Merge PR SigmaHQ#5173 from @X-Junior - New rule additions and some fixes

new: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
fix: Python Initiated Connection - Add filter for `pip install`
fix: Python Inline Command Execution - Add filter for whl package installations
---------

Co-authored-by: Nasreddine Bencherchali <[email protected]>

rules/windows/image_load/image_load_clfs_load.yml

@@ -0,0 +1,41 @@
+title: Clfs.SYS Loaded By Process Located In a Potential Suspicious Location
+id: fb4e2211-6d08-426b-8e6f-0d4a161e3b1d
+status: experimental
+description: Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
+references:
+    - https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
+    - https://x.com/Threatlabz/status/1879956781360976155
+author: X__Junior
+date: 2025-01-20
+tags:
+    - attack.execution
+    - attack.t1059
+logsource:
+    category: image_load
+    product: windows
+detection:
+    selection_dll:
+        ImageLoaded|endswith: '\clfs.sys'
+    selection_folders_1:
+        Image|contains:
+            - ':\Perflogs\'
+            - ':\Users\Public\'
+            - '\Temporary Internet'
+            - '\Windows\Temp\'
+    selection_folders_2:
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Favorites\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Favourites\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Contacts\'
+        - Image|contains|all:
+              - ':\Users\'
+              - '\Pictures\'
+    condition: selection_dll and 1 of selection_folders_*
+falsepositives:
+    - Unknown
+level: medium

rules/windows/network_connection/net_connection_win_python.yml

@@ -7,7 +7,7 @@ references:
     - https://pypi.org/project/scapy/
 author: frack113
 date: 2021-12-10
-modified: 2023-09-07
+modified: 2025-01-20
 tags:
     - attack.discovery
     - attack.t1046
@@ -35,6 +35,10 @@ detection:
         # This could be caused when launching an instance of Jupyter Notebook locally for example but can also be caused by other instances of python opening sockets locally etc. So comment this out if you want to monitor for those instances
         DestinationIp: 127.0.0.1
         SourceIp: 127.0.0.1
+    filter_main_pip:
+        CommandLine|contains|all:
+            - 'pip.exe'
+            - 'install'
     condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Legitimate python scripts using the socket library or similar will trigger this. Apply additional filters and perform an initial baseline before deploying.

rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml

@@ -8,7 +8,7 @@ references:
     - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
 author: Nasreddine Bencherchali (Nextron Systems)
 date: 2023-01-02
-modified: 2023-02-17
+modified: 2025-01-20
 tags:
     - attack.execution
     - attack.t1059
@@ -24,13 +24,17 @@ detection:
               - 'python2.exe'
     selection_cli:
         CommandLine|contains: ' -c'
-    filter_python: # Based on baseline
+    filter_main_python: # Based on baseline
         ParentImage|startswith: 'C:\Program Files\Python'
         ParentImage|endswith: '\python.exe'
         ParentCommandLine|contains: '-E -s -m ensurepip -U --default-pip'
-    filter_vscode:
+    filter_optional_vscode:
         ParentImage|endswith: '\AppData\Local\Programs\Microsoft VS Code\Code.exe'
-    condition: all of selection_* and not 1 of filter_*
+    filter_optional_pip:
+        CommandLine|contains|all:
+            - '<pip-setuptools-caller>'
+            - 'exec(compile('
+    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
 falsepositives:
     - Python libraries that use a flag starting with "-c". Filter according to your environment
 level: medium