@panguard-ai/panguard-guard 1.4.5 → 2.0.0

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_legacy_option.yml

@@ -1,30 +0,0 @@
-title: Suspicious High IntegrityLevel Conhost Legacy Option
-id: 3037d961-21e9-4732-b27a-637bcc7bf539
-status: test
-description: ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
-references:
-    - https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29
-    - https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/
-    - https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control
-author: frack113
-date: 2022-12-09
-modified: 2024-12-01
-tags:
-    - attack.defense-evasion
-    - attack.t1202
-logsource:
-    product: windows
-    category: process_creation
-detection:
-    selection:
-        IntegrityLevel:
-            - 'High'
-            - 'S-1-16-12288'
-        CommandLine|contains|all:
-            - 'conhost.exe'
-            - '0xffffffff'
-            - '-ForceV1'
-    condition: selection
-falsepositives:
-    - Very Likely, including launching cmd.exe via Run As Administrator
-level: informational

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_path_traversal.yml

@@ -1,22 +0,0 @@
-title: Conhost.exe CommandLine Path Traversal
-id: ee5e119b-1f75-4b34-add8-3be976961e39
-status: test
-description: detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking
-references:
-    - https://pentestlab.blog/2020/07/06/indirect-command-execution/
-author: Nasreddine Bencherchali (Nextron Systems)
-date: 2022-06-14
-tags:
-    - attack.execution
-    - attack.t1059.003
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection:
-        ParentCommandLine|contains: 'conhost'
-        CommandLine|contains: '/../../'
-    condition: selection
-falsepositives:
-    - Unlikely
-level: high

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_susp_child_process.yml

@@ -1,33 +0,0 @@
-title: Uncommon Child Process Of Conhost.EXE
-id: 7dc2dedd-7603-461a-bc13-15803d132355
-related:
-    - id: dfa03a09-8b92-4d83-8e74-f72839b1c407
-      type: similar
-status: test
-description: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
-references:
-    - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
-author: omkar72
-date: 2020-10-25
-modified: 2023-12-11
-tags:
-    - attack.defense-evasion
-    - attack.t1202
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection:
-        ParentImage|endswith: '\conhost.exe'
-    filter_main_conhost:
-        Image|endswith: ':\Windows\System32\conhost.exe'
-    filter_main_null:
-        Image: null
-    filter_main_empty:
-        Image: ''
-    filter_optional_provider:
-        Provider_Name: 'SystemTraceProvider-Process'  # Race condition with SystemTrace doesn't provide all fields.
-    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
-falsepositives:
-    - Unknown
-level: medium

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml

@@ -1,44 +0,0 @@
-title: Potentially Suspicious Child Processes Spawned by ConHost
-id: dfa03a09-8b92-4d83-8e74-f72839b1c407
-related:
-    - id: 7dc2dedd-7603-461a-bc13-15803d132355
-      type: similar
-status: experimental
-description: Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.
-references:
-    - https://tria.ge/241015-l98snsyeje/behavioral2
-author: Swachchhanda Shrawan Poudel (Nextron Systems)
-date: 2025-02-05
-tags:
-    - attack.t1202
-    - attack.defense-evasion
-    - attack.t1218
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_parent:
-        ParentImage|endswith: '\conhost.exe'
-    selection_child:
-        - Image|endswith:
-              - '\cmd.exe'             # Windows Command Prompt
-              - '\cscript.exe'         # Windows Script Host (used for scripting exploits)
-              - '\mshta.exe'           # MSHTA (HTML Application Host, often abused)
-              - '\powershell_ise.exe'  # PowerShell ISE
-              - '\powershell.exe'      # Windows PowerShell
-              - '\pwsh.exe'            # PowerShell Core
-              - '\regsvr32.exe'        # Windows Registry Server (commonly used for exploits)
-              - '\wscript.exe'         # Windows Script Host (for executing scripts)
-        - OriginalFileName:
-              - 'cmd.exe'
-              - 'cscript.exe'
-              - 'mshta.exe'
-              - 'powershell_ise.exe'
-              - 'powershell.exe'
-              - 'pwsh.dll'
-              - 'regsvr32.exe'
-              - 'wscript.exe'
-    condition: all of selection_*
-falsepositives:
-    - Legitimate administrative tasks using `conhost.exe` to spawn child processes such as `cmd.exe`, `powershell.exe`, or `regsvr32.exe`.
-level: high

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_conhost_uncommon_parent.yml

@@ -1,55 +0,0 @@
-title: Conhost Spawned By Uncommon Parent Process
-id: cbb9e3d1-2386-4e59-912e-62f1484f7a89
-status: test
-description: Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.
-references:
-    - https://www.elastic.co/guide/en/security/current/conhost-spawned-by-suspicious-parent-process.html
-author: Tim Rauch, Elastic (idea)
-date: 2022-09-28
-modified: 2025-03-06
-tags:
-    - attack.execution
-    - attack.t1059
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection:
-        Image|endswith: '\conhost.exe'
-        ParentImage|endswith:
-            - '\explorer.exe'
-            # - '\csrss.exe'  # Legitimate parent as seen in EchoTrail https://www.echotrail.io/insights/search/csrss.exe
-            # - '\ctfmon.exe'  # Seen several times in a testing environment
-            # - '\dllhost.exe'  # FP on clean system from grandparent 'svchost.exe -k DcomLaunch -p'
-            - '\lsass.exe'
-            - '\regsvr32.exe'
-            - '\rundll32.exe'
-            - '\services.exe'
-            - '\smss.exe'
-            - '\spoolsv.exe'
-            - '\svchost.exe'
-            - '\userinit.exe'
-            # - '\wermgr.exe'  # Legitimate parent as seen in EchoTrail https://www.echotrail.io/insights/search/wermgr.exe
-            - '\wininit.exe'
-            - '\winlogon.exe'
-    filter_main_svchost:
-        ParentCommandLine|contains:
-            - '-k apphost -s AppHostSvc'
-            - '-k imgsvc'
-            - '-k localService -p -s RemoteRegistry'
-            - '-k LocalSystemNetworkRestricted -p -s NgcSvc'
-            - '-k NetSvcs -p -s NcaSvc'
-            - '-k netsvcs -p -s NetSetupSvc'
-            - '-k netsvcs -p -s wlidsvc'
-            - '-k NetworkService -p -s DoSvc'
-            - '-k wsappx -p -s AppXSvc'
-            - '-k wsappx -p -s ClipSVC'
-            - '-k wusvcs -p -s WaaSMedicSvc'
-    filter_optional_dropbox:
-        ParentCommandLine|contains:
-            - 'C:\Program Files (x86)\Dropbox\Client\'
-            - 'C:\Program Files\Dropbox\Client\'
-    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
-falsepositives:
-    - Unknown
-level: medium

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_control_panel_item.yml

@@ -1,43 +0,0 @@
-title: Control Panel Items
-id: 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
-status: test
-description: Detects the malicious use of a control panel item
-references:
-    - https://ired.team/offensive-security/code-execution/code-execution-through-control-panel-add-ins
-author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
-date: 2020-06-22
-modified: 2023-10-11
-tags:
-    - attack.privilege-escalation
-    - attack.execution
-    - attack.defense-evasion
-    - attack.t1218.002
-    - attack.persistence
-    - attack.t1546
-logsource:
-    product: windows
-    category: process_creation
-detection:
-    selection_reg_img:
-        - Image|endswith: '\reg.exe'
-        - OriginalFileName: 'reg.exe'
-    selection_reg_cli:
-        CommandLine|contains|all:
-            - 'add'
-            - 'CurrentVersion\Control Panel\CPLs'
-    selection_cpl:
-        CommandLine|endswith: '.cpl'
-    filter_cpl_sys:
-        CommandLine|contains:
-            - '\System32\'
-            - '%System%'
-            - '|C:\Windows\system32|'
-    filter_cpl_igfx:
-        CommandLine|contains|all:
-            - 'regsvr32 '
-            - ' /s '
-            - 'igfxCPL.cpl'
-    condition: all of selection_reg_* or (selection_cpl and not 1 of filter_cpl_*)
-falsepositives:
-    - Unknown
-level: high

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_createdump_lolbin_execution.yml

@@ -1,36 +0,0 @@
-title: CreateDump Process Dump
-id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48
-related:
-    - id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e
-      type: similar
-status: test
-description: Detects uses of the createdump.exe LOLOBIN utility to dump process memory
-references:
-    - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/
-    - https://twitter.com/bopin2020/status/1366400799199272960
-author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
-date: 2022-01-04
-modified: 2022-08-19
-tags:
-    - attack.defense-evasion
-    - attack.t1036
-    - attack.t1003.001
-    - attack.credential-access
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_img:
-        - Image|endswith: '\createdump.exe'
-        - OriginalFileName: 'FX_VER_INTERNALNAME_STR'
-    selection_cli:
-        CommandLine|contains:
-            - ' -u ' # Short version of '--full'
-            - ' --full '
-            - ' -f ' # Short version of '--name'
-            - ' --name '
-            - '.dmp '
-    condition: all of selection_*
-falsepositives:
-    - Command lines that use the same flags
-level: high

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_credential_guard_registry_tampering.yml

@@ -1,62 +0,0 @@
-title: Windows Credential Guard Registry Tampering Via CommandLine
-id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9
-related:
-    - id: 73921b9c-cafd-4446-b0c6-fdb0ace42bc0
-      type: similar
-    - id: d645ef86-2396-48a1-a2b6-b629ca3f57ff
-      type: similar
-status: experimental
-description: |
-    Detects attempts to add, modify, or delete Windows Credential Guard related registry keys or values via command line tools such as Reg.exe or PowerShell.
-    Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them.
-    Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation.
-    The rule matches suspicious command lines that target DeviceGuard or LSA registry paths and manipulate keys like EnableVirtualizationBasedSecurity, RequirePlatformSecurityFeatures, or LsaCfgFlags.
-    Such activity may indicate an attempt to disable or tamper with Credential Guard, potentially exposing sensitive credentials for misuse.
-references:
-    - https://woshub.com/disable-credential-guard-windows/
-    - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard
-author: Swachchhanda Shrawan Poudel (Nextron Systems)
-date: 2025-12-26
-tags:
-    - attack.defense-evasion
-    - attack.t1562.001
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_img:
-        - Image|endswith:
-              - '\powershell.exe'
-              - '\pwsh.exe'
-              - '\reg.exe'
-        - OriginalFileName:
-              - 'PowerShell.EXE'
-              - 'pwsh.dll'
-              - 'reg.exe'
-    selection_cli:
-        CommandLine|contains:
-            # add/modify
-            - 'add '
-            - 'New-ItemProperty '
-            - 'Set-ItemProperty '
-            - 'si '  # SetItem Alias
-            # delete
-            - 'delete '
-            - 'del '
-            - 'Remove-ItemProperty '
-            - 'rp '
-    selection_key_base:
-        CommandLine|contains:
-            - '\Control\DeviceGuard'
-            - '\Control\LSA'
-            - 'Software\Policies\Microsoft\Windows\DeviceGuard'
-    selection_key_specific:
-        CommandLine|contains:
-            - 'EnableVirtualizationBasedSecurity'
-            - 'RequirePlatformSecurityFeatures'
-            - 'LsaCfgFlags'
-    condition: all of selection_*
-falsepositives:
-    - Unlikely
-level: high
-regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_credential_guard_registry_tampering/info.yml

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_compilation.yml

@@ -1,29 +0,0 @@
-title: Dynamic .NET Compilation Via Csc.EXE - Hunting
-id: acf2807c-805b-4042-aab9-f86b6ba9cb2b
-related:
-    - id: dcaa3f04-70c3-427a-80b4-b870d73c94c4
-      type: derived
-status: test
-description: Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
-references:
-    - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
-    - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
-    - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
-    - https://twitter.com/gN3mes1s/status/1206874118282448897
-author: Nasreddine Bencherchali (Nextron Systems)
-date: 2023-08-02
-tags:
-    - attack.defense-evasion
-    - attack.t1027.004
-    - detection.threat-hunting
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection:
-        Image|endswith: '\csc.exe'
-        CommandLine|contains: '/noconfig /fullpaths @'
-    condition: selection
-falsepositives:
-    - Many legitimate applications make use of dynamic compilation. Use this rule to hunt for anomalies
-level: medium

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml

@@ -1,73 +0,0 @@
-title: Dynamic .NET Compilation Via Csc.EXE
-id: dcaa3f04-70c3-427a-80b4-b870d73c94c4
-status: test
-description: Detects execution of "csc.exe" to compile .NET code. Attackers often leverage this to compile code on the fly and use it in other stages.
-references:
-    - https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/
-    - https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf
-    - https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/
-    - https://twitter.com/gN3mes1s/status/1206874118282448897
-    - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe
-author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
-date: 2019-08-24
-modified: 2024-05-27
-tags:
-    - attack.defense-evasion
-    - attack.t1027.004
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_img:
-        Image|endswith: '\csc.exe'
-    selection_susp_location_1:
-        CommandLine|contains:
-            - ':\Perflogs\'
-            - ':\Users\Public\'
-            - '\AppData\Local\Temp\' # User execution
-            - '\Temporary Internet'
-            - '\Windows\Temp\' # Admin execution
-    selection_susp_location_2:
-        - CommandLine|contains|all:
-              - ':\Users\'
-              - '\Favorites\'
-        - CommandLine|contains|all:
-              - ':\Users\'
-              - '\Favourites\'
-        - CommandLine|contains|all:
-              - ':\Users\'
-              - '\Contacts\'
-        - CommandLine|contains|all:
-              - ':\Users\'
-              - '\Pictures\'
-    selection_susp_location_3:
-        CommandLine|re: '([Pp]rogram[Dd]ata|%([Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\([Ll]ocal([Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
-    filter_main_programfiles:
-        # Note: this is a generic filter. You could baseline execution in your env for a more robust rule
-        ParentImage|startswith:
-            - 'C:\Program Files (x86)\' # https://twitter.com/gN3mes1s/status/1206874118282448897
-            - 'C:\Program Files\' # https://twitter.com/gN3mes1s/status/1206874118282448897
-    filter_main_sdiagnhost:
-        ParentImage: 'C:\Windows\System32\sdiagnhost.exe' # https://twitter.com/gN3mes1s/status/1206874118282448897
-    filter_main_w3p:
-        ParentImage: 'C:\Windows\System32\inetsrv\w3wp.exe' # https://twitter.com/gabriele_pippi/status/1206907900268072962
-    filter_optional_chocolatey:
-        ParentImage: # Chocolatey https://chocolatey.org/
-            - 'C:\ProgramData\chocolatey\choco.exe'
-            - 'C:\ProgramData\chocolatey\tools\shimgen.exe'
-    filter_optional_defender:
-        ParentCommandLine|contains: '\ProgramData\Microsoft\Windows Defender Advanced Threat Protection'
-    filter_optional_ansible:
-        # Note: As ansible is widely used we exclude it with this generic filter.
-        # A better option would be to filter based on script content basis or other marker while hunting
-        ParentCommandLine|contains:
-            # '{"failed":true,"msg":"Ansible requires PowerShell v3.0 or newer"}'
-            - 'JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw'
-            - 'cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA'
-            - 'nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA'
-    condition: selection_img and 1 of selection_susp_location_* and not 1 of filter_main_* and not 1 of filter_optional_*
-falsepositives:
-    - Legitimate software from program files - https://twitter.com/gN3mes1s/status/1206874118282448897
-    - Legitimate Microsoft software - https://twitter.com/gabriele_pippi/status/1206907900268072962
-    - Ansible
-level: medium

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csc_susp_parent.yml

@@ -1,86 +0,0 @@
-title: Csc.EXE Execution Form Potentially Suspicious Parent
-id: b730a276-6b63-41b8-bcf8-55930c8fc6ee
-status: test
-description: Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
-references:
-    - https://www.uptycs.com/blog/warzonerat-can-now-evade-with-process-hollowing
-    - https://reaqta.com/2017/11/short-journey-darkvnc/
-    - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
-author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
-date: 2019-02-11
-modified: 2024-05-27
-tags:
-    - attack.execution
-    - attack.t1059.005
-    - attack.t1059.007
-    - attack.defense-evasion
-    - attack.t1218.005
-    - attack.t1027.004
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_img:
-        - Image|endswith: '\csc.exe'
-        - OriginalFileName: 'csc.exe'
-    selection_parent_generic:
-        ParentImage|endswith:
-            - '\cscript.exe'
-            - '\excel.exe'
-            - '\mshta.exe'
-            - '\onenote.exe'
-            - '\outlook.exe'
-            - '\powerpnt.exe'
-            - '\winword.exe'
-            - '\wscript.exe'
-    selection_parent_powershell:
-        ParentImage|endswith:
-            - '\powershell.exe'
-            - '\pwsh.exe'
-        ParentCommandLine|contains:
-            - '-Encoded '
-            - 'FromBase64String'
-    selection_parent_susp_location:
-        - ParentCommandLine|re: '([Pp]rogram[Dd]ata|%([Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\([Ll]ocal([Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
-        - ParentCommandLine|contains:
-              - ':\PerfLogs\'
-              - ':\Users\Public\'
-              - ':\Windows\Temp\'
-              - '\Temporary Internet'
-        - ParentCommandLine|contains|all:
-              - ':\Users\'
-              - '\Favorites\'
-        - ParentCommandLine|contains|all:
-              - ':\Users\'
-              - '\Favourites\'
-        - ParentCommandLine|contains|all:
-              - ':\Users\'
-              - '\Contacts\'
-        - ParentCommandLine|contains|all:
-              - ':\Users\'
-              - '\Pictures\'
-    filter_main_programfiles:
-        # Note: this is a generic filter. You could baseline execution in your env for a more robust rule
-        ParentImage|startswith:
-            - 'C:\Program Files (x86)\' # https://twitter.com/gN3mes1s/status/1206874118282448897
-            - 'C:\Program Files\' # https://twitter.com/gN3mes1s/status/1206874118282448897
-    filter_main_sdiagnhost:
-        ParentImage: 'C:\Windows\System32\sdiagnhost.exe' # https://twitter.com/gN3mes1s/status/1206874118282448897
-    filter_main_w3p:
-        ParentImage: 'C:\Windows\System32\inetsrv\w3wp.exe' # https://twitter.com/gabriele_pippi/status/1206907900268072962
-    filter_optional_chocolatey:
-        ParentImage: 'C:\ProgramData\chocolatey\choco.exe' # Chocolatey https://chocolatey.org/
-    filter_optional_defender:
-        ParentCommandLine|contains: '\ProgramData\Microsoft\Windows Defender Advanced Threat Protection'
-    filter_optional_ansible:
-        # Note: As ansible is widely used we exclude it with this generic filter.
-        # A better option would be to filter based on script content basis or other marker while hunting
-        ParentCommandLine|contains:
-            # '{"failed":true,"msg":"Ansible requires PowerShell v3.0 or newer"}'
-            - 'JwB7ACIAZgBhAGkAbABlAGQAIgA6AHQAcgB1AGUALAAiAG0AcwBnACIAOgAiAEEAbgBzAGkAYgBsAGUAIAByAGUAcQB1AGkAcgBlAHMAIABQAG8AdwBlAHIAUwBoAGUAbABsACAAdgAzAC4AMAAgAG8AcgAgAG4AZQB3AGUAcgAiAH0AJw'
-            - 'cAewAiAGYAYQBpAGwAZQBkACIAOgB0AHIAdQBlACwAIgBtAHMAZwAiADoAIgBBAG4AcwBpAGIAbABlACAAcgBlAHEAdQBpAHIAZQBzACAAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAMwAuADAAIABvAHIAIABuAGUAdwBlAHIAIgB9ACcA'
-            - 'nAHsAIgBmAGEAaQBsAGUAZAAiADoAdAByAHUAZQAsACIAbQBzAGcAIgA6ACIAQQBuAHMAaQBiAGwAZQAgAHIAZQBxAHUAaQByAGUAcwAgAFAAbwB3AGUAcgBTAGgAZQBsAGwAIAB2ADMALgAwACAAbwByACAAbgBlAHcAZQByACIAfQAnA'
-    condition: selection_img and 1 of selection_parent_* and not 1 of filter_main_* and not 1 of filter_optional_*
-falsepositives:
-    - Unknown
-level: high

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csi_execution.yml

@@ -1,35 +0,0 @@
-title: Suspicious Csi.exe Usage
-id: 40b95d31-1afc-469e-8d34-9a3a667d058e
-status: test
-description: Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'
-references:
-    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/
-    - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/
-    - https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/
-    - https://twitter.com/Z3Jpa29z/status/1317545798981324801
-author: Konstantin Grishchenko, oscd.community
-date: 2020-10-17
-modified: 2022-07-11
-tags:
-    - attack.lateral-movement
-    - attack.execution
-    - attack.t1072
-    - attack.defense-evasion
-    - attack.t1218
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_img:
-        - Image|endswith:
-              - '\csi.exe'
-              - '\rcsi.exe'
-        - OriginalFileName:
-              - 'csi.exe'
-              - 'rcsi.exe'
-    selection_cli:
-        Company: 'Microsoft Corporation'
-    condition: all of selection*
-falsepositives:
-    - Legitimate usage by software developers
-level: medium

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csi_use_of_csharp_console.yml

@@ -1,28 +0,0 @@
-title: Suspicious Use of CSharp Interactive Console
-id: a9e416a8-e613-4f8b-88b8-a7d1d1af2f61
-status: test
-description: Detects the execution of CSharp interactive console by PowerShell
-references:
-    - https://redcanary.com/blog/detecting-attacks-leveraging-the-net-framework/
-author: Michael R. (@nahamike01)
-date: 2020-03-08
-modified: 2022-07-14
-tags:
-    - attack.execution
-    - attack.defense-evasion
-    - attack.t1127
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection:
-        Image|endswith: '\csi.exe'
-        ParentImage|endswith:
-            - '\powershell.exe'
-            - '\pwsh.exe'
-            - '\powershell_ise.exe'
-        OriginalFileName: 'csi.exe'
-    condition: selection
-falsepositives:
-    - Possible depending on environment. Pair with other factors such as net connections, command-line args, etc.
-level: high

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_csvde_export.yml

@@ -1,30 +0,0 @@
-title: Active Directory Structure Export Via Csvde.EXE
-id: e5d36acd-acb4-4c6f-a13f-9eb203d50099
-status: test
-description: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.
-references:
-    - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms
-    - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
-    - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit
-    - https://redcanary.com/blog/msix-installers/
-author: Nasreddine Bencherchali (Nextron Systems)
-date: 2023-03-14
-tags:
-    - attack.exfiltration
-    - attack.discovery
-    - attack.t1087.002
-logsource:
-    category: process_creation
-    product: windows
-detection:
-    selection_img:
-        - Image|endswith: '\csvde.exe'
-        - OriginalFileName: 'csvde.exe'
-    selection_remote:
-        CommandLine|contains: ' -f'
-    filter_import:
-        CommandLine|contains: ' -i'
-    condition: all of selection_* and not 1 of filter_*
-falsepositives:
-    - Unknown
-level: medium

package/bundled-rules/sigma-rules/community/windows/process_creation/proc_creation_win_curl_cookie_hijacking.yml

@@ -1,25 +0,0 @@
-title: Potential Cookies Session Hijacking
-id: 5a6e1e16-07de-48d8-8aae-faa766c05e88
-status: test
-description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.
-references:
-    - https://curl.se/docs/manpage.html
-author: Nasreddine Bencherchali (Nextron Systems)
-date: 2023-07-27
-tags:
-    - attack.execution
-logsource:
-    product: windows
-    category: process_creation
-detection:
-    selection_img:
-        - Image|endswith: '\curl.exe'
-        - OriginalFileName: 'curl.exe'
-    selection_cli:
-        - CommandLine|re: '\s-c\s'
-        - CommandLine|contains: '--cookie-jar'
-    condition: all of selection_*
-falsepositives:
-    - Unknown
-level: medium
-regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml