deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potentially Suspicious Inline JavaScript Execution via NodeJS Binary
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Microsoft (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-04-21
ATT&CK techniques: T1059.007
Log source: windows/process_creation

Description:
Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\node.exe"
    },
    {
      "OriginalFileName": "node.exe"
    },
    {
      "Product": "Node.js"
    }
  ],
  "selection_cmd": {
    "CommandLine|contains|all": [
      "http",
      "execSync",
      "spawn",
      "fs",
      "path",
      "zlib"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/
Sigma Detection Rule: Potential Defense Evasion Via Binary Rename
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
Date: 2019-06-15
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed binary often used by attackers or malware leveraging new Sysmon OriginalFileName datapoint.

Detection logic:
{
  "selection": {
    "OriginalFileName": [
      "Cmd.Exe",
      "CONHOST.EXE",
      "7z.exe",
      "7za.exe",
      "WinRAR.exe",
      "wevtutil.exe",
      "net.exe",
      "net1.exe",
      "netsh.exe",
      "InstallUtil.exe"
    ]
  },
  "filter": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\conhost.exe",
      "\\7z.exe",
      "\\7za.exe",
      "\\WinRAR.exe",
      "\\wevtutil.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\netsh.exe",
      "\\InstallUtil.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html
  - https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html
  - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process
  - https://www.splunk.com/en_us/blog/security/inno-setup-malware-redline-stealer-campaign.html
Sigma Detection Rule: Suspicious High IntegrityLevel Conhost Legacy Option
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: frack113
Date: 2022-12-09
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.

Detection logic:
{
  "selection": {
    "IntegrityLevel": [
      "High",
      "S-1-16-12288"
    ],
    "CommandLine|contains|all": [
      "conhost.exe",
      "0xffffffff",
      "-ForceV1"
    ]
  },
  "condition": "selection"
}

References:
  - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
  - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
Sigma Detection Rule: WinRAR Execution in Non-Standard Folder
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Tigzy
Date: 2021-11-17
ATT&CK techniques: T1560.001
Log source: windows/process_creation

Description:
Detects a suspicious WinRAR execution in a folder which is not the default installation folder

Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\rar.exe",
        "\\winrar.exe"
      ]
    },
    {
      "Description": [
        "Command line RAR",
        "WinRAR"
      ]
    }
  ],
  "filter_main_unrar": {
    "Image|endswith": "\\UnRAR.exe"
  },
  "filter_main_path": {
    "Image|contains": [
      ":\\Program Files (x86)\\WinRAR\\",
      ":\\Program Files\\WinRAR\\"
    ]
  },
  "filter_optional_temp": {
    "Image|contains": ":\\Windows\\Temp\\"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]28406785
Sigma Detection Rule: Script Interpreter Spawning Credential Scanner - Windows
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-25
ATT&CK techniques: T1552, T1005, T1059.007
Log source: windows/process_creation

Description:
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\node.exe",
      "\\bun.exe"
    ]
  },
  "selection_child": [
    {
      "Image|endswith": [
        "trufflehog.exe",
        "gitleaks.exe"
      ]
    },
    {
      "CommandLine|contains": [
        "trufflehog",
        "gitleaks"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js
  - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised
  - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime
  - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/
Sigma Detection Rule: Time Travel Debugging Utility Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
Date: 2020-10-06
ATT&CK techniques: T1218, T1003.001
Log source: windows/process_creation

Description:
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\tttracer.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Tttracer/
  - https://twitter.com/mattifestation/status/[PII_REDACTED]83025666
  - https://twitter.com/oulusoyum/status/[PII_REDACTED]69655553
Sigma Detection Rule: Potentially Suspicious JWT Token Search Via CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), kagebunsher
Date: 2022-10-25
ATT&CK techniques: T1528, T1552.001
Log source: windows/process_creation

Description:
Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG".
JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others.
Threat actors may search for these tokens to steal them for lateral movement or privilege escalation.


Detection logic:
{
  "selection_tools": {
    "CommandLine|contains": [
      "find ",
      "find.exe",
      "findstr",
      "select-string ",
      "strings"
    ]
  },
  "selection_jwt_string": {
    "CommandLine|contains": [
      "eyJ0eXAiOi",
      "eyJhbGciOi",
      " eyJ0eX",
      " \"eyJ0eX\"",
      " 'eyJ0eX'",
      " eyJhbG",
      " \"eyJhbG\"",
      " 'eyJhbG'"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://mrd0x.com/stealing-tokens-from-office-applications/
  - https://www.scip.ch/en/?labs.20240523
Sigma Detection Rule: Start of NT Virtual DOS Machine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-07-16
Log source: windows/process_creation

Description:
Ntvdm.exe allows the execution of 16-bit Windows applications on 32-bit Windows operating systems, as well as the execution of both 16-bit and 32-bit DOS applications

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\ntvdm.exe",
      "\\csrstub.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
  - https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7
  - https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/
  - https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
Sigma Detection Rule: Powershell Executed From Headless ConHost Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matt Anderson (Huntress)
Date: 2024-07-23
ATT&CK techniques: T1059.001, T1059.003, T1564.003
Log source: windows/process_creation

Description:
Detects the use of powershell commands from headless ConHost window.
The "--headless" flag hides the windows from the user upon execution.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\conhost.exe"
    },
    {
      "OriginalFileName": "CONHOST.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "--headless",
      "powershell"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
Sigma Detection Rule: DLL Sideloading by VMware Xfer Utility
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-02
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL

Detection logic:
{
  "selection": {
    "Image|endswith": "\\VMwareXferlogs.exe"
  },
  "filter": {
    "Image|startswith": "C:\\Program Files\\VMware\\"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
Sigma Detection Rule: Potential PsExec Remote Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-28
ATT&CK techniques: T1587.001
Log source: windows/process_creation

Description:
Detects potential psexec command that initiate execution on a remote systems via common commandline flags used by the utility

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "accepteula",
      " -u ",
      " -p ",
      " \\\\\\\\"
    ]
  },
  "filter_main_localhost": {
    "CommandLine|contains": [
      "\\\\\\\\localhost",
      "\\\\\\\\127."
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.poweradmin.com/paexec/
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Sigma Detection Rule: HackTool - NetExec Execution
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Chirag Damani
Date: 2026-03-29
ATT&CK techniques: T1018, T1021
Log source: windows/process_creation

Description:
Detects execution of the hacktool NetExec.
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\nxc.exe",
    "CommandLine|contains": [
      " ftp ",
      " ldap ",
      " mssql ",
      " nfs ",
      " rdp ",
      " smb ",
      " ssh ",
      " vnc ",
      " winrm ",
      " wmi "
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
  - https://github.com/Pennyw0rth/NetExec
  - https://www.netexec.wiki/
Sigma Detection Rule: Potential MSTSC Shadowing Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-01-24
ATT&CK techniques: T1563.002
Log source: windows/process_creation

Description:
Detects RDP session hijacking by using MSTSC shadowing

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "noconsentprompt",
      "shadow:"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/kmkz_security/status/[PII_REDACTED]01976576
  - https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet
Sigma Detection Rule: HackTool - LaZagne Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2024-06-24
Log source: windows/process_creation

Description:
Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.
LaZagne has been leveraged multiple times by threat actors in order to dump credentials.


Detection logic:
{
  "selection_img_metadata": {
    "Image|endswith": "\\lazagne.exe"
  },
  "selection_img_cli": {
    "Image|contains": [
      ":\\PerfLogs\\",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Tmp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Temp\\",
      "\\$Recycle.bin",
      "\\AppData\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Favorites\\",
      "\\Links\\",
      "\\Music\\",
      "\\Photos\\",
      "\\Pictures\\",
      "\\Saved Games\\",
      "\\Searches\\",
      "\\Users\\Contacts\\",
      "\\Users\\Default\\",
      "\\Users\\Searches\\",
      "\\Videos\\",
      "\\Windows\\addins\\",
      "\\Windows\\Fonts\\",
      "\\Windows\\IME\\"
    ],
    "CommandLine|endswith": [
      ".exe all",
      ".exe browsers",
      ".exe chats",
      ".exe databases",
      ".exe games",
      ".exe git",
      ".exe mails",
      ".exe maven",
      ".exe memory",
      ".exe multimedia",
      ".exe sysadmin",
      ".exe unused",
      ".exe wifi",
      ".exe windows"
    ]
  },
  "selection_cli_modules": {
    "CommandLine|contains": [
      " all ",
      " browsers ",
      " chats ",
      " databases ",
      " games ",
      " mails ",
      " maven ",
      " memory ",
      " multimedia ",
      " php ",
      " svn ",
      " sysadmin ",
      " unused ",
      " wifi "
    ]
  },
  "selection_cli_options": {
    "CommandLine|contains": [
      "-1Password",
      "-apachedirectorystudio",
      "-autologon",
      "-ChromiumBa

References:
  - https://github.com/AlessandroZ/LaZagne/tree/master
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
  - https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/
  - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf
Sigma Detection Rule: Deleted Data Overwritten Via Cipher.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-26
ATT&CK techniques: T1485
Log source: windows/process_creation

Description:
Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk.
Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives


Detection logic:
{
  "selection_img": [
    {
      "OriginalFileName": "CIPHER.EXE"
    },
    {
      "Image|endswith": "\\cipher.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " /w:"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive
Sigma Detection Rule: Suspicious File Download From IP Via Wget.EXE - Paths
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-02-23
Log source: windows/process_creation

Description:
Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wget.exe"
    },
    {
      "OriginalFileName": "wget.exe"
    }
  ],
  "selection_ip": {
    "CommandLine|re": "://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_flag": [
    {
      "CommandLine|re": "\\s-O\\s"
    },
    {
      "CommandLine|contains": "--output-document"
    }
  ],
  "selection_paths": [
    {
      "CommandLine|contains": [
        ":\\PerfLogs\\",
        ":\\Temp\\",
        ":\\Users\\Public\\",
        ":\\Windows\\Help\\",
        ":\\Windows\\Temp\\",
        "\\Temporary Internet"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favorites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Favourites\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Contacts\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        ":\\Users\\",
        "\\Pictures\\"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.gnu.org/software/wget/manual/wget.html
Sigma Detection Rule: Potentially Suspicious Event Viewer Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-19
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects uncommon or suspicious child processes of "eventvwr.exe" which might indicate a UAC bypass attempt

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\eventvwr.exe"
  },
  "filter_main_generic": {
    "Image|endswith": [
      ":\\Windows\\System32\\mmc.exe",
      ":\\Windows\\System32\\WerFault.exe",
      ":\\Windows\\SysWOW64\\WerFault.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/
  - https://www.hybrid-analysis.com/sample/e122bc8bf291f15cab182a5d2d27b8db1e7019e4e96bb5cdbd1dfe7446f3f51f?environmentId=100
Sigma Detection Rule: Invoke-Obfuscation Via Use MSHTA
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/process_creation

Description:
Detects Obfuscated Powershell via use MSHTA in Scripts

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "set",
      "&&",
      "mshta",
      "vbscript:createobject",
      ".run",
      "(window.close)"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-14
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.

Detection logic:
{
  "selection": {
    "Image|contains": [
      ":\\Windows\\Microsoft.NET\\Framework\\",
      ":\\Windows\\Microsoft.NET\\Framework64\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm\\",
      ":\\Windows\\Microsoft.NET\\FrameworkArm64\\"
    ],
    "Image|endswith": "\\aspnet_compiler.exe",
    "CommandLine|contains": [
      "\\Users\\Public\\",
      "\\AppData\\Local\\Temp\\",
      "\\AppData\\Local\\Roaming\\",
      ":\\Temp\\",
      ":\\Windows\\Temp\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/
  - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
Sigma Detection Rule: Suspicious Service DACL Modification Via Set-Service Cmdlet
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-18
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects suspicious DACL modifications via the "Set-Service" cmdlet using the "SecurityDescriptorSddl" flag (Only available with PowerShell 7) that can be used to hide services or make them unstopable

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\pwsh.exe"
    },
    {
      "OriginalFileName": "pwsh.dll"
    }
  ],
  "selection_sddl_flag": {
    "CommandLine|contains": [
      "-SecurityDescriptorSddl ",
      "-sd "
    ]
  },
  "selection_set_service": {
    "CommandLine|contains|all": [
      "Set-Service ",
      "D;;"
    ],
    "CommandLine|contains": [
      ";;;IU",
      ";;;SU",
      ";;;BA",
      ";;;SY",
      ";;;WD"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://learn.microsoft.com/pt-br/windows/win32/secauthz/sid-strings
Sigma Detection Rule: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-01-26
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe.
HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode.
Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\reg.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "reg.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "add ",
      "New-ItemProperty ",
      "Set-ItemProperty ",
      "si "
    ]
  },
  "selection_cli_base": {
    "CommandLine|contains": "\\DeviceGuard"
  },
  "selection_cli_key": {
    "CommandLine|contains": [
      "EnableVirtualizationBasedSecurity",
      "HypervisorEnforcedCodeIntegrity"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
  - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity