deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Cmd.EXE Missing Space Characters Execution Anomaly
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-23
ATT&CK techniques: T1059.001
Log source: windows/process_creation

Description:
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.
This could be a sign of obfuscation of a fat finger problem (typo by the developer).


Detection logic:
{
  "selection1": {
    "CommandLine|contains": [
      "cmd.exe/c",
      "\\cmd/c",
      "\"cmd/c",
      "cmd.exe/k",
      "\\cmd/k",
      "\"cmd/k",
      "cmd.exe/r",
      "\\cmd/r",
      "\"cmd/r"
    ]
  },
  "selection2": {
    "CommandLine|contains": [
      "/cwhoami",
      "/cpowershell",
      "/cschtasks",
      "/cbitsadmin",
      "/ccertutil",
      "/kwhoami",
      "/kpowershell",
      "/kschtasks",
      "/kbitsadmin",
      "/kcertutil"
    ]
  },
  "selection3": {
    "CommandLine|contains": [
      "cmd.exe /c",
      "cmd /c",
      "cmd.exe /k",
      "cmd /k",
      "cmd.exe /r",
      "cmd /r"
    ]
  },
  "filter_generic": {
    "CommandLine|contains": [
      "cmd.exe /c ",
      "cmd /c ",
      "cmd.exe /k ",
      "cmd /k ",
      "cmd.exe /r ",
      "cmd /r "
    ]
  },
  "filter_fp": [
    {
      "CommandLine|contains": "AppData\\Local\\Programs\\Microsoft VS Code\\resources\\app\\node_modules"
    },
    {
      "CommandLine|endswith": "cmd.exe/c ."
    },
    {
      "CommandLine": "cmd.exe /c"
    }
  ],
  "condition": "1 of selection* and not 1 of filter_*"
}

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]52678912
  - https://ss64.com/nt/cmd.html
Sigma Detection Rule: Suspicious Child Process Of BgInfo.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-08-16
ATT&CK techniques: T1059.005, T1218, T1202
Log source: windows/process_creation

Description:
Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\bginfo.exe",
      "\\bginfo64.exe"
    ]
  },
  "selection_child": [
    {
      "Image|endswith": [
        "\\calc.exe",
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\notepad.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\wscript.exe"
      ]
    },
    {
      "Image|contains": [
        "\\AppData\\Local\\",
        "\\AppData\\Roaming\\",
        ":\\Users\\Public\\",
        ":\\Temp\\",
        ":\\Windows\\Temp\\",
        ":\\PerfLogs\\"
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/
  - https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/
Sigma Detection Rule: Binary Proxy Execution Via Dotnet-Trace.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jimmy Bayne (@bohops)
Date: 2024-01-02
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects commandline arguments for executing a child process via dotnet-trace.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dotnet-trace.exe"
    },
    {
      "OriginalFileName": "dotnet-trace.dll"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "-- ",
      "collect"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/bohops/status/[PII_REDACTED]98037480
Sigma Detection Rule: HackTool - PCHunter Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
Date: 2022-10-10
ATT&CK techniques: T1082, T1057, T1012, T1083, T1007
Log source: windows/process_creation

Description:
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff

Detection logic:
{
  "selection_image": {
    "Image|endswith": [
      "\\PCHunter64.exe",
      "\\PCHunter32.exe"
    ]
  },
  "selection_pe": [
    {
      "OriginalFileName": "PCHunter.exe"
    },
    {
      "Description": "Epoolsoft Windows Information View Tools"
    }
  ],
  "selection_hashes": {
    "Hashes|contains": [
      "SHA1=5F1CBC3D99558307BC1250D084FA[PII_REDACTED]25",
      "MD5=987B65CD9B9F4E9A1AFD8F8B48CF64A7",
      "SHA256=2B214BDDAAB130C274DE6204AF6DBA5AEEC7433DA99AA950022FA306421A6D32",
      "IMPHASH=444D210CEA1FF8112F256A4997EED7FF",
      "SHA1=3FB89787CB97D902780DA080545584D97FB1C2EB",
      "MD5=228DD0C2E6287547E26FFBD973A40F14",
      "SHA256=55F041BF4E78E9BFA6D4EE68BE40E496CE3A1353E1CA[PII_REDACTED]E19802522C",
      "IMPHASH=0479F44DF47CFA2EF1CCC4416A538663"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]5125/http://www.xuetr.com/
  - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/
  - https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
Sigma Detection Rule: Windows Defender Definition Files Removed
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-07-07
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Adversaries may disable security tools to avoid possible detection of their tools and activities by removing Windows Defender Definition Files

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\MpCmdRun.exe"
    },
    {
      "OriginalFileName": "MpCmdRun.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -RemoveDefinitions",
      " -All"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/
Sigma Detection Rule: Start Windows Service Via Net.EXE
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1569.002
Log source: windows/process_creation

Description:
Detects the usage of the "net.exe" command to start a service using the "start" flag

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\net.exe",
        "\\net1.exe"
      ]
    },
    {
      "OriginalFileName": [
        "net.exe",
        "net1.exe"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " start "
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.002/T1569.002.md
Sigma Detection Rule: HackTool - TruffleSnout Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-08-20
ATT&CK techniques: T1482
Log source: windows/process_creation

Description:
Detects the use of TruffleSnout.exe an iterative AD discovery toolkit for offensive operators, situational awareness and targeted low noise enumeration.

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "TruffleSnout.exe"
    },
    {
      "Image|endswith": "\\TruffleSnout.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1482/T1482.md
  - https://github.com/dsnezhkov/TruffleSnout
  - https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
Sigma Detection Rule: Suspicious DLL Loaded via CertOC.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-15
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects when a user installs certificates by using CertOC.exe to load the target DLL file.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certoc.exe"
    },
    {
      "OriginalFileName": "CertOC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -LoadDLL "
  },
  "selection_paths": {
    "CommandLine|contains": [
      "\\Appdata\\Local\\Temp\\",
      "\\Desktop\\",
      "\\Downloads\\",
      "\\Users\\Public\\",
      "C:\\Windows\\Tasks\\",
      "C:\\Windows\\Temp\\"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/sblmsrsn/status/[PII_REDACTED]03480072?s=20
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
Sigma Detection Rule: Suspicious New Service Creation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-14
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths

Detection logic:
{
  "selection_sc": {
    "Image|endswith": "\\sc.exe",
    "CommandLine|contains|all": [
      "create",
      "binPath="
    ]
  },
  "selection_posh": {
    "CommandLine|contains|all": [
      "New-Service",
      "-BinaryPathName"
    ]
  },
  "susp_binpath": {
    "CommandLine|contains": [
      "powershell",
      "mshta",
      "wscript",
      "cscript",
      "svchost",
      "dllhost",
      "cmd ",
      "cmd.exe /c",
      "cmd.exe /k",
      "cmd.exe /r",
      "rundll32",
      "C:\\Users\\Public",
      "\\Downloads\\",
      "\\Desktop\\",
      "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\",
      "C:\\Windows\\TEMP\\",
      "\\AppData\\Local\\Temp"
    ]
  },
  "condition": "1 of selection* and susp_binpath"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md
  - https://web.archive.org/web/[PII_REDACTED]4337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
Sigma Detection Rule: PUA - NirCmd Execution As LOCAL SYSTEM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-24
ATT&CK techniques: T1569.002
Log source: windows/process_creation

Description:
Detects the use of NirCmd tool for command execution as SYSTEM user

Detection logic:
{
  "selection": {
    "CommandLine|contains": " runassystem "
  },
  "condition": "selection"
}

References:
  - https://www.nirsoft.net/utils/nircmd.html
  - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/
  - https://www.nirsoft.net/utils/nircmd2.html#using
Sigma Detection Rule: HackTool - SharpDPAPI Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-26
ATT&CK techniques: T1134.001, T1134.003
Log source: windows/process_creation

Description:
Detects the execution of the SharpDPAPI tool based on CommandLine flags and PE metadata.
SharpDPAPI is a C# port of some DPAPI functionality from the Mimikatz project.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\SharpDPAPI.exe"
    },
    {
      "OriginalFileName": "SharpDPAPI.exe"
    }
  ],
  "selection_other_cli": {
    "CommandLine|contains": [
      " backupkey ",
      " blob ",
      " certificates ",
      " credentials ",
      " keepass ",
      " masterkeys ",
      " rdg ",
      " vaults "
    ]
  },
  "selection_other_options_guid": {
    "CommandLine|contains|all": [
      " {",
      "}:"
    ]
  },
  "selection_other_options_flags": {
    "CommandLine|contains": [
      " /file:",
      " /machine",
      " /mkfile:",
      " /password:",
      " /pvk:",
      " /server:",
      " /target:",
      " /unprotect"
    ]
  },
  "condition": "selection_img or (selection_other_cli and 1 of selection_other_options_*)"
}

References:
  - https://github.com/GhostPack/SharpDPAPI
Sigma Detection Rule: VMToolsd Suspicious Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: bohops, Bhabesh Raj
Date: 2021-10-08
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\vmtoolsd.exe"
  },
  "selection_img": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\cscript.exe",
        "\\mshta.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\wscript.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "cscript.exe",
        "MSHTA.EXE",
        "PowerShell.EXE",
        "pwsh.dll",
        "REGSVR32.EXE",
        "RUNDLL32.EXE",
        "wscript.exe"
      ]
    }
  ],
  "filter_main_vmwaretools_script": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": [
      "\\VMware\\VMware Tools\\poweron-vm-default.bat",
      "\\VMware\\VMware Tools\\poweroff-vm-default.bat",
      "\\VMware\\VMware Tools\\resume-vm-default.bat",
      "\\VMware\\VMware Tools\\suspend-vm-default.bat"
    ]
  },
  "filter_main_empty": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine": ""
  },
  "filter_main_null": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine": null
  },
  "condition": "all of selection* and not 1 of filter_main_*"
}

References:
  - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/
  - https://user-images.githubusercontent.com/61026070/136518004-b68cce7d-f9b8-4e9a-9b7b-53b1568a9a94.png
  - https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/tools.conf
Sigma Detection Rule: Suspicious WmiPrvSE Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Vadim Khrykov (ThreatIntel), Cyb3rEng, Florian Roth (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1047, T1204.002, T1218.010
Log source: windows/process_creation

Description:
Detects suspicious and uncommon child processes of WmiPrvSE

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\wbem\\WmiPrvSE.exe"
  },
  "selection_children_1": {
    "Image|endswith": [
      "\\certutil.exe",
      "\\cscript.exe",
      "\\mshta.exe",
      "\\msiexec.exe",
      "\\regsvr32.exe",
      "\\rundll32.exe",
      "\\verclsid.exe",
      "\\wscript.exe"
    ]
  },
  "selection_children_2": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": [
      "cscript",
      "mshta",
      "powershell",
      "pwsh",
      "regsvr32",
      "rundll32",
      "wscript"
    ]
  },
  "filter_main_werfault": {
    "Image|endswith": "\\WerFault.exe"
  },
  "filter_main_wmiprvse": {
    "Image|endswith": "\\WmiPrvSE.exe"
  },
  "filter_main_msiexec": {
    "Image|endswith": "\\msiexec.exe",
    "CommandLine|contains": "/i "
  },
  "condition": "selection_parent and 1 of selection_children_* and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
  - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/
  - https://twitter.com/ForensicITGuy/status/[PII_REDACTED]20309760
Sigma Detection Rule: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonhnathan Ribeiro, oscd.community
Date: 2020-10-16
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable.

Detection logic:
{
  "selection_sc": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_sdset": {
    "CommandLine|contains|all": [
      "sdset",
      "D;"
    ]
  },
  "selection_trustee": {
    "CommandLine|contains": [
      ";IU",
      ";SU",
      ";BA",
      ";SY",
      ";WD"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
  - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings
Sigma Detection Rule: Suspicious Msbuild Execution By Uncommon Parent Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-11-17
Log source: windows/process_creation

Description:
Detects suspicious execution of 'Msbuild.exe' by a uncommon parent process

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\MSBuild.exe"
    },
    {
      "OriginalFileName": "MSBuild.exe"
    }
  ],
  "filter_parent": {
    "ParentImage|endswith": [
      "\\devenv.exe",
      "\\cmd.exe",
      "\\msbuild.exe",
      "\\python.exe",
      "\\explorer.exe",
      "\\nuget.exe"
    ]
  },
  "condition": "selection and not filter_parent"
}

References:
  - https://app.any.run/tasks/abdf586e-df0c-4d39-89a7-06bf24913401/
  - https://www.echotrail.io/insights/search/msbuild.exe
Sigma Detection Rule: Finger.EXE Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), omkar72, oscd.community
Date: 2021-02-24
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects execution of the "finger.exe" utility.
Finger.EXE or "TCPIP Finger Command" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon.
Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of "finger.exe" can be considered "suspicious" and worth investigating.


Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "finger.exe"
    },
    {
      "Image|endswith": "\\finger.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://twitter.com/bigmacjpg/status/[PII_REDACTED]63011328?s=12
  - https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/
  - http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt
Sigma Detection Rule: Use NTFS Short Name in Image
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-06
ATT&CK techniques: T1564.004
Log source: windows/process_creation

Description:
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection

Detection logic:
{
  "selection": {
    "Image|contains": [
      "~1.bat",
      "~1.dll",
      "~1.exe",
      "~1.hta",
      "~1.js",
      "~1.msi",
      "~1.ps1",
      "~1.tmp",
      "~1.vbe",
      "~1.vbs",
      "~2.bat",
      "~2.dll",
      "~2.exe",
      "~2.hta",
      "~2.js",
      "~2.msi",
      "~2.ps1",
      "~2.tmp",
      "~2.vbe",
      "~2.vbs"
    ]
  },
  "filter_main_generic_parent": {
    "ParentImage": "C:\\Windows\\explorer.exe"
  },
  "filter_optional_webex": {
    "ParentImage|endswith": "\\WebEx\\WebexHost.exe"
  },
  "filter_optional_thor": {
    "ParentImage|endswith": "\\thor\\thor64.exe"
  },
  "filter_optional_winzip": {
    "Image": "C:\\PROGRA~1\\WinZip\\WZPREL~1.EXE"
  },
  "filter_optional_vcred": {
    "Image|endswith": "\\VCREDI~1.EXE"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
  - https://twitter.com/jonasLyk/status/[PII_REDACTED]02921984
Sigma Detection Rule: PUA - SoftPerfect Netscan Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @d4ns4n_ (Wuerth-Phoenix)
Date: 2024-04-25
ATT&CK techniques: T1046
Log source: windows/process_creation

Description:
Detects usage of SoftPerfect's "netscan.exe". An application for scanning networks.
It is actively used in-the-wild by threat actors to inspect and understand the network architecture of a victim.


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\netscan.exe"
    },
    {
      "Product": "Network Scanner"
    },
    {
      "Description": "Application for scanning networks"
    }
  ],
  "condition": "selection"
}

References:
  - https://www.protect.airbus.com/blog/uncovering-cyber-intruders-netscan/
  - https://secjoes-reports.s3.eu-central-1.amazonaws.com/Sockbot%2Bin%2BGoLand.pdf
  - https://www.sentinelone.com/labs/black-basta-ransomware-attacks-deploy-custom-edr-evasion-tools-tied-to-fin7-threat-actor/
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/yanluowang-ransomware-attacks-continue
  - https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/
Sigma Detection Rule: File Download From IP Based URL Via CertOC.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-10-18
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects when a user downloads a file from an IP based URL using CertOC.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certoc.exe"
    },
    {
      "OriginalFileName": "CertOC.exe"
    }
  ],
  "selection_ip": {
    "CommandLine|re": "://[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}"
  },
  "selection_cli": {
    "CommandLine|contains": "-GetCACAPS"
  },
  "condition": "all of selection*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
Sigma Detection Rule: Remote Access Tool - Anydesk Execution From Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-05-20
ATT&CK techniques: T1219.002
Log source: windows/process_creation

Description:
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)


Detection logic:
{
  "selection": [
    {
      "Image|endswith": [
        "\\AnyDesk.exe",
        "\\AnyDeskMSI.exe"
      ]
    },
    {
      "Description": "AnyDesk"
    },
    {
      "Product": "AnyDesk"
    },
    {
      "Company": "AnyDesk Software GmbH"
    }
  ],
  "filter": {
    "Image|contains": [
      "\\AppData\\",
      "Program Files (x86)\\AnyDesk",
      "Program Files\\AnyDesk"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/