Merge PR SigmaHQ#5533 from @swachchhanda000 - fix: github reported issues

new: AWS IAM user with Console Access Login Without MFA (SigmaHQ#5074)
new: Suspicious BitLocker Access Agent Update Utility Execution (SigmaHQ#5502)
new: BaaUpdate.exe Suspicious DLL Load
update: Suspicious C2 Activities - update definition (SigmaHQ#5142)
fix: Firewall Configuration Discovery Via Netsh.EXE - fix logic (SigmaHQ#5171)
fix: WannaCry Ransomware Activity - remove generic indicators (SigmaHQ#5131)
fix: Rare Remote Thread Creation By Uncommon Source Image - filter office FPs (SigmaHQ#5529)
---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

Author: swachchhanda000

rules-emerging-threats/2017/Malware/WannaCry/proc_creation_win_malware_wannacry.yml

@@ -4,9 +4,10 @@ status: test
 description: Detects WannaCry ransomware activity
 references:
     - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100
+    - https://x.com/nas_bench/status/1868639048484425963
 author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
 date: 2019-01-16
-modified: 2023-02-03
+modified: 2025-10-18
 tags:
     - attack.lateral-movement
     - attack.t1210
@@ -22,7 +23,7 @@ logsource:
     category: process_creation
     product: windows
 detection:
-    selection1:
+    selection_img:
         - Image|endswith:
               - '\tasksche.exe'
               - '\mssecsvc.exe'
@@ -35,27 +36,9 @@ detection:
               - '\linuxnew.exe'
               - '\wannacry.exe'
         - Image|contains: 'WanaDecryptor'
-    selection2:
-        - CommandLine|contains|all:
-              - 'icacls'
-              - '/grant'
-              - 'Everyone:F'
-              - '/T'
-              - '/C'
-              - '/Q'
-        - CommandLine|contains|all:
-              - 'bcdedit'
-              - '/set'
-              - '{default}'
-              - 'recoveryenabled'
-              - 'no'
-        - CommandLine|contains|all:
-              - 'wbadmin'
-              - 'delete'
-              - 'catalog'
-              - '-quiet'
-        - CommandLine|contains: '@Please_Read_Me@.txt'
-    condition: 1 of selection*
+    selection_cmd:
+        CommandLine|contains: '@Please_Read_Me@.txt'
+    condition: 1 of selection_*
 fields:
     - CommandLine
     - ParentCommandLine

rules/cloud/aws/cloudtrail/aws_iam_user_with_console_access_login_without_mfa.yml

@@ -0,0 +1,25 @@
+title: AWS IAM User with Console Access Login Without MFA
+id: 77caf516-34e5-4df9-b4db-20744fea0a60
+status: experimental
+description: |
+    Identifies AWS IAM user authentication to the AWS Management Console without Multi-Factor Authentication (MFA).
+    IAM users who can access the Console but haven't enabled MFA pose a security risk. These accounts could be compromised through credential stuffing, brute force attacks, or social engineering techniques.
+references:
+    - https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
+    - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
+author: Thuya@Hacktilizer
+date: 2025-10-18
+tags:
+    - attack.initial-access
+    - attack.t1078.004
+logsource:
+    product: aws
+    service: cloudtrail
+detection:
+    selection:
+        eventName: 'ConsoleLogin'
+        additionalEventData.MFAUsed: 'NO'
+    condition: selection
+falsepositives:
+    - Unlikely
+level: medium

rules/linux/auditd/lnx_auditd_susp_c2_commands.yml

@@ -15,6 +15,31 @@ tags:
 logsource:
     product: linux
     service: auditd
+    definition: |
+        Required auditd configuration:
+        -w /usr/bin/wget -p x -k susp_activity
+        -w /usr/bin/curl -p x -k susp_activity
+        -w /usr/bin/base64 -p x -k susp_activity
+        -w /bin/nc -p x -k susp_activity
+        -w /bin/netcat -p x -k susp_activity
+        -w /usr/bin/ncat -p x -k susp_activity
+        -w /usr/bin/ss -p x -k susp_activity
+        -w /usr/bin/netstat -p x -k susp_activity
+        -w /usr/bin/ssh -p x -k susp_activity
+        -w /usr/bin/scp -p x -k susp_activity
+        -w /usr/bin/sftp -p x -k susp_activity
+        -w /usr/bin/ftp -p x -k susp_activity
+        -w /usr/bin/socat -p x -k susp_activity
+        -w /usr/bin/wireshark -p x -k susp_activity
+        -w /usr/bin/tshark -p x -k susp_activity
+        -w /usr/bin/rawshark -p x -k susp_activity
+        -w /usr/bin/rdesktop -p x -k susp_activity
+        -w /usr/local/bin/rdesktop -p x -k susp_activity
+        -w /usr/bin/wlfreerdp -p x -k susp_activity
+        -w /usr/bin/xfreerdp -p x -k susp_activity
+        -w /usr/local/bin/xfreerdp -p x -k susp_activity
+        -w /usr/bin/nmap -p x -k susp_activity
+        (via https://github.com/Neo23x0/auditd/blob/ddf2603dbc985f97538d102f13b4e4446b402bae/audit.rules#L336)
 detection:
     selection:
         key: 'susp_activity'

rules/windows/create_remote_thread/create_remote_thread_win_susp_relevant_source_image.yml

@@ -10,7 +10,7 @@ references:
     - https://lolbas-project.github.io
 author: Perez Diego (@darkquassar), oscd.community
 date: 2019-10-27
-modified: 2025-07-08
+modified: 2025-10-18
 tags:
     - attack.privilege-escalation
     - attack.defense-evasion
@@ -78,6 +78,12 @@ detection:
         TargetImage|startswith:
             - 'C:\Program Files (x86)\' # C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
             - 'C:\Program Files\' # C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\AI\ai.exe
+    filter_main_ms_office:
+        # Raised by following issue: https://github.com/SigmaHQ/sigma/issues/5529
+        SourceImage|startswith:
+            - 'C:\Program Files\Microsoft Office\'
+            - 'C:\Program Files (x86)\Microsoft Office\'
+        TargetImage: 'System'
     filter_optional_explorer_vmtools:
         SourceImage|endswith: '\SysWOW64\explorer.exe'
         TargetImage:

rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml

@@ -0,0 +1,46 @@
+title: BaaUpdate.exe Suspicious DLL Load
+id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984
+related:
+    - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 # Suspicious BitLocker Access Agent Update Utility Execution
+      type: similar
+status: experimental
+description: |
+    Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.
+    This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)
+    which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.
+references:
+    - https://github.com/rtecCyberSec/BitlockMove
+author: Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-10-18
+tags:
+    - attack.defense-evasion
+    - attack.t1218
+    - attack.lateral-movement
+    - attack.t1021.003
+logsource:
+    category: image_load
+    product: windows
+detection:
+    selection:
+        Image|endswith: '\BaaUpdate.exe'
+        ImageLoaded|endswith: '.dll'
+        ImageLoaded|contains:
+            - ':\Perflogs\'
+            - ':\Users\Default\'
+            - ':\Users\Public\'
+            - ':\Windows\Temp\'
+            - '\AppData\Local\Temp\'
+            - '\AppData\Roaming\'
+            - '\Contacts\'
+            - '\Favorites\'
+            - '\Favourites\'
+            - '\Links\'
+            - '\Music\'
+            - '\Pictures\'
+            - '\ProgramData\'
+            - '\Temporary Internet'
+            - '\Videos\'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high

rules/windows/process_creation/proc_creation_win_baaupdate_susp_child_process.yml

@@ -0,0 +1,40 @@
+title: Suspicious BitLocker Access Agent Update Utility Execution
+id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512
+related:
+    - id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 # BaaUpdate.exe Suspicious DLL Load
+      type: similar
+status: experimental
+description: |
+    Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes.
+    Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.
+references:
+    - https://github.com/rtecCyberSec/BitlockMove
+author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)
+date: 2025-10-18
+tags:
+    - attack.defense-evasion
+    - attack.t1218
+    - attack.lateral-movement
+    - attack.t1021.003
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    selection:
+        ParentImage|endswith: '\baaupdate.exe'
+        Image|endswith:
+            - '\bitsadmin.exe'
+            - '\cmd.exe'
+            - '\cscript.exe'
+            - '\mshta.exe'
+            - '\powershell_ise.exe'
+            - '\powershell.exe'
+            - '\regsvr32.exe'
+            - '\rundll32.exe'
+            - '\schtasks.exe'
+            - '\wmic.exe'
+            - '\wscript.exe'
+    condition: selection
+falsepositives:
+    - Unknown
+level: high

rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml

@@ -7,7 +7,7 @@ references:
     - https://ss64.com/nt/netsh.html
 author: frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'
 date: 2021-12-07
-modified: 2023-12-11
+modified: 2025-10-18
 tags:
     - attack.discovery
     - attack.t1016
@@ -20,7 +20,7 @@ detection:
         - OriginalFileName: 'netsh.exe'
     selection_cli:
         CommandLine|contains|all:
-            - 'netsh '
+            - 'netsh'
             - 'show '
             - 'firewall '
         CommandLine|contains: