deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: FlowCloud Registry Markers
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: NVISO
Date: 2020-06-09
ATT&CK techniques: T1112
Log source: windows/registry_event

Description:
Detects FlowCloud malware registry markers from threat group TA410.
The malware stores its configuration in the registry alongside drivers utilized by the malware's keylogger components.


Detection logic:
{
  "selection": {
    "TargetObject|contains": [
      "\\HARDWARE\\{2DB80286-1784-48b5-A751-B6ED1F490303}",
      "\\HARDWARE\\{804423C2-F490-4ac3-BFA5-13DEDE63A71A}",
      "\\HARDWARE\\{A5124AF5-DF23-49bf-B0ED-A18ED3DEA027}",
      "\\SYSTEM\\Setup\\PrintResponsor\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.proofpoint.com/us/blog/threat-insight/ta410-group-behind-lookback-attacks-against-us-utilities-sector-returns-new
Sigma Detection Rule: ComRAT Network Communication
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-05-26
ATT&CK techniques: T1071.001
Log source: /proxy

Description:
Detects Turla ComRAT network communication.

Detection logic:
{
  "selection": {
    "c-uri|contains": "/index/index.php\\?h="
  },
  "condition": "selection"
}

References:
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf
Sigma Detection Rule: CVE-2020-0688 Exchange Exploitation via Web Log
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-02-29
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

Detection logic:
{
  "selection1": {
    "cs-method": "GET",
    "cs-uri-query|contains": [
      "/ecp/",
      "/owa/"
    ]
  },
  "selection2": {
    "cs-uri-query|contains": "__VIEWSTATE="
  },
  "condition": "all of selection*"
}

References:
  - https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/
Sigma Detection Rule: CVE-2020-0688 Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: NVISO
Date: 2020-02-27
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects CVE-2020-0688 Exploitation attempts

Detection logic:
{
  "selection": {
    "cs-uri-query|contains|all": [
      "/ecp/default.aspx",
      "__VIEWSTATEGENERATOR=",
      "__VIEWSTATE="
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Ridter/cve-2020-0688
Sigma Detection Rule: CVE-2020-0688 Exploitation via Eventlog
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), wagga
Date: 2020-02-29
ATT&CK techniques: T1190
Log source: windows/

Description:
Detects the exploitation of Microsoft Exchange vulnerability as described in CVE-2020-0688

Detection logic:
{
  "selection1": {
    "EventID": 4,
    "Provider_Name": "MSExchange Control Panel",
    "Level": "Error"
  },
  "selection2": [
    "&__VIEWSTATE="
  ],
  "condition": "all of selection*"
}

References:
  - https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/
  - https://cyberpolygon.com/materials/okhota-na-ataki-ms-exchange-chast-2-cve-2020-0688-cve-2020-16875-cve-2021-24085/
Sigma Detection Rule: Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-10
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempt against Citrix Netscaler, Application Delivery Controller (ADS) and Citrix Gateway exploiting vulnerabilities reported as CVE-2020-8193 and CVE-2020-8195

Detection logic:
{
  "selection1": {
    "cs-uri-query|contains": "/rapi/filedownload?filter=path:%2F"
  },
  "selection2": {
    "cs-uri-query|contains|all": [
      "/pcidss/report",
      "type=all_signatures",
      "sig_name=_default_signature_"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://support.citrix.com/article/CTX276688
  - https://research.nccgroup.com/2020/07/10/rift-citrix-adc-vulnerabilities-cve-2020-8193-cve-2020-8195-and-cve-2020-8196-intelligence/
  - https://dmaasland.github.io/posts/citrix.html
Sigma Detection Rule: Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-02-12
ATT&CK techniques: T1210
Log source: windows/process_creation

Description:
Detects the execution of the commonly used ZeroLogon PoC executable.

Detection logic:
{
  "selection_main": {
    "ParentImage|endswith": "\\cmd.exe",
    "Image|endswith": [
      "\\cool.exe",
      "\\zero.exe"
    ],
    "CommandLine|contains|all": [
      "Administrator",
      "-c"
    ]
  },
  "selection_payloads_1": {
    "CommandLine|contains|all": [
      "taskkill",
      "/f",
      "/im"
    ]
  },
  "selection_payloads_2": {
    "CommandLine|contains": "powershell"
  },
  "condition": "selection_main and 1 of selection_payloads_*"
}

References:
  - https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/
  - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/
Sigma Detection Rule: CVE-2020-10148 SolarWinds Orion API Auth Bypass
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Bhabesh Raj, Tim Shelton
Date: 2020-12-27
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects CVE-2020-10148 SolarWinds Orion API authentication bypass attempts

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "/WebResource.axd",
      "/ScriptResource.axd",
      "/i18n.ashx",
      "/Skipi18n"
    ]
  },
  "selection2": {
    "cs-uri-query|contains": [
      "/SolarWinds/",
      "/api/"
    ]
  },
  "valid_request_1": {
    "cs-uri-query|contains": "Orion/Skipi18n/Profiler/"
  },
  "valid_request_2": {
    "cs-uri-query|contains": [
      "css.i18n.ashx",
      "js.i18n.ashx"
    ]
  },
  "condition": "all of selection* and not 1 of valid_request_*"
}

References:
  - https://kb.cert.org/vuls/id/843464
Sigma Detection Rule: Cisco ASA FTD Exploit CVE-2020-3452
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-07
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452 with a status code of 200 (sccessful exploitation)

Detection logic:
{
  "selection_endpoint": {
    "cs-uri-query|contains": [
      "+CSCOT+/translation-table",
      "+CSCOT+/oem-customization"
    ]
  },
  "selection_path_select": {
    "cs-uri-query|contains": [
      "&textdomain=/",
      "&textdomain=%",
      "&name=/",
      "&name=%"
    ]
  },
  "select_status_code": {
    "sc-status": 200
  },
  "condition": "selection_endpoint and selection_path_select and select_status_code"
}

References:
  - https://twitter.com/aboul3la/status/[PII_REDACTED]22155525
  - https://github.com/darklotuskdb/CISCO-CVE-2020-3452-Scanner-Exploiter
Sigma Detection Rule: Suspicious PrinterPorts Creation (CVE-2020-1048)
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: EagleEye Team, Florian Roth
Date: 2020-05-13
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects new commands that add new printer port which point to suspicious file

Detection logic:
{
  "selection1": {
    "CommandLine|contains": "Add-PrinterPort -Name"
  },
  "selection2": {
    "CommandLine|contains": [
      ".exe",
      ".dll",
      ".bat"
    ]
  },
  "selection3": {
    "CommandLine|contains": "Generic / Text Only"
  },
  "condition": "(selection1 and selection2) or selection3"
}

References:
  - https://windows-internals.com/printdemon-cve-2020-1048/
Sigma Detection Rule: CVE-2020-1048 Exploitation Attempt - Suspicious New Printer Ports - Registry
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: EagleEye Team, Florian Roth (Nextron Systems), NVISO
Date: 2020-05-13
ATT&CK techniques: T1112
Log source: windows/registry_set

Description:
Detects changes to the "Ports" registry key with data that includes a Windows path or a file with a suspicious extension.
This could be an attempt to exploit CVE-2020-1048 - a Windows Print Spooler elevation of privilege vulnerability.


Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Microsoft\\Windows NT\\CurrentVersion\\Ports",
    "Details|contains": [
      ".bat",
      ".com",
      ".dll",
      ".exe",
      ".ps1",
      ".vbe",
      ".vbs",
      "C:"
    ]
  },
  "condition": "selection"
}

References:
  - https://windows-internals.com/printdemon-cve-2020-1048/
Sigma Detection Rule: CVE-2020-5902 F5 BIG-IP Exploitation Attempt
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-05
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation attempt of the vulnerability found in F5 BIG-IP and described in CVE-2020-5902

Detection logic:
{
  "selection_base": {
    "cs-uri-query|contains": [
      "/tmui/",
      "/hsqldb"
    ]
  },
  "selection_traversal": {
    "cs-uri-query|contains": [
      "..;/",
      ".jsp/.."
    ]
  },
  "condition": "selection_base and selection_traversal"
}

References:
  - https://support.f5.com/csp/article/K52145254
  - https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/
  - https://twitter.com/yorickkoster/status/[PII_REDACTED]51434754
  - https://www.criticalstart.com/f5-big-ip-remote-code-execution-exploit/
Sigma Detection Rule: Oracle WebLogic Exploit CVE-2020-14882
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-11-02
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects exploitation attempts on WebLogic servers

Detection logic:
{
  "selection": {
    "cs-uri-query|contains": [
      "/console/images/%252E%252E%252Fconsole.portal",
      "/console/css/%2e"
    ]
  },
  "condition": "selection"
}

References:
  - https://isc.sans.edu/diary/26734
  - https://twitter.com/jas502n/status/[PII_REDACTED]50667009?s=20
  - https://twitter.com/sudo_sudoka/status/[PII_REDACTED]78223874
Sigma Detection Rule: Exploited CVE-2020-10189 Zoho ManageEngine
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-03-25
ATT&CK techniques: T1190, T1059.001, T1059.003
Log source: windows/process_creation

Description:
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "DesktopCentral_Server\\jre\\bin\\java.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\bitsadmin.exe",
      "\\systeminfo.exe",
      "\\net.exe",
      "\\net1.exe",
      "\\reg.exe",
      "\\query.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
  - https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=48224
Sigma Detection Rule: DNS RCE CVE-2020-1350
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-15
ATT&CK techniques: T1190, T1569.002
Log source: windows/process_creation

Description:
Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub process

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\System32\\dns.exe"
  },
  "filter": {
    "Image|endswith": [
      "\\System32\\werfault.exe",
      "\\System32\\conhost.exe",
      "\\System32\\dnscmd.exe",
      "\\System32\\dns.exe"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/
  - https://web.archive.org/web/[PII_REDACTED]2447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
Sigma Detection Rule: TerraMaster TOS CVE-2020-28188
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-01-25
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects the exploitation of the TerraMaster TOS vulnerability described in CVE-2020-28188

Detection logic:
{
  "base_url": {
    "cs-method": "GET",
    "cs-uri-query|contains|all": [
      "/include/makecvs.php",
      "?Event="
    ]
  },
  "payload": {
    "cs-uri-query|contains": [
      "curl",
      "wget",
      ".py",
      ".sh",
      "chmod",
      "_GET"
    ]
  },
  "condition": "base_url and payload"
}

References:
  - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
  - https://research.checkpoint.com/2021/freakout-leveraging-newest-vulnerabilities-for-creating-a-botnet/
Sigma Detection Rule: TAIDOOR RAT DLL Load
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-30
ATT&CK techniques: T1055.001
Log source: windows/process_creation

Description:
Detects specific process characteristics of Chinese TAIDOOR RAT malware load

Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "dll,MyStart",
      "dll MyStart"
    ]
  },
  "selection2a": {
    "CommandLine|endswith": " MyStart"
  },
  "selection2b": {
    "CommandLine|contains": "rundll32.exe"
  },
  "condition": "selection1 or ( selection2a and selection2b )"
}

References:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a
Sigma Detection Rule: GALLIUM Artefacts - Builtin
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Burrell
Date: 2020-02-07
ATT&CK techniques: T1071
Log source: windows/

Description:
Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

Detection logic:
{
  "selection": {
    "EventID": 257,
    "QNAME": [
      "asyspy256.ddns.net",
      "hotkillmail9sddcc.ddns.net",
      "rosaf112.ddns.net",
      "cvdfhjh1231.myftp.biz",
      "sz2016rose.ddns.net",
      "dffwescwer4325.myftp.biz",
      "cvdfhjh1231.ddns.net"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
  - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn800669(v=ws.11)
Sigma Detection Rule: GALLIUM IOCs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Burrell
Date: 2020-02-07
ATT&CK techniques: T1212, T1071
Log source: windows/process_creation

Description:
Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

Detection logic:
{
  "selection": {
    "Hashes|contains": [
      "SHA256=9ae7c4a4e1cfe9b505c3a47e66551eb1357affee65bfefb0109d02f4e97c06dd",
      "SHA256=7772d624e1aed327abcd24ce2068063da0e31bb1d5d3bf2841fc977e198c6c5b",
      "SHA256=657fc7e6447e0065d488a7db2caab13071e[PII_REDACTED]4f9024ca843fe4e86b5",
      "SHA256=2ef157a97e28574356e1d871abf75deca7d7a1ea662f38b577a06dd039dbae29",
      "SHA256=52fd7b90d7144ac448af4008be639d4d45c252e51823f4311011af3207a5fc77",
      "SHA256=a370e47cb97b35f1ae6590d14ada7561d22b4a73be0cb6df7e851d85054b1ac3",
      "SHA256=5bf80b871278a29f356bd42af1e35428aead20cd90b0c7642247afcaaa95b022",
      "SHA256=6f690ccfd54c2b02f0c3cb89c938162c10cbeee693286e809579c540b07ed883",
      "SHA256=3c884f776fbd16597c072afd81029e8764dd57ee79d798829ca111f5e170bd8e",
      "SHA256=1922a419f57afb351b58330ed456143cc8de8b3ebcbd236d26a219b03b3464d7",
      "SHA256=fe0e4ef832b62d49b43433e10c47dc51072959af93963c790892efc20ec422f1",
      "SHA256=7ce9e1c5562c8a5c93878629a47fe6071a35d604ed57a8f918f3eadf82c11a9c",
      "SHA256=178d5ee8c04401d332af331087a80fb4e5e2937edfba7266f9be34a5029b6945",
      "SHA256=51f70956fa8c487784fd21ab795f6ba2199b5c2d346acdeef1de0318a4c729d9",
      "SHA256=889bca95f1a69e94aaade1e959ed0d3620531dc0fc563be9a8decf41899b4d79",
      "SHA256=332ddaa00e2eb862742cb8d7e24ce52a5d38ffb22f6c8bd51162bd35e84d7ddf",
      "SHA256=44bcf82fa[PII_REDACTED]98504e8369e9dcdb32686b95fcb44579f0b4efa79df08",
      "SHA256=63552772fdd8c947712a2cff00dfe25c7a[PII_REDACTED]4b6d486227384f8cf3ef"

References:
  - https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/
  - https://github.com/Azure/Azure-Sentinel/blob/a02ce85c96f162de6f8cc06f07a53b6525f0ff7f/Solutions/Legacy%20IOC%20based%20Threat%20Protection/Analytic%20Rules/GalliumIOCs.yaml
Sigma Detection Rule: Solarwinds SUPERNOVA Webshell Access
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-12-17
ATT&CK techniques: T1505.003
Log source: /webserver

Description:
Detects access to SUPERNOVA webshell as described in Guidepoint report

Detection logic:
{
  "selection1": {
    "cs-uri-query|contains|all": [
      "logoimagehandler.ashx",
      "clazz"
    ]
  },
  "selection2": {
    "cs-uri-query|contains": "logoimagehandler.ashx",
    "sc-status": 500
  },
  "condition": "selection1 or selection2"
}

References:
  - https://www.guidepointsecurity.com/supernova-solarwinds-net-webshell-analysis/
  - https://www.anquanke.com/post/id/226029
Sigma Detection Rule: Suspicious VBScript UN2452 Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-05
ATT&CK techniques: T1547.001
Log source: windows/process_creation

Description:
Detects suspicious inline VBScript keywords as used by UNC2452

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "Execute",
      "CreateObject",
      "RegRead",
      "window.close",
      "\\Microsoft\\Windows\\CurrentVersion"
    ]
  },
  "filter": {
    "CommandLine|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run"
  },
  "condition": "selection and not filter"
}

References:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
Sigma Detection Rule: UNC2452 PowerShell Pattern
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-20
ATT&CK techniques: T1059.001, T1047
Log source: windows/process_creation

Description:
Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Detection logic:
{
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "Invoke-WMIMethod win32_process -name create -argumentlist",
      "rundll32 c:\\windows"
    ]
  },
  "selection_cli_2": {
    "CommandLine|contains|all": [
      "wmic /node:",
      "process call create \"rundll32 c:\\windows"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware
  - https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command
Sigma Detection Rule: UNC2452 Process Creation Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-22
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

Detection logic:
{
  "selection_generic_1": {
    "CommandLine|contains": [
      "7z.exe a -v500m -mx9 -r0 -p",
      "7z.exe a -mx9 -r0 -p"
    ],
    "CommandLine|contains|all": [
      ".zip",
      ".txt"
    ]
  },
  "selection_generic_2": {
    "CommandLine|contains": [
      "7z.exe a -v500m -mx9 -r0 -p",
      "7z.exe a -mx9 -r0 -p"
    ],
    "CommandLine|contains|all": [
      ".zip",
      ".log"
    ]
  },
  "selection_generic_3": {
    "ParentCommandLine|contains|all": [
      "wscript.exe",
      ".vbs"
    ],
    "CommandLine|contains|all": [
      "rundll32.exe",
      "C:\\Windows",
      ".dll,Tk_"
    ]
  },
  "selection_generic_4": {
    "ParentImage|endswith": "\\rundll32.exe",
    "ParentCommandLine|contains|all": [
      "C:\\Windows",
      ".dll"
    ],
    "CommandLine|contains": "cmd.exe /C "
  },
  "selection_generic_5": {
    "ParentImage|endswith": "\\rundll32.exe",
    "Image|endswith": "\\dllhost.exe",
    "CommandLine": ""
  },
  "condition": "1 of selection_generic_*"
}

References:
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
Sigma Detection Rule: Leviathan Registry Key Activity
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Aidan Bracher
Date: 2020-07-07
ATT&CK techniques: T1547.001
Log source: windows/registry_event

Description:
Detects registry key used by Leviathan APT in Malaysian focused campaign

Detection logic:
{
  "selection": {
    "TargetObject|contains": "\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ntkd"
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/blog/advanced-techniques-used-in-malaysian-focused-apt-campaign
Sigma Detection Rule: EvilNum APT Golden Chickens Deployment Via OCX Files
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-10
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects Golden Chickens deployment method as used by Evilnum and described in ESET July 2020 report

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "regsvr32",
      "/s",
      "/i",
      "\\AppData\\Roaming\\",
      ".ocx"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/
  - https://app.any.run/tasks/33d37fdf-158d-4930-aa68-813e1d5eb8ba/
Sigma Detection Rule: Greenbug Espionage Group Indicators
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-05-20
ATT&CK techniques: T1059.001, T1105, T1036.005
Log source: windows/process_creation

Description:
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      ":\\ProgramData\\adobe\\Adobe.exe",
      ":\\ProgramData\\oracle\\local.exe",
      "\\revshell.exe",
      "\\infopagesbackup\\ncat.exe",
      ":\\ProgramData\\comms\\comms.exe"
    ]
  },
  "selection_msf": {
    "CommandLine|contains|all": [
      "-ExecutionPolicy Bypass -File",
      "\\msf.ps1"
    ]
  },
  "selection_ncat": {
    "CommandLine|contains|all": [
      "infopagesbackup",
      "\\ncat",
      "-e cmd.exe"
    ]
  },
  "selection_powershell": {
    "CommandLine|contains": [
      "system.Data.SqlClient.SqlDataAdapter($cmd); [void]$da.fill",
      "-nop -w hidden -c $k=new-object",
      "[Net.CredentialCache]::DefaultCredentials;IEX ",
      " -nop -w hidden -c $m=new-object net.webclient;$m",
      "-noninteractive -executionpolicy bypass whoami",
      "-noninteractive -executionpolicy bypass netstat -a"
    ]
  },
  "selection_other": {
    "CommandLine|contains": "L3NlcnZlcj1"
  },
  "condition": "1 of selection_*"
}

References:
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia