In "NotPetya Ransomware Activity" rule, for which field we have this selection: select_perfc_keyword.

[qasimqlf]

for this highlighted keyword, where i need to look because no field there? CommandLine or Image?

Rule Link: (https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_malware_notpetya.yml)
cc: @Neo23x0 @nasbench @frack113

[nasbench]

To my knowledge, In SIGMA a keyword selection means that look in all the fields described by the logsource section. In this specifc case, you should look for the keyword "perfc.dat" in all the fields of process creation (ie 4688 and Sysmon EID 1).

Just to get the idea across, for example this rule 06d71506-7beb-4f22-8888-e2e5e2ca7fd8 will look in all the windows event logs available for those specific keywords. (Because no category was specified)

I hope this helps :D

[qasimqlf]

Thanks for your answer. @nasbench