deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Reconnaissance Activity Via GatherNetworkInfo.VBS
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: blueteamer8699
Date: 2022-01-03
ATT&CK techniques: T1615, T1059.005
Log source: windows/process_creation

Description:
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\cscript.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "cscript.exe",
        "wscript.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "gatherNetworkInfo.vbs"
  },
  "condition": "all of selection_*"
}

References:
  - https://posts.slayerlabs.com/living-off-the-land/#gathernetworkinfovbs
  - https://www.mandiant.com/resources/blog/trojanized-windows-installers-ukrainian-government
Sigma Detection Rule: PowerShell Get-Clipboard Cmdlet Via CLI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2020-05-02
ATT&CK techniques: T1115
Log source: windows/process_creation

Description:
Detects usage of the 'Get-Clipboard' cmdlet via CLI

Detection logic:
{
  "selection": {
    "CommandLine|contains": "Get-Clipboard"
  },
  "condition": "selection"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/16
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md
Sigma Detection Rule: File Encoded To Base64 Via Certutil.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-02-24
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects the execution of certutil with the "encode" flag to encode a file to base64. This can be abused by threat actors and attackers for data exfiltration

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certutil.exe"
    },
    {
      "OriginalFileName": "CertUtil.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-encode"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil
  - https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/
  - https://lolbas-project.github.io/lolbas/Binaries/Certutil/
Sigma Detection Rule: Possible Privilege Escalation via Weak Service Permissions
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Teymur Kheirkhabarov
Date: 2019-10-26
ATT&CK techniques: T1574.011
Log source: windows/process_creation

Description:
Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand

Detection logic:
{
  "scbynonadmin": {
    "Image|endswith": "\\sc.exe",
    "IntegrityLevel": [
      "Medium",
      "S-1-16-8192"
    ]
  },
  "selection_binpath": {
    "CommandLine|contains|all": [
      "config",
      "binPath"
    ]
  },
  "selection_failure": {
    "CommandLine|contains|all": [
      "failure",
      "command"
    ]
  },
  "condition": "scbynonadmin and 1 of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment
  - https://pentestlab.blog/2017/03/30/weak-service-permissions/
Sigma Detection Rule: PPL Tampering Via WerFaultSecure
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Jason (https://github.com/0xbcf)
Date: 2025-09-23
ATT&CK techniques: T1685, T1003.001
Log source: windows/process_creation

Description:
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).
This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.
Distinct command line patterns help identify the specific tool:
- WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
- EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine
Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.


Detection logic:
{
  "selection_image": [
    {
      "Image|endswith": "\\WerFaultSecure.exe"
    },
    {
      "OriginalFileName": "WerFaultSecure.exe"
    }
  ],
  "selection_args": {
    "CommandLine|contains|all": [
      " /h ",
      " /pid ",
      " /tid ",
      " /encfile ",
      " /cancel ",
      " /type ",
      " 268310"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
  - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
  - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
  - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251
Sigma Detection Rule: Hacktool Execution - Imphash
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-04
ATT&CK techniques: T1588.002, T1003
Log source: windows/process_creation

Description:
Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed

Detection logic:
{
  "selection": {
    "Hashes|contains": [
      "IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932",
      "IMPHASH=3A19059BD7688CB88E70005F18EFC439",
      "IMPHASH=bf6223a49e45d[PII_REDACTED]7eb6004ba",
      "IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1",
      "IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC",
      "IMPHASH=F9A28C458284584A93B14216308D31BD",
      "IMPHASH=[PII_REDACTED]FC175BC7EBECFF0769B46E",
      "IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA",
      "IMPHASH=563233BFA169ACC7892451F71AD5850A",
      "IMPHASH=87575CB7A0E0700EB37F2E3668671A08",
      "IMPHASH=13F08707F759AF6003837A150A371BA1",
      "IMPHASH=1781F06048A7E58B323F0B9259BE798B",
      "IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5",
      "IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D",
      "IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2",
      "IMPHASH=713C29B396B907ED71A72482759ED757",
      "IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F",
      "IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E",
      "IMPHASH=8B114550386E31895DFAB371E741123D",
      "IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793",
      "IMPHASH=9D[PII_REDACTED]0E00E0BD939EE5E6C141",
      "IMPHASH=B18A1401FF8F444056D29450FBC0A6CE",
      "IMPHASH=CB567F[PII_REDACTED]D77A451374955F5F",
      "IMPHASH=[PII_REDACTED]94CD328547BF1F72289752",
      "IMPHASH=17B461A082950FC[PII_REDACTED]138B80C",
      "IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9",
      "IMPHASH=819B19D53CA6736448F9325A85736792",
      "IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E",
      "IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74",
      

References:
  - Internal Research
Sigma Detection Rule: Suspicious Explorer Process with Whitespace Padding - ClickFix/FileFix
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-04
ATT&CK techniques: T1204.004, T1027.010
Log source: windows/process_creation

Description:
Detects process creation with suspicious whitespace padding followed by a '#' character, which may indicate ClickFix or FileFix techniques used to conceal malicious commands from visual inspection.
ClickFix and FileFix are social engineering attack techniques where adversaries distribute phishing documents or malicious links that deceive users into opening the Windows Run dialog box or File Explorer search bar.
The victims are then instructed to paste commands from their clipboard, which contain extensive whitespace padding using various Unicode space characters to push the actual malicious command far to the right, effectively hiding it from immediate view.


Detection logic:
{
  "selection_explorer": {
    "ParentImage|endswith": "\\explorer.exe",
    "CommandLine|contains": "#"
  },
  "selection_space_variation": {
    "CommandLine|contains": [
      "\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000\u2000",
      "\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001\u2001",
      "\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002\u2002",
      "\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003\u2003",
      "\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004\u2004",
      "\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005\u2005",
      "\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006\u2006",
      "\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007\u2007",
      "\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008\u2008",
      "\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009\u2009",
      "\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a\u200a",
      "\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0",
      "            "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
  - https://mrd0x.com/filefix-clickfix-alternative/
Sigma Detection Rule: HackTool - SecurityXploded Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2018-12-19
ATT&CK techniques: T1555
Log source: windows/process_creation

Description:
Detects the execution of SecurityXploded Tools

Detection logic:
{
  "selection": [
    {
      "Company": "SecurityXploded"
    },
    {
      "Image|endswith": "PasswordDump.exe"
    },
    {
      "OriginalFileName|endswith": "PasswordDump.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://securityxploded.com/
  - https://web.archive.org/web/[PII_REDACTED]0524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
Sigma Detection Rule: WmiPrvSE Spawned A Process
Repository: SigmaHQ/sigma
Severity: medium
Status: stable
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-15
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects WmiPrvSE spawning a process

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\WmiPrvSe.exe"
  },
  "filter_logonid": {
    "LogonId": [
      "0x3e7",
      "null"
    ]
  },
  "filter_system_user": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "filter_wmiprvse": {
    "Image|endswith": "\\WmiPrvSE.exe"
  },
  "filter_werfault": {
    "Image|endswith": "\\WerFault.exe"
  },
  "filter_null": {
    "LogonId": null
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html
Sigma Detection Rule: Forfiles Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic, E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2022-06-14
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects the execution of "forfiles" with the "/c" flag.
While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary.
Can be used to bypass application whitelisting.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\forfiles.exe"
    },
    {
      "OriginalFileName": "forfiles.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -c "
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Forfiles/
  - https://pentestlab.blog/2020/07/06/indirect-command-execution/
Sigma Detection Rule: Regsvr32 DLL Execution With Suspicious File Extension
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), frack113
Date: 2021-11-29
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects the execution of REGSVR32.exe with DLL files masquerading as other files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      ".bin",
      ".bmp",
      ".cr2",
      ".dat",
      ".eps",
      ".gif",
      ".ico",
      ".jpeg",
      ".jpg",
      ".log",
      ".nef",
      ".orf",
      ".png",
      ".raw",
      ".rtf",
      ".sr2",
      ".temp",
      ".tif",
      ".tiff",
      ".tmp",
      ".txt"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
  - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
  - https://guides.lib.umich.edu/c.php?g=282942&p=1885348
  - https://harfanglab.io/insidethelab/uac-0057-pressure-ukraine-poland/
Sigma Detection Rule: Process Launched Without Image Name
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Matt Anderson (Huntress)
Date: 2024-07-23
Log source: windows/process_creation

Description:
Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\.exe"
  },
  "condition": "selection"
}

References:
  - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
Sigma Detection Rule: Bypass UAC via Fodhelper.exe
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Identifies use of Fodhelper.exe to bypass User Account Control. Adversaries use this technique to execute privileged processes.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\fodhelper.exe"
  },
  "condition": "selection"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md
Sigma Detection Rule: Shadow Copies Deletion Using Operating Systems Utilities
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)
Date: 2019-10-22
ATT&CK techniques: T1070, T1490
Log source: windows/process_creation

Description:
Shadow Copies deletion using operating systems utilities

Detection logic:
{
  "selection1_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wmic.exe",
        "\\vssadmin.exe",
        "\\diskshadow.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll",
        "wmic.exe",
        "VSSADMIN.EXE",
        "diskshadow.exe"
      ]
    }
  ],
  "selection1_cli": {
    "CommandLine|contains|all": [
      "shadow",
      "delete"
    ]
  },
  "selection2_img": [
    {
      "Image|endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection2_cli": {
    "CommandLine|contains|all": [
      "delete",
      "catalog",
      "quiet"
    ]
  },
  "selection3_img": [
    {
      "Image|endswith": "\\vssadmin.exe"
    },
    {
      "OriginalFileName": "VSSADMIN.EXE"
    }
  ],
  "selection3_cli": {
    "CommandLine|contains|all": [
      "resize",
      "shadowstorage"
    ],
    "CommandLine|contains": [
      "unbounded",
      "/MaxSize="
    ]
  },
  "condition": "(all of selection1*) or (all of selection2*) or (all of selection3*)"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment
  - https://blog.talosintelligence.com/2017/05/wannacry.html
  - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/
  - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/
  - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f[PII_REDACTED]80439c6e5babe8e080e41aa?environmentId=100
Sigma Detection Rule: Compressed File Extraction Via Tar.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: AdmU3
Date: 2023-12-19
ATT&CK techniques: T1560, T1560.001
Log source: windows/process_creation

Description:
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\tar.exe"
    },
    {
      "OriginalFileName": "bsdtar"
    }
  ],
  "selection_extract": {
    "CommandLine|contains": "-x"
  },
  "condition": "all of selection_*"
}

References:
  - https://unit42.paloaltonetworks.com/chromeloader-malware/
  - https://lolbas-project.github.io/lolbas/Binaries/Tar/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
Sigma Detection Rule: Active Directory Database Snapshot Via ADExplorer
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-14
ATT&CK techniques: T1087.002, T1069.002, T1482
Log source: windows/process_creation

Description:
Detects the execution of Sysinternals ADExplorer with the "-snapshot" flag in order to save a local copy of the active directory database. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\ADExp.exe",
        "\\ADExplorer.exe",
        "\\ADExplorer64.exe",
        "\\ADExplorer64a.exe"
      ]
    },
    {
      "OriginalFileName": "AdExp"
    },
    {
      "Description": "Active Directory Editor"
    },
    {
      "Product": "Sysinternals ADExplorer"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "snapshot"
  },
  "condition": "all of selection_*"
}

References:
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
  - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
  - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24
  - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/
  - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
Sigma Detection Rule: CMSTP UAC Bypass via COM Object Access
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Nik Seetharaman, Christian Burkard (Nextron Systems)
Date: 2019-07-31
ATT&CK techniques: T1548.002, T1218.003
Log source: windows/process_creation

Description:
Detects UAC Bypass Attempt Using Microsoft Connection Manager Profile Installer Autoelevate-capable COM Objects (e.g. UACMe ID of 41, 43, 58 or 65)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\DllHost.exe",
    "ParentCommandLine|contains": [
      " /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}",
      " /Processid:{3E000D72-A845-4CD9-BD83-80C07C3B881F}",
      " /Processid:{BD54C901-076B-434E-B6C7-17C531F4AB41}",
      " /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}",
      " /Processid:{E9495B87-D950-4AB5-87A5-FF6D70BF3E90}"
    ],
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
  - https://twitter.com/hFireF0X/status/[PII_REDACTED]53364225
  - https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious Process Created Via Wmic.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-10-12
ATT&CK techniques: T1047
Log source: windows/process_creation

Description:
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", etc.

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "process ",
      "call ",
      "create "
    ],
    "CommandLine|contains": [
      "rundll32",
      "bitsadmin",
      "regsvr32",
      "cmd.exe /c ",
      "cmd.exe /k ",
      "cmd.exe /r ",
      "cmd /c ",
      "cmd /k ",
      "cmd /r ",
      "powershell",
      "pwsh",
      "certutil",
      "cscript",
      "wscript",
      "mshta",
      "\\Users\\Public\\",
      "\\Windows\\Temp\\",
      "\\AppData\\Local\\",
      "%temp%",
      "%tmp%",
      "%ProgramData%",
      "%appdata%",
      "%comspec%",
      "%localappdata%"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2020/10/08/ryuks-return/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
Sigma Detection Rule: Powershell Inline Execution From A File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-25
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects inline execution of PowerShell code from a file

Detection logic:
{
  "selection_exec": {
    "CommandLine|contains": [
      "iex ",
      "Invoke-Expression ",
      "Invoke-Command ",
      "icm "
    ]
  },
  "selection_read": {
    "CommandLine|contains": [
      "cat ",
      "get-content ",
      "type "
    ]
  },
  "selection_raw": {
    "CommandLine|contains": " -raw"
  },
  "condition": "all of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
Sigma Detection Rule: Potential Regsvr32 Commandline Flag Anomaly
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-07-13
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects a potential command line flag anomaly related to "regsvr32" in which the "/i" flag is used without the "/n" which should be uncommon.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\regsvr32.exe",
    "CommandLine|contains|windash": " -i:"
  },
  "filter_main_flag": {
    "CommandLine|contains|windash": " -n "
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/sbousseaden/status/[PII_REDACTED]86484737?s=12
Sigma Detection Rule: HackTool - Dumpert Process Dumper Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-02-04
ATT&CK techniques: T1003.001
Log source: windows/process_creation

Description:
Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory

Detection logic:
{
  "selection": [
    {
      "Hashes|contains": "MD5=09D278F9DE118EF09163C6140255C690"
    },
    {
      "CommandLine|contains": "Dumpert.dll"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/outflanknl/Dumpert
  - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/