deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Service Security Descriptor Tampering Via Sc.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-02-28
ATT&CK techniques: T1574.011
Log source: windows/process_creation

Description:
Detection of sc.exe utility adding a new service with special permission which hides that service.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\sc.exe"
    },
    {
      "OriginalFileName": "sc.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "sdset"
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html
  - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]96828672
  - https://twitter.com/0gtweet/status/[PII_REDACTED]37936386
  - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/
Sigma Detection Rule: Sysmon Configuration Update
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-09
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects updates to Sysmon's configuration. Attackers might update or replace the Sysmon configuration with a bare bone one to avoid monitoring without shutting down the service completely

Detection logic:
{
  "selection_pe": [
    {
      "Image|endswith": [
        "\\Sysmon64.exe",
        "\\Sysmon.exe"
      ]
    },
    {
      "Description": "System activity monitor"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": "-c"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
Sigma Detection Rule: Privilege Escalation via Named Pipe Impersonation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1021
Log source: windows/process_creation

Description:
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.

Detection logic:
{
  "selection_name": [
    {
      "Image|endswith": [
        "\\cmd.exe",
        "\\powershell.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Cmd.Exe",
        "PowerShell.EXE"
      ]
    }
  ],
  "selection_args": {
    "CommandLine|contains|all": [
      "echo",
      ">",
      "\\\\\\\\.\\\\pipe\\\\"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.elastic.co/guide/en/security/current/privilege-escalation-via-named-pipe-impersonation.html
Sigma Detection Rule: SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-16
ATT&CK techniques: T1218, T1216
Log source: windows/process_creation

Description:
Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\SyncAppvPublishingServer.vbs",
      ";"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
Sigma Detection Rule: Renamed PingCastle Binary Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Date: 2024-01-11
ATT&CK techniques: T1059, T1202
Log source: windows/process_creation

Description:
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": [
        "PingCastleReporting.exe",
        "PingCastleCloud.exe",
        "PingCastle.exe"
      ]
    },
    {
      "CommandLine|contains": [
        "--scanner aclcheck",
        "--scanner antivirus",
        "--scanner computerversion",
        "--scanner foreignusers",
        "--scanner laps_bitlocker",
        "--scanner localadmin",
        "--scanner nullsession",
        "--scanner nullsession-trust",
        "--scanner oxidbindings",
        "--scanner remote",
        "--scanner share",
        "--scanner smb",
        "--scanner smb3querynetwork",
        "--scanner spooler",
        "--scanner startup",
        "--scanner zerologon"
      ]
    },
    {
      "CommandLine|contains": "--no-enum-limit"
    },
    {
      "CommandLine|contains|all": [
        "--healthcheck",
        "--level Full"
      ]
    },
    {
      "CommandLine|contains|all": [
        "--healthcheck",
        "--server "
      ]
    }
  ],
  "filter_main_img": {
    "Image|endswith": [
      "\\PingCastleReporting.exe",
      "\\PingCastleCloud.exe",
      "\\PingCastle.exe"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://www.pingcastle.com/documentation/scanner/
Sigma Detection Rule: Potential DLL Sideloading Via DeviceEnroller.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @gott_cyber
Date: 2022-08-29
ATT&CK techniques: T1574.001
Log source: windows/process_creation

Description:
Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll".
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\deviceenroller.exe"
    },
    {
      "OriginalFileName": "deviceenroller.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": "/PhoneDeepLink"
  },
  "condition": "all of selection_*"
}

References:
  - https://mobile.twitter.com/0gtweet/status/[PII_REDACTED]41122561
  - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html
Sigma Detection Rule: Copy .DMP/.DUMP Files From Remote Share Via Cmd.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-27
Log source: windows/process_creation

Description:
Detects usage of the copy builtin cmd command to copy files with the ".dmp"/".dump" extension from a remote share

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\cmd.exe"
    },
    {
      "OriginalFileName": "Cmd.Exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "copy ",
      " \\\\\\\\"
    ],
    "CommandLine|contains": [
      ".dmp",
      ".dump",
      ".hdmp"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://thedfirreport.com/2022/09/26/bumblebee-round-two/
Sigma Detection Rule: Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @neu5ron
Date: 2019-02-07
ATT&CK techniques: T1070, T1542.003
Log source: windows/process_creation

Description:
Detects potential malicious and unauthorized usage of bcdedit.exe

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bcdedit.exe"
    },
    {
      "OriginalFileName": "bcdedit.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "delete",
      "deletevalue",
      "import",
      "safeboot",
      "network"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
  - https://twitter.com/malwrhunterteam/status/[PII_REDACTED]25512712/photo/2
Sigma Detection Rule: Potential CobaltStrike Process Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-07-27
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects potential process patterns related to Cobalt Strike beacon activity

Detection logic:
{
  "selection_generic_1": {
    "CommandLine|endswith": "cmd.exe /C whoami",
    "ParentImage|startswith": "C:\\Temp\\"
  },
  "selection_generic_2": {
    "ParentImage|endswith": [
      "\\runonce.exe",
      "\\dllhost.exe"
    ],
    "CommandLine|contains|all": [
      "cmd.exe /c echo",
      "> \\\\\\\\.\\\\pipe"
    ]
  },
  "selection_conhost_1": {
    "ParentCommandLine|contains|all": [
      "cmd.exe /C echo",
      " > \\\\\\\\.\\\\pipe"
    ],
    "CommandLine|endswith": "conhost.exe 0xffffffff -ForceV1"
  },
  "selection_conhost_2": {
    "ParentCommandLine|endswith": "/C whoami",
    "CommandLine|endswith": "conhost.exe 0xffffffff -ForceV1"
  },
  "condition": "1 of selection_*"
}

References:
  - https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/
  - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/
Sigma Detection Rule: Automated Collection Command Prompt
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-28
ATT&CK techniques: T1119, T1552.001
Log source: windows/process_creation

Description:
Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Detection logic:
{
  "selection_ext": {
    "CommandLine|contains": [
      ".doc",
      ".docx",
      ".xls",
      ".xlsx",
      ".ppt",
      ".pptx",
      ".rtf",
      ".pdf",
      ".txt"
    ]
  },
  "selection_other_dir": {
    "CommandLine|contains|all": [
      "dir ",
      " /b ",
      " /s "
    ]
  },
  "selection_other_findstr": {
    "OriginalFileName": "FINDSTR.EXE",
    "CommandLine|contains": [
      " /e ",
      " /si "
    ]
  },
  "condition": "selection_ext and 1 of selection_other_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Sigma Detection Rule: Process Memory Dump Via Comsvcs.DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Modexp, Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2020-02-18
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\rundll32.exe"
    },
    {
      "OriginalFileName": "RUNDLL32.EXE"
    },
    {
      "CommandLine|contains": "rundll32"
    }
  ],
  "selection_cli_1": {
    "CommandLine|contains|all": [
      "comsvcs",
      "full"
    ],
    "CommandLine|contains": [
      "#-",
      "#+",
      "#24",
      "24 ",
      "MiniDump",
      "#65560"
    ]
  },
  "selection_generic": {
    "CommandLine|contains|all": [
      "24",
      "comsvcs",
      "full"
    ],
    "CommandLine|contains": [
      " #",
      ",#",
      ", #",
      "\"#"
    ]
  },
  "condition": "(selection_img and 1 of selection_cli_*) or selection_generic"
}

References:
  - https://twitter.com/shantanukhande/status/[PII_REDACTED]98388484
  - https://twitter.com/pythonresponder/status/[PII_REDACTED]49630211?s=21
  - https://twitter.com/Hexacorn/status/[PII_REDACTED]95552769
  - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]74050817
Sigma Detection Rule: Suspicious SYSVOL Domain Group Policy Access
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Markus Neis, Jonhnathan Ribeiro, oscd.community
Date: 2018-04-09
ATT&CK techniques: T1552.006
Log source: windows/process_creation

Description:
Detects Access to Domain Group Policies stored in SYSVOL

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\SYSVOL\\",
      "\\policies\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://adsecurity.org/?p=2288
  - https://www.hybrid-analysis.com/sample/f2943f5e45befa52fb12748ca7171d30096e1d4fc3c365561497c618341299d5?environmentId=100
Sigma Detection Rule: Windows Defender Context Menu Removed
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Matt Anderson (Huntress)
Date: 2025-07-09
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the use of reg.exe or PowerShell to delete the Windows Defender context menu handler registry keys.
This action removes the "Scan with Microsoft Defender" option from the right-click menu for files, directories, and drives.
Attackers may use this technique to hinder manual, on-demand scans and reduce the visibility of the security product.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell_ise.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\reg.exe"
      ]
    },
    {
      "OriginalFileName": [
        "powershell_ise.EXE",
        "PowerShell.EXE",
        "pwsh.dll",
        "reg.exe"
      ]
    }
  ],
  "selection_action": {
    "CommandLine|contains": [
      "del",
      "Remove-Item",
      "ri "
    ]
  },
  "selection_reg_path": {
    "CommandLine|contains": "\\shellex\\ContextMenuHandlers\\EPP"
  },
  "condition": "all of selection_*"
}

References:
  - https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
  - https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
  - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/
  - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
Sigma Detection Rule: DLL Loaded via CertOC.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-10-23
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\certoc.exe"
    },
    {
      "OriginalFileName": "CertOC.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|windash": " -LoadDLL "
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/sblmsrsn/status/[PII_REDACTED]03480072?s=20
  - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2
  - https://lolbas-project.github.io/lolbas/Binaries/Certoc/
Sigma Detection Rule: Curl Web Request With Potential Custom User-Agent
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-27
Log source: windows/process_creation

Description:
Detects execution of "curl.exe" with a potential custom "User-Agent". Attackers can leverage this to download or exfiltrate data via "curl" to a domain that only accept specific "User-Agent" strings

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\curl.exe"
    },
    {
      "OriginalFileName": "curl.exe"
    }
  ],
  "selection_header_flag_1": {
    "CommandLine|re": "\\s-H\\s"
  },
  "selection_header_flag_2": {
    "CommandLine|contains": "--header"
  },
  "selection_user_agent": {
    "CommandLine|contains": "User-Agent:"
  },
  "condition": "selection_img and 1 of selection_header_* and selection_user_agent"
}

References:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv
Sigma Detection Rule: AgentExecutor PowerShell Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), memory-shards
Date: 2022-12-24
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument

Detection logic:
{
  "selection_img": [
    {
      "Image": "\\AgentExecutor.exe"
    },
    {
      "OriginalFileName": "AgentExecutor.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -powershell",
      " -remediationScript"
    ]
  },
  "filter_main_intune": {
    "ParentImage|endswith": "\\Microsoft.Management.Services.IntuneWindowsAgent.exe"
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://twitter.com/lefterispan/status/[PII_REDACTED]36514816
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/
  - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
  - https://twitter.com/jseerden/status/[PII_REDACTED]67066373/photo/1
Sigma Detection Rule: Registry Modification Attempt Via VBScript
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-08-13
ATT&CK techniques: T1112, T1059.005
Log source: windows/process_creation

Description:
Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs.
It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell.
Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "CreateObject",
      "Wscript.shell",
      ".RegWrite"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity[PII_REDACTED]182051843-TE00/
  - https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
Sigma Detection Rule: CreateDump Process Dump
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-04
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects uses of the createdump.exe LOLOBIN utility to dump process memory

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\createdump.exe"
    },
    {
      "OriginalFileName": "FX_VER_INTERNALNAME_STR"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " -u ",
      " --full ",
      " -f ",
      " --name ",
      ".dmp "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
  - https://twitter.com/bopin2020/status/[PII_REDACTED]99272960
Sigma Detection Rule: HackTool - Rubeus Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2018-12-19
ATT&CK techniques: T1003, T1558.003, T1550.003
Log source: windows/process_creation

Description:
Detects the execution of the hacktool Rubeus via PE information of command line parameters

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\Rubeus.exe"
    },
    {
      "OriginalFileName": "Rubeus.exe"
    },
    {
      "Description": "Rubeus"
    },
    {
      "CommandLine|contains": [
        "asreproast ",
        "dump /service:krbtgt ",
        "dump /luid:0x",
        "kerberoast ",
        "createnetonly /program:",
        "ptt /ticket:",
        "/impersonateuser:",
        "renew /ticket:",
        "asktgt /user:",
        "harvest /interval:",
        "s4u /user:",
        "s4u /ticket:",
        "hash /password:",
        "golden /aes256:",
        "silver /user:"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus
  - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
  - https://github.com/GhostPack/Rubeus
Sigma Detection Rule: Suspicious Copy From or To System Directory
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)
Date: 2020-07-03
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk.
Often used to move LOLBINs such as 'certutil' or 'desktopimgdownldr' to a different location with a different name in order to bypass detections based on locations.


Detection logic:
{
  "selection_img_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": "copy "
  },
  "selection_img_pwsh": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "CommandLine|contains": [
      "copy-item",
      " copy ",
      "cpi ",
      " cp "
    ]
  },
  "selection_img_other": [
    {
      "Image|endswith": [
        "\\robocopy.exe",
        "\\xcopy.exe"
      ]
    },
    {
      "OriginalFileName": [
        "robocopy.exe",
        "XCOPY.EXE"
      ]
    }
  ],
  "selection_target": {
    "CommandLine|re|i": "\\s['\"]?C:\\\\Windows\\\\(?:System32|SysWOW64|WinSxS)"
  },
  "filter_optional_avira": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains|all": [
      "/c copy",
      "\\Temp\\",
      "\\avira_system_speedup.exe"
    ],
    "CommandLine|contains": [
      "C:\\Program Files\\Avira\\",
      "C:\\Program Files (x86)\\Avira\\"
    ]
  },
  "condition": "1 of selection_img_* and selection_target and not 1 of filter_optional_*"
}

References:
  - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120
  - https://web.archive.org/web/[PII_REDACTED]4337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html
  - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
Sigma Detection Rule: Install New Package Via Winget Local Manifest
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sreeman, Florian Roth (Nextron Systems), frack113
Date: 2020-04-21
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them.
The manifest option enables you to install an application by passing in a YAML file directly to the client.
Winget can be used to download and install exe, msi or msix files later.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\winget.exe"
    },
    {
      "OriginalFileName": "winget.exe"
    }
  ],
  "selection_install_flag": {
    "CommandLine|contains": [
      "install",
      " add "
    ]
  },
  "selection_manifest_flag": {
    "CommandLine|contains": [
      "-m ",
      "--manifest"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
  - https://lolbas-project.github.io/lolbas/Binaries/Winget/
  - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget