alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...). Logsource: windows / file_event. Rule: title: DLL Search Order Hijackig Via Additional Space in Path id: b6f91281-20aa-446a-b986-38a92813a18f status: test description: 'Detects when an attacker create a similar folder structure to windows system folders such as (Windows, Program Files...) but with a space in order to trick DLL load search order and perform a "DLL Search Order Hijacking" attack ' references: - https://twitter.com/cyb3rops/status/1552932770464292864 - https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-30 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: - C:\Windows \ - C:\Program Files \ - C:\Program Files (x86) \ TargetFilename|endswith: .dll condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects access to Signal Desktop's sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop. Logsource: windows / security. Rule: title: File Access Of Signal Desktop Sensitive Data id: 5d6c375a-18ae-4952-b4f6-8b803f6c8555 status: experimental description: 'Detects access to Signal Desktop''s sensitive data files: db.sqlite and config.json. The db.sqlite file in Signal Desktop stores all locally saved messages in an encrypted SQLite database, while the config.json contains the decryption key needed to access that data. Since the key is stored in plain text, a threat actor who gains access to both files can decrypt and read sensitive messages without needing the users credentials. Currently the rule only covers the default Signal installation path in AppData\Roaming. Signal Portable installations may use different paths based on user configuration. Additional paths can be added to the selection as needed. ' references: - https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/ - https://vmois.dev/query-signal-desktop-messages-sqlite/ author: Andreas Braathen (mnemonic.io) date: 2025-10-19 tags: - attack.credential-access - attack.t1003 logsource: product: windows service: security definition: 'Requirements: System Access Control List (SACL) policy with attributes List folder/read data on Objects' detection: selection: EventID: 4663 ObjectType: File ObjectName|contains: \AppData\Roaming\Signal\ ObjectName|endswith: - \config.json - \db.sqlite filter_main_signal: ProcessName|endswith: - \signal-portable.exe - \signal.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely, but possible from AV or backup software accessing the files. level: medium
Sigma rule: Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via VSDiagnostics.EXE id: ac1c92b4-ac81-405a-9978-4604d78cc47e status: test description: Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries. references: - https://twitter.com/0xBoku/status/1679200664013135872 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-03 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VSDiagnostics.exe - OriginalFileName: VSDiagnostics.exe selection_cli_start: CommandLine|contains: start selection_cli_launch: CommandLine|contains: - ' /launch:' - ' -launch:' condition: all of selection_* falsepositives: - Legitimate usage for tracing and diagnostics purposes level: medium
Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the c. Logsource: windows / security. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - Security id: fd0f5778-d3cb-4c9a-9695-66759d04702a related: - id: 51aa9387-1c53-4153-91cc-d73c59ae1ca9 type: derived status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block linked in the references references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-11-27 tags: - attack.stealth - attack.t1027 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection_eid: EventID: 4697 selection_servicefilename: - ServiceFileName|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ServiceFileName|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ServiceFileName|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ServiceFileName|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ServiceFileName|re: \\*mdr\*\W\s*\)\.Name - ServiceFileName|re: \$VerbosePreference\.ToString\( - ServiceFileName|re: \String\]\s*\$VerbosePreference condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects the use of PSAttack PowerShell hack tool. Logsource: windows / ps_script. Rule: title: PowerShell PSAttack id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5 status: test description: Detects the use of PSAttack PowerShell hack tool references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PS ATTACK!!! condition: selection falsepositives: - Unknown level: high
Sigma rule: Identifies the creation of local users via the net.exe command.. Logsource: windows / process_creation. Rule: title: New User Created Via Net.EXE id: cd219ff3-fa99-45d4-8380-a7d15116c6dc related: - id: b9f0e6f5-09b4-4358-bae4-08408705bd5c type: similar status: test description: Identifies the creation of local users via the net.exe command. references: - https://eqllib.readthedocs.io/en/latest/analytics/014c3f51-89c6-40f1-ac9c-5688f26090ab.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md author: Endgame, JHasenbusch (adapted to Sigma for oscd.community) date: 2018-10-30 modified: 2023-02-21 tags: - attack.persistence - attack.t1136.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - user - add condition: all of selection_* falsepositives: - Legitimate user creation. - Better use event IDs for user creation rather than command line rules. level: medium
Sigma rule: Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execu. Logsource: windows / process_creation. Rule: title: Potential Remote SquiblyTwo Technique Execution id: 8d63dadf-b91b-4187-87b6-34a1114577ea related: - id: 06ce37c2-61ab-4f05-9ff5-b1a96d18ae32 type: similar - id: 05c36dd6-79d6-4a9a-97da-3db20298ab2d type: similar status: test description: 'Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution. ' references: - https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html - https://twitter.com/mattifestation/status/986280382042595328 - https://atomicredteam.io/defense-evasion/T1220/ - https://lolbas-project.github.io/lolbas/Binaries/Wmic/ - https://x.com/byrne_emmy12099/status/1932346420226658668 author: Markus Neis, Florian Roth, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-01-16 modified: 2026-01-24 tags: - attack.stealth - attack.t1047 - attack.t1220 - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_pe: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe - Hashes|contains: - IMPHASH=1B1A3F43BF37B5BFE60751F2EE2F326E - IMPHASH=37777A96245A3C74EB217308F3546F4C - IMPHASH=9D87C9D67CE724033C0B40CC4CA1B206 - IMPHASH=B12619881D79C3ACADF45E752A58554A - IMPHASH=16A48C3CABF98A9DC1BF02C07FE1EA00 selection_cli: CommandLine|contains|windash: '/format:' CommandLine|contains: - :// - \\\\ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect u. Logsource: macos / process_creation. Rule: title: Binary Padding - MacOS id: 95361ce5-c891-4b0a-87ca-e24607884a96 status: test description: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md - https://linux.die.net/man/1/truncate - https://linux.die.net/man/1/dd author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2023-02-17 tags: - attack.stealth - attack.t1027.001 logsource: product: macos category: process_creation detection: selection_truncate: Image|endswith: /truncate CommandLine|contains: -s + selection_dd: Image|endswith: /dd CommandLine|contains: - if=/dev/zero - if=/dev/random - if=/dev/urandom condition: 1 of selection_* falsepositives: - Legitimate script work level: high
Sigma rule: Identifies when a Point-to-site VPN is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Point-to-site VPN Modified or Deleted id: d9557b75-267b-4b43-922f-a775e2d1f792 status: test description: Identifies when a Point-to-site VPN is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/P2SVPNGATEWAYS/WRITE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DELETE - MICROSOFT.NETWORK/P2SVPNGATEWAYS/RESET/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/GENERATEVPNPROFILE/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/DISCONNECTP2SVPNCONNECTIONS/ACTION - MICROSOFT.NETWORK/P2SVPNGATEWAYS/PROVIDERS/MICROSOFT.INSIGHTS/DIAGNOSTICSETTINGS/WRITE condition: selection falsepositives: - Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command li. Logsource: windows / process_creation. Rule: title: HackTool - Certify Execution id: 762f2482-ff21-4970-8939-0aa317a886bb status: test description: Detects Certify a tool for Active Directory certificate abuse based on PE metadata characteristics and common command line arguments. references: - https://github.com/GhostPack/Certify author: pH-T (Nextron Systems) date: 2023-04-17 modified: 2023-04-25 tags: - attack.discovery - attack.credential-access - attack.t1649 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Certify.exe - OriginalFileName: Certify.exe - Description|contains: Certify selection_cli_commands: CommandLine|contains: - '.exe cas ' - '.exe find ' - '.exe pkiobjects ' - '.exe request ' - '.exe download ' selection_cli_options: CommandLine|contains: - ' /vulnerable' - ' /template:' - ' /altname:' - ' /domain:' - ' /path:' - ' /ca:' condition: selection_img or all of selection_cli_* falsepositives: - Unknown level: high
Sigma rule: Detects scheduled task creations or modification on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Types id: 24c8392b-aa3c-46b7-a545-43f71657fe98 related: - id: 7a02e22e-b885-4404-b38b-1ddc7e65258a type: similar status: test description: Detects scheduled task creations or modification on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' filter_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* and not 1 of filter_* falsepositives: - Legitimate processes that run at logon. Filter according to your environment level: high
Sigma rule: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that. Logsource: windows / registry_set. Rule: title: Enable Remote Connection Between Anonymous Computer - AllowAnonymousCallback id: 4d431012-2ab5-4db7-a84e-b29809da2172 status: test description: Detects enabling of the "AllowAnonymousCallback" registry value, which allows a remote connection between computers that do not have a trust relationship. references: - https://learn.microsoft.com/en-us/windows/win32/wmisdk/connecting-to-wmi-remotely-starting-with-vista author: X__Junior (Nextron Systems) date: 2023-11-03 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: \Microsoft\WBEM\CIMOM\AllowAnonymousCallback Details: DWORD (0x00000001) condition: selection falsepositives: - Administrative activity level: medium
Sigma rule: Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into. Logsource: windows / registry_set. Rule: title: Uncommon Extension In Keyboard Layout IME File Registry Value id: b888e3f2-224d-4435-b00b-9dd66e9ea1f1 related: - id: 9d8f9bb8-01af-4e15-a3a2-349071530530 type: derived status: test description: 'Detects usage of Windows Input Method Editor (IME) keyboard layout feature, which allows an attacker to load a DLL into the process after sending the WM_INPUTLANGCHANGEREQUEST message. Before doing this, the client needs to register the DLL in a special registry key that is assumed to implement this keyboard layout. This registry key should store a value named "Ime File" with a DLL path. IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean. ' references: - https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/ author: X__Junior (Nextron Systems) date: 2023-11-21 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \Control\Keyboard Layouts\ - Ime File filter_main_known_extension: Details|endswith: .ime condition: selection and not 1 of filter_main_* falsepositives: - IMEs are essential for languages that have more characters than can be represented on a standard keyboard, such as Chinese, Japanese, and Korean. level: high
Sigma rule: Detects process dump via legitimate sqldumper.exe binary. Logsource: windows / process_creation. Rule: title: Dumping Process via Sqldumper.exe id: 23ceaf5c-b6f1-4a32-8559-f2ff734be516 status: test description: Detects process dump via legitimate sqldumper.exe binary references: - https://twitter.com/countuponsec/status/910977826853068800 - https://twitter.com/countuponsec/status/910969424215232518 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/ author: Kirill Kiryanov, oscd.community date: 2020-10-08 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \sqldumper.exe CommandLine|contains: - '0x0110' - 0x01100:40 condition: selection falsepositives: - Legitimate MSSQL Server actions level: medium
Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node CurrentVersion Autorun Keys Modification id: b29aed60-ebd1-442b-9cb5-16a1d0324adb related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d - https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/ author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-12-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion selection_wow_current_version_keys: TargetObject|contains: - \ShellServiceObjectDelayLoad - \Run\ - \RunOnce\ - \RunOnceEx\ - \RunServices\ - \RunServicesOnce\ - \Explorer\ShellServiceObjects - \Explorer\ShellIconOverlayIdentifiers - \Explorer\ShellExecuteHooks - \Explorer\SharedTaskScheduler - \Explorer\Browser Helper Objects filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_ms_win_desktop_runtime: Details|startswith: '"C:\ProgramData\Package Cache\{d21a4f20-968a-4b0c-bf04-a38da5f06e41}\windowsdesktop-runtime-' filter_main_vcredist: Image|endswith: \VC_redist.x64.exe Details|endswith: '}\VC_redist.x64.exe" /burn.runonce' filter_main_upgrades: Image|startswith: - C:\ProgramData\Package Cache - C:\Windows\Temp\ Image|contains: - \winsdksetup.exe - \windowsdesktop-runtime- - \AspNetCoreSharedFrameworkBundle- Details|endswith: ' /burn.runonce' filter_main_uninstallers: Image|startswith: C:\Windows\Installer\MSI TargetObject|contains: \Explorer\Browser Helper Objects filter_main_msiexec: Image: C:\WINDOWS\system32\msiexec.exe TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ filter_main_edge: Image|contains|all: - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{ - \setup.exe filter_optional_msoffice1: Image: C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe TargetObject|contains: \Office\ClickToRun\REGISTRY\MACHINE\Software\Wow64
Sigma rule: Show when a monitor or a span/rspan is setup or modified. Logsource: cisco / aaa. Rule: title: Cisco Sniffing id: b9e1f193-d236-4451-aaae-2f3d2102120d status: test description: Show when a monitor or a span/rspan is setup or modified author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.discovery - attack.t1040 logsource: product: cisco service: aaa detection: keywords: - monitor capture point - set span - set rspan condition: keywords falsepositives: - Admins may setup new or modify old spans, or use a monitor for troubleshooting level: medium
Sigma rule: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific ser. Logsource: windows / security. Rule: title: Metasploit Or Impacket Service Installation Via SMB PsExec id: 6fb63b40-e02a-403e-9ffd-3bcc1d749442 related: - id: 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0 type: derived status: test description: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation references: - https://bczyz1.github.io/2021/01/30/psexec.html author: Bartlomiej Czyz, Relativity date: 2021-01-21 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1570 - attack.execution - attack.t1569.002 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|re: ^%systemroot%\\[a-zA-Z]{8}\.exe$ ServiceName|re: (^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$) ServiceStartType: 3 ServiceType: '0x10' filter: ServiceName: PSEXESVC condition: selection and not filter falsepositives: - Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name level: high
Sigma rule: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout. Logsource: windows / process_creation. Rule: title: Suspicious Powercfg Execution To Change Lock Screen Timeout id: f8d6a15e-4bc8-4c27-8e5d-2b10f0b73e5b status: test description: Detects suspicious execution of 'Powercfg.exe' to change lock screen timeout references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options author: frack113 date: 2022-11-18 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_power: - Image|endswith: \powercfg.exe - OriginalFileName: PowerCfg.exe selection_standby: - CommandLine|contains|all: - '/setacvalueindex ' - SCHEME_CURRENT - SUB_VIDEO - VIDEOCONLOCK - CommandLine|contains|all: - '-change ' - -standby-timeout- condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects port forwarding activity via SSH.exe. Logsource: windows / process_creation. Rule: title: Port Forwarding Activity Via SSH.EXE id: 327f48c1-a6db-4eb8-875a-f6981f1b0183 status: test description: Detects port forwarding activity via SSH.exe references: - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-12 modified: 2024-03-05 tags: - attack.command-and-control - attack.lateral-movement - attack.t1572 - attack.t1021.001 - attack.t1021.004 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ssh.exe CommandLine|contains|windash: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: medium