deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Office Macro File Creation
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-23
ATT&CK techniques: T1566.001
Log source: windows/file_event

Description:
Detects the creation of a new office macro files on the systems

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": [
      ".docm",
      ".dotm",
      ".xlsm",
      ".xltm",
      ".potm",
      ".pptm"
    ]
  },
  "filter_main_office": {
    "Image|startswith": [
      "C:\\Program Files\\Microsoft Office\\",
      "C:\\Program Files (x86)\\Microsoft Office\\"
    ],
    "Image|endswith": [
      "\\WINWORD.EXE",
      "\\EXCEL.EXE",
      "\\POWERPNT.EXE"
    ],
    "TargetFilename|contains": "\\~$"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
Sigma Detection Rule: SCR File Write Event
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2022-04-27
ATT&CK techniques: T1218.011
Log source: windows/file_event

Description:
Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.

Detection logic:
{
  "selection": {
    "TargetFilename|endswith": ".scr"
  },
  "filter": {
    "TargetFilename|contains": [
      ":\\$WINDOWS.~BT\\NewOS\\",
      ":\\Windows\\System32\\",
      ":\\Windows\\SysWOW64\\",
      ":\\Windows\\WinSxS\\",
      ":\\WUDownloadCache\\"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://lolbas-project.github.io/lolbas/Libraries/Desk/
Sigma Detection Rule: Office Macro File Download
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-23
ATT&CK techniques: T1566.001
Log source: windows/file_event

Description:
Detects the creation of a new office macro files on the system via an application (browser, mail client).
This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.


Detection logic:
{
  "selection_processes": {
    "Image|endswith": [
      "\\RuntimeBroker.exe",
      "\\outlook.exe",
      "\\thunderbird.exe",
      "\\brave.exe",
      "\\chrome.exe",
      "\\firefox.exe",
      "\\iexplore.exe",
      "\\maxthon.exe",
      "\\MicrosoftEdge.exe",
      "\\msedge.exe",
      "\\msedgewebview2.exe",
      "\\opera.exe",
      "\\safari.exe",
      "\\seamonkey.exe",
      "\\vivaldi.exe",
      "\\whale.exe"
    ]
  },
  "selection_ext": [
    {
      "TargetFilename|endswith": [
        ".docm",
        ".dotm",
        ".xlsm",
        ".xltm",
        ".potm",
        ".pptm"
      ]
    },
    {
      "TargetFilename|contains": [
        ".docm:Zone",
        ".dotm:Zone",
        ".xlsm:Zone",
        ".xltm:Zone",
        ".potm:Zone",
        ".pptm:Zone"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md
  - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference
Sigma Detection Rule: PSEXEC Remote Execution File Artefact
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-21
ATT&CK techniques: T1136.002, T1543.003, T1570
Log source: windows/file_event

Description:
Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Detection logic:
{
  "selection": {
    "TargetFilename|startswith": "C:\\Windows\\PSEXEC-",
    "TargetFilename|endswith": ".key"
  },
  "condition": "selection"
}

References:
  - https://aboutdfir.com/the-key-to-identify-psexec/
  - https://twitter.com/davisrichardg/status/[PII_REDACTED]84704028
Sigma Detection Rule: Potential Remote PowerShell Session Initiated
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-09-12
ATT&CK techniques: T1059.001, T1021.006
Log source: windows/network_connection

Description:
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.


Detection logic:
{
  "selection": {
    "DestinationPort": [
      5985,
      5986
    ],
    "Initiated": "true",
    "SourceIsIpv6": "false"
  },
  "filter_main_service_users": [
    {
      "User|contains": [
        "NETWORK SERVICE",
        "NETZWERKDIENST",
        "SERVICIO DE RED",
        "SERVIZIO DI RETE"
      ]
    },
    {
      "User|contains|all": [
        "SERVICE R",
        "SEAU"
      ]
    }
  ],
  "filter_main_localhost": {
    "SourceIp": [
      "::1",
      "127.0.0.1"
    ],
    "DestinationIp": [
      "::1",
      "127.0.0.1"
    ]
  },
  "filter_optional_avast": {
    "Image": [
      "C:\\Program Files\\Avast Software\\Avast\\AvastSvc.exe",
      "C:\\Program Files (x86)\\Avast Software\\Avast\\AvastSvc.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
Sigma Detection Rule: Suspicious Non-Browser Network Communication With Google API
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Gavin Knapp
Date: 2023-05-01
ATT&CK techniques: T1102
Log source: windows/network_connection

Description:
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)


Detection logic:
{
  "selection": {
    "DestinationHostname|contains": [
      "drive.googleapis.com",
      "oauth2.googleapis.com",
      "sheets.googleapis.com",
      "www.googleapis.com"
    ]
  },
  "filter_optional_brave": {
    "Image|endswith": "\\brave.exe"
  },
  "filter_optional_chrome": {
    "Image|endswith": [
      ":\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      ":\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_google_drive": {
    "Image|contains": ":\\Program Files\\Google\\Drive File Stream\\",
    "Image|endswith": "\\GoogleDriveFS.exe"
  },
  "filter_optional_firefox": {
    "Image|endswith": [
      ":\\Program Files\\Mozilla Firefox\\firefox.exe",
      ":\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_optional_ie": {
    "Image|endswith": [
      ":\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      ":\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_optional_maxthon": {
    "Image|endswith": "\\maxthon.exe"
  },
  "filter_optional_edge_1": [
    {
      "Image|contains": ":\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": [
        ":\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        ":\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe",
        "\\WindowsApps\\MicrosoftEdge.exe"
      ]
    }
  ],
  "filter_optional_edge_2": {
    "Image|contains": [
      ":\\Program

References:
  - https://github.com/looCiprian/GC2-sheet
  - https://youtu.be/n2dFlSaBBKo
  - https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf
  - https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/
  - https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/
Sigma Detection Rule: Network Connection Initiated To Cloudflared Tunnels Domains
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems)
Date: 2024-05-27
ATT&CK techniques: T1567, T1572
Log source: windows/network_connection

Description:
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": [
      ".v2.argotunnel.com",
      "protocol-v2.argotunnel.com",
      "trycloudflare.com",
      "update.argotunnel.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/
  - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/
  - Internal Research
Sigma Detection Rule: Office Application Initiated Network Connection To Non-Local IP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-11-10
ATT&CK techniques: T1203
Log source: windows/network_connection

Description:
Detects an office application (Word, Excel, PowerPoint)  that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\excel.exe",
      "\\outlook.exe",
      "\\powerpnt.exe",
      "\\winword.exe",
      "\\wordview.exe"
    ],
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "filter_main_msrange_generic": {
    "DestinationIp|cidr": [
      "2.16.56.0/23",
      "2.17.248.0/21",
      "13.107.240.0/21",
      "20.184.0.0/13",
      "23.61.224.0/20",
      "20.192.0.0/10",
      "23.72.0.0/13",
      "23.3.88.0/22",
      "23.216.132.0/22",
      "40.76.0.0/14",
      "51.10.0.0/15",
      "51.103.0.0/16",
      "51.104.0.0/15",
      "51.142.136.0/22",
      "52.160.0.0/11",
      "95.101.96.0/21",
      "204.79.197.0/24"
    ]
  },
  "filter_main_msrange_exchange_1": {
    "DestinationIp|cidr": [
      "13.107.4.0/22",
      "13.107.6.152/31",
      "13.107.18.10/31",
      "13.107.42.0/23",
      "13.107.128.0/22",
      "23.35.224.0/20",
      "23.53.40.0/22",
      "23.103.160.0/20",
      "23.216.76.0/22",
      "40.96.0.0/13",
      "40.104.0.0/15",
      "52.96.0.0/14",
      "131.253.33.215/32",
      "132.245.0.0/16",
      "150.171.32.0/22",
      "204.79.197.215/32",
      "2603:1006::/40",
      "2603:1016::/36",
      "2603:1026::/36",
      "2603:1036::/36",
      "2603:1046::/36",
      "2603:1056::/36",
    

References:
  - https://corelight.com/blog/detecting-cve-2021-42292
  - https://learn.microsoft.com/de-de/microsoft-365/enterprise/urls-and-ip-address-ranges?view=o365-worldwide
Sigma Detection Rule: Silenttrinity Stager Msbuild Activity
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Kiran kumar s, oscd.community
Date: 2020-10-11
ATT&CK techniques: T1127.001
Log source: windows/network_connection

Description:
Detects a possible remote connections to Silenttrinity c2

Detection logic:
{
  "selection": {
    "Image|endswith": "\\msbuild.exe"
  },
  "filter": {
    "DestinationPort": [
      80,
      443
    ],
    "Initiated": "true"
  },
  "condition": "selection and filter"
}

References:
  - https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
Sigma Detection Rule: Python Initiated Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-10
ATT&CK techniques: T1046
Log source: windows/network_connection

Description:
Detects a Python process initiating a network connection. While this often relates to package installation, it can also indicate a potential malicious script communicating with a C&C server.

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|contains|all": [
      "\\python",
      ".exe"
    ]
  },
  "filter_optional_conda": {
    "ParentImage": "C:\\ProgramData\\Anaconda3\\Scripts\\conda.exe",
    "CommandLine|contains|all": [
      ":\\ProgramData\\Anaconda3\\Scripts\\conda-script.py",
      "update"
    ]
  },
  "filter_optional_conda_jupyter_notebook": {
    "ParentImage": "C:\\ProgramData\\Anaconda3\\python.exe",
    "CommandLine|contains": "C:\\ProgramData\\Anaconda3\\Scripts\\jupyter-notebook-script.py"
  },
  "filter_main_local_communication": {
    "DestinationIp": "127.0.0.1",
    "SourceIp": "127.0.0.1"
  },
  "filter_main_pip": {
    "CommandLine|contains|all": [
      "pip.exe",
      "install"
    ]
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python
  - https://pypi.org/project/scapy/
Sigma Detection Rule: Process Initiated Network Connection To Ngrok Domain
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-07-16
ATT&CK techniques: T1567, T1572, T1102
Log source: windows/network_connection

Description:
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": [
      ".ngrok-free.app",
      ".ngrok-free.dev",
      ".ngrok.app",
      ".ngrok.dev",
      ".ngrok.io"
    ]
  },
  "condition": "selection"
}

References:
  - https://ngrok.com/
  - https://ngrok.com/blog-post/new-ngrok-domains
  - https://www.virustotal.com/gui/file/cca0c1182ac114b44dc52dd2058fcd38611c20bb6b5ad84710681d38212f835a/
  - https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
Sigma Detection Rule: Uncommon Outbound Kerberos Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, oscd.community
Date: 2019-10-24
ATT&CK techniques: T1558, T1550.003
Log source: windows/network_connection

Description:
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.


Detection logic:
{
  "selection": {
    "DestinationPort": 88,
    "Initiated": "true"
  },
  "filter_main_lsass": {
    "Image": "C:\\Windows\\System32\\lsass.exe"
  },
  "filter_optional_chrome": {
    "Image": [
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_optional_firefox": {
    "Image": [
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_optional_tomcat": {
    "Image|endswith": "\\tomcat\\bin\\tomcat8.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://github.com/GhostPack/Rubeus
Sigma Detection Rule: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-24
ATT&CK techniques: T1102, T1102.001
Log source: windows/network_connection

Description:
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": "azurewebsites.net"
  },
  "filter_main_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_main_chrome_appdata": {
    "Image|startswith": "C:\\Users\\",
    "Image|endswith": "\\AppData\\Local\\Google\\Chrome\\Application\\chrome.exe"
  },
  "filter_main_firefox": {
    "Image": [
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_main_firefox_appdata": {
    "Image|startswith": "C:\\Users\\",
    "Image|endswith": "\\AppData\\Local\\Mozilla Firefox\\firefox.exe"
  },
  "filter_main_ie": {
    "Image": [
      "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_main_edge_1": [
    {
      "Image|startswith": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
    },
    {
      "Image": [
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
      ]
    }
  ],
  "filter_main_edge_2": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft\\EdgeCore\\",
      "C:\\Program Files\\Microsoft\\EdgeCore\\"

References:
  - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/
  - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia
  - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/
  - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
Sigma Detection Rule: Communication To Ngrok Tunneling Service Initiated
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-11-03
ATT&CK techniques: T1567, T1568.002, T1572, T1090, T1102
Log source: windows/network_connection

Description:
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.


Detection logic:
{
  "selection": {
    "DestinationHostname|contains": [
      "tunnel.us.ngrok.com",
      "tunnel.eu.ngrok.com",
      "tunnel.ap.ngrok.com",
      "tunnel.au.ngrok.com",
      "tunnel.sa.ngrok.com",
      "tunnel.jp.ngrok.com",
      "tunnel.in.ngrok.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/hakluke/status/[PII_REDACTED]14977537/photo/1
  - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent
Sigma Detection Rule: New Connection Initiated To Potential Dead Drop Resolver Domain
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sorina Ionescu, X__Junior (Nextron Systems)
Date: 2022-08-17
ATT&CK techniques: T1102, T1102.001
Log source: windows/network_connection

Description:
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": [
      ".t.me",
      "4shared.com",
      "abuse.ch",
      "anonfiles.com",
      "cdn.discordapp.com",
      "cloudflare.com",
      "ddns.net",
      "discord.com",
      "docs.google.com",
      "drive.google.com",
      "dropbox.com",
      "dropmefiles.com",
      "facebook.com",
      "feeds.rapidfeeds.com",
      "fotolog.com",
      "ghostbin.co/",
      "githubusercontent.com",
      "gofile.io",
      "hastebin.com",
      "imgur.com",
      "livejournal.com",
      "mediafire.com",
      "mega.co.nz",
      "mega.nz",
      "onedrive.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "reddit.com",
      "send.exploit.in",
      "sendspace.com",
      "steamcommunity.com",
      "storage.googleapis.com",
      "technet.microsoft.com",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "twitter.com",
      "ufile.io",
      "vimeo.com",
      "w3spaces.com",
      "wetransfer.com",
      "workers.dev",
      "youtube.com"
    ]
  },
  "filter_main_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_main_chrome_appdata": {
    "Image|startswith": "C:\\Users\\",
    "Image|endswith": "\\AppData\\Local\\

References:
  - https://web.archive.org/web/[PII_REDACTED]4315/https://content.fireeye.com/apt-41/rpt-apt41/
  - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/
  - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html
  - https://github.com/kleiton0x00/RedditC2
  - https://twitter.com/kleiton0x7e/status/[PII_REDACTED]10551296
Sigma Detection Rule: Potentially Suspicious Network Connection To Notion API
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Gavin Knapp
Date: 2023-05-03
ATT&CK techniques: T1102
Log source: windows/network_connection

Description:
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"

Detection logic:
{
  "selection": {
    "DestinationHostname|contains": "api.notion.com"
  },
  "filter_main_notion": {
    "Image|endswith": "\\AppData\\Local\\Programs\\Notion\\Notion.exe"
  },
  "filter_main_brave": {
    "Image|endswith": "\\brave.exe"
  },
  "filter_main_chrome": {
    "Image": [
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe",
      "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"
    ]
  },
  "filter_main_firefox": {
    "Image": [
      "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
      "C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"
    ]
  },
  "filter_main_ie": {
    "Image": [
      "C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe",
      "C:\\Program Files\\Internet Explorer\\iexplore.exe"
    ]
  },
  "filter_main_maxthon": {
    "Image|endswith": "\\maxthon.exe"
  },
  "filter_main_edge_1": [
    {
      "Image|startswith": "C:\\Program Files (x86)\\Microsoft\\EdgeWebView\\Application\\"
    },
    {
      "Image|endswith": "\\WindowsApps\\MicrosoftEdge.exe"
    },
    {
      "Image": [
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "C:\\Program Files\\Microsoft\\Edge\\Application\\msedge.exe"
      ]
    }
  ],
  "filter_main_edge_2": {
    "Image|startswith": [
      "C:\\Program Files (x86)\\Microsoft\\EdgeCore\\",
      "C:\\Program Files\\Microsoft\\EdgeCore\\"
    ],
    "Image|endswith": [
      "\\msedge.exe",
      "\\msedgewebview2.exe"
    ]
  },
  "fil

References:
  - https://github.com/mttaggart/OffensiveNotion
  - https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332