deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: RDP Over Reverse SSH Tunnel
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Samir Bousseaden
Date: 2019-02-16
ATT&CK techniques: T1572, T1021.001
Log source: windows/network_connection

Description:
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389

Detection logic:
{
  "selection_img": {
    "Image|endswith": "\\svchost.exe",
    "Initiated": "true",
    "SourcePort": 3389
  },
  "selection_destination": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "::1/128"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]37625346
Sigma Detection Rule: Suspicious Outbound SMTP Connections
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1048.003
Log source: windows/network_connection

Description:
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
The data may also be sent to an alternate network location from the main command and control server.


Detection logic:
{
  "selection": {
    "DestinationPort": [
      25,
      587,
      465,
      2525
    ],
    "Initiated": "true"
  },
  "filter_clients": {
    "Image|endswith": [
      "\\thunderbird.exe",
      "\\outlook.exe"
    ]
  },
  "filter_mailserver": {
    "Image|startswith": "C:\\Program Files\\Microsoft\\Exchange Server\\"
  },
  "filter_outlook": {
    "Image|startswith": "C:\\Program Files\\WindowsApps\\microsoft.windowscommunicationsapps_",
    "Image|endswith": "\\HxTsr.exe"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-5---exfiltration-over-alternative-protocol---smtp
  - https://www.ietf.org/rfc/rfc2821.txt
Sigma Detection Rule: Outbound Network Connection To Public IP Via Winlogon
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io
Date: 2023-04-28
ATT&CK techniques: T1218.011
Log source: windows/network_connection

Description:
Detects a "winlogon.exe" process that initiate network communications with public IP addresses

Detection logic:
{
  "selection": {
    "Image|endswith": "\\winlogon.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/
Sigma Detection Rule: Network Communication Initiated To Portmap.IO Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2024-05-31
ATT&CK techniques: T1041, T1090.002
Log source: windows/network_connection

Description:
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": ".portmap.io"
  },
  "condition": "selection"
}

References:
  - https://portmap.io/
  - https://github.com/rapid7/metasploit-framework/issues/11337
  - https://pro.twitter.com/JaromirHorejsi/status/[PII_REDACTED]46761892/photo/2
Sigma Detection Rule: Network Communication Initiated To File Sharing Domains From Process Located In Suspicious Folder
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2018-08-30
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.

Detection logic:
{
  "selection_paths": {
    "Image|contains": [
      ":\\$Recycle.bin",
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Fonts\\",
      ":\\Windows\\IME\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      ":\\Windows\\Temp\\",
      "\\AppData\\Temp\\",
      "\\config\\systemprofile\\",
      "\\Windows\\addins\\"
    ]
  },
  "selection_domains": {
    "Initiated": "true",
    "DestinationHostname|endswith": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.co.nz",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "pixeldrain.com",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/M_haggis/status/[PII_REDACTED]35889665
  - https://twitter.com/M_haggis/status/[PII_REDACTED]13066752
  - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker
  - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a
  - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1
Sigma Detection Rule: Network Communication With Crypto Mining Pool
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-10-26
ATT&CK techniques: T1496
Log source: windows/network_connection

Description:
Detects initiated network connections to crypto mining pools

Detection logic:
{
  "selection": {
    "DestinationHostname": [
      "alimabi.cn",
      "ap.luckpool.net",
      "bcn.pool.minergate.com",
      "bcn.vip.pool.minergate.com",
      "bohemianpool.com",
      "ca-aipg.miningocean.org",
      "ca-dynex.miningocean.org",
      "ca-neurai.miningocean.org",
      "ca-qrl.miningocean.org",
      "ca-upx.miningocean.org",
      "ca-zephyr.miningocean.org",
      "ca.minexmr.com",
      "ca.monero.herominers.com",
      "cbd.monerpool.org",
      "cbdv2.monerpool.org",
      "cryptmonero.com",
      "crypto-pool.fr",
      "crypto-pool.info",
      "cryptonight-hub.miningpoolhub.com",
      "d1pool.ddns.net",
      "d5pool.us",
      "daili01.monerpool.org",
      "de-aipg.miningocean.org",
      "de-dynex.miningocean.org",
      "de-zephyr.miningocean.org",
      "de.minexmr.com",
      "dl.nbminer.com",
      "donate.graef.in",
      "donate.ssl.xmrig.com",
      "donate.v2.xmrig.com",
      "donate.xmrig.com",
      "donate2.graef.in",
      "drill.moneroworld.com",
      "dwarfpool.com",
      "emercoin.com",
      "emercoin.net",
      "emergate.net",
      "ethereumpool.co",
      "eu.luckpool.net",
      "eu.minerpool.pw",
      "fcn-xmr.pool.minergate.com",
      "fee.xmrig.com",
      "fr-aipg.miningocean.org",
      "fr-dynex.miningocean.org",
      "fr-neurai.miningocean.org",
      "fr-qrl.miningocean.org",
      "fr-upx.miningocean.org",
      "fr-zephyr.miningocean.org",
      "fr.minexmr.com",
      "hellominer.com",
      "herominer

References:
  - https://www.poolwatch.io/coin/monero
  - https://github.com/stamparm/maltrail/blob/3ea70459b[PII_REDACTED]423c0a7d8b965ac5c40ea/trails/static/suspicious/crypto_mining.txt
  - https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
Sigma Detection Rule: Network Connection Initiated via Finger.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-11-19
ATT&CK techniques: T1071.004, T1059.003
Log source: windows/network_connection

Description:
Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\finger.exe"
  },
  "condition": "selection"
}

References:
  - https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
Sigma Detection Rule: Network Connection Initiated By Eqnedt32.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-14
ATT&CK techniques: T1203
Log source: windows/network_connection

Description:
Detects network connections from the Equation Editor process "eqnedt32.exe".

Detection logic:
{
  "selection": {
    "Image|endswith": "\\eqnedt32.exe"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/forensicitguy/status/[PII_REDACTED]86079238
  - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/
  - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/
Sigma Detection Rule: Network Connection Initiated Via Notepad.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: EagleEye Team
Date: 2020-05-14
ATT&CK techniques: T1055
Log source: windows/network_connection

Description:
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\notepad.exe"
  },
  "filter_optional_printing": {
    "DestinationPort": 9100
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]2749/https://www.sans.org/cyber-security-summit/archives/file/summit-archive[PII_REDACTED].pdf
  - https://www.cobaltstrike.com/blog/why-is-notepad-exe-connecting-to-the-internet
Sigma Detection Rule: Network Connection Initiated To Mega.nz
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-12-06
ATT&CK techniques: T1567.002
Log source: windows/network_connection

Description:
Detects a network connection initiated by a binary to "api.mega.co.nz".
Attackers were seen abusing file sharing websites similar to "mega.nz" in order to upload/download additional payloads.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": [
      "mega.co.nz",
      "mega.nz"
    ]
  },
  "condition": "selection"
}

References:
  - https://megatools.megous.com/
  - https://www.mandiant.com/resources/russian-targeting-gov-business
Sigma Detection Rule: Network Connection Initiated From Process Located In Potentially Suspicious Or Uncommon Location
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2017-03-19
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|contains": [
      ":\\$Recycle.bin",
      ":\\Perflogs\\",
      ":\\Temp\\",
      ":\\Users\\Default\\",
      ":\\Users\\Public\\",
      ":\\Windows\\Fonts\\",
      ":\\Windows\\IME\\",
      ":\\Windows\\System32\\Tasks\\",
      ":\\Windows\\Tasks\\",
      "\\config\\systemprofile\\",
      "\\Contacts\\",
      "\\Favorites\\",
      "\\Favourites\\",
      "\\Music\\",
      "\\Pictures\\",
      "\\Videos\\",
      "\\Windows\\addins\\"
    ]
  },
  "filter_main_domains": {
    "DestinationHostname|endswith": [
      ".githubusercontent.com",
      "anonfiles.com",
      "cdn.discordapp.com",
      "ddns.net",
      "dl.dropboxusercontent.com",
      "ghostbin.co",
      "github.com",
      "glitch.me",
      "gofile.io",
      "hastebin.com",
      "mediafire.com",
      "mega.co.nz",
      "mega.nz",
      "onrender.com",
      "pages.dev",
      "paste.ee",
      "pastebin.com",
      "pastebin.pl",
      "pastetext.net",
      "portmap.io",
      "privatlab.com",
      "privatlab.net",
      "send.exploit.in",
      "sendspace.com",
      "storage.googleapis.com",
      "storjshare.io",
      "supabase.co",
      "temp.sh",
      "transfer.sh",
      "trycloudflare.com",
      "ufile.io",
      "w3spaces.com",
      "workers.dev"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
Sigma Detection Rule: RegAsm.EXE Initiating Network Connection To Public IP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2024-04-25
ATT&CK techniques: T1218.009
Log source: windows/network_connection

Description:
Detects "RegAsm.exe" initiating a network connection to public IP adresses

Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\regasm.exe"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://app.any.run/tasks/ec[PII_REDACTED]-47eb-a0f4-4c6abb2e7668/
  - https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/
  - https://lolbas-project.github.io/lolbas/Binaries/Regasm/
Sigma Detection Rule: Network Connection Initiated By IMEWDBLD.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-22
ATT&CK techniques: T1105
Log source: windows/network_connection

Description:
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\IMEWDBLD.exe"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download
  - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/
Sigma Detection Rule: Network Connection Initiated To DevTunnels Domain
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Kamran Saifullah
Date: 2023-11-20
ATT&CK techniques: T1567.001, T1572
Log source: windows/network_connection

Description:
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "DestinationHostname|endswith": ".devtunnels.ms"
  },
  "condition": "selection"
}

References:
  - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2
  - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security
  - https://cydefops.com/devtunnels-unleashed
Sigma Detection Rule: Outbound RDP Connections Over Non-Standard Tools
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis
Date: 2019-05-15
ATT&CK techniques: T1021.001
Log source: windows/network_connection

Description:
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.


Detection logic:
{
  "selection": {
    "DestinationPort": 3389,
    "Initiated": "true"
  },
  "filter_main_mstsc": {
    "Image": [
      "C:\\Windows\\System32\\mstsc.exe",
      "C:\\Windows\\SysWOW64\\mstsc.exe"
    ]
  },
  "filter_optional_dns": {
    "Image": "C:\\Windows\\System32\\dns.exe",
    "SourcePort": 53,
    "Protocol": "udp"
  },
  "filter_optional_avast": {
    "Image|endswith": [
      "\\Avast Software\\Avast\\AvastSvc.exe",
      "\\Avast\\AvastSvc.exe"
    ]
  },
  "filter_optional_sysinternals_rdcman": {
    "Image|endswith": "\\RDCMan.exe"
  },
  "filter_optional_chrome": {
    "Image": "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"
  },
  "filter_optional_third_party": {
    "Image|endswith": [
      "\\FSAssessment.exe",
      "\\FSDiscovery.exe",
      "\\MobaRTE.exe",
      "\\mRemote.exe",
      "\\mRemoteNG.exe",
      "\\Passwordstate.exe",
      "\\RemoteDesktopManager.exe",
      "\\RemoteDesktopManager64.exe",
      "\\RemoteDesktopManagerFree.exe",
      "\\RSSensor.exe",
      "\\RTS2App.exe",
      "\\RTSApp.exe",
      "\\spiceworks-finder.exe",
      "\\Terminals.exe",
      "\\ws_TunnelService.exe"
    ]
  },
  "filter_optional_thor": {
    "Image|endswith": [
      "\\thor.exe",
      "\\thor64.exe"
    ]
  },
  "filter_optional_splunk": {
    "Image|startswith": "C:\\Program Files\\SplunkUniversalForwarder\\bin\\"
  },
  "filter_optional_sentinel_one": {
    "Image|endswith": "\\Ranger\\SentinelRanger.exe"
  },
  "filter_optional_firef

References:
  - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
Sigma Detection Rule: Remote Access Tool - AnyDesk Incoming Connection
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: @d4ns4n_ (Wuerth-Phoenix)
Date: 2024-09-02
ATT&CK techniques: T1219.002
Log source: windows/network_connection

Description:
Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.


Detection logic:
{
  "selection": {
    "Image|endswith": [
      "\\AnyDesk.exe",
      "\\AnyDeskMSI.exe"
    ],
    "Initiated": "false"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-2---anydesk-files-detected-test-on-windows
  - https://asec.ahnlab.com/en/40263/
Sigma Detection Rule: Network Connection Initiated By AddinUtil.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
ATT&CK techniques: T1218
Log source: windows/network_connection

Description:
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe".
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.


Detection logic:
{
  "selection": {
    "Initiated": "true",
    "Image|endswith": "\\addinutil.exe"
  },
  "condition": "selection"
}

References:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Sigma Detection Rule: Outbound Network Connection Initiated By Cmstp.EXE
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-30
ATT&CK techniques: T1218.003
Log source: windows/network_connection

Description:
Detects a network connection initiated by Cmstp.EXE
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.


Detection logic:
{
  "selection": {
    "Image|endswith": "\\cmstp.exe",
    "Initiated": "true"
  },
  "filter_main_local_ranges": {
    "DestinationIp|cidr": [
      "127.0.0.0/8",
      "10.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "::1/128",
      "fe80::/10",
      "fc00::/7"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
Sigma Detection Rule: Mimikatz Use
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), David ANDRE (additional keywords)
Date: 2017-01-10
ATT&CK techniques: T1003.002, T1003.004, T1003.001, T1003.006
Log source: windows/

Description:
This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Detection logic:
{
  "keywords": [
    "dpapi::masterkey",
    "eo.oe.kiwi",
    "event::clear",
    "event::drop",
    "gentilkiwi.com",
    "kerberos::golden",
    "kerberos::ptc",
    "kerberos::ptt",
    "kerberos::tgt",
    "Kiwi Legit Printer",
    "lsadump::",
    "mimidrv.sys",
    "\\mimilib.dll",
    "misc::printnightmare",
    "misc::shadowcopies",
    "misc::skeleton",
    "privilege::backup",
    "privilege::debug",
    "privilege::driver",
    "sekurlsa::"
  ],
  "filter": {
    "EventID": 15
  },
  "condition": "keywords and not filter"
}

References:
  - https://tools.thehacker.recipes/mimikatz/modules
Sigma Detection Rule: Suspicious Digital Signature Of AppX Package
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
Log source: windows/

Description:
Detects execution of AppX packages with known suspicious or malicious signature

Detection logic:
{
  "selection": {
    "EventID": 157,
    "subjectName": "CN=Foresee Consulting Inc., O=Foresee Consulting Inc., L=North York, S=Ontario, C=CA, SERIALNUMBER=1004913-1, OID.1.3.6.1.4.1.311.60.2.1.3=CA, OID.2.5.4.15=Private Organization"
  },
  "condition": "selection"
}

References:
  - Internal Research
  - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/
Sigma Detection Rule: Ngrok Usage with Remote Desktop Service
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-04-29
ATT&CK techniques: T1090
Log source: windows/

Description:
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour

Detection logic:
{
  "selection": {
    "EventID": 21,
    "Address|contains": "16777216"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/tekdefense/status/[PII_REDACTED]62556416?s=12&t=OTsHCBkQOTNs1k3USz65Zg
  - https://ngrok.com/
Sigma Detection Rule: DNS Server Error Failed Loading the ServerLevelPluginDLL
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-05-08
ATT&CK techniques: T1574.001
Log source: windows/

Description:
Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded

Detection logic:
{
  "selection": {
    "EventID": [
      150,
      770,
      771
    ]
  },
  "condition": "selection"
}

References:
  - https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83
  - https://technet.microsoft.com/en-us/library/cc735829(v=ws.10).aspx
  - https://twitter.com/gentilkiwi/status/[PII_REDACTED]44391680
Sigma Detection Rule: Failed DNS Zone Transfer
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Zach Mathis
Date: 2023-05-24
ATT&CK techniques: T1590.002
Log source: windows/

Description:
Detects when a DNS zone transfer failed.

Detection logic:
{
  "selection": {
    "EventID": 6004
  },
  "condition": "selection"
}

References:
  - https://kb.eventtracker.com/evtpass/evtpages/EventId_6004_Microsoft-Windows-DNS-Server-Service_65410.asp