deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Compromised 3CXDesktopApp Beaconing Activity - Netcon
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-29
Log source: windows/network_connection

Description:
Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise

Detection logic:
{
  "selection": {
    "Image|endswith": "\\3CXDesktopApp.exe",
    "DestinationHostname|contains": [
      "akamaicontainer.com",
      "akamaitechcloudservices.com",
      "azuredeploystore.com",
      "azureonlinecloud.com",
      "azureonlinestorage.com",
      "dunamistrd.com",
      "glcloudservice.com",
      "journalide.org",
      "msedgepackageinfo.com",
      "msstorageazure.com",
      "msstorageboxes.com",
      "officeaddons.com",
      "officestoragebox.com",
      "pbxcloudeservices.com",
      "pbxphonenetwork.com",
      "pbxsources.com",
      "qwepoi123098.com",
      "sbmsa.wiki",
      "sourceslabs.com",
      "visualstudiofactory.com",
      "zacharryblogs.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/
Sigma Detection Rule: Potential Compromised 3CXDesktopApp ICO C2 File Download
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-31
Log source: /proxy

Description:
Detects potential malicious .ICO files download from a compromised 3CXDesktopApp via web requests to the the malicious Github repository

Detection logic:
{
  "selection": {
    "c-uri|contains|all": [
      "IconStorages/images/main/icon",
      ".ico"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sentinelone.com/blog/smoothoperator-ongoing-campaign-trojanizes-3cx-software-in-software-supply-chain-attack/
  - https://www.linkedin.com/feed/update/urn:li:activity:[PII_REDACTED]834198529/
Sigma Detection Rule: Lace Tempest PowerShell Launcher
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-09
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "\\SysAidServer\\tomcat\\webapps",
      "Starting user.exe",
      "\\usersfiles\\user.exe",
      "Remove-Item -Force \"$wapps",
      "(Sophos)."
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
Sigma Detection Rule: Lace Tempest Cobalt Strike Download
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-09
Log source: windows/process_creation

Description:
Detects specific command line execution used by Lace Tempest to download Cobalt Strike as reported by SysAid Team

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(",
      "/a')"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
Sigma Detection Rule: Lace Tempest Malware Loader Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-09
Log source: windows/process_creation

Description:
Detects execution of a specific binary based on filename and hash used by Lace Tempest to load additional malware as reported by SysAid Team

Detection logic:
{
  "selection_img": {
    "Image|endswith": ":\\Program Files\\SysAidServer\\tomcat\\webapps\\usersfiles\\user.exe"
  },
  "selection_hash": {
    "Hashes|contains": "SHA256=B5ACF14CDAC40BE590318DEE95425D0746E85B1B7B1CBD14DA66F21F2522BF4D"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
Sigma Detection Rule: Lace Tempest File Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-09
Log source: windows/file_event

Description:
Detects PowerShell script file creation with specific names or suffixes which was seen being used often in PowerShell scripts by FIN7

Detection logic:
{
  "selection": [
    {
      "TargetFilename|endswith": [
        ":\\Program Files\\SysAidServer\\tomcat\\webapps\\usersfiles\\user.exe",
        ":\\Program Files\\SysAidServer\\tomcat\\webapps\\usersfiles.war",
        ":\\Program Files\\SysAidServer\\tomcat\\webapps\\leave"
      ]
    },
    {
      "TargetFilename|contains": ":\\Program Files\\SysAidServer\\tomcat\\webapps\\user."
    }
  ],
  "condition": "selection"
}

References:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
Sigma Detection Rule: Lace Tempest PowerShell Evidence Eraser
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-11-09
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "cleanLL",
      "usersfiles.war",
      "Remove-Item -Path \"$tomcat_dir",
      "SysAidServer",
      "sleep ",
      "while(1)"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
Sigma Detection Rule: Potential Operation Triangulation C2 Beaconing Activity - DNS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-06-01
Log source: /dns

Description:
Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Detection logic:
{
  "selection": {
    "query": [
      "addatamarket.net",
      "ans7tv.net",
      "anstv.net",
      "backuprabbit.com",
      "businessvideonews.com",
      "cloudsponcer.com",
      "datamarketplace.net",
      "growthtransport.com",
      "mobilegamerstats.com",
      "snoweeanalytics.com",
      "tagclick-cdn.com",
      "topographyupdates.com",
      "unlimitedteacup.com",
      "virtuallaughing.com",
      "web-trackers.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/operation-triangulation/109842/
  - https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
Sigma Detection Rule: Potential Operation Triangulation C2 Beaconing Activity - Proxy
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-06-01
Log source: /proxy

Description:
Detects potential beaconing activity to domains used in 0day attacks on iOS devices and revealed by Kaspersky and the FSB

Detection logic:
{
  "selection": {
    "cs-host|contains": [
      "addatamarket.net",
      "ans7tv.net",
      "anstv.net",
      "backuprabbit.com",
      "businessvideonews.com",
      "cloudsponcer.com",
      "datamarketplace.net",
      "growthtransport.com",
      "mobilegamerstats.com",
      "snoweeanalytics.com",
      "tagclick-cdn.com",
      "topographyupdates.com",
      "unlimitedteacup.com",
      "virtuallaughing.com",
      "web-trackers.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://securelist.com/operation-triangulation/109842/
  - https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp
Sigma Detection Rule: Mint Sandstorm - Log4J Wstomcat Process Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), MSTIC (idea)
Date: 2023-04-20
Log source: windows/process_creation

Description:
Detects Log4J Wstomcat process execution as seen in Mint Sandstorm activity

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\ws_tomcatservice.exe"
  },
  "filter_main_repadmin": {
    "Image|endswith": "\\repadmin.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
Sigma Detection Rule: Mint Sandstorm - AsperaFaspex Suspicious Process Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), MSTIC (idea)
Date: 2023-04-20
Log source: windows/process_creation

Description:
Detects suspicious execution from AsperaFaspex as seen used by Mint Sandstorm

Detection logic:
{
  "selection_parent": {
    "ParentImage|contains|all": [
      "aspera",
      "\\ruby"
    ]
  },
  "selection_special_child_powershell_img": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe"
    ]
  },
  "selection_special_child_powershell_cli": [
    {
      "CommandLine|contains": [
        " echo ",
        "-dumpmode",
        "-ssh",
        ".dmp",
        "add-MpPreference",
        "adscredentials",
        "bitsadmin",
        "certutil",
        "csvhost.exe",
        "DownloadFile",
        "DownloadString",
        "dsquery",
        "ekern.exe",
        "FromBase64String",
        "iex ",
        "iex(",
        "Invoke-Expression",
        "Invoke-WebRequest",
        "localgroup administrators",
        "o365accountconfiguration",
        "samaccountname=",
        "set-MpPreference",
        "svhost.exe",
        "System.IO.Compression",
        "System.IO.MemoryStream",
        "usoprivate",
        "usoshared",
        "whoami"
      ]
    },
    {
      "CommandLine|re": [
        "[-/\u2013][Ee^]{1,2}[ncodema^]*\\s[A-Za-z0-9+/=]{15,}",
        "net\\s+user",
        "net\\s+group",
        "query\\s+session"
      ]
    }
  ],
  "selection_special_child_lsass_1": {
    "CommandLine|contains": "lsass"
  },
  "selection_special_child_lsass_2": {
    "CommandLine|contains": [
      "procdump",
      "tasklist",
      "findstr"
    ]
  },
  "selection_child_wget": {
    "Image|endswith": "\\wget.exe",
    "CommandLine|contai

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
Sigma Detection Rule: Mint Sandstorm - ManageEngine Suspicious Process Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), MSTIC (idea)
Date: 2023-04-20
Log source: windows/process_creation

Description:
Detects suspicious execution from ManageEngine as seen used by Mint Sandstorm

Detection logic:
{
  "selection_parent_path": {
    "ParentImage|contains": [
      "manageengine",
      "ServiceDesk"
    ]
  },
  "selection_parent_image": {
    "ParentImage|contains": "\\java"
  },
  "selection_special_child_powershell_img": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe"
    ]
  },
  "selection_special_child_powershell_cli": [
    {
      "CommandLine|contains": [
        " echo ",
        "-dumpmode",
        "-ssh",
        ".dmp",
        "add-MpPreference",
        "adscredentials",
        "bitsadmin",
        "certutil",
        "csvhost.exe",
        "DownloadFile",
        "DownloadString",
        "dsquery",
        "ekern.exe",
        "FromBase64String",
        "iex ",
        "iex(",
        "Invoke-Expression",
        "Invoke-WebRequest",
        "localgroup administrators",
        "o365accountconfiguration",
        "samaccountname=",
        "set-MpPreference",
        "svhost.exe",
        "System.IO.Compression",
        "System.IO.MemoryStream",
        "usoprivate",
        "usoshared",
        "whoami"
      ]
    },
    {
      "CommandLine|re": "[-/\u2013][Ee^]{1,2}[ncodema^]*\\s[A-Za-z0-9+/=]{15,}"
    },
    {
      "CommandLine|re": "net\\s+user"
    },
    {
      "CommandLine|re": "net\\s+group"
    },
    {
      "CommandLine|re": "query\\ssession"
    }
  ],
  "selection_special_child_lsass_1": {
    "CommandLine|contains": "lsass"
  },
  "selection_special_child_lsass_2": {
    "CommandLine|contains": [
 

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/18/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets/
Sigma Detection Rule: Peach Sandstorm APT Process Activity Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: X__Junior (Nextron Systems)
Date: 2024-01-15
Log source: windows/process_creation

Description:
Detects process creation activity related to Peach Sandstorm APT

Detection logic:
{
  "selection": {
    "CommandLine|contains": "QP's\\*(58vaP!tF4"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/MsftSecIntel/status/[PII_REDACTED]69628824
  - https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
Sigma Detection Rule: Potential Peach Sandstorm APT C2 Communication Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: X__Junior (Nextron Systems)
Date: 2024-01-15
Log source: /proxy

Description:
Detects potential C2 communication activity related to Peach Sandstorm APT

Detection logic:
{
  "selection": {
    "cs-method": "GET",
    "c-uri|endswith": [
      "/api/Core/Command/Init",
      "/api/Core/Command/Restart"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/MsftSecIntel/status/[PII_REDACTED]69628824
  - https://www.virustotal.com/gui/file/364275326bbfc4a3b89233dabdaf3230a3d149ab774678342a40644ad9f8d614/details
Sigma Detection Rule: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor - Task Scheduler
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: CISA
Date: 2023-12-18
Log source: windows/

Description:
Hunts for known SVR-specific scheduled task names

Detection logic:
{
  "selection": {
    "EventID": [
      129,
      140,
      141
    ],
    "TaskName": [
      "\\defender",
      "\\Microsoft\\DefenderService",
      "\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck",
      "\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck",
      "\\Microsoft\\Windows\\ATPUpd",
      "\\Microsoft\\Windows\\Data Integrity Scan\\Data Integrity Update",
      "\\Microsoft\\Windows\\DefenderUPDService",
      "\\Microsoft\\Windows\\IISUpdateService",
      "\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask",
      "\\Microsoft\\Windows\\WiMSDFS",
      "\\Microsoft\\Windows\\Windows Defender\\Defender Update Service",
      "\\Microsoft\\Windows\\Windows Defender\\Service Update",
      "\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting",
      "\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting",
      "\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart",
      "\\Microsoft\\Windows\\WindowsDefenderService",
      "\\Microsoft\\Windows\\WindowsDefenderService2",
      "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck",
      "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check",
      "\\WindowUpdate"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: Scheduled Tasks Names Used By SVR For GraphicalProton Backdoor
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: CISA
Date: 2023-12-18
Log source: windows/

Description:
Hunts for known SVR-specific scheduled task names

Detection logic:
{
  "selection": {
    "EventID": [
      4698,
      4699,
      4702
    ],
    "TaskName": [
      "\\defender",
      "\\Microsoft\\DefenderService",
      "\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCheck",
      "\\Microsoft\\Windows\\Application Experience\\StartupAppTaskCkeck",
      "\\Microsoft\\Windows\\ATPUpd",
      "\\Microsoft\\Windows\\Data Integrity Scan\\Data Integrity Update",
      "\\Microsoft\\Windows\\DefenderUPDService",
      "\\Microsoft\\Windows\\IISUpdateService",
      "\\Microsoft\\Windows\\Speech\\SpeechModelInstallTask",
      "\\Microsoft\\Windows\\WiMSDFS",
      "\\Microsoft\\Windows\\Windows Defender\\Defender Update Service",
      "\\Microsoft\\Windows\\Windows Defender\\Service Update",
      "\\Microsoft\\Windows\\Windows Error Reporting\\CheckReporting",
      "\\Microsoft\\Windows\\Windows Error Reporting\\SubmitReporting",
      "\\Microsoft\\Windows\\Windows Filtering Platform\\BfeOnServiceStart",
      "\\Microsoft\\Windows\\WindowsDefenderService",
      "\\Microsoft\\Windows\\WindowsDefenderService2",
      "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled AutoCheck",
      "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Check",
      "\\WindowUpdate"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: DLL Names Used By SVR For GraphicalProton Backdoor
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: CISA
Date: 2023-12-18
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Hunts known SVR-specific DLL names.

Detection logic:
{
  "selection": {
    "ImageLoaded|endswith": [
      "\\AclNumsInvertHost.dll",
      "\\AddressResourcesSpec.dll",
      "\\BlendMonitorStringBuild.dll",
      "\\ChildPaletteConnected.dll",
      "\\DeregisterSeekUsers.dll",
      "\\HandleFrequencyAll.dll",
      "\\HardSwapColor.dll",
      "\\LengthInMemoryActivate.dll",
      "\\ModeBitmapNumericAnimate.dll",
      "\\ModeFolderSignMove.dll",
      "\\ParametersNamesPopup.dll",
      "\\PerformanceCaptionApi.dll",
      "\\ScrollbarHandleGet.dll",
      "\\UnregisterAncestorAppendAuto.dll",
      "\\WowIcmpRemoveReg.dll"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: Diamond Sleet APT Scheduled Task Creation - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
ATT&CK techniques: T1685
Log source: windows/registry_event

Description:
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability


Detection logic:
{
  "selection": {
    "TargetObject|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\",
      "Windows TeamCity Settings User Interface"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: Diamond Sleet APT Process Activity Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
Log source: windows/process_creation

Description:
Detects process creation activity indicators related to Diamond Sleet APT

Detection logic:
{
  "selection": {
    "CommandLine|contains": " uTYNkfKxHiZrx3KJ"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: Diamond Sleet APT DNS Communication Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
Log source: windows/dns_query

Description:
Detects DNS queries related to Diamond Sleet APT activity

Detection logic:
{
  "selection": {
    "QueryName|contains": [
      "3dkit.org",
      "dersmarketim.com",
      "galerielamy.com",
      "olidhealth.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: Diamond Sleet APT File Creation Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
Log source: windows/file_event

Description:
Detects file creation activity that is related to Diamond Sleet APT activity

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ":\\ProgramData\\4800-84DC-063A6A41C5C",
      ":\\ProgramData\\clip.exe",
      ":\\ProgramData\\DSROLE.dll",
      ":\\ProgramData\\Forest64.exe",
      ":\\ProgramData\\readme.md",
      ":\\ProgramData\\Version.dll",
      ":\\ProgramData\\wsmprovhost.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: Diamond Sleet APT Scheduled Task Creation
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
ATT&CK techniques: T1053.005
Log source: windows/

Description:
Detects registry event related to the creation of a scheduled task used by Diamond Sleet APT during exploitation of Team City CVE-2023-42793 vulnerability


Detection logic:
{
  "selection": {
    "EventID": 4698,
    "TaskName": "\\Windows TeamCity Settings User Interface",
    "TaskContent|contains": "uTYNkfKxHiZrx3KJ"
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: Diamond Sleet APT DLL Sideloading Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-24
ATT&CK techniques: T1574.001
Log source: windows/image_load

Description:
Detects DLL sideloading activity seen used by Diamond Sleet APT

Detection logic:
{
  "selection_1": {
    "Image|endswith": ":\\ProgramData\\clip.exe",
    "ImageLoaded|endswith": ":\\ProgramData\\Version.dll"
  },
  "selection_2": {
    "Image|endswith": ":\\ProgramData\\wsmprovhost.exe",
    "ImageLoaded|endswith": ":\\ProgramData\\DSROLE.dll"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/
Sigma Detection Rule: UNC4841 - Potential SEASPY Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-16
Log source: linux/process_creation

Description:
Detects execution of specific named binaries which were used by UNC4841 to deploy their SEASPY backdoor

Detection logic:
{
  "selection": {
    "Image|endswith": [
      "/BarracudaMailService",
      "/resize2fstab",
      "/resize_reisertab"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally