Merge PR #5898 from @FlorianBracq - Set groups in regular expressions as non capturing

update: Dynamic .NET Compilation Via Csc.EXE - Update regex to use a non-capturing group
update: Csc.EXE Execution Form Potentially Suspicious Parent - Update regex to use a non-capturing group
update: Invoke-Obfuscation Obfuscated IEX Invocation - Update regex to use a non-capturing group
update: Invoke-Obfuscation Via Stdin - Update regex to use a non-capturing group
update: Invoke-Obfuscation Via Use Clip - Update regex to use a non-capturing group
update: Powershell Token Obfuscation - Process Creation - Update regex to use a non-capturing group
update: Potential Rundll32 Execution With DLL Stored In ADS - Update regex to use a non-capturing group
update: Suspicious Copy From or To System Directory - Update regex to use a non-capturing group
update: Obfuscated IP Download Activity - Update regex to use a non-capturing group
update: Obfuscated IP Via CLI - Update regex to use a non-capturing group
update: Uncommon Svchost Command Line Parameter - Update regex to use a non-capturing group
---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>

Author: 3 people

rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml

@@ -10,7 +10,7 @@ references:
     - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe
 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
 date: 2019-08-24
-modified: 2024-05-27
+modified: 2026-03-23
 tags:
     - attack.defense-evasion
     - attack.t1027.004
@@ -41,7 +41,7 @@ detection:
               - ':\Users\'
               - '\Pictures\'
     selection_susp_location_3:
-        CommandLine|re: '([Pp]rogram[Dd]ata|%([Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\([Ll]ocal([Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
+        CommandLine|re: '(?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
     filter_main_programfiles:
         # Note: this is a generic filter. You could baseline execution in your env for a more robust rule
         ParentImage|startswith:

rules/windows/process_creation/proc_creation_win_csc_susp_parent.yml

@@ -8,7 +8,7 @@ references:
     - https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
 date: 2019-02-11
-modified: 2024-05-27
+modified: 2026-03-23
 tags:
     - attack.execution
     - attack.t1059.005
@@ -41,7 +41,7 @@ detection:
             - '-Encoded '
             - 'FromBase64String'
     selection_parent_susp_location:
-        - ParentCommandLine|re: '([Pp]rogram[Dd]ata|%([Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\([Ll]ocal([Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
+        - ParentCommandLine|re: '(?:[Pp]rogram[Dd]ata|%(?:[Ll]ocal)?[Aa]pp[Dd]ata%|\\[Aa]pp[Dd]ata\\(?:[Ll]ocal(?:[Ll]ow)?|[Rr]oaming))\\[^\\]{1,256}$'
         - ParentCommandLine|contains:
               - ':\PerfLogs\'
               - ':\Users\Public\'

rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
 author: 'Daniel Bohannon (@Mandiant/@FireEye), oscd.community'
 date: 2019-11-08
-modified: 2022-12-31
+modified: 2026-03-16
 tags:
     - attack.defense-evasion
     - attack.t1027
@@ -20,7 +20,7 @@ detection:
         - CommandLine|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\['
         - CommandLine|re: '\$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\['
         - CommandLine|re: '\$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\['
-        - CommandLine|re: '\$env:ComSpec\[(\s*\d{1,3}\s*,){2}'
+        - CommandLine|re: '\$env:ComSpec\[(?:\s*\d{1,3}\s*,){2}'
         - CommandLine|re: '\*mdr\*\W\s*\)\.Name'
         - CommandLine|re: '\$VerbosePreference\.ToString\('
         - CommandLine|re: '\[String\]\s*\$VerbosePreference'

rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009 # (Task28)
 author: Nikita Nazarov, oscd.community
 date: 2020-10-12
-modified: 2024-04-16
+modified: 2026-03-16
 tags:
     - attack.defense-evasion
     - attack.t1027
@@ -17,7 +17,7 @@ logsource:
     product: windows
 detection:
     selection:
-        CommandLine|re: '(?i)(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*"'
+        CommandLine|re: '(?i)(?:set).*&&\s?set.*(?:environment|invoke|\$\{?input).*&&.*"'
     condition: selection
 falsepositives:
     - Unknown

rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml

@@ -6,7 +6,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009 # (Task29)
 author: Nikita Nazarov, oscd.community
 date: 2020-10-09
-modified: 2024-04-15
+modified: 2026-03-16
 tags:
     - attack.defense-evasion
     - attack.t1027
@@ -19,7 +19,7 @@ detection:
     selection:
         # Example 1: C:\WINdoWS\sySteM32\CMd /c " ECho\Invoke-Expression (New-Object Net.WebClient).DownloadString|Clip.Exe&&C:\WINdoWS\sySteM32\CMd /c pOWerSheLl -STa . ( \"{2}{0}{1}\"-f'dd-',(\"{0}{1}\" -f 'T','ype' ),'A' ) -Assembly ( \"{4}{1}{3}{0}{2}\"-f (\"{0}{1}\" -f 'nd','ow'),( \"{1}{0}\"-f'.W','stem' ),( \"{2}{1}{0}\" -f 'rms','Fo','s.'),'i','Sy') ; ${exeCUtIOnCONTeXT}.\"INV`oKECOM`m`ANd\".\"INV`ok`ESCriPT\"( ( [sYSteM.wiNDoWS.forMs.ClIPboaRD]::( \"{2}{0}{1}\" -f'Ex','t',(\"{0}{1}\" -f'Get','t' ) ).\"iNvo`Ke\"( )) ) ; [System.Windows.Forms.Clipboard]::(\"{1}{0}\" -f 'ar','Cle' ).\"in`V`oKE\"( )"
         # Example 2: C:\WINDowS\sYsTEM32\CmD.eXE /C" echo\Invoke-Expression (New-Object Net.WebClient).DownloadString| C:\WIndOWs\SYSteM32\CLip &&C:\WINDowS\sYsTEM32\CmD.eXE /C POWERSHeLL -sT -noL [Void][System.Reflection.Assembly]::( \"{0}{3}{4}{1}{2}\" -f( \"{0}{1}\"-f'Lo','adW' ),( \"{0}{1}\"-f 'Par','t'),( \"{0}{1}{2}\"-f 'ial','N','ame'),'it','h' ).\"in`VO`KE\"( ( \"{3}{1}{4}{5}{2}{0}\"-f'rms','ystem.Windo','Fo','S','w','s.' )) ; ( [wIndows.fOrms.cLIPBOArD]::( \"{1}{0}\"-f'T',( \"{1}{0}\" -f'tEX','gET' )).\"i`Nvoke\"( ) ) ^^^| ^^^& ( ( ^^^& ( \"{2}{1}{0}\"-f 'e',( \"{2}{1}{0}\"-f'IABl','aR','v' ),( \"{0}{1}\"-f'Get','-' ) ) ( \"{1}{0}\"-f'*','*MDr' )).\"n`Ame\"[3,11,2]-jOin'') ; [Windows.Forms.Clipboard]::( \"{0}{1}\" -f (\"{1}{0}\"-f'tT','Se' ),'ext').\"in`VoKe\"(' ' )"
-        CommandLine|re: '(?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)'
+        CommandLine|re: '(?i)echo.*clip.*&&.*(?:Clipboard|i`?n`?v`?o`?k`?e`?)'
     condition: selection
 falsepositives:
     - Unknown

rules/windows/process_creation/proc_creation_win_powershell_token_obfuscation.yml

@@ -9,7 +9,7 @@ references:
     - https://github.com/danielbohannon/Invoke-Obfuscation
 author: frack113
 date: 2022-12-27
-modified: 2024-08-11
+modified: 2026-03-16
 tags:
     - attack.defense-evasion
     - attack.t1027.009
@@ -22,9 +22,9 @@ detection:
         #   IN`V`o`Ke-eXp`ResSIOn (Ne`W-ob`ject Net.WebClient).DownloadString
         #   &('In'+'voke-Expressi'+'o'+'n') (.('New-Ob'+'jec'+'t') Net.WebClient).DownloadString
         #   &("{2}{3}{0}{4}{1}"-f 'e','Expression','I','nvok','-') (&("{0}{1}{2}"-f'N','ew-O','bject') Net.WebClient).DownloadString
-        - CommandLine|re: '\w+`(\w+|-|.)`[\w+|\s]'
+        - CommandLine|re: '\w+`(?:\w+|-|.)`[\w+|\s]'
         # - CommandLine|re: '\((\'(\w|-|\.)+\'\+)+\'(\w|-|\.)+\'\)' TODO: fixme
-        - CommandLine|re: '"(\{\d\})+"\s*-f'
+        - CommandLine|re: '"(?:\{\d\})+"\s*-f'
         #   ${e`Nv:pATh}
         - CommandLine|re: '(?i)\$\{`?e`?n`?v`?:`?p`?a`?t`?h`?\}'
     filter_main_envpath:

rules/windows/process_creation/proc_creation_win_rundll32_ads_stored_dll_execution.yml

@@ -6,7 +6,7 @@ references:
     - https://lolbas-project.github.io/lolbas/Binaries/Rundll32
 author: Harjot Singh, '@cyb3rjy0t'
 date: 2023-01-21
-modified: 2023-02-08
+modified: 2026-03-16
 tags:
     - attack.defense-evasion
     - attack.t1564.004
@@ -21,7 +21,7 @@ detection:
         # Example:
         #   rundll32 "C:\ads\file.txt:ADSDLL.dll",DllMain
         # Note: This doesn't cover the use case where a full path for the DLL isn't used. As it requires a more expensive regex
-        CommandLine|re: '[Rr][Uu][Nn][Dd][Ll][Ll]32(\.[Ee][Xx][Ee])? \S+?\w:\S+?:'
+        CommandLine|re: '[Rr][Uu][Nn][Dd][Ll][Ll]32(?:\.[Ee][Xx][Ee])? \S+?\w:\S+?:'
     condition: all of selection_*
 falsepositives:
     - Unknown

rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml

@@ -13,7 +13,7 @@ references:
     - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/
 author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems)
 date: 2020-07-03
-modified: 2025-11-27
+modified: 2026-03-16
 tags:
     - attack.defense-evasion
     - attack.t1036.003
@@ -41,7 +41,7 @@ detection:
               - 'robocopy.exe'
               - 'XCOPY.EXE'
     selection_target:
-        CommandLine|re|i: \s['"]?C:\\Windows\\(System32|SysWOW64|WinSxS)
+        CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS)
     filter_optional_avira:
         Image|endswith: '\cmd.exe'
         CommandLine|contains|all:

rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml

@@ -8,7 +8,7 @@ references:
     - https://twitter.com/fr0s7_/status/1712780207105404948
 author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems)
 date: 2022-08-03
-modified: 2025-07-18
+modified: 2026-03-16
 tags:
     - attack.discovery
 logsource:
@@ -43,13 +43,13 @@ detection:
         # http://1359248394
         - CommandLine|re: 'https?://0[0-9]{3,11}'
         # http://0121.04.0174.012
-        - CommandLine|re: 'https?://(0[0-9]{1,11}\.){3}0[0-9]{1,11}'
+        - CommandLine|re: 'https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}'
         # http://012101076012
         - CommandLine|re: 'https?://0[0-9]{1,11}'
         # For octal format
         - CommandLine|re: ' [0-7]{7,13}'
     filter_main_valid_ip:
-        CommandLine|re: 'https?://((25[0-5]|(2[0-4]|1\d|[1-9])?\d)(\.|\b)){4}'
+        CommandLine|re: 'https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}'
     condition: selection_command and 1 of selection_ip_* and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml

@@ -7,7 +7,7 @@ references:
     - https://twitter.com/Yasser_Elsnbary/status/1553804135354564608
 author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
 date: 2022-08-03
-modified: 2023-11-06
+modified: 2026-03-16
 tags:
     - attack.discovery
 logsource:
@@ -36,13 +36,13 @@ detection:
         # http://1359248394
         - CommandLine|re: 'https?://0[0-9]{3,11}'
         # http://0121.04.0174.012
-        - CommandLine|re: 'https?://(0[0-9]{1,11}\.){3}0[0-9]{1,11}'
+        - CommandLine|re: 'https?://(?:0[0-9]{1,11}\.){3}0[0-9]{1,11}'
         # http://012101076012
         - CommandLine|re: 'https?://0[0-9]{1,11}'
         # For octal format
         - CommandLine|re: ' [0-7]{7,13}'
     filter_main_valid_ip:
-        CommandLine|re: 'https?://((25[0-5]|(2[0-4]|1\d|[1-9])?\d)(\.|\b)){4}'
+        CommandLine|re: 'https?://(?:(?:25[0-5]|(?:2[0-4]|1\d|[1-9])?\d)(?:\.|\b)){4}'
     condition: selection_img and 1 of selection_ip_* and not 1 of filter_main_*
 falsepositives:
     - Unknown