Detection logic:
{
  "selection": {
    "Status": "Sucess",
    "Location|expand": "%LegitCountries%",
    "Date|expand": "%ClosingTime%"
  },
  "condition": "selection"
}

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
Sigma Detection Rule: Privilege Role Elevation Not Occuring on SAW or PAW
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects failed sign-in from a PAW or SAW device

Detection logic:
{
  "selection": {
    "properties.message|contains": "Add memmber to role completed (PIM aciviation)",
    "Location|expand": "%LegitCountries%",
    "IPaddress|expand": "%UnApprovedIp%",
    "DeviceInfo|expand": "%UnApprovedDevice%",
    "DeviceDetail.isCompliant": "false",
    "Status": [
      "Sucess",
      "failure"
    ]
  },
  "condition": "selection"
}

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor
Sigma Detection Rule: Account Created And Deleted By Non Approved Users
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'
Date: 2022-08-11
ATT&CK techniques: T1078
Log source: azure/

Description:
Detects accounts that are created or deleted by non-approved users.

Detection logic:
{
  "selection": {
    "properties.message": [
      "Add user",
      "Delete user"
    ],
    "Status": "Sucess"
  },
  "valid_admin": {
    "Initiatied.By|expand": "%ApprovedUserUpn%"
  },
  "condition": "selection and not valid_admin"
}

References:
  - https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-accounts
Sigma Detection Rule: Okta Session Impersonation Granted From Untrusted Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: zendannyy
Date: 2026-04-28
ATT&CK techniques: T1484.002, T1199
Log source: okta/

Description:
Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session.
This event type "user.session.impersonation.grant" signifies that someone has been given temporary access to act on behalf of another user account.
Threat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user.
Legitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.


Detection logic:
{
  "selection": {
    "eventType": "user.session.impersonation.grant"
  },
  "filter_main_okta": {
    "actor.alternateId|contains": "system@okta.com"
  },
  "filter_main_company": {
    "actor.alternateId|contains|expand": "%legtimate_identifiers%"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://developer.okta.com/docs/reference/system-log-query/
  - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection
  - https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For
Sigma Detection Rule: DNS Request From Windows Script Host
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Josh Nickels, Marius Rothenbücher
Date: 2024-09-06
ATT&CK techniques: T1059
Log source: windows/dns_query

Description:
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\wscript.exe",
      "\\cscript.exe"
    ],
    "QueryName|contains": "."
  },
  "filter_main_internal_domains": {
    "QueryName|expand": "%internal_domains%"
  },
  "filter_optional_trusted_domains": [
    {
      "QueryName": [
        "crl.starfieldtech.com",
        "ocsp.usertrust.com",
        "officecdn.microsoft.com",
        "oneocsp.microsoft.com",
        "oscp.comodoca.com",
        "oscp.sectigo.com",
        "oscp.starfieldtech.com",
        "www.python.org"
      ]
    },
    {
      "QueryName|endswith": [
        ".digicert.com",
        ".entrust.net",
        ".globalsign.net",
        ".verisign.com"
      ]
    }
  ],
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - Internal Research