deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential SSH Tunnel Persistence Install Using A Scheduled Task
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Rory Duncan
Date: 2025-07-14
ATT&CK techniques: T1053.005
Log source: windows/process_creation

Description:
Detects the creation of new scheduled tasks via commandline, using Schtasks.exe. This rule detects tasks creating that call OpenSSH, which may indicate the creation of reverse SSH tunnel to the attacker's server.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\schtasks.exe"
    },
    {
      "OriginalFileName": "schtasks.exe"
    }
  ],
  "selection_cli_sshd": {
    "CommandLine|contains|all": [
      " /create ",
      "sshd.exe",
      "-f"
    ]
  },
  "selection_cli_ssh": {
    "CommandLine|contains|all": [
      " /create ",
      "ssh.exe",
      "-i"
    ]
  },
  "condition": "selection_img and 1 of selection_cli_*"
}

References:
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection
Sigma Detection Rule: Windows Recall Feature Enabled Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sajid Nawaz Khan
Date: 2024-06-02
ATT&CK techniques: T1113
Log source: windows/process_creation

Description:
Detects the enabling of the Windows Recall feature via registry manipulation.
Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_value": {
    "CommandLine|contains|all": [
      "Microsoft\\Windows\\WindowsAI",
      "DisableAIDataAnalysis"
    ]
  },
  "selection_action_add": {
    "CommandLine|contains": [
      "add",
      "0"
    ]
  },
  "selection_action_delete": {
    "CommandLine|contains": "delete"
  },
  "condition": "selection_img and selection_value and 1 of selection_action_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/client-management/manage-recall
  - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
Sigma Detection Rule: MMC20 Lateral Movement
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @2xxeformyshirt (Security Risk Advisors) - rule; Teymur Kheirkhabarov (idea)
Date: 2020-03-04
ATT&CK techniques: T1021.003
Log source: windows/process_creation

Description:
Detects MMC20.Application Lateral Movement; specifically looks for the spawning of the parent MMC.exe with a command line of "-Embedding" as a child of svchost.exe

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\svchost.exe",
    "Image|endswith": "\\mmc.exe",
    "CommandLine|contains": "-Embedding"
  },
  "condition": "selection"
}

References:
  - https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/
  - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view?usp=sharing
Sigma Detection Rule: Potential PowerShell Obfuscation Via WCHAR/CHAR
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-07-09
ATT&CK techniques: T1059.001, T1027
Log source: windows/process_creation

Description:
Detects suspicious encoded character syntax often used for defense evasion

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "[char]0x",
      "(WCHAR)0x"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/0gtweet/status/[PII_REDACTED]93482496
Sigma Detection Rule: Copy From VolumeShadowCopy Via Cmd.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects the execution of the builtin "copy" command that targets a shadow copy (sometimes used to copy registry hives that are in use)

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "copy ",
      "\\\\\\\\\\?\\\\GLOBALROOT\\\\Device\\\\HarddiskVolumeShadowCopy"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/vxunderground/status/[PII_REDACTED]60002816?s=20
  - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection
  - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/
Sigma Detection Rule: Malicious Windows Script Components File Execution by TAEF Detection
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Agro (@agro_sev) oscd.community
Date: 2020-10-13
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces
Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe


Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\te.exe"
    },
    {
      "ParentImage|endswith": "\\te.exe"
    },
    {
      "OriginalFileName": "\\te.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/
  - https://twitter.com/pabraeken/status/[PII_REDACTED]40992768
  - https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/
Sigma Detection Rule: UAC Bypass Using PkgMgr and DISM
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1548.002
Log source: windows/process_creation

Description:
Detects the pattern of UAC Bypass using pkgmgr.exe and dism.exe (UACMe 23)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\pkgmgr.exe",
    "Image|endswith": "\\dism.exe",
    "IntegrityLevel": [
      "High",
      "System",
      "S-1-16-16384",
      "S-1-16-12288"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/hfiref0x/UACME
Sigma Detection Rule: Suspicious CustomShellHost Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-19
ATT&CK techniques: T1216
Log source: windows/process_creation

Description:
Detects the execution of CustomShellHost.exe where the child isn't located in 'C:\Windows\explorer.exe'. CustomShellHost is a known LOLBin that can be abused by attackers for defense evasion techniques.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\CustomShellHost.exe"
  },
  "filter_main_explorer": {
    "Image": "C:\\Windows\\explorer.exe"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/LOLBAS-Project/LOLBAS/pull/180
  - https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/
Sigma Detection Rule: Suspicious CodePage Switch Via CHCP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
Date: 2019-10-14
ATT&CK techniques: T1036
Log source: windows/process_creation

Description:
Detects a code page switch in command line or batch scripts to a rare language

Detection logic:
{
  "selection": {
    "Image|endswith": "\\chcp.com",
    "CommandLine|endswith": [
      " 936",
      " 1258"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows/win32/intl/code-page-identifiers
  - https://twitter.com/cglyer/status/[PII_REDACTED]52248325
Sigma Detection Rule: File Download Via Bitsadmin To A Suspicious Target Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1197, T1036.003, T1105
Log source: windows/process_creation

Description:
Detects usage of bitsadmin downloading a file to a suspicious target folder

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\bitsadmin.exe"
    },
    {
      "OriginalFileName": "bitsadmin.exe"
    }
  ],
  "selection_flags": {
    "CommandLine|contains": [
      " /transfer ",
      " /create ",
      " /addfile "
    ]
  },
  "selection_folder": {
    "CommandLine|contains": [
      ":\\Perflogs",
      ":\\ProgramData\\",
      ":\\Temp\\",
      ":\\Users\\Public\\",
      ":\\Windows\\",
      "\\$Recycle.Bin\\",
      "\\AppData\\Local\\",
      "\\AppData\\Roaming\\",
      "\\Contacts\\",
      "\\Desktop\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\inetpub\\wwwroot\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\Start Menu\\Programs\\Startup\\",
      "\\Users\\Default\\",
      "\\Videos\\",
      "%ProgramData%",
      "%public%",
      "%temp%",
      "%tmp%"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin
  - https://isc.sans.edu/diary/22264
  - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/
  - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/
Sigma Detection Rule: Audit Policy Tampering Via NT Resource Kit Auditpol
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-18
ATT&CK techniques: T1685.001
Log source: windows/process_creation

Description:
Threat actors can use an older version of the auditpol binary available inside the NT resource kit to change audit policy configuration to impair detection capability.
This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.


Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "/logon:none",
      "/system:none",
      "/sam:none",
      "/privilege:none",
      "/object:none",
      "/process:none",
      "/policy:none"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Windows%202000%20Resource%20Kit%20Tools/AuditPol
Sigma Detection Rule: Unsigned AppX Installation Attempt Using Add-AppxPackage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-31
Log source: windows/process_creation

Description:
Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cmdlet": {
    "CommandLine|contains": [
      "Add-AppPackage ",
      "Add-AppxPackage "
    ]
  },
  "selection_flag": {
    "CommandLine|contains": " -AllowUnsigned"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
  - https://twitter.com/WindowsDocs/status/[PII_REDACTED]80325122
Sigma Detection Rule: Suspicious Spool Service Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Justin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
Date: 2021-07-11
ATT&CK techniques: T1203, T1068
Log source: windows/process_creation

Description:
Detects suspicious print spool service (spoolsv.exe) child processes.

Detection logic:
{
  "spoolsv": {
    "ParentImage|endswith": "\\spoolsv.exe",
    "IntegrityLevel": [
      "System",
      "S-1-16-16384"
    ]
  },
  "suspicious_unrestricted": {
    "Image|endswith": [
      "\\gpupdate.exe",
      "\\whoami.exe",
      "\\nltest.exe",
      "\\taskkill.exe",
      "\\wmic.exe",
      "\\taskmgr.exe",
      "\\sc.exe",
      "\\findstr.exe",
      "\\curl.exe",
      "\\wget.exe",
      "\\certutil.exe",
      "\\bitsadmin.exe",
      "\\accesschk.exe",
      "\\wevtutil.exe",
      "\\bcdedit.exe",
      "\\fsutil.exe",
      "\\cipher.exe",
      "\\schtasks.exe",
      "\\write.exe",
      "\\wuauclt.exe",
      "\\systeminfo.exe",
      "\\reg.exe",
      "\\query.exe"
    ]
  },
  "suspicious_net": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ]
  },
  "suspicious_net_filter": {
    "CommandLine|contains": "start"
  },
  "suspicious_cmd": {
    "Image|endswith": "\\cmd.exe"
  },
  "suspicious_cmd_filter": {
    "CommandLine|contains": [
      ".spl",
      "route add",
      "program files"
    ]
  },
  "suspicious_netsh": {
    "Image|endswith": "\\netsh.exe"
  },
  "suspicious_netsh_filter": {
    "CommandLine|contains": [
      "add portopening",
      "rule name"
    ]
  },
  "suspicious_powershell": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\pwsh.exe"
    ]
  },
  "suspicious_powershell_filter": {
    "CommandLine|contains": ".spl"
  },
  "suspicious_rundll32_img": [
    {
      "Image|endswith": "\\rundll

References:
  - https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/efa17a600b43c897b4b7463cc8541daa1987eeb4/Exploits/Print%20Spooler%20RCE/Suspicious%20Spoolsv%20Child%20Process.md
Sigma Detection Rule: HackTool - SysmonEOP Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-12-04
ATT&CK techniques: T1068
Log source: windows/process_creation

Description:
Detects the execution of the PoC that can be used to exploit Sysmon CVE-2022-41120

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\SysmonEOP.exe"
  },
  "selection_hash": {
    "Hashes|contains": [
      "IMPHASH=22F4089EB8ABA31E1BB162C6D9BF72E5",
      "IMPHASH=5123FA4C4384D431CD0D893EEB49BBEC"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/Wh04m1001/SysmonEoP
Sigma Detection Rule: Sysinternals PsService Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-16
ATT&CK techniques: T1543.003
Log source: windows/process_creation

Description:
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": "psservice.exe"
    },
    {
      "Image|endswith": [
        "\\PsService.exe",
        "\\PsService64.exe"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice
Sigma Detection Rule: Hiding User Account Via SpecialAccounts Registry Key - CommandLine
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @Kostastsale, TheDFIRReport
Date: 2022-05-14
ATT&CK techniques: T1564.002
Log source: windows/process_creation

Description:
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains|all": [
      "\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList",
      "add",
      "/v",
      "/d 0"
    ]
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
  - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
  - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Sigma Detection Rule: PUA - PingCastle Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2024-01-11
ATT&CK techniques: T1595
Log source: windows/process_creation

Description:
Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level.

Detection logic:
{
  "selection": [
    {
      "Hashes|contains": [
        "MD5=f741f25ac909ee434e50812d436c73ff",
        "MD5=d40acbfc29ee24388262e3d8be16f622",
        "MD5=01bb2c16fadb992fa66228cd02d45c60",
        "MD5=9e1b18e62e42b5444fc55b51e640355b",
        "MD5=b7f8fe33ac471b074ca9e630ba0c7e79",
        "MD5=324579d717c9b9b8e71d0269d13f811f",
        "MD5=63257a1ddaf83cfa43fe24a3bc06c207",
        "MD5=049e85963826b059c9bac273bb9c82ab",
        "MD5=ecb98b7b4d4427eb[PII_REDACTED]ff4cb2",
        "MD5=faf87749ac790ec3a10dd069d10f9d63",
        "MD5=f296dba5d21ad18e6990b1992aea8f83",
        "MD5=93ba94355e794b6c6f98204cf39f7a11",
        "MD5=a258ef593ac63155523a461ecc73bdba",
        "MD5=97000eb5d1653f1140ee3f47186463c4",
        "MD5=95eb317fbbe14a82bd9fdf31c48b8d93",
        "MD5=32fe9f0d2630ac40ea29023920f20f49",
        "MD5=a05930dde939cfd02677fc18bb2b7df5",
        "MD5=124283924e86933ff9054a549d3a268b",
        "MD5=ceda6909b8573fdeb0351c[PII_REDACTED]",
        "MD5=60ce120040f2cd311c810ae6f6bbc182",
        "MD5=2f10cdc5b09100a260703a28eadd0ceb",
        "MD5=011d967028e797a4c16d547f7ba1463f",
        "MD5=2da9152c0970500c697c1c9b4a9e0360",
        "MD5=b5ba72034b8f44d431f55275bace9f8b",
        "MD5=d6ed9101df0f24e27ff92ddab42dacca",
        "MD5=3ed3cdb6d12aa1ac562ad185cdbf2d1d",
        "MD5=5e083cd0143ae95a6cb79b68c07ca573",
        "MD5=28caff93748cb84be70486e79f04c2df",
        "MD5=9d4f12c30f9b500f896efd1800e4dd11",
        "MD5=4586f7dd14271ad65a5fb696b393f4c0",
        

References:
  - https://github.com/vletoux/pingcastle
  - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/
  - https://github.com/fengjixuchui/Start-ADEnum/blob/e237a739db98b6104427d[PII_REDACTED]07da36a58/Functions/Start-ADEnum.ps1#L450
  - https://github.com/lkys37en/Start-ADEnum/blob/5b42c54215fe5f57fc59abc52c20487d15764005/Functions/Start-ADEnum.ps1#L680
  - https://github.com/projectHULK/AD_Recon/blob/dde2daba9b3393a9388cbebda87068972cc0bd3b/SecurityAssessment.ps1#L2699
Sigma Detection Rule: Mshtml.DLL RunHTMLApplication Suspicious Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems),  Florian Roth (Nextron Systems), Josh Nickels, frack113, Zaw Min Htun (ZETA)
Date: 2022-08-14
Log source: windows/process_creation

Description:
Detects execution of commands that leverage the "mshtml.dll" RunHTMLApplication export to run arbitrary code via different protocol handlers (vbscript, javascript, file, http...)


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "\\..\\",
      "mshtml"
    ],
    "CommandLine|contains": [
      "#135",
      "RunHTMLApplication"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/n1nj4sec/status/[PII_REDACTED]81277959
  - https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt
  - http://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_DETECTION_BYPASS.txt
Sigma Detection Rule: Perl Inline Command Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-02
ATT&CK techniques: T1059
Log source: windows/process_creation

Description:
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\perl.exe"
    },
    {
      "OriginalFileName": "perl.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": " -e"
  },
  "condition": "all of selection_*"
}

References:
  - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
  - https://www.revshells.com/
Sigma Detection Rule: Mstsc.EXE Execution From Uncommon Parent
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-04-18
Log source: windows/process_creation

Description:
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\brave.exe",
      "\\CCleanerBrowser.exe",
      "\\chrome.exe",
      "\\chromium.exe",
      "\\firefox.exe",
      "\\iexplore.exe",
      "\\microsoftedge.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe",
      "\\whale.exe",
      "\\outlook.exe"
    ]
  },
  "selection_img": [
    {
      "Image|endswith": "\\mstsc.exe"
    },
    {
      "OriginalFileName": "mstsc.exe"
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
  - https://web.archive.org/web/[PII_REDACTED]4748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
Sigma Detection Rule: Suspicious IIS Module Registration
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Microsoft (idea)
Date: 2022-08-04
ATT&CK techniques: T1505.004
Log source: windows/process_creation

Description:
Detects a suspicious IIS module registration as described in Microsoft threat report on IIS backdoors

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\w3wp.exe"
  },
  "selection_cli_1": {
    "CommandLine|contains": "appcmd.exe add module"
  },
  "selection_cli_2": {
    "CommandLine|contains": " system.enterpriseservices.internal.publish",
    "Image|endswith": "\\powershell.exe"
  },
  "selection_cli_3": {
    "CommandLine|contains|all": [
      "gacutil",
      " /I"
    ]
  },
  "condition": "selection_parent and 1 of selection_cli_*"
}

References:
  - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/
Sigma Detection Rule: Suspicious Query of MachineGUID
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1082
Log source: windows/process_creation

Description:
Use of reg to get MachineGuid information

Detection logic:
{
  "selection": {
    "Image|endswith": "\\reg.exe",
    "CommandLine|contains|all": [
      "SOFTWARE\\Microsoft\\Cryptography",
      "/v ",
      "MachineGuid"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-8---windows-machineguid-discovery
Sigma Detection Rule: Suspicious Plink Port Forwarding
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-01-19
ATT&CK techniques: T1572, T1021.001
Log source: windows/process_creation

Description:
Detects suspicious Plink tunnel port forwarding to a local port

Detection logic:
{
  "selection": {
    "Description": "Command-line SSH, Telnet, and Rlogin client",
    "CommandLine|contains": " -R "
  },
  "condition": "selection"
}

References:
  - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
  - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d