deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Emotet Loader Execution Via .LNK File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-04-22
ATT&CK techniques: T1059.006
Log source: windows/process_creation

Description:
Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022.
The ".lnk" file was delivered via phishing campaign.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\explorer.exe",
      "\\powershell.exe"
    ],
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe"
    ],
    "CommandLine|contains|all": [
      "findstr",
      ".vbs",
      ".lnk"
    ]
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5221/https://twitter.com/malware_traffic/status/[PII_REDACTED]00846338
  - https://twitter.com/Cryptolaemus1/status/[PII_REDACTED]40632576
  - https://tria.ge/220422-1pw1pscfdl/
  - https://tria.ge/220422-1nnmyagdf2/
Sigma Detection Rule: Hermetic Wiper TG Process Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-02-25
ATT&CK techniques: T1021.001
Log source: windows/process_creation

Description:
Detects process execution patterns found in intrusions related to the Hermetic Wiper malware attacks against Ukraine in February 2022

Detection logic:
{
  "selection1": {
    "Image|endswith": "\\policydefinitions\\postgresql.exe"
  },
  "selection2": [
    {
      "CommandLine|contains": [
        "CSIDL_SYSTEM_DRIVE\\temp\\sys.tmp",
        " 1> \\\\\\\\127.0.0.1\\ADMIN$\\__16"
      ]
    },
    {
      "CommandLine|contains|all": [
        "powershell -c ",
        "\\comsvcs.dll MiniDump ",
        "\\winupd.log full"
      ]
    }
  ],
  "condition": "1 of selection*"
}

References:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia
Sigma Detection Rule: Raspberry Robin Subsequent Execution of Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-05-06
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects raspberry robin subsequent execution of commands.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\fodhelper.exe",
    "Image|endswith": [
      "\\rundll32.exe",
      "\\regsvr32.exe"
    ],
    "CommandLine|contains|all": [
      "odbcconf.exe",
      "regsvr",
      "shellexec_rundll"
    ],
    "CommandLine|contains": [
      "installdriver",
      "setfiledsndir",
      "vkipdse"
    ],
    "CommandLine|endswith|windash": [
      "/a",
      "/f",
      "/s"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/raspberry-robin/
Sigma Detection Rule: Raspberry Robin Initial Execution From External Drive
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-05-06
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\cmd.exe",
    "ParentCommandLine|contains": "/r",
    "ParentCommandLine|endswith": [
      ".bin",
      ".ico",
      ".lnk",
      ".lo",
      ".sv",
      ".usb"
    ]
  },
  "selection_child_img": {
    "Image|endswith": "\\msiexec.exe",
    "CommandLine|contains|windash": "/q"
  },
  "selection_child_http": {
    "CommandLine|contains": [
      "http:",
      "https:"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://redcanary.com/blog/raspberry-robin/
Sigma Detection Rule: Potential Raspberry Robin Dot Ending File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-28
Log source: windows/process_creation

Description:
Detects commandline containing reference to files ending with a "." This scheme has been seen used by raspberry-robin

Detection logic:
{
  "selection": {
    "CommandLine|re": "\\\\[a-zA-Z0-9]{1,32}\\.[a-zA-Z0-9]{1,6}\\.[ \"']{1}"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/
Sigma Detection Rule: Potential Bumblebee Remote Thread Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-27
ATT&CK techniques: T1218.011, T1059.001
Log source: windows/create_remote_thread

Description:
Detects remote thread injection events based on action seen used by bumblebee

Detection logic:
{
  "selection": {
    "SourceImage|endswith": [
      "\\wabmig.exe",
      "\\wab.exe",
      "\\ImagingDevices.exe"
    ],
    "TargetImage|endswith": "\\rundll32.exe"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: FakeUpdates/SocGholish Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-06-16
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\wscript.exe",
    "ParentCommandLine|contains|all": [
      "\\AppData\\Local\\Temp",
      ".zip",
      "update",
      ".js"
    ],
    "ParentCommandLine|contains": [
      "Chrome",
      "Edge",
      "Firefox",
      "Opera",
      "Brave",
      "Vivaldi"
    ],
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/th3_protoCOL/status/[PII_REDACTED]89497600
  - https://twitter.com/1ZRR4H/status/[PII_REDACTED]27778304
Sigma Detection Rule: ChromeLoader Malware Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @kostastsale
Date: 2022-01-10
ATT&CK techniques: T1053.005, T1059.001, T1176
Log source: windows/process_creation

Description:
Detects execution of ChromeLoader malware via a registered scheduled task

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\powershell.exe",
    "ParentCommandLine|contains": "-ExecutionPolicy Bypass -WindowStyle Hidden -E JAB",
    "CommandLine|contains": "--load-extension=\"*\\Appdata\\local\\chrome\"",
    "Image|endswith": "\\chrome.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
  - https://twitter.com/th3_protoCOL/status/[PII_REDACTED]64322817
  - https://twitter.com/Kostastsale/status/[PII_REDACTED]21011458
  - https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
Sigma Detection Rule: Zimbra Collaboration Suite Email Server Unauthenticated RCE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @gott_cyber
Date: 2022-08-17
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection

Detection logic:
{
  "selection_servlet": {
    "cs-method": "POST",
    "cs-uri-query|contains": "/service/extension/backup/mboximport\\?",
    "cs-uri-query|contains|all": [
      "account-name",
      "ow",
      "no-switch",
      "append"
    ],
    "sc-status": [
      401,
      200
    ]
  },
  "selection_shell": {
    "cs-uri-query|contains": "/zimbraAdmin/",
    "cs-uri-query|endswith": ".jsp",
    "sc-status|contains": "200"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
  - https://www.yang99.top/index.php/archives/82/
  - https://github.com/vnhacker1337/CVE-2022-27925-PoC
Sigma Detection Rule: Potential CVE-2022-29072 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, @kostastsale
Date: 2022-04-17
Log source: windows/process_creation

Description:
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability.
7-Zip version 21.07 and earlier on Windows allows privilege escalation (CVE-2022-29072) and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow.
The command runs in a child process under the 7zFM.exe process.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\7zFM.exe"
  },
  "selection_img": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "filter_main_extensions_and_flags": [
    {
      "CommandLine|contains": [
        " /c ",
        " /k ",
        " /r "
      ]
    },
    {
      "CommandLine|endswith": [
        ".bat",
        ".cmd",
        ".ps1"
      ]
    }
  ],
  "filter_main_null": {
    "CommandLine": null
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/kagancapar/CVE-2022-29072
  - https://twitter.com/kagancapar/status/[PII_REDACTED]34161153
Sigma Detection Rule: Potential Nimbuspwn Exploit CVE-2022-29799 and CVE-2022-27800
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2022-05-04
ATT&CK techniques: T1068
Log source: linux/

Description:
Detects potential exploitation attempts of Nimbuspwn vulnerabilities CVE-2022-29799 and CVE-2022-27800 in Linux systems.


Detection logic:
{
  "keywords": {
    "|all": [
      "networkd-dispatcher",
      "Error handling notification for interface",
      "../../"
    ]
  },
  "condition": "keywords"
}

References:
  - https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/
  - https://github.com/Immersive-Labs-Sec/nimbuspwn
Sigma Detection Rule: CVE-2022-24527 Microsoft Connected Cache LPE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-13
ATT&CK techniques: T1059.001
Log source: windows/file_event

Description:
Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "WindowsPowerShell\\Modules\\webAdministration\\webAdministration.psm1"
  },
  "filter": {
    "User|contains": [
      "AUTHORI",
      "AUTORI"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/
Sigma Detection Rule: Exploitation Indicator Of CVE-2022-42475
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Nilaa Maharjan, Douglasrose75
Date: 2024-02-08
Log source: fortios/

Description:
Detects exploitation indicators of CVE-2022-42475 a heap-based buffer overflow in sslvpnd.

Detection logic:
{
  "keywords": [
    "/data/etc/wxd.conf",
    "/data/lib/libgif.so",
    "/data/lib/libips.bak",
    "/data/lib/libiptcp.so",
    "/data/lib/libipudp.so",
    "/data/lib/libjepg.so",
    "/var/.sslvpnconfigbk"
  ],
  "condition": "keywords"
}

References:
  - https://www.fortiguard.com/psirt/FG-IR-22-398
  - https://www.bleepingcomputer.com/news/security/fortinet-says-ssl-vpn-pre-auth-rce-bug-is-exploited-in-attacks/
  - https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
  - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420
Sigma Detection Rule: CVE-2022-31656 VMware Workspace ONE Access Auth Bypass
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-12
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of VMware Workspace ONE Access Authentication Bypass vulnerability as described in CVE-2022-31656
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.
A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.


Detection logic:
{
  "selection": {
    "cs-uri-query|contains": "/SAAS/t/_/;/"
  },
  "condition": "selection"
}

References:
  - https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
Sigma Detection Rule: Potential OWASSRF Exploitation Attempt - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-22
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "sc-status": 200,
    "c-uri|contains|all": [
      "/owa/",
      "/powershell"
    ],
    "c-uri|contains": [
      "@",
      "%40"
    ]
  },
  "filter_main_ua": {
    "c-useragent": [
      "ClientInfo",
      "Microsoft WinRM Client",
      "Exchange BackEnd Probes"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
  - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
Sigma Detection Rule: OWASSRF Exploitation Attempt Using Public POC - Proxy
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-22
ATT&CK techniques: T1190
Log source: /proxy

Description:
Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Detection logic:
{
  "selection": {
    "c-useragent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.54 Safari/537.36",
    "cs-method": "POST",
    "sc-status": 200,
    "c-uri|contains|all": [
      "/owa/mastermailbox",
      "/powershell"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
  - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
  - https://twitter.com/purp1ew0lf/status/[PII_REDACTED]76808961?s=12&t=OkZJl_ViICeiftVEsohRyw
Sigma Detection Rule: Potential OWASSRF Exploitation Attempt - Webserver
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-22
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt of the OWASSRF variant targeting exchange servers It uses the OWA endpoint to access the powershell backend endpoint

Detection logic:
{
  "selection": {
    "cs-method": "POST",
    "sc-status": 200,
    "cs-uri-query|contains|all": [
      "/owa/",
      "/powershell"
    ],
    "cs-uri-query|contains": [
      "@",
      "%40"
    ]
  },
  "filter_main_ua": {
    "cs-user-agent": [
      "ClientInfo",
      "Microsoft WinRM Client",
      "Exchange BackEnd Probes"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
  - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
Sigma Detection Rule: OWASSRF Exploitation Attempt Using Public POC - Webserver
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-22
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt of the OWASSRF variant targeting exchange servers using publicly available POC. It uses the OWA endpoint to access the powershell backend endpoint

Detection logic:
{
  "selection": {
    "cs-user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.54 Safari/537.36",
    "cs-method": "POST",
    "sc-status": 200,
    "cs-uri-query|contains|all": [
      "/owa/mastermailbox",
      "/powershell"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
  - https://www.rapid7.com/blog/post/2022/12/21/cve-2022-41080-cve-2022-41082-rapid7-observed-exploitation-of-owassrf-in-exchange-for-rce/
  - https://twitter.com/purp1ew0lf/status/[PII_REDACTED]76808961?s=12&t=OkZJl_ViICeiftVEsohRyw
Sigma Detection Rule: Potential CVE-2022-22954 Exploitation Attempt - VMware Workspace ONE Access Remote Code Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @kostastsale
Date: 2022-04-25
ATT&CK techniques: T1059.006, T1190
Log source: windows/process_creation

Description:
Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\prunsrv.exe"
  },
  "selection_payload_pwsh": {
    "Image|endswith": "\\powershell.exe"
  },
  "selection_payload_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": "/c powershell"
  },
  "condition": "selection_parent and 1 of selection_payload_*"
}

References:
  - https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
  - https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
Sigma Detection Rule: Potential KDC RC4-HMAC Downgrade Exploit - CVE-2022-37966
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-11-09
Log source: windows/

Description:
Detects the exploitation of a security bypass and elevation of privilege vulnerability with Authentication Negotiation by using weak RC4-HMAC negotiation

Detection logic:
{
  "selection": {
    "EventID": 42,
    "Provider_Name": [
      "Kerberos-Key-Distribution-Center",
      "Microsoft-Windows-Kerberos-Key-Distribution-Center"
    ],
    "Level": 2
  },
  "condition": "selection"
}

References:
  - https://support.microsoft.com/en-us/topic/kb5021131-how-to-manage-the-kerberos-protocol-changes-related-to-cve-2022-37966-fd837ac3-cdec-4e76-a6ec-86e67501407d
Sigma Detection Rule: Potential CVE-2022-26809 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-13
ATT&CK techniques: T1190, T1569.002
Log source: windows/process_creation

Description:
Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (long shot to detect the exploitation of vulnerabilities like CVE-2022-26809)

Detection logic:
{
  "selection": {
    "ParentImage": "C:\\Windows\\System32\\svchost.exe",
    "ParentCommandLine|contains": "-k RPCSS"
  },
  "condition": "selection"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26809
  - https://www.bleepingcomputer.com/startups/RpcSs.exe-14544.html
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]34097664
  - https://www.securonix.com/blog/cve-2022-26809-remote-procedure-call-runtime-remote-code-execution-vulnerability-and-coverage/
Sigma Detection Rule: Suspicious Sysmon as Execution Parent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Tim Shelton (fp werfault)
Date: 2022-11-10
ATT&CK techniques: T1068
Log source: windows/process_creation

Description:
Detects suspicious process executions in which Sysmon itself is the parent of a process, which could be a sign of exploitation (e.g. CVE-2022-41120)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\Sysmon.exe",
      "\\Sysmon64.exe"
    ]
  },
  "filter_main_temp_sysmon": {
    "Image|startswith": "C:\\Users\\",
    "Image|contains": "\\AppData\\Local\\Temp\\",
    "Image|endswith": [
      "\\Sysmon.exe",
      "\\Sysmon64.exe"
    ]
  },
  "filter_main_generic": {
    "Image|contains": [
      ":\\Windows\\Sysmon.exe",
      ":\\Windows\\Sysmon64.exe",
      ":\\Windows\\System32\\conhost.exe",
      ":\\Windows\\System32\\WerFault.exe",
      ":\\Windows\\System32\\WerFaultSecure.exe",
      ":\\Windows\\System32\\wevtutil.exe",
      ":\\Windows\\SysWOW64\\wevtutil.exe"
    ]
  },
  "filter_main_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41120
  - https://twitter.com/filip_dragovic/status/[PII_REDACTED]60055041
  - https://twitter.com/filip_dragovic/status/[PII_REDACTED]27436290
Sigma Detection Rule: Potential CVE-2023-21554 QueueJumper Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-12
Log source: windows/process_creation

Description:
Detects potential exploitation of CVE-2023-21554 (dubbed QueueJumper)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\Windows\\System32\\mqsvc.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\schtasks.exe",
      "\\wmic.exe",
      "\\wscript.exe",
      "\\wsl.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://research.checkpoint.com/2023/queuejumper-critical-unauthorized-rce-vulnerability-in-msmq-service/
Sigma Detection Rule: Suspicious Set Value of MSDT in Registry (CVE-2022-30190)
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sittikorn S
Date: 2020-05-31
ATT&CK techniques: T1221
Log source: windows/registry_set

Description:
Detects set value ms-msdt MSProtocol URI scheme in Registry that could be an attempt to exploit CVE-2022-30190.

Detection logic:
{
  "selection": {
    "TargetObject|startswith": "HKCR\\ms-msdt\\"
  },
  "condition": "selection"
}

References:
  - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
  - https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/
Sigma Detection Rule: Potential CVE-2022-46169 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-27
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects potential exploitation attempts that target the Cacti Command Injection CVE-2022-46169

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "/remote_agent.php",
      "action=polldata",
      "poller_id="
    ],
    "cs-uri-query|contains": [
      "| base64 -d | /bin/bash`",
      "%7C%20base64%20-d%20%7C%20%2Fbin%2Fbash%60",
      "`whoami",
      "powershell",
      "cmd",
      "wget"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/0xf4n9x/CVE-2022-46169
  - https://github.com/Cacti/cacti/security/advisories/GHSA-6p93-p743-35gf
  - https://github.com/rapid7/metasploit-framework/pull/17407