deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Discovery of a System Time
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community
Date: 2019-10-24
ATT&CK techniques: T1124
Log source: windows/process_creation

Description:
Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system.

Detection logic:
{
  "selection_time": {
    "Image|endswith": [
      "\\net.exe",
      "\\net1.exe"
    ],
    "CommandLine|contains": "time"
  },
  "selection_w32tm": {
    "Image|endswith": "\\w32tm.exe",
    "CommandLine|contains": "tz"
  },
  "condition": "1 of selection_*"
}

References:
  - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md
Sigma Detection Rule: Python One-Liners with Base64 Decoding
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Hugh Ryan (HueCodes), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-03-09
ATT&CK techniques: T1059.006, T1027.010
Log source: windows/process_creation

Description:
Detects Python one-liners that use base64 decoding functions in command line executions.
Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.


Detection logic:
{
  "selection_img": [
    {
      "Image|contains": "\\python"
    },
    {
      "OriginalFileName|contains": "python"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "import",
      "base64",
      " -c"
    ],
    "CommandLine|contains": [
      ".decode",
      "b16decode",
      "b32decode",
      "b32hexdecode",
      "b64decode",
      "b85decode",
      "z85decode"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://docs.python.org/3/library/base64.html
  - https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior
  - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
Sigma Detection Rule: HackTool - Jlaive In-Memory Assembly Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jose Luis Sanchez Martinez (@Joseliyo_Jstnk)
Date: 2022-05-24
ATT&CK techniques: T1059.003
Log source: windows/process_creation

Description:
Detects the use of Jlaive to execute assemblies in a copied PowerShell

Detection logic:
{
  "parent_selection": {
    "ParentImage|endswith": "\\cmd.exe",
    "ParentCommandLine|endswith": ".bat"
  },
  "selection1": {
    "Image|endswith": "\\xcopy.exe",
    "CommandLine|contains|all": [
      "powershell.exe",
      ".bat.exe"
    ]
  },
  "selection2": {
    "Image|endswith": "\\xcopy.exe",
    "CommandLine|contains|all": [
      "pwsh.exe",
      ".bat.exe"
    ]
  },
  "selection3": {
    "Image|endswith": "\\attrib.exe",
    "CommandLine|contains|all": [
      "+s",
      "+h",
      ".bat.exe"
    ]
  },
  "condition": "parent_selection and (1 of selection*)"
}

References:
  - https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
  - https://web.archive.org/web/[PII_REDACTED]3704/https://github.com/ch2sh/Jlaive
Sigma Detection Rule: PUA - DefenderCheck Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-08-30
ATT&CK techniques: T1027.005
Log source: windows/process_creation

Description:
Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\DefenderCheck.exe"
    },
    {
      "Description": "DefenderCheck"
    }
  ],
  "condition": "selection"
}

References:
  - https://github.com/matterpreter/DefenderCheck
Sigma Detection Rule: File Download Using Notepad++ GUP Utility
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-10
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\GUP.exe"
    },
    {
      "OriginalFileName": "gup.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      " -unzipTo ",
      "http"
    ]
  },
  "filter": {
    "ParentImage|endswith": "\\notepad++.exe"
  },
  "condition": "all of selection* and not filter"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]63179776
Sigma Detection Rule: Potentially Suspicious Office Document Executed From Trusted Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-06-21
ATT&CK techniques: T1202
Log source: windows/process_creation

Description:
Detects the execution of an Office application that points to a document that is located in a trusted location. Attackers often used this to avoid macro security and execute their malicious code.

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\explorer.exe",
      "\\dopus.exe"
    ]
  },
  "selection_img": [
    {
      "Image|endswith": [
        "\\EXCEL.EXE",
        "\\POWERPNT.EXE",
        "\\WINWORD.exe"
      ]
    },
    {
      "OriginalFileName": [
        "Excel.exe",
        "POWERPNT.EXE",
        "WinWord.exe"
      ]
    }
  ],
  "selection_trusted_location": {
    "CommandLine|contains": [
      "\\AppData\\Roaming\\Microsoft\\Templates",
      "\\AppData\\Roaming\\Microsoft\\Word\\Startup\\",
      "\\Microsoft Office\\root\\Templates\\",
      "\\Microsoft Office\\Templates\\"
    ]
  },
  "filter_main_dotx": {
    "CommandLine|endswith": [
      ".dotx",
      ".xltx",
      ".potx"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - Internal Research
  - https://twitter.com/Max_Mal_/status/[PII_REDACTED]09874176
  - https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465
  - https://twitter.com/_JohnHammond/status/[PII_REDACTED]52788994
Sigma Detection Rule: RegAsm.EXE Execution Without CommandLine Flags or Files
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: frack113
Date: 2025-06-04
ATT&CK techniques: T1218.009
Log source: windows/process_creation

Description:
Detects the execution of "RegAsm.exe" without a commandline flag or file, which might indicate potential process injection activity.
Usually "RegAsm.exe" should point to a dedicated DLL file or call the help with the "/?" flag.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\RegAsm.exe"
    },
    {
      "OriginalFileName": "RegAsm.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      "RegAsm",
      "RegAsm.exe",
      "RegAsm.exe\"",
      "RegAsm.exe'"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
  - https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
  - https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
  - https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
  - https://www.joesandbox.com/analysis/1467354/0/html
Sigma Detection Rule: WhoAmI as Parameter
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-11-29
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects a suspicious process command line that uses whoami as first parameter (as e.g. used by EfsPotato)

Detection logic:
{
  "selection": {
    "CommandLine|contains": ".exe whoami"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/blackarrowsec/status/[PII_REDACTED]02224645?s=12
Sigma Detection Rule: Suspicious Child Process of Notepad++ Updater - GUP.Exe
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2026-02-03
ATT&CK techniques: T1195.002, T1557
Log source: windows/process_creation

Description:
Detects suspicious child process creation by the Notepad++ updater process (gup.exe).
This could indicate potential exploitation of the updater component to deliver unwanted malware.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\gup.exe"
  },
  "selection_child_img": {
    "Image|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\cscript.exe",
      "\\wscript.exe",
      "\\mshta.exe"
    ]
  },
  "selection_child_cli": {
    "CommandLine|contains": [
      "bitsadmin",
      "certutil",
      "curl",
      "finger",
      "forfiles",
      "regsvr32",
      "rundll32",
      "wget"
    ]
  },
  "condition": "selection_parent and 1 of selection_child_*"
}

References:
  - https://notepad-plus-plus.org/news/v889-released/
  - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html
  - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/
  - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/
  - https://securelist.com/notepad-supply-chain-attack/118708/
Sigma Detection Rule: Remote File Download Via Desktopimgdownldr Utility
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-27
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\desktopimgdownldr.exe",
    "ParentImage|endswith": "\\desktopimgdownldr.exe",
    "CommandLine|contains": "/lockscreenurl:http"
  },
  "condition": "selection"
}

References:
  - https://www.elastic.co/guide/en/security/current/remote-file-download-via-desktopimgdownldr-utility.html
Sigma Detection Rule: Suspicious Rundll32 Invoking Inline VBScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-03-05
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "rundll32.exe",
      "Execute",
      "RegRead",
      "window.close"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/
Sigma Detection Rule: HackTool - CrackMapExec Execution Patterns
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Thomas Patzke
Date: 2020-05-22
ATT&CK techniques: T1047, T1053, T1059.003, T1059.001
Log source: windows/process_creation

Description:
Detects various execution patterns of the CrackMapExec pentesting framework

Detection logic:
{
  "selection": {
    "CommandLine|contains": [
      "cmd.exe /Q /c * 1> \\\\\\\\*\\\\*\\\\* 2>&1",
      "cmd.exe /C * > \\\\\\\\*\\\\*\\\\* 2>&1",
      "cmd.exe /C * > *\\\\Temp\\\\* 2>&1",
      "powershell.exe -exec bypass -noni -nop -w 1 -C \"",
      "powershell.exe -noni -nop -w 1 -enc "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/byt3bl33d3r/CrackMapExec
Sigma Detection Rule: Program Executed Using Proxy/Local Command Via SSH.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2022-12-29
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

Detection logic:
{
  "selection_parent": {
    "ParentImage": "C:\\Windows\\System32\\OpenSSH\\sshd.exe"
  },
  "selection_cli_img": [
    {
      "Image|endswith": "\\ssh.exe"
    },
    {
      "Product": "OpenSSH for Windows"
    },
    {
      "Hashes|contains": [
        "IMPHASH=55b4964d29aad5438b9e950052dbbbc0",
        "IMPHASH=334d66c33503ccbf647c15b47c27eef4",
        "IMPHASH=27b0da080ef92afb37983d30d839141e",
        "IMPHASH=977eb4c263d384e47daa0712d34713ab",
        "IMPHASH=3eaadce9ae43d5a918bb082065815c3b",
        "IMPHASH=980fe6cf0d996ab1eedf877222e722aa",
        "IMPHASH=5f959422308ac3d721010d66647e100e",
        "IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b",
        "IMPHASH=dd335f759b6d5d6a8382b71dd9d65791"
      ]
    }
  ],
  "selection_cli_flags": [
    {
      "CommandLine|contains": "ProxyCommand="
    },
    {
      "CommandLine|contains|all": [
        "PermitLocalCommand=yes",
        " LocalCommand"
      ]
    }
  ],
  "condition": "selection_parent or all of selection_cli_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ssh/
  - https://github.com/LOLBAS-Project/LOLBAS/pull/211/files
  - https://gtfobins.github.io/gtfobins/ssh/
  - https://man.openbsd.org/ssh_config#ProxyCommand
  - https://man.openbsd.org/ssh_config#LocalCommand
Sigma Detection Rule: Potentially Over Permissive Permissions Granted Using Dsacls.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects usage of Dsacls to grant over permissive permissions

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\dsacls.exe"
    },
    {
      "OriginalFileName": "DSACLS.EXE"
    }
  ],
  "selection_flag": {
    "CommandLine|contains": " /G "
  },
  "selection_permissions": {
    "CommandLine|contains": [
      "GR",
      "GE",
      "GW",
      "GA",
      "WP",
      "WD"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://ss64.com/nt/dsacls.html
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)
Sigma Detection Rule: Suspicious WebDav Client Execution Via Rundll32.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2023-03-16
ATT&CK techniques: T1048.003
Log source: windows/process_creation

Description:
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397


Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\svchost.exe",
    "ParentCommandLine|contains": "-s WebClient",
    "Image|endswith": "\\rundll32.exe",
    "CommandLine|contains": "C:\\windows\\system32\\davclnt.dll,DavSetCookie",
    "CommandLine|re": "://\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"
  },
  "filter_local_ips": {
    "CommandLine|contains": [
      "://10.",
      "://192.168.",
      "://172.16.",
      "://172.17.",
      "://172.18.",
      "://172.19.",
      "://172.20.",
      "://172.21.",
      "://172.22.",
      "://172.23.",
      "://172.24.",
      "://172.25.",
      "://172.26.",
      "://172.27.",
      "://172.28.",
      "://172.29.",
      "://172.30.",
      "://172.31.",
      "://127.",
      "://169.254."
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://twitter.com/aceresponder/status/[PII_REDACTED]06818562
  - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/
  - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/
  - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png
  - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/
Sigma Detection Rule: Verclsid.exe Runs COM Object
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Victor Sergeev, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects when verclsid.exe is used to run COM object via GUID

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\verclsid.exe"
    },
    {
      "OriginalFileName": "verclsid.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "/S",
      "/C"
    ]
  },
  "filter_main_runtimebroker": {
    "ParentImage|endswith": "C:\\Windows\\System32\\RuntimeBroker.exe",
    "CommandLine|contains|all": [
      "verclsid.exe\" /S /C {",
      "} /I {"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Verclsid/
  - https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5
  - https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/
Sigma Detection Rule: File Explorer Folder Opened Using Explorer Folder Shortcut Via Shell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @Kostastsale
Date: 2022-12-22
ATT&CK techniques: T1135
Log source: windows/process_creation

Description:
Detects the initial execution of "cmd.exe" which spawns "explorer.exe" with the appropriate command line arguments for opening the "My Computer" folder.


Detection logic:
{
  "selection": {
    "ParentImage|endswith": [
      "\\cmd.exe",
      "\\powershell.exe",
      "\\pwsh.exe"
    ],
    "Image|endswith": "\\explorer.exe",
    "CommandLine|contains": "shell:mycomputerfolder"
  },
  "condition": "selection"
}

References:
  - https://ss64.com/nt/shell.html
Sigma Detection Rule: Execute Files with Msdeploy.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Beyu Denis, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects file execution using the msdeploy.exe lolbin

Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "verb:sync",
      "-source:RunCommand",
      "-dest:runCommand"
    ],
    "Image|endswith": "\\msdeploy.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/
  - https://twitter.com/pabraeken/status/[PII_REDACTED]79032576
  - https://twitter.com/pabraeken/status/[PII_REDACTED]39313408
Sigma Detection Rule: Potential SysInternals ProcDump Evasion
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1036, T1003.001
Log source: windows/process_creation

Description:
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name

Detection logic:
{
  "selection_1": {
    "CommandLine|contains": [
      "copy procdump",
      "move procdump"
    ]
  },
  "selection_2": {
    "CommandLine|contains|all": [
      "copy ",
      ".dmp "
    ],
    "CommandLine|contains": [
      "2.dmp",
      "lsass",
      "out.dmp"
    ]
  },
  "selection_3": {
    "CommandLine|contains": [
      "copy lsass.exe_",
      "move lsass.exe_"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]01204481
Sigma Detection Rule: Suspicious Microsoft Office Child Process
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io
Date: 2018-04-06
ATT&CK techniques: T1047, T1204.002, T1218.010
Log source: windows/process_creation

Description:
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)

Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": [
      "\\EQNEDT32.EXE",
      "\\EXCEL.EXE",
      "\\MSACCESS.EXE",
      "\\MSPUB.exe",
      "\\ONENOTE.EXE",
      "\\POWERPNT.exe",
      "\\VISIO.exe",
      "\\WINWORD.EXE",
      "\\wordpad.exe",
      "\\wordview.exe"
    ]
  },
  "selection_child_processes": [
    {
      "OriginalFileName": [
        "bitsadmin.exe",
        "CertOC.exe",
        "CertUtil.exe",
        "Cmd.Exe",
        "CMSTP.EXE",
        "cscript.exe",
        "curl.exe",
        "HH.exe",
        "IEExec.exe",
        "InstallUtil.exe",
        "javaw.exe",
        "Microsoft.Workflow.Compiler.exe",
        "msdt.exe",
        "MSHTA.EXE",
        "msiexec.exe",
        "Msxsl.exe",
        "odbcconf.exe",
        "pcalua.exe",
        "PowerShell.EXE",
        "RegAsm.exe",
        "RegSvcs.exe",
        "REGSVR32.exe",
        "RUNDLL32.exe",
        "schtasks.exe",
        "ScriptRunner.exe",
        "wmic.exe",
        "WorkFolders.exe",
        "wscript.exe"
      ]
    },
    {
      "Image|endswith": [
        "\\AppVLP.exe",
        "\\bash.exe",
        "\\bitsadmin.exe",
        "\\certoc.exe",
        "\\certutil.exe",
        "\\cmd.exe",
        "\\cmstp.exe",
        "\\control.exe",
        "\\cscript.exe",
        "\\curl.exe",
        "\\forfiles.exe",
        "\\hh.exe",
        "\\ieexec.exe",
        "\\installutil.exe",
        "\\javaw.exe",
        "\\mftrace.exe",
        "\\Microsoft.Workflow.Compiler.exe",
     

References:
  - https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100
  - https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html
  - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
  - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
  - https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml
Sigma Detection Rule: Potential SMB Relay Attack Tool Execution
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-07-24
ATT&CK techniques: T1557.001
Log source: windows/process_creation

Description:
Detects different hacktools used for relay attacks on Windows for privilege escalation

Detection logic:
{
  "selection_pe": {
    "Image|contains": [
      "PetitPotam",
      "RottenPotato",
      "HotPotato",
      "JuicyPotato",
      "\\just_dce_",
      "Juicy Potato",
      "\\temp\\rot.exe",
      "\\Potato.exe",
      "\\SpoolSample.exe",
      "\\Responder.exe",
      "\\smbrelayx",
      "\\ntlmrelayx",
      "\\LocalPotato"
    ]
  },
  "selection_script": {
    "CommandLine|contains": [
      "Invoke-Tater",
      " smbrelay",
      " ntlmrelay",
      "cme smb ",
      " /ntlm:NTLMhash ",
      "Invoke-PetitPotam",
      ".exe -t * -p "
    ]
  },
  "selection_juicypotato_enum": {
    "CommandLine|contains": ".exe -c \"{",
    "CommandLine|endswith": "}\" -z"
  },
  "filter_hotpotatoes": {
    "Image|contains": [
      "HotPotatoes6",
      "HotPotatoes7",
      "HotPotatoes "
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_*"
}

References:
  - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/
  - https://pentestlab.blog/2017/04/13/hot-potato/
  - https://github.com/ohpe/juicy-potato
  - https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
  - https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire