deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Computer Discovery And Export Via Get-ADComputer Cmdlet
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-10
ATT&CK techniques: T1033
Log source: windows/process_creation

Description:
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    {
      "OriginalFileName": [
        "PowerShell.EXE",
        "pwsh.dll"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "Get-ADComputer ",
      " -Filter \\*"
    ],
    "CommandLine|contains": [
      " > ",
      " | Select ",
      "Out-File",
      "Set-Content",
      "Add-Content"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
Sigma Detection Rule: Uncommon Child Process Of Defaultpack.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-31
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\DefaultPack.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/
  - https://www.echotrail.io/insights/search/defaultpack.exe
Sigma Detection Rule: All Backups Deleted Via Wbadmin.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-13
ATT&CK techniques: T1490
Log source: windows/process_creation

Description:
Detects the deletion of all backups or system state backups via "wbadmin.exe".
This technique is used by numerous ransomware families and actors.
This may only be successful on server platforms that have Windows Backup enabled.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\wbadmin.exe"
    },
    {
      "OriginalFileName": "WBADMIN.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains|all": [
      "delete",
      "backup"
    ],
    "CommandLine|contains": "keepVersions:0"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md
  - https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
  - https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/ransomware-report-avaddon-and-new-techniques-emerge-industrial-sector-targeted
  - https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
Sigma Detection Rule: Suspicious Execution of Shutdown
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-01
ATT&CK techniques: T1529
Log source: windows/process_creation

Description:
Use of the commandline to shutdown or reboot windows

Detection logic:
{
  "selection": {
    "Image|endswith": "\\shutdown.exe",
    "CommandLine|contains": [
      "/r ",
      "/s "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/shutdown
Sigma Detection Rule: Renamed AutoIt Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2023-06-04
ATT&CK techniques: T1027
Log source: windows/process_creation

Description:
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.


Detection logic:
{
  "selection_1": {
    "CommandLine|contains": [
      " /AutoIt3ExecuteScript",
      " /ErrorStdOut"
    ]
  },
  "selection_2": {
    "Hashes|contains": [
      "IMPHASH=FDC554B3A8683918D[PII_REDACTED]83DDF",
      "IMPHASH=CD30A61B60B3D60CECDB034C8C83C290",
      "IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000"
    ]
  },
  "selection_3": {
    "OriginalFileName": [
      "AutoIt3.exe",
      "AutoIt2.exe",
      "AutoIt.exe"
    ]
  },
  "filter_main_legit_name": {
    "Image|endswith": [
      "\\AutoIt.exe",
      "\\AutoIt2.exe",
      "\\AutoIt3_x64.exe",
      "\\AutoIt3.exe"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]30725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w
  - https://www.autoitscript.com/site/
Sigma Detection Rule: File Download From Browser Process Via Inline URL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-11
ATT&CK techniques: T1105
Log source: windows/process_creation

Description:
Detects execution of a browser process with a URL argument pointing to a file with a potentially interesting extension. This can be abused to download arbitrary files or to hide from the user for example by launching the browser in a minimized state.

Detection logic:
{
  "selection_img": {
    "Image|endswith": [
      "\\brave.exe",
      "\\chrome.exe",
      "\\msedge.exe",
      "\\opera.exe",
      "\\vivaldi.exe"
    ]
  },
  "selection_http": {
    "CommandLine|contains": "http"
  },
  "selection_extensions": [
    {
      "CommandLine|endswith": [
        ".7z",
        ".dat",
        ".dll",
        ".exe",
        ".hta",
        ".ps1",
        ".psm1",
        ".txt",
        ".vbe",
        ".vbs",
        ".zip"
      ]
    },
    {
      "CommandLine|contains": [
        ".7z\"",
        ".dat\"",
        ".dll\"",
        ".hta\"",
        ".ps1\"",
        ".psm1\"",
        ".txt\"",
        ".vbe\"",
        ".vbs\"",
        ".zip\""
      ]
    }
  ],
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/mrd0x/status/[PII_REDACTED]05641220
  - https://lolbas-project.github.io/lolbas/Binaries/Msedge/
Sigma Detection Rule: Delete All Scheduled Tasks
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-09-09
ATT&CK techniques: T1489
Log source: windows/process_creation

Description:
Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users.

Detection logic:
{
  "selection": {
    "Image|endswith": "\\schtasks.exe",
    "CommandLine|contains|all": [
      " /delete ",
      "/tn \\*",
      " /f"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete
Sigma Detection Rule: Capture Credentials with Rpcping.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Julia Fomina, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1003
Log source: windows/process_creation

Description:
Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process.

Detection logic:
{
  "selection_main_img": [
    {
      "Image|endswith": "\\RpcPing.exe"
    },
    {
      "OriginalFileName": "\\RpcPing.exe"
    }
  ],
  "selection_main_flag": {
    "CommandLine|contains|windash": "-s"
  },
  "selection_cli_ntlm": {
    "CommandLine|contains|windash": "-u",
    "CommandLine|contains": "NTLM"
  },
  "selection_cli_ncacn": {
    "CommandLine|contains|windash": "-t",
    "CommandLine|contains": "ncacn_np"
  },
  "condition": "all of selection_main_* and 1 of selection_cli_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Rpcping/
  - https://twitter.com/vysecurity/status/[PII_REDACTED]16072960
  - https://twitter.com/vysecurity/status/[PII_REDACTED]24266241
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11)
Sigma Detection Rule: Suspicious Userinit Child Process
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Samir Bousseaden (idea)
Date: 2019-06-17
ATT&CK techniques: T1055
Log source: windows/process_creation

Description:
Detects a suspicious child process of userinit

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\userinit.exe"
  },
  "filter_main_netlogon": {
    "CommandLine|contains": "\\netlogon\\"
  },
  "filter_main_explorer": [
    {
      "Image|endswith": "\\explorer.exe"
    },
    {
      "OriginalFileName": "explorer.exe"
    },
    {
      "CommandLine": "C:\\Windows\\Explorer.EXE"
    }
  ],
  "filter_main_null": {
    "Image": null
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]60562176
Sigma Detection Rule: C# IL Code Compilation Via Ilasm.EXE
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-05-07
ATT&CK techniques: T1127
Log source: windows/process_creation

Description:
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\ilasm.exe"
    },
    {
      "OriginalFileName": "ilasm.exe"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /dll",
      " /exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Ilasm/
  - https://www.echotrail.io/insights/search/ilasm.exe
Sigma Detection Rule: Regsvr32 Execution From Highly Suspicious Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-26
ATT&CK techniques: T1218.010
Log source: windows/process_creation

Description:
Detects execution of regsvr32 where the DLL is located in a highly suspicious locations

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\regsvr32.exe"
    },
    {
      "OriginalFileName": "REGSVR32.EXE"
    }
  ],
  "selection_path_1": {
    "CommandLine|contains": [
      ":\\PerfLogs\\",
      ":\\Temp\\",
      "\\Windows\\Registration\\CRMLog",
      "\\Windows\\System32\\com\\dmp\\",
      "\\Windows\\System32\\FxsTmp\\",
      "\\Windows\\System32\\Microsoft\\Crypto\\RSA\\MachineKeys\\",
      "\\Windows\\System32\\spool\\drivers\\color\\",
      "\\Windows\\System32\\spool\\PRINTERS\\",
      "\\Windows\\System32\\spool\\SERVERS\\",
      "\\Windows\\System32\\Tasks_Migrated\\",
      "\\Windows\\System32\\Tasks\\Microsoft\\Windows\\SyncCenter\\",
      "\\Windows\\SysWOW64\\com\\dmp\\",
      "\\Windows\\SysWOW64\\FxsTmp\\",
      "\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\PLA\\System\\",
      "\\Windows\\SysWOW64\\Tasks\\Microsoft\\Windows\\SyncCenter\\",
      "\\Windows\\Tasks\\",
      "\\Windows\\Tracing\\"
    ]
  },
  "selection_path_2": {
    "CommandLine|contains": [
      " \"C:\\",
      " C:\\",
      " 'C:\\",
      "D:\\"
    ]
  },
  "selection_exclude_known_dirs": {
    "CommandLine|contains": [
      "C:\\Program Files (x86)\\",
      "C:\\Program Files\\",
      "C:\\ProgramData\\",
      "C:\\Users\\",
      " C:\\Windows\\",
      " \"C:\\Windows\\",
      " 'C:\\Windows\\"
    ]
  },
  "filter_main_empty": {
    "CommandLine": ""
  },
  "filter_main_null": {
    "CommandLine": null
  },
  "condition": "selection_img a

References:
  - Internal Research
Sigma Detection Rule: Renamed Office Binary Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-12-20
ATT&CK techniques: T1036.003
Log source: windows/process_creation

Description:
Detects the execution of a renamed office binary

Detection logic:
{
  "selection": [
    {
      "OriginalFileName": [
        "Excel.exe",
        "MSACCESS.EXE",
        "MSPUB.EXE",
        "OneNote.exe",
        "OneNoteM.exe",
        "OUTLOOK.EXE",
        "POWERPNT.EXE",
        "WinWord.exe",
        "Olk.exe"
      ]
    },
    {
      "Description": [
        "Microsoft Access",
        "Microsoft Excel",
        "Microsoft OneNote",
        "Microsoft Outlook",
        "Microsoft PowerPoint",
        "Microsoft Publisher",
        "Microsoft Word",
        "Sent to OneNote Tool"
      ]
    }
  ],
  "filter_main_legit_names": {
    "Image|endswith": [
      "\\EXCEL.exe",
      "\\excelcnv.exe",
      "\\MSACCESS.exe",
      "\\MSPUB.EXE",
      "\\ONENOTE.EXE",
      "\\ONENOTEM.EXE",
      "\\OUTLOOK.EXE",
      "\\POWERPNT.EXE",
      "\\WINWORD.exe",
      "\\OLK.EXE"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://infosec.exchange/@sbousseaden/[PII_REDACTED]4022664
Sigma Detection Rule: Suspicious Shells Spawn by Java Utility Keytool
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Andreas Hunkeler (@Karneades)
Date: 2021-12-22
Log source: windows/process_creation

Description:
Detects suspicious shell spawn from Java utility keytool process (e.g. adselfservice plus exploitation)

Detection logic:
{
  "selection": {
    "ParentImage|endswith": "\\keytool.exe",
    "Image|endswith": [
      "\\cmd.exe",
      "\\sh.exe",
      "\\bash.exe",
      "\\powershell.exe",
      "\\pwsh.exe",
      "\\schtasks.exe",
      "\\certutil.exe",
      "\\whoami.exe",
      "\\bitsadmin.exe",
      "\\wscript.exe",
      "\\cscript.exe",
      "\\scrcons.exe",
      "\\regsvr32.exe",
      "\\hh.exe",
      "\\wmic.exe",
      "\\mshta.exe",
      "\\rundll32.exe",
      "\\forfiles.exe",
      "\\scriptrunner.exe",
      "\\mftrace.exe",
      "\\AppVLP.exe",
      "\\systeminfo.exe",
      "\\reg.exe",
      "\\query.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://redcanary.com/blog/intelligence-insights-december-2021
  - https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html
Sigma Detection Rule: New DNS ServerLevelPluginDll Installed Via Dnscmd.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-08
ATT&CK techniques: T1574.001, T1112
Log source: windows/process_creation

Description:
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)

Detection logic:
{
  "selection": {
    "Image|endswith": "\\dnscmd.exe",
    "CommandLine|contains|all": [
      "/config",
      "/serverlevelplugindll"
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
  - https://blog.3or.de/hunting-dns-server-level-plugin-dll-injection.html
Sigma Detection Rule: Suspicious Windows Defender Registry Key Tampering Via Reg.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-03-22
ATT&CK techniques: T1685
Log source: windows/process_creation

Description:
Detects the usage of "reg.exe" to tamper with different Windows Defender registry keys in order to disable some important features related to protection and detection


Detection logic:
{
  "selection_root_img": [
    {
      "Image|endswith": "\\reg.exe"
    },
    {
      "OriginalFileName": "reg.exe"
    }
  ],
  "selection_root_path": {
    "CommandLine|contains": [
      "SOFTWARE\\Microsoft\\Windows Defender\\",
      "SOFTWARE\\Policies\\Microsoft\\Windows Defender Security Center",
      "SOFTWARE\\Policies\\Microsoft\\Windows Defender\\"
    ]
  },
  "selection_dword_0": {
    "CommandLine|contains|all": [
      " add ",
      "d 0"
    ],
    "CommandLine|contains": [
      "DisallowExploitProtectionOverride",
      "EnableControlledFolderAccess",
      "MpEnablePus",
      "PUAProtection",
      "SpynetReporting",
      "SubmitSamplesConsent",
      "TamperProtection"
    ]
  },
  "selection_dword_1": {
    "CommandLine|contains|all": [
      " add ",
      "d 1"
    ],
    "CommandLine|contains": [
      "DisableAccess",
      "DisableAntiSpyware",
      "DisableAntiSpywareRealtimeProtection",
      "DisableAntiVirus",
      "DisableAntiVirusSignatures",
      "DisableArchiveScanning",
      "DisableBehaviorMonitoring",
      "DisableBlockAtFirstSeen",
      "DisableCloudProtection",
      "DisableConfig",
      "DisableEnhancedNotifications",
      "DisableIntrusionPreventionSystem",
      "DisableIOAVProtection",
      "DisableNetworkProtection",
      "DisableOnAccessProtection",
      "DisablePrivacyMode",
      "DisableRealtimeMonitoring",
      "DisableRoutinelyTakingAction",
      "DisableScanOnRealtimeEnable",
      "DisableScriptScanning

References:
  - https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/
  - https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91
  - https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2
  - https://tria.ge/241231-j9yatstqbm/behavioral1
Sigma Detection Rule: Audit Policy Tampering Via Auditpol
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Janantha Marasinghe (https://github.com/blueteam0ps)
Date: 2021-02-02
ATT&CK techniques: T1685.001
Log source: windows/process_creation

Description:
Threat actors can use auditpol binary to change audit policy configuration to impair detection capability.
This can be carried out by selectively disabling/removing certain audit policies as well as restoring a custom policy owned by the threat actor.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\auditpol.exe"
    },
    {
      "OriginalFileName": "AUDITPOL.EXE"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "disable",
      "clear",
      "remove",
      "restore"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
Sigma Detection Rule: Findstr Launching .lnk File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Trent Liffick
Date: 2020-05-01
ATT&CK techniques: T1036, T1202, T1027.003
Log source: windows/process_creation

Description:
Detects usage of findstr to identify and execute a lnk file as seen within the HHS redirect attack

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\find.exe",
        "\\findstr.exe"
      ]
    },
    {
      "OriginalFileName": [
        "FIND.EXE",
        "FINDSTR.EXE"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|endswith": [
      ".lnk",
      ".lnk\"",
      ".lnk'"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.bleepingcomputer.com/news/security/hhsgov-open-redirect-used-by-coronavirus-phishing-to-spread-malware/
Sigma Detection Rule: PUA - 3Proxy Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-09-13
ATT&CK techniques: T1572
Log source: windows/process_creation

Description:
Detects the use of 3proxy, a tiny free proxy server

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\3proxy.exe"
  },
  "selection_pe": {
    "Description": "3proxy - tiny proxy server"
  },
  "selection_params": {
    "CommandLine|contains": ".exe -i127.0.0.1 -p"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/3proxy/3proxy
  - https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
Sigma Detection Rule: Potential DLL Injection Or Execution Using Tracker.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Avneet Singh @v3t0_, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1055.001
Log source: windows/process_creation

Description:
Detects potential DLL injection and execution using "Tracker.exe"

Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": "\\tracker.exe"
    },
    {
      "Description": "Tracker"
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      " /d ",
      " /c "
    ]
  },
  "filter_msbuild1": {
    "CommandLine|contains": " /ERRORREPORT:PROMPT "
  },
  "filter_msbuild2": {
    "ParentImage|endswith": [
      "\\Msbuild\\Current\\Bin\\MSBuild.exe",
      "\\Msbuild\\Current\\Bin\\amd64\\MSBuild.exe"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_*"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Tracker/
Sigma Detection Rule: Potential PowerShell Execution Via DLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis, Nasreddine Bencherchali (Nextron Systems)
Date: 2018-08-25
ATT&CK techniques: T1218.011
Log source: windows/process_creation

Description:
Detects potential PowerShell execution from a DLL instead of the usual PowerShell process as seen used in PowerShdll.
This detection assumes that PowerShell commands are passed via the CommandLine.


Detection logic:
{
  "selection_img": [
    {
      "Image|endswith": [
        "\\InstallUtil.exe",
        "\\RegAsm.exe",
        "\\RegSvcs.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe"
      ]
    },
    {
      "OriginalFileName": [
        "InstallUtil.exe",
        "RegAsm.exe",
        "RegSvcs.exe",
        "REGSVR32.EXE",
        "RUNDLL32.EXE"
      ]
    }
  ],
  "selection_cli": {
    "CommandLine|contains": [
      "Default.GetString",
      "DownloadString",
      "FromBase64String",
      "ICM ",
      "IEX ",
      "Invoke-Command",
      "Invoke-Expression"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/p3nt4/PowerShdll/blob/62cfa172fb4e1f7f4ac00ca942685baeb88ff356/README.md
Sigma Detection Rule: Use of VisualUiaVerifyNative.exe
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
Date: 2022-06-01
ATT&CK techniques: T1218
Log source: windows/process_creation

Description:
VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.

Detection logic:
{
  "selection": [
    {
      "Image|endswith": "\\VisualUiaVerifyNative.exe"
    },
    {
      "OriginalFileName": "VisualUiaVerifyNative.exe"
    }
  ],
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/
  - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac
  - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/
  - https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad