Merge PR SigmaHQ#5679 from @swachchhanda000 - chore: update evtx baseline to v0.8.2

chore: update evtx baseline to v0.8.2 and fix FPs
---------

Co-authored-by: Swachchhanda Shrawan Poudel <87493836+swachchhanda000@users.noreply.github.com>

Author: phantinuss

.github/workflows/goodlog-tests.yml

@@ -39,7 +39,7 @@ on:
   workflow_dispatch:
 
 env:
-  EVTX_BASELINE_VERSION: v0.8.1
+  EVTX_BASELINE_VERSION: v0.8.2
 
 jobs:
   check-baseline-win7:

.github/workflows/known-FPs.csv

@@ -3,11 +3,10 @@ RuleId;RuleName;MatchString
 ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94;Suspicious WSMAN Provider Image Loads;.*
 db809f10-56ce-4420-8c86-d6a7d793c79c;Raw Disk Access Using Illegitimate Tools;python-3
 db809f10-56ce-4420-8c86-d6a7d793c79c;Raw Disk Access Using Illegitimate Tools;target\.exe
-96f697b0-b499-4e5d-9908-a67bec11cdb6;Removal of Potential COM Hijacking Registry Keys;sharepointclient
-96f697b0-b499-4e5d-9908-a67bec11cdb6;Removal of Potential COM Hijacking Registry Keys;odopen
+96f697b0-b499-4e5d-9908-a67bec11cdb6;Removal of Potential COM Hijacking Registry Keys;.*
 1277f594-a7d1-4f28-a2d3-73af5cbeab43;Windows Shell File Write to Suspicious Folder;Computer: Agamemnon
 e28a5a99-da44-436d-b7a0-2afc20a5f413;Whoami Execution;WindowsPowerShell
-8ac03a65-6c84-4116-acad-dc1558ff7a77;Sysmon Configuration Change;sysmon-intense\.xml
+8ac03a65-6c84-4116-acad-dc1558ff7a77;Sysmon Configuration Change;(sysmon-intense\.xml|sysmonconfig-trace\.xml)
 8ac03a65-6c84-4116-acad-dc1558ff7a77;Sysmon Configuration Change;Computer: (evtx-PC|Agamemnon)
 4358e5a5-7542-4dcb-b9f3-87667371839b;ISO or Image Mount Indicator in Recent Files;_Office_Professional_Plus_
 36480ae1-a1cb-4eaa-a0d6-29801d7e9142;Renamed Binary;WinRAR
@@ -17,8 +16,8 @@ e28a5a99-da44-436d-b7a0-2afc20a5f413;Whoami Execution;WindowsPowerShell
 162ab1e4-6874-4564-853c-53ec3ab8be01;TeamViewer Remote Session;TeamViewer(_Service)?\.exe
 cdc8da7d-c303-42f8-b08c-b4ab47230263;Rundll32 Internet Connection;20\.49\.150\.241
 bef0bc5a-b9ae-425d-85c6-7b2d705980c6;Python Initiated Connection;151\.101\.64\.223
+bef0bc5a-b9ae-425d-85c6-7b2d705980c6;Python Initiated Connection;146\.75\.117\.55
 9711de76-5d4f-4c50-a94f-21e4e8f8384d;Installation of TeamViewer Desktop;TeamViewer_Desktop\.exe
-96f697b0-b499-4e5d-9908-a67bec11cdb6;Removal of Potential COM Hijacking Registry Keys;target\.exe
 9494479d-d994-40bf-a8b1-eea890237021;Scheduled Task Creation From Potential Suspicious Parent Location;.*
 81325ce1-be01-4250-944f-b4789644556f;Suspicius Schtasks From Env Var Folder;TVInstallRestore
 6ea3bf32-9680-422d-9f50-e90716b12a66;UAC Bypass Via Wsreset;EventType: DeleteKey
@@ -37,6 +36,7 @@ a96970af-f126-420d-90e1-d37bf25e50e1;Use Short Name Path in Image;unzip\.exe
 349d891d-fef0-4fe4-bc53-eee623a15969;Use Short Name Path in Command Line;TeamViewer_\.exe
 7a02e22e-b885-4404-b38b-1ddc7e65258a;Suspicious Schtasks Schedule Type;TeamViewer_\.exe
 949f1ffb-6e85-4f00-ae1e-c3c5b190d605;Explorer Process Tree Break;Computer: Agamemnon
+949f1ffb-6e85-4f00-ae1e-c3c5b190d605;Explorer Process Tree Break;Computer: WinDev2310Eval
 fdbf0b9d-0182-4c43-893b-a1eaab92d085;Newly Registered Protocol Handler;.*
 100ef69e-3327-481c-8e5c-6d80d9507556;System Eventlog Cleared;.*
 52a85084-6989-40c3-8f32-091e12e17692;Suspicious Usage of CVE_2021_34484 or CVE 2022_21919;Computer: Agamemnon
@@ -48,8 +48,8 @@ b69888d4-380c-45ce-9cf9-d9ce46e67821;Executable in ADS;msedge\.exe
 b69888d4-380c-45ce-9cf9-d9ce46e67821;Executable in ADS;firefox\.exe 
 b69888d4-380c-45ce-9cf9-d9ce46e67821;Executable in ADS;7z\.exe
 65236ec7-ace0-4f0c-82fd-737b04fd4dcb;EVTX Created In Uncommon Location;powershell\.exe
-a62b37e0-45d3-48d9-a517-90c1a1b0186b;Eventlog Cleared;Computer: DESKTOP-A8CALR3
-a62b37e0-45d3-48d9-a517-90c1a1b0186b;Eventlog Cleared;Computer: WIN-06FB45IHQ35
+65236ec7-ace0-4f0c-82fd-737b04fd4dcb;EVTX Created In Uncommon Location;Computer: WIN-FPV0DSIC9O6.sigma.fr
+a62b37e0-45d3-48d9-a517-90c1a1b0186b;Eventlog Cleared;Computer: .*
 4eec988f-7bf0-49f1-8675-1e6a510b3a2a;Potential PendingFileRenameOperations Tamper;target\.exe
 4eec988f-7bf0-49f1-8675-1e6a510b3a2a;Potential PendingFileRenameOperations Tamper;target\.tmp
 48bfd177-7cf2-412b-ad77-baf923489e82;Image Load of VSS Dll by Uncommon Executable;SetupFrontEnd.exe
@@ -59,3 +59,14 @@ e9d4ab66-a532-4ef7-a502-66a9e4a34f5d;NTLMv1 Logon Between Client and Server;.*
 ccb5742c-c248-4982-8c5c-5571b9275ad3;Potential Suspicious Findstr.EXE Execution;httpd\.exe
 9ae01559-cf7e-4f8e-8e14-4c290a1b4784;CredUI.DLL Load By Uncommon Process;Spotify\.exe
 52182dfb-afb7-41db-b4bc-5336cb29b464;Suspicious File Download From File Sharing Websites;objects\.githubusercontent\.com
+ce72ef99-22f1-43d4-8695-419dcb5d9330;Suspicious Windows Service Tampering;TeamViewer
+dae8171c-5ec6-4396-b210-8466585b53e9;SCM Database Privileged Operation;0x277c6
+3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781;OpenSSH Server Listening On Socket;.*
+b69888d4-380c-45ce-9cf9-d9ce46e67821;Hidden Executable In NTFS Alternate Data Stream;.*
+4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76;Potentially Suspicious AccessMask Requested From LSASS;\\setup\.exe
+d99b79d2-0a6f-4f46-ad8b-260b6e17f982;Security Eventlog Cleared;Computer: WinDevEval
+b28e58e4-2a72-4fae-bdee-0fbe904db642;Windows Defender Real-time Protection Disabled;Computer: WinDev2310Eval
+ef9dcfed-690c-4c5d-a9d1-482cd422225c;Browser Execution In Headless Mode;.*
+65236ec7-ace0-4f0c-82fd-737b04fd4dcb;EVTX Created In Uncommon Location;Computer: (DESKTOP-6D0DBMB|WinDev2310Eval)
+de587dce-915e-4218-aac4-835ca6af6f70;Potential Persistence Attempt Via Run Keys Using Reg.EXE;\\Discord\\
+24357373-078f-44ed-9ac4-6d334a668a11;Direct Autorun Keys Modification;Discord\.exe

rules-threat-hunting/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml

@@ -0,0 +1,68 @@
+title: Use Short Name Path in Command Line
+id: 349d891d-fef0-4fe4-bc53-eee623a15969
+related:
+    - id: a96970af-f126-420d-90e1-d37bf25e50e1
+      type: similar
+status: test
+description: |
+    Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations.
+    Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs.
+    When investigating, examine:
+    - Commands using short paths to access sensitive directories or files
+    - Web servers on Windows (especially Apache) where short filenames could bypass security controls
+    - Correlation with other suspicious behaviors
+    - baseline of short name usage in your environment and look for deviations
+references:
+    - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/
+    - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
+    - https://twitter.com/frack113/status/1555830623633375232
+author: frack113, Nasreddine Bencherchali
+date: 2022-08-07
+modified: 2025-10-07
+tags:
+    - attack.defense-evasion
+    - attack.t1564.004
+    - detection.threat-hunting
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        CommandLine|contains:
+            - '~1\'
+            - '~2\'
+    filter_main_system_process:
+        ParentImage:
+            - 'C:\Windows\System32\Dism.exe'
+            - 'C:\Windows\System32\cleanmgr.exe'
+    filter_main_winget:
+        - ParentImage|endswith: '\winget.exe'
+        - ParentImage|contains: '\AppData\Local\Temp\WinGet\'
+    filter_main_installers:
+        - Image|contains|all:
+              - '\AppData\'
+              - '\Temp\'
+        - CommandLine|contains: '\AppData\Local\Temp\' # sometimes installers spawn other installers from temp folder
+    filter_optional_dopus:
+        ParentImage: 'C:\Program Files\GPSoftware\Directory Opus\dopus.exe'
+    filter_optional_aurora:
+        ParentImage|endswith:
+            - '\aurora-agent-64.exe'
+            - '\aurora-agent.exe'
+    filter_optional_thor:
+        ParentImage|endswith: '\thor\thor64.exe'
+    filter_optional_git:
+        CommandLine|contains:
+            - 'C:\Program Files\Git\post-install.bat'
+            - 'C:\Program Files\Git\cmd\scalar.exe'
+    filter_optional_webex:
+        - ParentImage|endswith: '\WebEx\webexhost.exe'
+        - CommandLine|contains: '\appdata\local\webex\webex64\meetings\wbxreport.exe'
+    filter_optional_veeam:
+        ParentImage|endswith: '\veeam.backup.shell.exe'
+    filter_optional_everything:
+        ParentImage|endswith: '\Everything\Everything.exe'
+    condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
+falsepositives:
+    - Applications could use this notation occasionally which might generate some false positives. In that case investigate the parent and child process.
+level: medium

rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml

@@ -9,7 +9,7 @@ references:
     - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-01-11
-modified: 2025-03-07
+modified: 2025-10-07
 tags:
     - attack.defense-evasion
 logsource:
@@ -28,6 +28,7 @@ detection:
             - 'C:\Windows\ImmersiveControlPanel\'
             - 'x-windowsupdate://'
             - 'file:///C:/Program%20Files' # Also covers 'file:///C:/Program%20Files%20(x86)/'
+            - 'AppData/Local/Temp/WinGet/Microsoft.Winget.Source'
     filter_main_specific:
         Path|contains:
             - 'https://statics.teams.cdn.live.net/'

rules/windows/builtin/firewall_as/win_firewall_as_add_rule.yml

@@ -6,7 +6,7 @@ references:
     - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
 author: frack113
 date: 2022-02-19
-modified: 2024-08-29
+modified: 2025-10-08
 tags:
     - attack.defense-evasion
     - attack.t1562.004
@@ -28,9 +28,6 @@ detection:
             - 'C:\Windows\System32\'
             - 'C:\Windows\SysWOW64\'
             - 'C:\Windows\WinSxS\'
-    filter_optional_msmpeng:
-        ModifyingApplication|startswith: 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
-        ModifyingApplication|endswith: '\MsMpEng.exe'
     filter_main_covered_paths:
         # This filter is added to avoid duplicate alerting from 9e2575e7-2cb9-4da1-adc8-ed94221dca5e
         ApplicationPath|contains:
@@ -41,13 +38,28 @@ detection:
             - 'C:\Windows\Tasks\'
             - 'C:\Windows\Temp\'
             - '\AppData\Local\Temp\'
+    filter_main_system_dllhost:
+        ApplicationPath: 'System'
+        ModifyingApplication: 'C:\Windows\System32\dllhost.exe'
+    filter_main_tiworker:
+        ModifyingApplication|startswith: 'C:\Windows\WinSxS\'
+        ModifyingApplication|endswith: '\TiWorker.exe'
+    filter_main_null:
+        ApplicationPath: null
     filter_optional_no_path:
         # This filter filters a lot of FPs related to Windows Services
         ModifyingApplication:
             - 'C:\Windows\System32\svchost.exe'
             - 'C:\Windows\System32\dllhost.exe'
         ApplicationPath: ''
-    filter_main_null:
-        ApplicationPath: null
+    filter_optional_msmpeng:
+        - ModifyingApplication|startswith:
+              - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
+              - 'C:\Program Files\Windows Defender\'
+          ModifyingApplication|endswith: '\MsMpEng.exe'
+        - ApplicationPath|startswith:
+              - 'C:\ProgramData\Microsoft\Windows Defender\Platform\'
+              - 'C:\Program Files\Windows Defender\'
+          ApplicationPath|endswith: '\MsMpEng.exe'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 level: medium

rules/windows/builtin/security/win_security_user_driver_loaded.yml

@@ -12,7 +12,7 @@ references:
     - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
 author: xknow (@xknow_infosec), xorxes (@xor_xes)
 date: 2019-04-08
-modified: 2023-01-20
+modified: 2025-10-07
 tags:
     - attack.defense-evasion
     - attack.t1562.001
@@ -24,7 +24,7 @@ detection:
         EventID: 4673
         PrivilegeList: 'SeLoadDriverPrivilege'
         Service: '-'
-    filter_exact:
+    filter_main_exact:
         ProcessName:
             - 'C:\Windows\System32\Dism.exe'
             - 'C:\Windows\System32\rundll32.exe'
@@ -36,17 +36,22 @@ detection:
             - 'C:\Windows\System32\RuntimeBroker.exe'
             - 'C:\Windows\System32\SystemSettingsBroker.exe'
             - 'C:\Windows\explorer.exe'
-    filter_endswith:
+    filter_optional_others:
         ProcessName|endswith:
             - '\procexp64.exe'
             - '\procexp.exe'
             - '\procmon64.exe'
             - '\procmon.exe'
             - '\Google\Chrome\Application\chrome.exe'
             - '\AppData\Local\Microsoft\Teams\current\Teams.exe'
-    filter_startswith:
+    filter_main_startswith:
         ProcessName|startswith: 'C:\Program Files\WindowsApps\Microsoft'
-    condition: selection_1 and not 1 of filter_*
+    filter_optional_dropbox:
+        ProcessName|startswith:
+            - 'C:\Program Files (x86)\Dropbox\'
+            - 'C:\Program Files\Dropbox\'
+        ProcessName|endswith: '\Dropbox.exe'
+    condition: selection_1 and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Other legimate tools loading drivers. Including but not limited to, Sysinternals, CPU-Z, AVs etc. A baseline needs to be created according to the used products and allowed tools. A good thing to do is to try and exclude users who are allowed to load drivers.
 level: medium

rules/windows/file/file_event/file_event_win_creation_system_file.yml

@@ -8,7 +8,7 @@ references:
     - Internal Research
 author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
 date: 2020-05-26
-modified: 2024-06-24
+modified: 2025-10-07
 tags:
     - attack.defense-evasion
     - attack.t1036.005
@@ -102,19 +102,29 @@ detection:
             - 'C:\Windows\WinSxS\'
             - 'C:\Windows\uus\'
     filter_main_svchost:
-        Image|endswith: 'C:\Windows\system32\svchost.exe'
-        TargetFilename|contains: 'C:\Program Files\WindowsApps\'
+        Image|endswith:
+            - 'C:\Windows\system32\svchost.exe'
+            - 'C:\Windows\SysWOW64\svchost.exe'
+        TargetFilename|contains:
+            - 'C:\Program Files\WindowsApps\'
+            - 'C:\Program Files (x86)\WindowsApps\'
+            - '\AppData\Local\Microsoft\WindowsApps\'
     filter_main_wuauclt:
-        Image|endswith: 'C:\Windows\System32\wuauclt.exe'
+        Image|endswith:
+            - 'C:\Windows\System32\wuauclt.exe'
+            - 'C:\Windows\SysWOW64\wuauclt.exe'
     filter_main_explorer:
         TargetFilename|endswith: 'C:\Windows\explorer.exe'
     filter_main_msiexec:
         # This filter handles system processes who are updated/installed using misexec.
-        Image|endswith: 'C:\WINDOWS\system32\msiexec.exe'
+        Image|endswith:
+            - 'C:\WINDOWS\system32\msiexec.exe'
+            - 'C:\WINDOWS\SysWOW64\msiexec.exe'
         # Add more processes if you find them or simply filter msiexec on its own. If the list grows big
-        TargetFilename|endswith:
+        TargetFilename|startswith:
             - 'C:\Program Files\PowerShell\7\pwsh.exe'
             - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
+            - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview\'
     filter_main_healtray:
         TargetFilename|contains: 'C:\Windows\System32\SecurityHealth\'
         TargetFilename|endswith: '\SecurityHealthSystray.exe'

rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml

@@ -7,7 +7,7 @@ references:
     - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-05-09
-modified: 2023-10-18
+modified: 2025-10-07
 tags:
     - attack.persistence
 logsource:
@@ -28,6 +28,10 @@ detection:
             - ':\Windows\SysWOW64\poqexec.exe' # https://github.com/SigmaHQ/sigma/issues/4448
             - ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
             - ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
+    filter_main_msiexec:
+        Image:
+            - 'C:\Windows\System32\msiexec.exe'
+            - 'C:\Windows\SysWOW64\msiexec.exe'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/file/file_event/file_event_win_ps_script_policy_test_creation_by_uncommon_process.yml

@@ -6,7 +6,7 @@ references:
     - https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-06-01
-modified: 2023-12-11
+modified: 2025-10-07
 tags:
     - attack.defense-evasion
 logsource:
@@ -15,19 +15,26 @@ logsource:
 detection:
     selection:
         TargetFilename|contains: '__PSScriptPolicyTest_'
+    filter_main_powershell:
+        Image:
+            - 'C:\Program Files\PowerShell\7-preview\pwsh.exe'
+            - 'C:\Program Files\PowerShell\7\pwsh.exe'
+            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
+            - 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
+            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
+            - 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
+    filter_main_pwsh_preview:
+        Image|contains:
+            - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
+            - '\AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview'
+        Image|endswith: '\pwsh.exe'
     filter_main_generic:
-        Image|endswith:
-            - ':\Program Files\PowerShell\7-preview\pwsh.exe'
-            - ':\Program Files\PowerShell\7\pwsh.exe'
-            - ':\Windows\System32\dsac.exe'
-            - ':\Windows\System32\sdiagnhost.exe'
-            - ':\Windows\System32\ServerManager.exe'
-            - ':\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe'
-            - ':\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
-            - ':\Windows\System32\wsmprovhost.exe'
-            - ':\Windows\SysWOW64\sdiagnhost.exe'
-            - ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe'
-            - ':\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
+        Image:
+            - 'C:\Windows\System32\dsac.exe'
+            - 'C:\Windows\System32\sdiagnhost.exe'
+            - 'C:\Windows\System32\ServerManager.exe'
+            - 'C:\Windows\System32\wsmprovhost.exe'
+            - 'C:\Windows\SysWOW64\sdiagnhost.exe'
     condition: selection and not 1 of filter_main_*
 falsepositives:
     - Unknown

rules/windows/file/file_event/file_event_win_shell_write_susp_files_extensions.yml

@@ -9,7 +9,7 @@ references:
     - Internal Research
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2022-08-12
-modified: 2025-08-05
+modified: 2025-10-07
 tags:
     - attack.defense-evasion
     - attack.t1036
@@ -69,6 +69,14 @@ detection:
         TargetFilename|contains|all:
             - 'C:\Program Files\WindowsApps\Clipchamp'
             - '.ps1'
+    filter_main_powershell_preview:
+        Image:
+            - 'C:\Windows\system32\svchost.exe'
+            - 'C:\Windows\SysWOW64\svchost.exe'
+        TargetFilename|startswith:
+            - 'C:\Program Files\WindowsApps\Microsoft.PowerShellPreview'
+            - 'C:\Program Files (x86)\WindowsApps\Microsoft.PowerShellPreview'
+        TargetFilename|endswith: '.ps1'
     condition: 1 of selection_* and not 1 of filter_main_*
 falsepositives:
     - Unknown