alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to lo. Logsource: windows / registry_set. Rule: title: Default RDP Port Changed to Non Standard Port id: 509e84b9-a71a-40e0-834f-05470369bd1e status: test description: 'Detects changes to the default RDP port. Remote desktop is a common feature in operating systems. It allows a user to log into a remote system using an interactive session with a graphical user interface. Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS). ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md author: frack113 date: 2022-01-01 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Control\Terminal Server\WinStations\RDP-Tcp\PortNumber filter_main_port: Details: DWORD (0x00000d3d) condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_change_rdp_port/info.yml simulation: - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Powershell technique: T1021.001 atomic_guid: 2f840dd4-8a2e-4f44-beb3-6b2399ea3771 - type: atomic-red-team name: Changing RDP Port to Non Standard Port via Command_Prompt technique: T1021.001 atomic_guid: 74ace21e-a31c-4f7d-b540-53e4eb6d1f73
Sigma rule: Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution proc. Logsource: windows / ps_script. Rule: title: Security Software Discovery Via Powershell Script id: 904e8e61-8edf-4350-b59c-b905fc8e810c status: test description: 'Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-16 modified: 2023-10-24 tags: - attack.discovery - attack.t1518.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: - get-process | \? - get-process | where - gps | \? - gps | where selection_field: ScriptBlockText|contains: - Company -like - Description -like - Name -like - Path -like - Product -like selection_keywords: ScriptBlockText|contains: - \*avira\* - \*carbonblack\* - \*cylance\* - \*defender\* - \*kaspersky\* - \*malware\* - \*sentinel\* - \*symantec\* - \*virus\* condition: all of selection_* falsepositives: - False positives might occur due to the nature of the ScriptBlock being ingested as a big blob. Initial tuning is required. - As the "selection_cmdlet" is common in scripts the matching engine might slow down the search. Change into regex or a more accurate string to avoid heavy resource consumption if experienced level: medium
Sigma rule: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, w. Logsource: windows / registry_set. Rule: title: Office Macros Warning Disabled id: 91239011-fe3c-4b54-9f24-15c86bb65913 related: - id: 9b894e57-033f-46cf-b7fa-a52804181973 type: obsolete status: test description: Detects registry changes to Microsoft Office "VBAWarning" to a value of "1" which enables the execution of all macros, whether signed or unsigned. references: - https://twitter.com/inversecos/status/1494174785621819397 - https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/ - https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/ author: Trent Liffick (@tliffick), Nasreddine Bencherchali (Nextron Systems) date: 2020-05-22 modified: 2024-03-19 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Security\VBAWarnings Details: DWORD (0x00000001) condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as. Logsource: windows / file_event. Rule: title: Potential Persistence Attempt Via ErrorHandler.Cmd id: 15904280-565c-4b73-9303-3291f964e7f9 status: test description: 'Detects creation of a file named "ErrorHandler.cmd" in the "C:\WINDOWS\Setup\Scripts\" directory which could be used as a method of persistence The content of C:\WINDOWS\Setup\Scripts\ErrorHandler.cmd is read whenever some tools under C:\WINDOWS\System32\oobe\ (e.g. Setup.exe) fail to run for any reason. ' references: - https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/ - https://github.com/last-byte/PersistenceSniper author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-09 modified: 2022-12-19 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: \WINDOWS\Setup\Scripts\ErrorHandler.cmd condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate pote. Logsource: windows / file_event. Rule: title: Uncommon File Created by Notepad++ Updater Gup.EXE id: 3b8f4c92-6a51-4d7e-9c3a-8e2d1f5a7b09 status: experimental description: 'Detects when the Notepad++ updater (gup.exe) creates files in suspicious or uncommon locations. This could indicate potential exploitation of the updater component to deliver unwanted malware or unwarranted files. ' references: - https://notepad-plus-plus.org/news/v889-released/ - https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html - https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ - https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ - https://securelist.com/notepad-supply-chain-attack/118708/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-02-03 modified: 2026-03-16 tags: - attack.collection - attack.credential-access - attack.t1195.002 - attack.initial-access - attack.t1557 logsource: category: file_event product: windows detection: selection: Image|endswith: \gup.exe filter_main_legit_paths: TargetFilename|startswith: - C:\Program Files\Notepad++\ - C:\Program Files (x86)\Notepad++\ filter_main_temp_update_installer: TargetFilename|startswith: C:\Users\ TargetFilename|contains|all: - \AppData\Local\Temp\ - npp. - .Installer. - .exe filter_main_temp_generic_zip: TargetFilename|startswith: C:\Users\ TargetFilename|contains|all: - \AppData\Local\Temp\ - .zip filter_main_recycle_bin: TargetFilename|startswith: C:\$Recycle.Bin\S-1-5-21 filter_main_plugins: - TargetFilename|contains: - \plugins\JsonTools\testfiles\ - \Notepad++\plugins\ComparePlugin\ - TargetFilename|contains|all: - npp. - .portable. - \plugins\ condition: selection and not 1 of filter_main_* falsepositives: - Custom or portable Notepad++ installations in non-standard directories. - Legitimate update processes creating temporary files in unexpected locations. level: high
Sigma rule: Detects wannacry killswitch domain dns queries. Logsource: dns. Rule: title: Wannacry Killswitch Domain id: 3eaf6218-3bed-4d8a-8707-274096f12a18 status: test description: Detects wannacry killswitch domain dns queries references: - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign author: Mike Wade date: 2020-09-16 modified: 2022-03-24 tags: - attack.command-and-control - attack.t1071.001 logsource: category: dns detection: selection: query: - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test - ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com - ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com - iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com condition: selection falsepositives: - Analyst testing level: high
Sigma rule: Detects when an instance identity has taken an action that isn't inside SSM. This can indicate that a compromised EC2 in. Logsource: aws / cloudtrail. Rule: title: Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure id: 352a918a-34d8-4882-8470-44830c507aa3 status: test description: 'Detects when an instance identity has taken an action that isn''t inside SSM. This can indicate that a compromised EC2 instance is being used as a pivot point. ' references: - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html - https://ermetic.com/blog/aws/aws-ec2-imds-what-you-need-to-know/ - https://www.packetmischief.ca/2023/07/31/amazon-ec2-credential-exfiltration-how-it-happens-and-how-to-mitigate-it/#lifting-credentials-from-imds-this-is-why-we-cant-have-nice-things author: jamesc-grafana date: 2024-07-11 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.t1078.002 logsource: product: aws service: cloudtrail detection: selection: userIdentity.arn|re: .+:assumed-role/aws:.+ filter_main_generic: - eventSource: ssm.amazonaws.com - eventName: RegisterManagedInstance - sourceIPAddress: AWS Internal condition: selection and not 1 of filter_main_* falsepositives: - A team has configured an EC2 instance to use instance profiles that grant the option for the EC2 instance to talk to other AWS Services level: high
Sigma rule: Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environ. Logsource: azure / signinlogs. Rule: title: Application Using Device Code Authentication Flow id: 248649b7-d64f-46f0-9fb2-a52774166fb5 status: test description: 'Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. If this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted. This can be a misconfigured application or potentially something malicious. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-01 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: signinlogs detection: selection: properties.message: Device Code condition: selection falsepositives: - Applications that are input constrained will need to use device code flow and are valid authentications. level: medium
Sigma rule: Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pod. Logsource: kubernetes / application / audit. Rule: title: Creation Of Pod In System Namespace id: a80d927d-ac6e-443f-a867-e8d6e3897318 status: test description: 'Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names. Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection. Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers. ' references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.stealth - attack.t1036.005 logsource: category: application product: kubernetes service: audit detection: selection: verb: create objectRef.resource: pods objectRef.namespace: kube-system condition: selection falsepositives: - System components such as daemon-set-controller and kube-scheduler also create pods in the kube-system namespace level: medium
Sigma rule: Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests.. Logsource: windows / iis-configuration. Rule: title: HTTP Logging Disabled On IIS Server id: e8ebd53a-30c2-45bd-81bb-74befba07bdb status: test description: Detects changes to of the IIS server configuration in order to disable HTTP logging for successful requests. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging author: frack113 date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration: /system.webServer/httpLogging/@dontLog NewValue: 'true' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the use of SDelete to erase a file not the free space. Logsource: windows / process_creation. Rule: title: Potential File Overwrite Via Sysinternals SDelete id: a4824fca-976f-4964-b334-0621379e84c4 status: test description: Detects the use of SDelete to erase a file not the free space references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md author: frack113 date: 2021-06-03 modified: 2023-02-28 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection: OriginalFileName: sdelete.exe filter: CommandLine|contains: - ' -h' - ' -c' - ' -z' - ' /\?' condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Identifies when secrets are modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Keyvault Secrets Modified or Deleted id: b831353c-1971-477b-abb6-2828edc3bca1 status: test description: Identifies when secrets are modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1552 - attack.t1552.001 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KEYVAULT/VAULTS/SECRETS/WRITE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/DELETE - MICROSOFT.KEYVAULT/VAULTS/SECRETS/BACKUP/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/PURGE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/UPDATE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RECOVER/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/RESTORE/ACTION - MICROSOFT.KEYVAULT/VAULTS/SECRETS/SETSECRET/ACTION condition: selection falsepositives: - Secrets being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc.. Logsource: windows / security. Rule: title: Suspicious Scheduled Task Creation id: 3a734d25-df5c-4b99-8034-af1ddb5883a4 status: test description: Detects suspicious scheduled task creation events. Based on attributes such as paths, commands line flags, etc. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2022-12-07 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection_eid: EventID: 4698 selection_paths: TaskContent|contains: - \AppData\Local\Temp\ - \AppData\Roaming\ - \Users\Public\ - \WINDOWS\Temp\ - C:\Temp\ - \Desktop\ - \Downloads\ - \Temporary Internet - C:\ProgramData\ - C:\Perflogs\ selection_commands: TaskContent|contains: - regsvr32 - rundll32 - cmd.exe</Command> - cmd</Command> - '<Arguments>/c ' - '<Arguments>/k ' - '<Arguments>/r ' - powershell - pwsh - mshta - wscript - cscript - certutil - bitsadmin - bash.exe - 'bash ' - scrcons - 'wmic ' - wmic.exe - forfiles - scriptrunner - hh.exe condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations s. Logsource: windows / registry_set. Rule: title: ClickOnce Trust Prompt Tampering id: ac9159cc-c364-4304-8f0a-d63fc1a0aabb status: test description: Detects changes to the ClickOnce trust prompt registry key in order to enable an installation from different locations such as the Internet. references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 - https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior author: '@SerkinValery, Nasreddine Bencherchali (Nextron Systems)' date: 2023-06-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\MICROSOFT\.NETFramework\Security\TrustManager\PromptingLevel\ TargetObject|endswith: - \Internet - \LocalIntranet - \MyComputer - \TrustedSites - \UntrustedSites Details: Enabled condition: selection falsepositives: - Legitimate internal requirements. level: medium
Sigma rule: Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature t. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To DevTunnels Domain id: 9501f8e6-8e3d-48fc-a8a6-1089dd5d7ef4 related: - id: 4b657234-038e-4ad5-997c-4be42340bce4 type: similar - id: b3e6418f-7c7a-4fad-993a-93b65027a9f1 type: similar - id: 1cb0c6ce-3d00-44fc-ab9c-6d6d577bf20b type: similar status: test description: 'Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://blueteamops.medium.com/detecting-dev-tunnels-16f0994dc3e2 - https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/security - https://cydefops.com/devtunnels-unleashed author: Kamran Saifullah date: 2023-11-20 tags: - attack.exfiltration - attack.command-and-control - attack.t1567.001 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: .devtunnels.ms condition: selection falsepositives: - Legitimate use of Devtunnels will also trigger this. level: medium
Sigma rule: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location. Logsource: windows / application. Rule: title: Dump Ntds.dit To Suspicious Location id: 94dc4390-6b7c-4784-8ffc-335334404650 status: test description: Detects potential abuse of ntdsutil to dump ntds.dit database to a suspicious location references: - https://twitter.com/mgreen27/status/1558223256704122882 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj574207(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection_root: Provider_Name: ESENT EventID: 325 Data|contains: ntds.dit selection_paths: Data|contains: - :\ntds.dit - \Appdata\ - \Desktop\ - \Downloads\ - \Perflogs\ - \Temp\ - \Users\Public\ condition: all of selection_* falsepositives: - Legitimate backup operation/creating shadow copies level: medium
Sigma rule: Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary co. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Outlook Today Page id: 487bb375-12ef-41f6-baae-c6a1572b4dd1 related: - id: ddd171b5-2cc6-4975-9e78-f0eccd08cc76 type: similar status: test description: 'Detects potential persistence activity via outlook today page. An attacker can set a custom page to execute arbitrary code and link to it via the registry values "URL" and "UserDefinedUrl". ' references: - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=74 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change author: Tobias Michalski (Nextron Systems), David Bertho (@dbertho) & Eirik Sveen (@0xSV1), Storebrand date: 2021-06-10 modified: 2024-08-07 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains|all: - Software\Microsoft\Office\ - \Outlook\Today\ selection_value_stamp: TargetObject|endswith: \Stamp Details: DWORD (0x00000001) selection_value_url: TargetObject|endswith: - \URL - \UserDefinedUrl filter_main_office: Image|startswith: - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ - C:\Program Files\Common Files\Microsoft Shared\ClickToRun\Updates\ Image|endswith: \OfficeClickToRun.exe condition: selection_main and 1 of selection_value_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects the mount of an ISO image on an endpoint. Logsource: windows / security. Rule: title: ISO Image Mounted id: 0248a7bc-8a9a-4cd8-a57e-3ae8e073a073 status: test description: Detects the mount of an ISO image on an endpoint references: - https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore - https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages - https://twitter.com/MsftSecIntel/status/1257324139515269121 - https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image author: Syed Hasan (@syedhasan009) date: 2021-05-29 modified: 2023-11-09 tags: - attack.initial-access - attack.t1566.001 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Removable Storage" must be configured for Success/Failure detection: selection: EventID: 4663 ObjectServer: Security ObjectType: File ObjectName|startswith: \Device\CdRom filter_main_generic: ObjectName: - \Device\CdRom0\autorun.ico - \Device\CdRom0\setup.exe - \Device\CdRom0\setup64.exe condition: selection and not 1 of filter_main_* falsepositives: - Software installation ISO files level: medium