deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Formbook Process Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
Date: 2019-09-30
ATT&CK techniques: T1587.001
Log source: windows/process_creation

Description:
Detects Formbook like process executions that inject code into a set of files in the System32 folder, which executes a special command command line to delete the dropper from the AppData Temp folder. We avoid false positives by excluding all parent process with command line parameters.

Detection logic:
{
  "selection1": {
    "ParentCommandLine|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ],
    "ParentCommandLine|endswith": ".exe"
  },
  "selection2": [
    {
      "CommandLine|contains|all": [
        "/c",
        "del",
        "C:\\Users\\",
        "\\AppData\\Local\\Temp\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        "/c",
        "del",
        "C:\\Users\\",
        "\\Desktop\\"
      ]
    },
    {
      "CommandLine|contains|all": [
        "/C",
        "type nul >",
        "C:\\Users\\",
        "\\Desktop\\"
      ]
    }
  ],
  "selection3": {
    "CommandLine|endswith": ".exe"
  },
  "condition": "all of selection*"
}

References:
  - https://inquest.net/blog/2018/06/22/a-look-at-formbook-stealer
  - https://app.any.run/tasks/388d5802-aa48-4826-b[PII_REDACTED]04758/
  - https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
  - https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/
Sigma Detection Rule: Potential Ursnif Malware Activity - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: megan201296
Date: 2019-02-13
ATT&CK techniques: T1112
Log source: windows/registry_add

Description:
Detects registry keys related to Ursnif malware.

Detection logic:
{
  "selection": {
    "TargetObject|endswith": "\\Software\\AppDataLow\\Software\\Microsoft\\3A861D62-51E0-7C9D-AB0E-15700F2219A4"
  },
  "condition": "selection"
}

References:
  - https://blog.yoroi.company/research/ursnif-long-live-the-steganography/
  - https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/
Sigma Detection Rule: Ursnif Malware Download URL Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Thomas Patzke
Date: 2019-12-19
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects download of Ursnif malware done by dropper documents.

Detection logic:
{
  "selection": {
    "c-uri|contains|all": [
      "/",
      ".php\\?l="
    ],
    "c-uri|endswith": ".cab",
    "sc-status": 200
  },
  "condition": "selection"
}

References:
  - https://notebook.community/Cyb3rWard0g/HELK/docker/helk-jupyter/notebooks/sigma/proxy_ursnif_malware
Sigma Detection Rule: Ursnif Malware C2 URL Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Thomas Patzke
Date: 2019-12-19
ATT&CK techniques: T1566.001, T1204.002, T1071.001
Log source: /proxy

Description:
Detects Ursnif C2 traffic.

Detection logic:
{
  "b64encoding": {
    "c-uri|contains": [
      "_2f",
      "_2b"
    ]
  },
  "urlpatterns": {
    "c-uri|contains|all": [
      ".avi",
      "/images/"
    ]
  },
  "condition": "b64encoding and urlpatterns"
}

References:
  - https://www.fortinet.com/blog/threat-research/ursnif-variant-spreading-word-document.html
Sigma Detection Rule: Potential Dtrack RAT Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-30
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects potential Dtrack RAT activity via specific process patterns

Detection logic:
{
  "selection_ping": {
    "CommandLine|re": "ping\\s+-n.{6,64}echo EEEE\\s?>\\s?"
  },
  "selection_ipconfig": {
    "CommandLine|re": "ipconfig\\s+/all",
    "CommandLine|contains": "\\temp\\res.ip"
  },
  "selection_netsh": {
    "CommandLine|contains|all": [
      "interface ip show config",
      "\\temp\\netsh.res"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://securelist.com/my-name-is-dtrack/93338/
  - https://securelist.com/andariel-deploys-dtrack-and-maui-ransomware/107063/
  - https://www.cyberbit.com/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/
  - https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
  - https://app.any.run/tasks/ce4deab5-3263-494f-93e3-afb2b9d79f14/
Sigma Detection Rule: LockerGoga Ransomware Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Vasiliy Burov, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1486
Log source: windows/process_creation

Description:
Detects LockerGoga ransomware activity via specific command line.

Detection logic:
{
  "selection": {
    "CommandLine|contains": "-i SM-tgytutrc -s"
  },
  "condition": "selection"
}

References:
  - https://medium.com/@malwaredancer/lockergoga-input-arguments-ipc-communication-and-others-bd4e5a7ba80a
  - https://blog.f-secure.com/analysis-of-lockergoga-ransomware/
  - https://www.carbonblack.com/blog/tau-threat-intelligence-notification-lockergoga-ransomware/
Sigma Detection Rule: Potential Dridex Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-01-10
ATT&CK techniques: T1055, T1135, T1033
Log source: windows/process_creation

Description:
Detects potential Dridex acitvity via specific process patterns

Detection logic:
{
  "selection_svchost": {
    "Image|endswith": "\\svchost.exe",
    "CommandLine|contains|all": [
      "C:\\Users\\",
      "\\Desktop\\"
    ]
  },
  "filter_svchost": {
    "ParentImage|startswith": "C:\\Windows\\System32\\"
  },
  "selection_regsvr": {
    "ParentImage|endswith": "\\excel.exe",
    "Image|endswith": "\\regsvr32.exe",
    "CommandLine|contains": [
      " -s ",
      "\\AppData\\Local\\Temp\\"
    ]
  },
  "filter_regsvr": {
    "CommandLine|contains": ".dll"
  },
  "selection_anomaly_parent": {
    "ParentImage|endswith": "\\svchost.exe"
  },
  "selection_anomaly_child_1": {
    "Image|endswith": "\\whoami.exe",
    "CommandLine|contains": " /all"
  },
  "selection_anomaly_child_2": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains": " view"
  },
  "condition": "(selection_svchost and not filter_svchost) or (selection_regsvr and not filter_regsvr) or (selection_anomaly_parent and 1 of selection_anomaly_child_*)"
}

References:
  - https://app.any.run/tasks/993daa5e-112a-4ff6-8b5a-edbcec7c7ba3
  - https://redcanary.com/threat-detection-report/threats/dridex/
Sigma Detection Rule: Potential BearLPE Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Olaf Hartong
Date: 2019-05-22
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects potential exploitation of the BearLPE exploit using Task Scheduler ".job" import arbitrary DACL write\par

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/change",
      "/TN",
      "/RU",
      "/RP"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/djhohnstein/polarbearrepo/blob/f26d3e008093cc5c835e92a7165170baf6713d43/bearlpe/polarbear/polarbear/exploit.cpp
Sigma Detection Rule: Pulse Secure Attack CVE-2019-11510
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-11-18
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects CVE-2019-11510 exploitation attempt - URI contains Guacamole

Detection logic:
{
  "selection": {
    "cs-uri-query": "*?/dana/html5acc/guacamole/*"
  },
  "condition": "selection"
}

References:
  - https://www.exploit-db.com/exploits/47297
Sigma Detection Rule: Exploiting SetupComplete.cmd CVE-2019-1378
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro
Date: 2019-11-15
ATT&CK techniques: T1068, T1059.003, T1574
Log source: windows/process_creation

Description:
Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

Detection logic:
{
  "selection": {
    "ParentCommandLine|contains|all": [
      "\\cmd.exe",
      "/c",
      "C:\\Windows\\Setup\\Scripts\\"
    ],
    "ParentCommandLine|endswith": [
      "SetupComplete.cmd",
      "PartnerSetupComplete.cmd"
    ]
  },
  "filter": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\",
      "C:\\Windows\\WinSxS\\",
      "C:\\Windows\\Setup\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]1708/https://www.embercybersecurity.com/blog/cve-2019-1378-exploiting-an-access-control-privilege-escalation-vulnerability-in-windows-10-update-assistant-wua
Sigma Detection Rule: Citrix Netscaler Attack CVE-2019-19781
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Arnim Rupp, Florian Roth
Date: 2020-01-02
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects CVE-2019-19781 exploitation attempt against Citrix Netscaler, Application Delivery Controller and Citrix Gateway Attack

Detection logic:
{
  "selection_cs": [
    {
      "cs-uri-query|contains": "/../vpns/"
    },
    {
      "cs-uri-query|endswith": "/vpns/cfg/smb.conf"
    }
  ],
  "selection_csall": {
    "cs-uri-query|contains|all": [
      "/vpns/portal/scripts/",
      ".pl"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://support.citrix.com/article/CTX267679
  - https://support.citrix.com/article/CTX267027
  - https://isc.sans.edu/diary/25686
  - https://twitter.com/mpgn_x64/status/[PII_REDACTED]10829826
  - https://github.com/x1sec/CVE-2019-19781/blob/25f7ab97275b2d41800bb3414dac8ca3a78af7e5/CVE-2019-19781-DFIR.md
Sigma Detection Rule: Exploiting CVE-2019-1388
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2019-11-20
ATT&CK techniques: T1068
Log source: windows/process_creation

Description:
Detects an exploitation attempt in which the UAC consent dialogue is used to invoke an Internet Explorer process running as LOCAL_SYSTEM

Detection logic:
{
  "selection_img": {
    "ParentImage|endswith": "\\consent.exe",
    "Image|endswith": "\\iexplore.exe",
    "CommandLine|contains": " http"
  },
  "selection_rights": [
    {
      "IntegrityLevel": [
        "System",
        "S-1-16-16384"
      ]
    },
    {
      "User|contains": [
        "AUTHORI",
        "AUTORI"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388
  - https://www.zerodayinitiative.com/blog/2019/11/19/thanksgiving-treat-easy-as-pie-windows-7-secure-desktop-escalation-of-privilege
Sigma Detection Rule: Potential RDP Exploit CVE-2019-0708
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Lionel PRAT, Christophe BROCAS, @atc_project (improvements)
Date: 2019-05-24
ATT&CK techniques: T1210
Log source: windows/

Description:
Detect suspicious error on protocol RDP, potential CVE-2019-0708

Detection logic:
{
  "selection": {
    "EventID": [
      56,
      50
    ],
    "Provider_Name": "TermDD"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]4152/https://github.com/zerosum0x0/CVE-2019-0708
  - https://github.com/Ekultek/BlueKeep
Sigma Detection Rule: Scanner PoC for CVE-2019-0708 RDP RCE Vuln
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Adam Bradbury (idea)
Date: 2019-06-02
ATT&CK techniques: T1210
Log source: windows/

Description:
Detects the use of a scanner by zerosum0x0 that discovers targets vulnerable to  CVE-2019-0708 RDP RCE aka BlueKeep

Detection logic:
{
  "selection": {
    "EventID": 4625,
    "TargetUserName": "AAAAAAA"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/AdamTheAnalyst/status/[PII_REDACTED]45003776
  - https://web.archive.org/web/[PII_REDACTED]4152/https://github.com/zerosum0x0/CVE-2019-0708
Sigma Detection Rule: Sudo Privilege Escalation CVE-2019-14287
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-15
ATT&CK techniques: T1068, T1548.003
Log source: linux/process_creation

Description:
Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Detection logic:
{
  "selection": {
    "CommandLine|contains": " -u#"
  },
  "condition": "selection"
}

References:
  - https://www.openwall.com/lists/oss-security/2019/10/14/1
  - https://access.redhat.com/security/cve/cve-2019-14287
  - https://twitter.com/matthieugarin/status/[PII_REDACTED]10412546
Sigma Detection Rule: Sudo Privilege Escalation CVE-2019-14287 - Builtin
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-10-15
ATT&CK techniques: T1068, T1548.003
Log source: linux/

Description:
Detects users trying to exploit sudo vulnerability reported in CVE-2019-14287

Detection logic:
{
  "selection_user": {
    "USER": [
      "#-*",
      "#*[PII_REDACTED]"
    ]
  },
  "condition": "selection_user"
}

References:
  - https://www.openwall.com/lists/oss-security/2019/10/14/1
  - https://access.redhat.com/security/cve/cve-2019-14287
  - https://twitter.com/matthieugarin/status/[PII_REDACTED]10412546
Sigma Detection Rule: Confluence Exploitation CVE-2019-3398
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-05-26
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of the Confluence vulnerability described in CVE-2019-3398

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "cs-uri-query|contains|all": [
      "/upload.action",
      "filename=../../../../"
    ]
  },
  "condition": "selection"
}

References:
  - https://devcentral.f5.com/s/articles/confluence-arbitrary-file-write-via-path-traversal-cve-2019-3398-34181
Sigma Detection Rule: Potential Russian APT Credential Theft Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2019-02-21
ATT&CK techniques: T1552.001, T1003.003
Log source: windows/process_creation

Description:
Detects Russian group activity as described in Global Threat Report 2019 by Crowdstrike

Detection logic:
{
  "selection_xcopy": {
    "CommandLine|contains|all": [
      "xcopy /S /E /C /Q /H \\\\\\\\",
      "\\sysvol\\"
    ]
  },
  "selection_adexplorer": {
    "CommandLine|contains|all": [
      "adexplorer -snapshot \"\" c:\\users\\",
      "\\downloads\\",
      ".snp"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
Sigma Detection Rule: Mustang Panda Dropper
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), oscd.community
Date: 2019-10-30
ATT&CK techniques: T1587.001
Log source: windows/process_creation

Description:
Detects specific process parameters as used by Mustang Panda droppers

Detection logic:
{
  "selection_cli": [
    {
      "CommandLine|contains": [
        "Temp\\wtask.exe /create",
        "%windir:~-3,1%%PUBLIC:~-9,1%",
        "/tn \"Security Script ",
        "%windir:~-1,1%"
      ]
    },
    {
      "CommandLine|contains|all": [
        "/E:vbscript",
        "C:\\Users\\",
        ".txt",
        "/F"
      ]
    }
  ],
  "selection_img": {
    "Image|endswith": "Temp\\winwsh.exe"
  },
  "condition": "1 of selection_*"
}

References:
  - https://app.any.run/tasks/7ca5661d-a67b-43ec-98c1-dd7a8103c256/
  - https://app.any.run/tasks/b12cccf3-1c22-4e28-9d3e-c7a6062f3914/
  - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations
Sigma Detection Rule: APT40 Dropbox Tool User Agent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thomas Patzke
Date: 2019-11-12
ATT&CK techniques: T1071.001, T1567.002
Log source: /proxy

Description:
Detects suspicious user agent string of APT40 Dropbox tool

Detection logic:
{
  "selection": {
    "c-useragent": "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36",
    "cs-host": "api.dropbox.com"
  },
  "condition": "selection"
}

References:
  - Internal research from Florian Roth
Sigma Detection Rule: APT31 Judgement Panda Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2019-02-21
ATT&CK techniques: T1003.001, T1560.001
Log source: windows/process_creation

Description:
Detects APT31 Judgement Panda activity as described in the Crowdstrike 2019 Global Threat Report

Detection logic:
{
  "selection_ldifde": {
    "CommandLine|contains|all": [
      "ldifde",
      "-f -n",
      "eprod.ldf"
    ]
  },
  "selection_lateral_movement": {
    "CommandLine|contains|all": [
      "copy \\\\\\\\",
      "c$"
    ],
    "CommandLine|contains": [
      "\\aaaa\\procdump64.exe",
      "\\aaaa\\netsess.exe",
      "\\aaaa\\7za.exe",
      "\\c$\\aaaa\\"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html
Sigma Detection Rule: Potential APT-C-12 BlueMushroom DLL Load Activity Via Regsvr32
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-10-02
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects potential BlueMushroom DLL loading activity via regsvr32 from AppData Local

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "regsvr32",
      "\\AppData\\Local\\",
      ".dll",
      ",DllEntry"
    ]
  },
  "condition": "selection"
}

References:
  - https://pbs.twimg.com/media/EF3yLGoWkAEGeLa?format=jpg
Sigma Detection Rule: Equation Group DLL_U Export Function Load
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2019-03-04
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects a specific export function name used by one of EquationGroup tools

Detection logic:
{
  "selection": [
    {
      "CommandLine|contains": "-export dll_u"
    },
    {
      "CommandLine|endswith": [
        ",dll_u",
        " dll_u"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/00derp/EquationGroupLeak/search?utf8=%E2%9C%93&q=dll_u&type=
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]12839170
Sigma Detection Rule: Operation Wocao Activity - Security
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), frack113
Date: 2019-12-20
ATT&CK techniques: T1012, T1036.004, T1027, T1053.005, T1059.001
Log source: windows/

Description:
Detects activity mentioned in Operation Wocao report

Detection logic:
{
  "selection": {
    "EventID": 4799,
    "TargetUserName|startswith": "Administr",
    "CallerProcessName|endswith": "\\checkadmin.exe"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]2615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
  - https://web.archive.org/web/[PII_REDACTED]2615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]63646976
Sigma Detection Rule: Operation Wocao Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), frack113
Date: 2019-12-20
ATT&CK techniques: T1012, T1036.004, T1027, T1053.005, T1059.001
Log source: windows/process_creation

Description:
Detects activity mentioned in Operation Wocao report

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "checkadmin.exe 127.0.0.1 -all",
      "netsh advfirewall firewall add rule name=powershell dir=in",
      "cmd /c powershell.exe -ep bypass -file c:\\s.ps1",
      "/tn win32times /f",
      "create win32times binPath=",
      "\\c$\\windows\\system32\\devmgr.dll",
      " -exec bypass -enc JgAg",
      "type *keepass\\KeePass.config.xml",
      "iie.exe iie.txt",
      "reg query HKEY_CURRENT_USER\\Software\\\\*\\PuTTY\\Sessions\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]63646976
Sigma Detection Rule: Potential EmpireMonkey Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
Date: 2019-04-02
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects potential EmpireMonkey APT activity

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "/e:jscript",
      "\\Local\\Temp\\Errors.bat"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
  - https://malpedia.caad.fkie.fraunhofer.de/actor/anthropoid_spider
Sigma Detection Rule: MSSQL Extended Stored Procedure Backdoor Maggie
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Denis Szadkowski, DIRT / DCSO CyTec
Date: 2022-10-09
ATT&CK techniques: T1546
Log source: windows/

Description:
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server

Detection logic:
{
  "selection": {
    "Provider_Name": "MSSQLSERVER",
    "EventID": 8128,
    "Message|contains": "maggie"
  },
  "condition": "selection"
}

References:
  - https://medium.com/@DCSO_CyTec/mssql-meet-maggie-898773df3b01
Sigma Detection Rule: BlueSky Ransomware Artefacts
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: j4son
Date: 2023-05-23
ATT&CK techniques: T1486
Log source: windows/

Description:
Detect access to files and shares with names and extensions used by BlueSky ransomware which could indicate a current or previous encryption attempt.

Detection logic:
{
  "selection_access_eid": {
    "EventID": [
      4663,
      4656
    ]
  },
  "selection_access_data": [
    {
      "ObjectName|endswith": ".bluesky"
    },
    {
      "ObjectName|contains": "DECRYPT FILES BLUESKY"
    }
  ],
  "selection_share_eid": {
    "EventID": 5145
  },
  "selection_share_data": [
    {
      "RelativeTargetName|endswith": ".bluesky"
    },
    {
      "RelativeTargetName|contains": "DECRYPT FILES BLUESKY"
    }
  ],
  "condition": "all of selection_access_* or all of selection_share_*"
}

References:
  - https://unit42.paloaltonetworks.com/bluesky-ransomware/
Sigma Detection Rule: Serpent Backdoor Payload Execution Via Scheduled Task
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-03-21
ATT&CK techniques: T1053.005, T1059.006
Log source: windows/process_creation

Description:
Detects post exploitation execution technique of the Serpent backdoor.
According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method.
It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe"
    ],
    "CommandLine|contains|all": [
      "[System/EventID=",
      "/create",
      "/delete",
      "/ec",
      "/so",
      "/tn run"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain