Repository: SigmaHQ/sigma
Pull request: Add Image to avoid FP
<!--
Thanks for your contribution. Please make sure to fill the contents of this template with the necessary information to ease and speed up the review process.

!!! PLEASE DO NOT DELETE ANY SECTION, COMMENT OR THE CONTENT OF THE TEMPLATE. !!!
-->

### Summary of the Pull Request

<!--
**Please note that this section is required and must be filled**
A short summary of your pull request.
-->
Fixes a false positives reported in #4812

Try many tests on windows 11 , can only get the commandline with `cmd /c "dir"`

### Changelog

fix: File And SubFolder Enumeration Via Dir Command - Fix false positive with firefox and similar CLI apps.
### Example Log Event

```
2019-05-21 09:35:12.705 +09:00 · File Enumeration Via Dir Command · low · IEWIN7 · Sysmon · 1 · Disc · T1217 · · 386 · Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3168.20.1502540827\1989220046" -childID 3 -isForBrowser -prefsHandle 3032 -prefMapHandle 3056 -prefsLen 6207 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3168 "\.\pipe\gecko-crash-server-pipe.3168" 3024 tab ¦ Proc: C:\Program Files\Mozilla Firefox\firefox.exe ¦ User: IEWIN7\IEUser ¦ ParentCmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" ¦ LID: 0xc796 ¦ LGUID: 365ABB72-39CC-5CE3-0000-002096C70000 ¦ PID: 3372 ¦ PGUID: 365ABB72-47C0-5CE3-0000-00108D243F00 ¦ ParentPID: 3168 ¦ ParentPGUID: 365ABB72-47BB-5CE3-0000-001053AF3E00 ¦ Description: Firefox ¦ Product: Firefox ¦ Company: Mozilla Corporation ¦ Hashes: SHA1=B18D536DA2242D6D9BB66CBE63CF312ABC9987A8,MD5=6AC1B75613E6143F94FF7A933B7993FC,SHA256=ABCE2767221B43127068C82BE7EBDF66FAA38B72F67676311FA4589075502A7F,IMPHASH=C5596CA4210F5F3474B68D7D54A73D16 · CurrentDirectory: C:\Users\IEUser\Downloads\ ¦ FileVersion: 66.0.5 ¦ IntegrityLevel: Low ¦ RuleName: ¦ TerminalSessionId: 1 ¦ UtcTime: 2019-05-21 00:35:12.474 · test.yml · ../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx
```
```
2022-01-07 07:27:21.407 +09:00 · File Enumeration Via Dir Command · low · win10-02.offsec.lan · Sec · 4688 · Disc · T1217 · · 5999468 · Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admmig\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admmig\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=96.0.4664.110 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=96.0.1054.62 --initial-client-data=0xf0,0xf4,0xf8,0xa4,0xfc,0x7ffa3209a740,0x7ffa3209a750,0x7ffa3209a760 ¦ Proc: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ¦ PID: 6196 ¦ User: admmig ¦ LID: 0x8e3563 · MandatoryLabel: HIGH_INTEGRITY ¦ ProcessId: 9120 ¦ SubjectDomainName: OFFSEC ¦ SubjectUserSid: S-1-5-21-4230534742-2542757381-3142984815-1111 ¦ TargetDomainName: - ¦ TargetLogonId: 0x0 ¦ TargetUserName: - ¦ TargetUserSid: S-1-0-0 ¦ TokenElevationType: FULL_TOKEN · test.yml · ../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1204-User execution/ID4688-Edge payload download via command.evtx
```

<!--
Fill this in case of false positive fixes
-->

### Fixed Issues

Fixes #4812

<!--
Link the fixed issues here, in case your commit fixes issues with rules or code
-->

### SigmaHQ Rule Creation Conventions

- If your PR adds new rules, please consider following and applying these [conventions](https://github.com/SigmaHQ/sigma-specification/blob/main/sigmahq/sigmahq_conventions.md)


Problem statement:
FPs with "File Enumeration Via Dir Command"
### Rule UUID

7c9340a9-e2ee-4e43-94c5-c54ebbea1006

### Example EventLog

2019-05-21 09:35:12.705 +09:00 · File Enumeration Via Dir Command · low · IEWIN7 · Sysmon · 1 · Disc · T1217 ·  · 386 · Cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3168.20.1502540827\1989220046" -childID 3 -isForBrowser -prefsHandle 3032 -prefMapHandle 3056 -prefsLen 6207 -prefMapSize 183351 -parentBuildID 20190507012018 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3168 "\\.\pipe\gecko-crash-server-pipe.3168" 3024 tab ¦ Proc: C:\Program Files\Mozilla Firefox\firefox.exe ¦ User: IEWIN7\IEUser ¦ ParentCmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" ¦ LID: 0xc796 ¦ LGUID: 365ABB72-39CC-5CE3-0000-002096C70000 ¦ PID: 3372 ¦ PGUID: 365ABB72-47C0-5CE3-0000-00108D243F00 ¦ ParentPID: 3168 ¦ ParentPGUID: 365ABB72-47BB-5CE3-0000-001053AF3E00 ¦ Description: Firefox ¦ Product: Firefox ¦ Company: Mozilla Corporation ¦ Hashes: SHA1=B18D536DA2242D6D9BB66CBE63CF312ABC9987A8,MD5=6AC1B75613E6143F94FF7A933B7993FC,SHA256=ABCE2767221B43127068C82BE7EBDF66FAA38B72F67676311FA4589075502A7F,IMPHASH=C5596CA4210F5F3474B68D7D54A73D16 · CurrentDirectory: C:\Users\IEUser\Downloads\ ¦ FileVersion: 66.0.5 ¦ IntegrityLevel: Low ¦ RuleName:  ¦ TerminalSessionId: 1 ¦ UtcTime: 2019-05-21 00:35:12.474 · test.yml · ../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Persistence/persist_firefox_comhijack_sysmon_11_13_7_1.evtx

2022-01-07 07:27:21.407 +09:00 · File Enumeration Via Dir Command · low · win10-02.offsec.lan · Sec · 4688 · Disc · T1217 ·  · 5999468 · Cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admmig\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admmig\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=96.0.4664.110 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=96.0.1054.62 --initial-client-data=0xf0,0xf4,0xf8,0xa4,0xfc,0x7ffa3209a740,0x7ffa3209a750,0x7ffa3209a760 ¦ Proc: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe ¦ PID: 6196 ¦ User: admmig ¦ LID: 0x8e3563 · MandatoryLabel: HIGH_INTEGRITY ¦ ProcessId: 9120 ¦ SubjectDomainName: OFFSEC ¦ SubjectUserSid: S-1-5-21-4230534742-2542757381-3142984815-1111 ¦ TargetDomainName: - ¦ TargetLogonId: 0x0 ¦ TargetUserName: - ¦ TargetUserSid: S-1-0-0 ¦ TokenElevationType: FULL_TOKEN · test.yml · ../hayabusa-sample-evtx/EVTX-to-MITRE-Attack/TA0002-Execution/T1204-User execution/ID4688-Edge payload download via command.evtx

### Description

This rule gives many false positives because it is not checking the process. You can probably reduce FPs significantly by adding `Image|endswith: \cmd.exe` as part of a selection.

However, this will still result in false positives from these kinds of logs:
```
2020-08-12 22:06:00.737 +09:00 · File Enumeration Via Dir Command · low · MSEDGEWIN10 · Sysmon · 1 · Disc · T1217 ·  · 342411 · Cmdline: C:\Windows\system32\cmd.exe /c rmdir /s/q C:\ProgramData\Microsoft\Windows\WER\ReportQueue\a_b_c_d_e > nul 2>&1 ¦ Proc: C:\Windows\System32\cmd.exe ¦ User: MSEDGEWIN10\IEUser ¦ ParentCmdline: WerTrigger.exe ¦ LID: 0x41c24 ¦ LGUID: 747F3D96-E911-5F33-0000-0020241C0400 ¦ PID: 7836 ¦ PGUID: 747F3D96-E938-5F33-0000-00101CA50E00 ¦ ParentPID: 7820 ¦ ParentPGUID: 747F3D96-E938-5F33-0000-00109CA00E00 ¦ Description: Windows Command Processor ¦ Product: Microsoft® Windows® Operating System ¦ Company: Microsoft Corporation ¦ Hashes: SHA1=8C5437CD76A89EC983E3B364E219944DA3DAB464,MD5=975B45B669930B0CC773EAF2B414206F,SHA256=3656F37A1C6951EC4496FABB8EE957D3A6E3C276D5A3785476B482C9C0D32EA2,IMPHASH=272245E2988E1E430500B852C4FB5E18 · CurrentDirectory: C:\Users\Public\tools\PrivEsc\cve-2020-1337-poc-master\ ¦ FileVersion: 10.0.17763.592 (WinBuild.160101.0800) ¦ IntegrityLevel: Medium ¦ OriginalFileName: Cmd.Exe ¦ ParentImage: C:\Users\Public\tools\PrivEsc\cve-2020-1337-poc-master\WerTrigger.exe ¦ RuleName:  ¦ TerminalSessionId: 1 ¦ UtcTime: 2020-08-12 13:06:00.734 · test.yml · ../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Privilege Escalation/privesc_spoolsv_spl_file_write_sysmon11.evtx

2021-08-08 08:33:15.303 +09:00 · File Enumeration Via Dir Command · low · MSEDGEWIN10 · Sysmon · 1 · Disc · T1217 ·  · 557006 · Cmdline: cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM \system32\AppHostRegistrationVerifier.exe ¦ Proc: C:\Windows\System32\cmd.exe ¦ User: MSEDGEWIN10\IEUser ¦ ParentCmdline: ? ¦ LID: 0x7a857 ¦ LGUID: 747F3D96-1231-610F-0000-002057A80700 ¦ PID: 11324 ¦ PGUID: 747F3D96-183B-610F-0000-0010DC6CD400 ¦ ParentPID: 1108 ¦ ParentPGUID: 00000000-0000-0000-0000-000000000000 ¦ Description: Windows Command Processor ¦ Product: Microsoft® Windows® Operating System ¦ Company: Microsoft Corporation ¦ Hashes: SHA1=8C5437CD76A89EC983E3B364E219944DA3DAB464,MD5=975B45B669930B0CC773EAF2B414206F,SHA256=3656F37A1C6951EC4496FABB8EE957D3A6E3C276D5A3785476B482C9C0D32EA2,IMPHASH=272245E2988E1E430500B852C4FB5E18 · CurrentDirectory: C:\Windows\system32\ ¦ FileVersion: 10.0.17763.592 (WinBuild.160101.0800) ¦ IntegrityLevel: Medium ¦ OriginalFileName: Cmd.Exe ¦ RuleName:  ¦ TerminalSessionId: 1 ¦ UtcTime: 2021-08-07 23:33:15.285 · test.yml · ../hayabusa-sample-evtx/EVTX-ATTACK-SAMPLES/Other/maldoc_mshta_via_shellbrowserwind_rundll32.evtx
```

where the attacker is running `rmdir` or has `windir` in the option followed by `-s` or `/s` somewhere. (In the example above, it is `\system32` but I think you can reverse the slashes and it still works.) So you would have to filter out these words, etc...

Just running `dir` in command prompt or powershell prompt does not result in a new process creation event. Only if it is called like `cmd /c "dir"`. I am not sure how you would do something similar with powershell so this may be limited to cmd.exe? (Please correct me if I am wrong). If that is the case though, then an attacker wouldn't be able to run `dir -s`, so you might want to remove the usage of `windash` and do `CommandLine|contains: 'dir*/s'` instead.

Hints from issue discussion:

Commit message: Add Image to avoid FP

Patch to review:
diff --git a/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml b/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml
index 97785562034..5845f08095d 100644
--- a/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml
+++ b/rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml
@@ -1,4 +1,4 @@
-title: File Enumeration Via Dir Command
+title: File Enumeration and SubFolder Via Dir Command
 id: 7c9340a9-e2ee-4e43-94c5-c54ebbea1006
 status: test
 description: |
@@ -7,7 +7,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
 author: frack113
 date: 2021/12/13
-modified: 2024/03/06
+modified: 2024/04/14
 tags:
     - attack.discovery
     - attack.t1217
@@ -15,9 +15,12 @@ logsource:
     category: process_creation
     product: windows
 detection:
-    selection:
-        CommandLine|contains|windash: 'dir*-s'
-    condition: selection
+    selection_cmd:
+        - Image|endswith: '\cmd.exe'
+        - OriginalFileName: Cmd.Exe
+    selection_cli:
+        CommandLine|contains: 'dir*/s'
+    condition: all of selection_*
 falsepositives:
     - Likely
 level: low


Code review comments:
diff_hunk: @@ -1,4 +1,4 @@
-title: File Enumeration Via Dir Command
+title: File Enumeration and SubFolder Via Dir Command
path: rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml
text: @user1:
```suggestion
title: File And SubFolder Enumeration Via Dir Command
```

diff_hunk: @@ -7,17 +7,20 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
 author: frack113
 date: 2021/12/13
-modified: 2024/03/06
+modified: 2024/04/14
 tags:
     - attack.discovery
     - attack.t1217
 logsource:
     category: process_creation
     product: windows
 detection:
-    selection:
-        CommandLine|contains|windash: 'dir*-s'
-    condition: selection
+    selection_cmd:
+        - Image|endswith: '\cmd.exe'
+        - OriginalFileName: Cmd.Exe
+    selection_cli:
+        CommandLine|contains: 'dir*/s'
path: rules/windows/process_creation/proc_creation_win_cmd_dir_execution.yml
text: @user1:
```suggestion
        CommandLine|contains|windash: 'dir*-s'
```