deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Exploitation of GoAnywhere MFT Vulnerability
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-07
ATT&CK techniques: T1190, T1059.001, T1133
Log source: windows/process_creation

Description:
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.
This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.


Detection logic:
{
  "selection_parent": {
    "ParentImage|contains": "\\GoAnywhere\\tomcat\\"
  },
  "selection_powershell_img": {
    "Image|endswith": [
      "\\powershell.exe",
      "\\powershell_ise.exe",
      "\\pwsh.exe"
    ]
  },
  "selection_powershell_cmd": [
    {
      "CommandLine|contains|all": [
        "IEX",
        "enc",
        "Hidden",
        "bypass"
      ]
    },
    {
      "CommandLine|re": [
        "net\\s+user",
        "net\\s+group",
        "query\\s+session"
      ]
    },
    {
      "CommandLine|contains": [
        "whoami",
        "systeminfo",
        "dsquery",
        "localgroup administrators",
        "nltest",
        "samaccountname=",
        "adscredentials",
        "o365accountconfiguration",
        ".DownloadString(",
        ".DownloadFile(",
        "FromBase64String(",
        "System.IO.Compression",
        "System.IO.MemoryStream",
        "curl"
      ]
    }
  ],
  "selection_child_cmd": {
    "Image|endswith": "\\cmd.exe",
    "CommandLine|contains": [
      "powershell",
      "whoami",
      "net.exe",
      "net1.exe",
      "rundll32",
      "quser",
      "nltest",
      "curl"
    ]
  },
  "selection_child_others": {
    "CommandLine|contains": [
      "bitsadmin",
      "certutil",
      "mshta",
      "cscript",
      "wscript"
    ]
  },
  "condition": "selection_parent and (all of selection_powershell_* or 1 of selection_child_*)"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
Sigma Detection Rule: Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-10-20
ATT&CK techniques: T1078.001
Log source: windows/process_creation

Description:
Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password.
This could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.


Detection logic:
{
  "selection": {
    "CommandLine|contains|all": [
      "qlogin",
      "_+_PublicSharingUser_"
    ],
    "CommandLine|re": "[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}"
  },
  "condition": "selection"
}

References:
  - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
Sigma Detection Rule: Non-Standard Nsswitch.Conf Creation - Potential CVE-2025-32463 Exploitation
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawn Poudel (Nextron Systems)
Date: 2025-10-02
ATT&CK techniques: T1068
Log source: linux/file_event

Description:
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463.
This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations.
When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment,
potentially leading to arbitrary code execution and privilege escalation.


Detection logic:
{
  "selection": {
    "TargetFilename|endswith": "/etc/nsswitch.conf"
  },
  "filter_main_legitimate_path": {
    "TargetFilename": [
      "/etc/nsswitch.conf",
      "/usr/share/factory/etc/nsswitch.conf"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa[PII_REDACTED]c3ed4bfa434c197ad4/exploit.sh
Sigma Detection Rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-13
ATT&CK techniques: T1218, T1105
Log source: windows/process_creation

Description:
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
which involves unauthorized code execution via WebDAV through external control of file names or paths.
The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe  by manipulating
their working directories to point to attacker-controlled WebDAV servers, causing them to execute
malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
through Process.Start() search order manipulation.


Detection logic:
{
  "selection_parent": {
    "ParentImage": [
      "C:\\Program Files\\internet explorer\\iediagcmd.exe",
      "C:\\Windows\\System32\\CustomShellHost.exe"
    ]
  },
  "selection_child_current_dir": [
    {
      "CurrentDirectory|startswith": "\\\\\\\\"
    },
    {
      "CurrentDirectory|contains": "\\DavWWWRoot\\"
    },
    {
      "Image|contains": "\\DavWWWRoot\\"
    },
    {
      "Image|startswith": "\\\\\\\\"
    }
  ],
  "selection_child_img": {
    "Image|endswith": [
      "\\route.exe",
      "\\netsh.exe",
      "\\makecab.exe",
      "\\dxdiag.exe",
      "\\ipconfig.exe",
      "\\explorer.exe"
    ]
  },
  "filter_main_system": {
    "Image|startswith": [
      "C:\\Windows\\System32\\",
      "C:\\Windows\\SysWOW64\\"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
  - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
Sigma Detection Rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-13
ATT&CK techniques: T1218, T1105
Log source: windows/image_load

Description:
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.


Detection logic:
{
  "selection_img_path": {
    "Image|startswith": "\\\\\\\\",
    "Image|contains": "\\DavWWWRoot\\"
  },
  "selection_img_bin": {
    "Image|endswith": [
      "\\route.exe",
      "\\netsh.exe",
      "\\makecab.exe",
      "\\dxdiag.exe",
      "\\ipconfig.exe",
      "\\explorer.exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
  - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
Sigma Detection Rule: Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-06-13
ATT&CK techniques: T1218, T1105
Log source: windows/process_access

Description:
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe)
accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting
Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers
instead of legitimate system binaries. The vulnerability allows unauthorized code execution through
external control of file names or paths via WebDAV.


Detection logic:
{
  "selection_src": {
    "SourceImage": [
      "C:\\Program Files\\internet explorer\\iediagcmd.exe",
      "C:\\Windows\\System32\\CustomShellHost.exe"
    ]
  },
  "selection_target_dir": [
    {
      "TargetImage|startswith": "\\\\\\\\"
    },
    {
      "TargetImage|contains": "\\DavWWWRoot\\"
    }
  ],
  "selection_target_exe": {
    "TargetImage|endswith": [
      "\\route.exe",
      "\\netsh.exe",
      "\\makecab.exe",
      "\\dxdiag.exe",
      "\\ipconfig.exe",
      "\\explorer.exe"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
  - https://research.checkpoint.com/2025/stealth-falcon-zero-day/
Sigma Detection Rule: Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-20
ATT&CK techniques: T1190, T1203
Log source: /webserver

Description:
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0.
CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass,
which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through
template injection. This sequence enables unauthenticated remote code execution, significantly increasing
the impact of exploitation.


Detection logic:
{
  "selection_uri": {
    "cs-uri-stem|contains": "/mifs/rs/api/v2/featureusage",
    "cs-uri-query|contains": "format="
  },
  "selection_exploit_rce": [
    {
      "cs-uri-query|contains|all": [
        "java.lang.Runtime",
        ".getMethod",
        "getRuntime",
        ".exec("
      ]
    },
    {
      "cs-uri-query|contains|all": [
        "java%2elang%2eRuntime",
        "%2egetMethod",
        "%2eexec%28"
      ]
    },
    {
      "cs-uri-query|contains": [
        "%6a%61%76%61%2e%6c%61%6e%67%2e%52%75%6e%74%69%6d%65%65%28%29",
        "%67%65%74%52%75%6e%74%69%6d%65",
        "%2e%65%78%65%63%28"
      ]
    }
  ],
  "selection_exploit_template_injection": {
    "cs-uri-query|contains": [
      "{7*7}",
      "%7B7*7%7D",
      "%7b7%2a7%7d"
    ]
  },
  "condition": "selection_uri and 1 of selection_exploit_*"
}

References:
  - https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123
Sigma Detection Rule: Potential SharePoint ToolShell CVE-2025-53770 Exploitation - File Create
Repository: SigmaHQ/sigma
Severity: critical
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-21
ATT&CK techniques: T1190
Log source: windows/file_event

Description:
Detects the creation of file such as spinstall0.aspx which may indicate successful exploitation of CVE-2025-53770.
CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.


Detection logic:
{
  "selection": {
    "TargetFilename|startswith": [
      "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\",
      "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Web Server Extensions\\"
    ],
    "TargetFilename|contains": [
      "\\15\\TEMPLATE\\LAYOUTS\\",
      "\\16\\TEMPLATE\\LAYOUTS\\"
    ],
    "TargetFilename|endswith": [
      "\\spinstall.aspx",
      "\\spinstall?.aspx",
      "\\debug_dev.js"
    ]
  },
  "condition": "selection"
}

References:
  - https://research.eye.security/sharepoint-under-siege/
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
  - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
Sigma Detection Rule: SharePoint ToolShell CVE-2025-53770 Exploitation - Web IIS
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-21
ATT&CK techniques: T1190
Log source: /webserver

Description:
Detects access to vulnerable SharePoint components potentially being exploited in CVE-2025-53770 through IIS web server logs.
CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.


Detection logic:
{
  "selection_exploit_post": {
    "cs-method": "POST",
    "cs-uri-stem|contains": "/_layouts/15/ToolPane.aspx",
    "cs-uri-query|contains": "DisplayMode=Edit&a=/ToolPane.aspx"
  },
  "selection_exploit_get": {
    "cs-method": "GET",
    "cs-uri-stem|contains": "/_layouts/15/spinstall0.aspx"
  },
  "selection_referer": {
    "cs-referer|contains": "/_layouts/SignOut.aspx"
  },
  "condition": "1 of selection_exploit_* and selection_referer"
}

References:
  - https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity[PII_REDACTED]363303425-bL2f
  - https://research.eye.security/sharepoint-under-siege/
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
Sigma Detection Rule: Potential SharePoint ToolShell CVE-2025-53770 Exploitation Indicators
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-07-21
ATT&CK techniques: T1190
Log source: windows/process_creation

Description:
Detects potential exploitation of CVE-2025-53770 by identifying indicators such as suspicious command lines discovered in Post-Exploitation activities.
CVE-2025-53770 is a zero-day vulnerability in SharePoint that allows remote code execution.


Detection logic:
{
  "selection_img": {
    "ParentImage|endswith": "\\w3wp.exe"
  },
  "selection_encoded_aspx": [
    {
      "CommandLine|wide|base64offset|contains": "spinstall0.aspx"
    },
    {
      "CommandLine|base64|contains": "spinstall0.aspx"
    }
  ],
  "selection_encoded_path": {
    "CommandLine|wide|base64offset|contains": [
      ":\\PROGRA~1\\COMMON~1\\MICROS~1\\WEBSER~1\\15\\TEMPLATE\\LAYOUTS",
      ":\\PROGRA~1\\COMMON~1\\MICROS~1\\WEBSER~1\\16\\TEMPLATE\\LAYOUTS",
      ":\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\15\\TEMPLATE\\LAYOUTS",
      ":\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\16\\TEMPLATE\\LAYOUTS"
    ]
  },
  "selection_ioc": {
    "CommandLine|contains": [
      "-EncodedCommand JABiAGEAcwBlADYANABTAHQAcgBpAG4AZwAgAD0",
      "TEMPLATE\\LAYOUTS\\spinstall0.aspx"
    ]
  },
  "condition": "(selection_img and 1 of selection_encoded_*) or selection_ioc"
}

References:
  - https://research.eye.security/sharepoint-under-siege/
  - https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
Sigma Detection Rule: Potential Exploitation of CVE-2025-5054 or CVE-2025-4598
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Milad Cheraghi
Date: 2026-04-28
ATT&CK techniques: T1548, T1003
Log source: linux/process_creation

Description:
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.


Detection logic:
{
  "selection_suid_dumpable_sysctl": {
    "Image|endswith": [
      "/sbin/sysctl",
      "/bin/sysctl"
    ],
    "CommandLine|contains": "fs.suid_dumpable="
  },
  "selection_echo_proc_write": {
    "Image|endswith": [
      "/bin/bash",
      "/bin/sh"
    ],
    "CommandLine|contains": [
      "echo 1 > /proc/sys/fs/suid_dumpable",
      "echo 2 > /proc/sys/fs/suid_dumpable",
      "echo 1 >/proc/sys/fs/suid_dumpable",
      "echo 2 >/proc/sys/fs/suid_dumpable",
      "echo 1> /proc/sys/fs/suid_dumpable",
      "echo 2> /proc/sys/fs/suid_dumpable",
      "echo 1>/proc/sys/fs/suid_dumpable",
      "echo 2>/proc/sys/fs/suid_dumpable"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-5054
  - https://nvd.nist.gov/vuln/detail/CVE-2025-4598
  - https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598
Sigma Detection Rule: Linux Suspicious Child Process from Node.js - React2Shell
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
Date: 2025-12-05
ATT&CK techniques: T1059, T1190
Log source: linux/process_creation

Description:
Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell).
This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands.
When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>).
For other methods, the Image field will show the spawned process directly.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "/node",
    "ParentCommandLine|contains": [
      "--experimental-https",
      "--experimental-next-config-strip-types",
      "/node_modules/next",
      "next dev",
      "next start",
      "node_modules/.bin",
      "react-scripts start",
      "start-server.js"
    ]
  },
  "selection_generic_child_img": [
    {
      "Image|endswith": [
        "/busybox",
        "/cat",
        "/curl",
        "/dash",
        "/dig",
        "/head",
        "/id",
        "/ifconfig",
        "/ip",
        "/java",
        "/less",
        "/lua",
        "/more",
        "/nc",
        "/ncat",
        "/netcat",
        "/netstat",
        "/nslookup",
        "/perl",
        "/ping",
        "/python",
        "/python2",
        "/ruby",
        "/socat",
        "/tail",
        "/wget",
        "/whoami"
      ]
    },
    {
      "Image|contains": "/python"
    }
  ],
  "selection_generic_child_cli": {
    "CommandLine|contains": [
      "/dev/tcp/",
      "/dev/udp/",
      "/etc/hosts",
      "/etc/passwd",
      "/etc/shadow",
      "base64",
      "cat ",
      "curl",
      "dig",
      "ifconfig",
      "IO::Socket::INET",
      "java",
      "less ",
      "lua",
      "mkfifo ",
      "more",
      "nc ",
      "ncat",
      "netcat",
      "netstat",
      "nslookup",
      "perl",
      "php",
      "ping",
      "ps -ef",
      "ps aux",
      "python",
      "rcat",
      "ruby",
      "sh -i 2>&1",
      

References:
  - https://github.com/msanft/CVE-2025-55182
  - https://nodejs.org/api/child_process.html#class-childprocess
  - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
  - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
Sigma Detection Rule: Windows Suspicious Child Process from Node.js - React2Shell
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
Date: 2025-12-05
ATT&CK techniques: T1059, T1190
Log source: windows/process_creation

Description:
Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell).
Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync().
If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked.
For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.


Detection logic:
{
  "selection_parent": {
    "ParentImage|endswith": "\\node.exe",
    "ParentCommandLine|contains": [
      "--experimental-https",
      "--experimental-next-config-strip-types",
      "\\node_modules\\next",
      "next dev",
      "next start",
      "next\" start",
      "node_modules\\\\.bin\\\\\\\\..\\\\next",
      "react-scripts start",
      "start-server.js"
    ]
  },
  "selection_generic_child_img": [
    {
      "Image|endswith": [
        "\\bash.exe",
        "\\bitsadmin.exe",
        "\\certutil.exe",
        "\\cscript.exe",
        "\\curl.exe",
        "\\ipconfig.exe",
        "\\mshta.exe",
        "\\net.exe",
        "\\net1.exe",
        "\\netsh.exe",
        "\\nslookup.exe",
        "\\OpenConsole.exe",
        "\\perl.exe",
        "\\ping.exe",
        "\\powershell.exe",
        "\\pwsh.exe",
        "\\py.exe",
        "\\python.exe",
        "\\pythonw.exe",
        "\\pyw.exe",
        "\\reg.exe",
        "\\regsvr32.exe",
        "\\rundll32.exe",
        "\\sc.exe",
        "\\sh.exe",
        "\\systeminfo.exe",
        "\\wget.exe",
        "\\whoami.exe",
        "\\wmic.exe",
        "\\wscript.exe",
        "\\wt.exe"
      ]
    },
    {
      "Image|contains": "\\python"
    }
  ],
  "selection_generic_child_cli_susp_pattern": {
    "CommandLine|contains": [
      "\\net",
      "bitsadmin",
      "certutil ",
      "conhost --headless",
      "cscript ",
      "curl",
      "ipconfig",
      "java",
      "lua",
      "mshta",
  

References:
  - https://github.com/msanft/CVE-2025-55182
  - https://nodejs.org/api/child_process.html#class-childprocess
  - https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
  - https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
Sigma Detection Rule: Rejetto HTTP File Server RCE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-19
ATT&CK techniques: T1190, T1505.003
Log source: /webserver

Description:
Detects attempts to exploit a Rejetto HTTP File Server (HFS) via CVE-2014-6287

Detection logic:
{
  "selection_search": {
    "cs-uri-query|contains": "?search=%00{."
  },
  "selection_payload": {
    "cs-uri-query|contains": [
      "save|",
      "powershell",
      "cmd.exe",
      "cmd /c",
      "cmd /r",
      "cmd /k",
      "cscript",
      "wscript",
      "python",
      "C:\\Users\\Public\\",
      "%comspec%"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://vk9-sec.com/hfs-code-execution-cve-2014-6287/
  - https://www.exploit-db.com/exploits/39161
  - https://github.com/Twigonometry/Cybersecurity-Notes/blob/c875b0f52df7d2c7a870e75e1f0c2679d417931d/Writeups/Hack%20the%20Box/Boxes/Optimum/10%20-%20Website.md
Sigma Detection Rule: Turla Group Commands May 2020
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2020-05-26
ATT&CK techniques: T1059.001, T1053.005, T1027
Log source: windows/process_creation

Description:
Detects commands used by Turla group as reported by ESET in May 2020

Detection logic:
{
  "selection_cli_1": {
    "CommandLine|contains": [
      "tracert -h 10 yahoo.com",
      ".WSqmCons))|iex;",
      "Fr`omBa`se6`4Str`ing"
    ]
  },
  "selection_cli_2": {
    "CommandLine|re": "net\\s+use\\s+https://docs.live.net",
    "CommandLine|contains": "@aol.co.uk"
  },
  "condition": "1 of selection_*"
}

References:
  - https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf