alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers. Logsource: windows / create_stream_hash. Rule: title: Creation Of a Suspicious ADS File Outside a Browser Download id: 573df571-a223-43bc-846e-3f98da481eca status: test description: Detects the creation of a suspicious ADS (Alternate Data Stream) file by software other than browsers references: - https://www.bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings/ author: frack113 date: 2022-10-22 modified: 2023-06-12 tags: - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|startswith: '[ZoneTransfer] ZoneId=3' TargetFilename|endswith: :Zone.Identifier TargetFilename|contains: - .exe - .scr - .bat - .cmd - .docx - .hta - .jse - .lnk - .pptx - .ps - .reg - .sct - .vb - .wsc - .wsf - .xlsx filter_optional_brave: Image|endswith: \brave.exe filter_optional_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_optional_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_optional_maxthon: Image|endswith: \maxthon.exe filter_optional_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_optional_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_optional_opera: Image|endswith: \opera.exe filter_optional_safari: Image|endswith: \safari.exe filter_optional_seamonkey: Image|endswith: \seamonkey.exe filter_optional_vivaldi: Image|endswith: \vivaldi.exe filter_optional_whale: Image|endswith: \whale.exe filter_optional_snipping_tool: Image|startswith: C:\Program Files\WindowsApps\Microsoft.ScreenSketch_ Image|endswith: \SnippingTool\SnippingTool.exe TargetFilename|startswith: C:\Users\ TargetFilename|contains|all: - \AppData\Local\Packages\Microsoft.ScreenSketch_ - '\TempState\Screenshot ' TargetFilename|endswith: .png:Zone.Identifier condition: selection and not 1 of filter_optional_* falsepositives: - Other legitimate browsers not currently included in the filter (please add them) - Legitimate d
Sigma rule: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process inj. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Conhost.EXE id: 7dc2dedd-7603-461a-bc13-15803d132355 related: - id: dfa03a09-8b92-4d83-8e74-f72839b1c407 type: similar status: test description: Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity. references: - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ author: omkar72 date: 2020-10-25 modified: 2023-12-11 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \conhost.exe filter_main_conhost: Image|endswith: :\Windows\System32\conhost.exe filter_main_null: Image: null filter_main_empty: Image: '' filter_optional_provider: Provider_Name: SystemTraceProvider-Process condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects service ticket requests using RC4 encryption type. Logsource: windows / security. Rule: title: Suspicious Kerberos RC4 Ticket Encryption id: 496a0e47-0a33-4dca-b009-9e6ca3591f39 status: test description: Detects service ticket requests using RC4 encryption type references: - https://adsecurity.org/?p=3458 - https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity author: Florian Roth (Nextron Systems) date: 2017-02-06 modified: 2022-06-19 tags: - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4769 TicketOptions: '0x40810000' TicketEncryptionType: '0x17' reduction: ServiceName|endswith: $ condition: selection and not reduction falsepositives: - Service accounts used on legacy systems (e.g. NetApp) - Windows Domains with DFL 2003 and legacy systems level: medium
Sigma rule: Detects instances where a TFTP service on an OpenCanary node has had a request.. Logsource: opencanary / application. Rule: title: OpenCanary - TFTP Request id: b4e6b016-a2ac-4759-ad85-8000b300d61e status: test description: Detects instances where a TFTP service on an OpenCanary node has had a request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.exfiltration - attack.t1041 logsource: category: application product: opencanary detection: selection: logtype: 10001 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects well-known credential dumping tools execution via service execution events. Logsource: windows / system. Rule: title: Credential Dumping Tools Service Execution - System id: 4976aa50-8f41-45c6-8b15-ab3fc10e79ed status: test description: Detects well-known credential dumping tools execution via service execution events references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community date: 2017-03-05 modified: 2022-11-29 tags: - attack.credential-access - attack.execution - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 - attack.t1569.002 - attack.s0005 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - cachedump - dumpsvc - fgexec - gsecdump - mimidrv - pwdump - servpw condition: selection falsepositives: - Legitimate Administrator using credential dumping tool for password recovery level: high
Sigma rule: Detects execution of shells from a parent process located in a temporary (/tmp) directory. Logsource: linux / process_creation. Rule: title: Shell Execution Of Process Located In Tmp Directory id: 2fade0b6-7423-4835-9d4f-335b39b83867 status: test description: Detects execution of shells from a parent process located in a temporary (/tmp) directory references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.execution logsource: product: linux category: process_creation detection: selection: ParentImage|startswith: /tmp/ Image|endswith: - /bash - /csh - /dash - /fish - /ksh - /sh - /zsh condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS rec. Logsource: windows / process_creation. Rule: title: Nslookup PowerShell Download Cradle - ProcessCreation id: 1b3b01c7-84e9-4072-86e5-fc285a41ff23 related: - id: 72671447-4352-4413-bb91-b85569687135 type: obsolete - id: 999bff6d-dc15-44c9-9f5c-e1051bfc86e1 type: similar status: test description: Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records references: - https://twitter.com/Alh4zr3d/status/1566489367232651264 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-05 modified: 2022-12-19 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \nslookup.exe - OriginalFileName: \nslookup.exe selection_cmd: ParentImage|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -q=txt ' - ' -querytype=txt ' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects Obfuscated Powershell via Stdin in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Stdin - Powershell id: 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 status: test description: Detects Obfuscated Powershell via Stdin in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-12 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*" condition: selection_4104 falsepositives: - Unknown level: high
Sigma rule: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. A. Logsource: windows / process_creation. Rule: title: NtdllPipe Like Activity Execution id: bbc865e4-7fcd-45a6-8ff1-95ced28ec5b2 status: test description: Detects command that type the content of ntdll.dll to a different file or a pipe in order to evade AV / EDR detection. As seen being used in the POC NtdllPipe references: - https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe author: Florian Roth (Nextron Systems) date: 2022-03-05 modified: 2023-03-07 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - type %windir%\system32\ntdll.dll - type %systemroot%\system32\ntdll.dll - type c:\windows\system32\ntdll.dll - \\ntdll.dll > \\\\.\\pipe\\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-. Logsource: windows / process_creation. Rule: title: MMC Executing Files with Reversed Extensions Using RTLO Abuse id: 9cfe4b27-1e56-48b4-b7a8-d46851c91a44 status: experimental description: Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats. references: - https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf - https://en.wikipedia.org/wiki/Right-to-left_override - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.execution - attack.stealth - attack.t1204.002 - attack.t1218.014 - attack.t1036.002 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \mmc.exe - OriginalFileName: MMC.exe selection_commandline: CommandLine|contains: - cod.msc - fdp.msc - ftr.msc - lmth.msc - slx.msc - tdo.msc - xcod.msc - xslx.msc - xtpp.msc condition: all of selection_* falsepositives: - Legitimate administrative actions using MMC to execute misnamed `.msc` files. - Unconventional but non-malicious usage of RLO or reversed extensions. level: high
Sigma rule: Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common a. Logsource: windows / file_event. Rule: title: Suspicious File Creation In Uncommon AppData Folder id: d7b50671-d1ad-4871-aa60-5aa5b331fe04 status: test description: Detects the creation of suspicious files and folders inside the user's AppData folder but not inside any of the common and well known directories (Local, Romaing, LocalLow). This method could be used as a method to bypass detection who exclude the AppData folder in fear of FPs references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-02-23 tags: - attack.execution - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|startswith: C:\Users\ TargetFilename|contains: \AppData\ TargetFilename|endswith: - .bat - .cmd - .cpl - .dll - .exe - .hta - .iso - .lnk - .msi - .ps1 - .psm1 - .scr - .vbe - .vbs filter_main: TargetFilename|startswith: C:\Users\ TargetFilename|contains: - \AppData\Local\ - \AppData\LocalLow\ - \AppData\Roaming\ condition: selection and not filter_main falsepositives: - Unlikely level: high
Sigma rule: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to. Logsource: windows / ps_module. Rule: title: Suspicious Get Information for SMB Share - PowerShell Module id: 6942bd25-5970-40ab-af49-944247103358 status: test description: 'Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md author: frack113 date: 2021-12-15 modified: 2022-12-02 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: - Payload|contains: get-smbshare - ContextInfo|contains: get-smbshare condition: selection falsepositives: - Administrator script level: low
Sigma rule: Detects the default "UserName" used by the DiagTrackEoP POC. Logsource: windows / security. Rule: title: DiagTrackEoP Default Login Username id: 2111118f-7e46-4fc8-974a-59fd8ec95196 status: test description: Detects the default "UserName" used by the DiagTrackEoP POC references: - https://github.com/Wh04m1001/DiagTrackEoP/blob/3a2fc99c9700623eb7dc7d4b5f314fd9ce5ef51f/main.cpp#L46 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-03 tags: - attack.privilege-escalation logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 TargetOutboundUserName: thisisnotvaliduser condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.. Logsource: kubernetes / application / audit. Rule: title: Potential Remote Command Execution In Pod Container id: a1b0ca4e-7835-413e-8471-3ff2b8a66be6 status: test description: 'Detects attempts to execute remote commands, within a Pod''s container using e.g. the "kubectl exec" command. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1609 - attack.execution logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods objectRef.subresource: exec condition: selection falsepositives: - Legitimate debugging activity. Investigate the identity performing the requests and their authorization. level: medium
Sigma rule: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to. Logsource: windows / security. Rule: title: Replay Attack Detected id: 5a44727c-3b85-4713-8c44-4401d5499629 status: test description: Detects possible Kerberos Replay Attack on the domain controllers when "KRB_AP_ERR_REPEAT" Kerberos response is sent to the client references: - https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4649 author: frack113 date: 2022-10-14 tags: - attack.credential-access - attack.t1558 logsource: service: security product: windows detection: selection: EventID: 4649 condition: selection falsepositives: - Unknown level: high
Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: linux / auditd. Rule: title: System Shutdown/Reboot - Linux id: 4cb57c2f-1f29-41f8-893d-8bed8e1c1d2f status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: linux service: auditd detection: execve: type: EXECVE shutdowncmd: - shutdown - reboot - halt - poweroff init: - init - telinit initselection: - 0 - 6 condition: execve and (shutdowncmd or (init and initselection)) falsepositives: - Legitimate administrative activity level: informational
Sigma rule: Attempts to load dismcore.dll after dropping it. Logsource: windows / image_load. Rule: title: UAC Bypass With Fake DLL id: a5ea83a7-05a5-44c1-be2e-addccbbd8c03 status: test description: Attempts to load dismcore.dll after dropping it references: - https://steemit.com/utopian-io/@ah101/uac-bypassing-utility author: oscd.community, Dmitry Uchakin date: 2020-10-06 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1548.002 - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \dism.exe ImageLoaded|endswith: \dismcore.dll filter: ImageLoaded: C:\Windows\System32\Dism\dismcore.dll condition: selection and not filter falsepositives: - Actions of a legitimate telnet client level: high
Sigma rule: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.. Logsource: windows / ps_script. Rule: title: PowerView PowerShell Cmdlets - ScriptBlock id: dcd74b95-3f36-4ed9-9598-0490951643aa related: - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d type: similar status: test description: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework. references: - https://powersploit.readthedocs.io/en/stable/Recon/README - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon - https://thedfirreport.com/2020/10/08/ryuks-return - https://adsecurity.org/?p=2277 author: Bhabesh Raj date: 2021-05-18 modified: 2023-11-22 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PowerViewCSV - Find-DomainLocalGroupMember - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-InterestingDomain - Find-InterestingFile - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainDNSZone - Get-DomainFileServer - Get-DomainGPOComputerLocalGroupMapping - Get-DomainGPOLocalGroup - Get-DomainGPOUserLocalGroupMapping - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetFileServer - Get-NetForest - Get-NetGPOGroup - Get-NetProcess - Get-NetRDPSession - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-EnumerateLocalAdmin - Invoke-EventHunter - Invoke-FileFinder - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke-ProcessHunter - Invoke-RevertToSelf - Invoke-ShareFinder - Invoke-UserHunter - Invoke-UserImpersonation - Remove-RemoteConnection - Request-SPNTicket - Resolve-IPAddress condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data.. Logsource: windows / process_creation. Rule: title: Potential Cookies Session Hijacking id: 5a6e1e16-07de-48d8-8aae-faa766c05e88 status: test description: Detects execution of "curl.exe" with the "-c" flag in order to save cookie data. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: - CommandLine|re: \s-c\s - CommandLine|contains: --cookie-jar condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_cookie_hijacking/info.yml
Sigma rule: Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are prog. Logsource: windows / file_event. Rule: title: Suspicious Screensaver Binary File Creation id: 97aa2e88-555c-450d-85a6-229bcd87efb8 status: test description: 'Adversaries may establish persistence by executing malicious content triggered by user inactivity. Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.002/T1546.002.md author: frack113 date: 2021-12-29 modified: 2022-11-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .scr filter_generic: Image|endswith: - \Kindle.exe - \Bin\ccSvcHst.exe filter_tiworker: Image|endswith: \TiWorker.exe TargetFilename|endswith: \uwfservicingscr.scr condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Sigma rule: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat a. Logsource: windows / process_creation. Rule: title: AADInternals PowerShell Cmdlets Execution - ProccessCreation id: c86500e9-a645-4680-98d7-f882c70c1ea3 related: - id: 91e69562-2426-42ce-a647-711b8152ced6 type: similar status: test description: Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365. references: - https://o365blog.com/aadinternals/ - https://github.com/Gerenios/AADInternals author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-12-23 modified: 2025-02-06 tags: - attack.execution - attack.reconnaissance - attack.discovery - attack.credential-access - attack.impact logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_cli: CommandLine|contains: - Add-AADInt - ConvertTo-AADInt - Disable-AADInt - Enable-AADInt - Export-AADInt - Find-AADInt - Get-AADInt - Grant-AADInt - Initialize-AADInt - Install-AADInt - Invoke-AADInt - Join-AADInt - New-AADInt - Open-AADInt - Read-AADInt - Register-AADInt - Remove-AADInt - Reset-AADInt - Resolve-AADInt - Restore-AADInt - Save-AADInt - Search-AADInt - Send-AADInt - Set-AADInt - Start-AADInt - Unprotect-AADInt - Update-AADInt condition: all of selection_* falsepositives: - Legitimate use of the library for administrative activity level: high