alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects potential DLL sideloading using comctl32.dll to obtain system privileges. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via comctl32.dll id: 6360757a-d460-456c-8b13-74cf0e60cceb status: test description: Detects potential DLL sideloading using comctl32.dll to obtain system privileges references: - https://github.com/binderlabs/DirCreate2System - https://github.com/sailay1996/awesome_windows_logical_bugs/blob/60cbb23a801f4c3195deac1cc46df27c225c3d07/dir_create2system.txt author: Nasreddine Bencherchali (Nextron Systems), Subhash Popuri (@pbssubhash) date: 2022-12-16 modified: 2022-12-19 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|startswith: - C:\Windows\System32\logonUI.exe.local\ - C:\Windows\System32\werFault.exe.local\ - C:\Windows\System32\consent.exe.local\ - C:\Windows\System32\narrator.exe.local\ - C:\windows\system32\wermgr.exe.local\ ImageLoaded|endswith: \comctl32.dll condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects the download of suspicious file type from a well-known file and paste sharing domain. Logsource: windows / create_stream_hash. Rule: title: Unusual File Download From File Sharing Websites - File Stream id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 related: - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects the download of suspicious file type from a well-known file and paste sharing domain references: - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90015 - https://www.cisa.gov/uscert/ncas/alerts/aa22-321a - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ author: Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2026-03-29 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection_domain: Contents|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at selection_extension: TargetFilename|contains: - .bat:Zone - .cmd:Zone - .ps1:Zone condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection. Logsource: windows / process_creation. Rule: title: Renamed Mavinject.EXE Execution id: e6474a1b-5390-49cd-ab41-8d88655f7394 status: test description: Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://twitter.com/gN3mes1s/status/941315826107510784 - https://reaqta.com/2017/12/mavinject-microsoft-injector/ - https://twitter.com/Hexacorn/status/776122138063409152 - https://github.com/SigmaHQ/sigma/issues/3742 - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection author: frack113, Florian Roth date: 2022-12-05 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 - attack.t1218.013 logsource: category: process_creation product: windows detection: selection: OriginalFileName: - mavinject32.exe - mavinject64.exe filter: Image|endswith: - \mavinject32.exe - \mavinject64.exe condition: selection and not filter falsepositives: - Unlikely level: high
Sigma rule: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by chec. Logsource: windows / security. Rule: title: User Couldn't Call a Privileged Service 'LsaRegisterLogonProcess' id: 6daac7fc-77d1-449a-a71a-e6b4d59a0e54 status: test description: The 'LsaRegisterLogonProcess' function verifies that the application making the function call is a logon process by checking that it has the SeTcbPrivilege privilege set. Possible Rubeus tries to get a handle to LSA. references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.credential-access - attack.lateral-movement - attack.privilege-escalation - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4673 Service: LsaRegisterLogonProcess() Keywords: '0x8010000000000000' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence. Logsource: windows / registry_set. Rule: title: Potential Persistence Via CHM Helper DLL id: 976dd1f2-a484-45ec-aa1d-0e87e882262b status: test description: Detects when an attacker modifies the registry key "HtmlHelp Author" to achieve persistence references: - https://persistence-info.github.io/Data/htmlhelpauthor.html - https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \Software\Microsoft\HtmlHelp Author\Location - \Software\WOW6432Node\Microsoft\HtmlHelp Author\Location condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the creation of a office macro file from a a suspicious process. Logsource: windows / file_event. Rule: title: Office Macro File Creation From Suspicious Process id: b1c50487-1967-4315-a026-6491686d860e status: test description: Detects the creation of a office macro file from a a suspicious process references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2023-02-22 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows definition: 'Requirements: The "ParentImage" field is not available by default on EID 11 of Sysmon logs. To be able to use this rule to the full extent you need to enriche the log with additional ParentImage data' detection: selection_cmd: - Image|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - ParentImage|endswith: - \cscript.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_ext: TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed us. Logsource: windows / image_load. Rule: title: Potential Vcruntime140 DLL Sideloading id: d7a63acb-1284-49bc-bfea-7771146c8b1c status: experimental description: 'Detects potential DLL sideloading of vcruntime140.dll, a common C++ runtime library. Threat actors have been observed using DLL sideloading techniques to load malicious payloads under the guise of legitimate applications such as SqlWriter, SqlDumper etc. Notably, APT29 has been documented leveraging WinELOADER to sideload vcruntime140.dll for executing malicious code. ' references: - https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties - https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader - https://www.nextron-systems.com/2023/09/15/detecting-janelarat-with-yara-and-thor/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-12 modified: 2026-05-18 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vcruntime140.dll filter_main_legitimate_path: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Program Files\ - C:\Program Files (x86)\ filter_main_legitimate_signer: Signed: true SignatureStatus: Valid Description|endswith: C Runtime Library filter_optional_onedrive: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Microsoft\OneDrive\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/image_load/image_load_side_load_vcruntime140/info.yml
Sigma rule: By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged. Logsource: windows / process_creation. Rule: title: Persistence Via Sticky Key Backdoor id: 1070db9a-3e5d-412e-8e7b-7183b616e1b3 status: test description: 'By replacing the sticky keys executable with the local admins CMD executable, an attacker is able to access a privileged windows console session without authenticating to the system. When the sticky keys are "activated" the privilleged shell is launched. ' references: - https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html - https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf - https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors author: Sreeman date: 2020-02-18 modified: 2023-03-07 tags: - attack.persistence - attack.t1546.008 - attack.privilege-escalation logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - 'copy ' - '/y ' - C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Detects usage of the "systeminfo" command to retrieve information. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Systeminfo id: 0ef56343-059e-4cb6-adc1-4c3c967c5e46 status: test description: Detects usage of the "systeminfo" command to retrieve information references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo author: frack113 date: 2022-01-01 modified: 2022-07-14 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \systeminfo.exe - OriginalFileName: sysinfo.exe condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects potential DLL sideloading of rcdll.dll. Logsource: windows / image_load. Rule: title: Potential Rcdll.DLL Sideloading id: 6e78b74f-c762-4800-82ad-f66787f10c8a status: test description: Detects potential DLL sideloading of rcdll.dll references: - https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html author: X__Junior (Nextron Systems) date: 2023-03-13 modified: 2023-03-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \rcdll.dll filter: ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Visual Studio\ - C:\Program Files (x86)\Windows Kits\ condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 2 id: c98f2a0d-e1b8-4f76-90d3-359caf88d6b9 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🤷🏼 - 🤷🏼‍♂️ - 🙎🏼‍♀️ - 🙎🏼 - 🙎🏼‍♂️ - 🙍🏼‍♀️ - 🙍🏼 - 🙍🏼‍♂️ - 💇🏼‍♀️ - 💇🏼 - 💇🏼‍♂️ - 💆🏼‍♀️ - 💆🏼 - 💆🏼‍♂️ - 🧖🏼‍♀️ - 🧖🏼 - 🧖🏼‍♂️ - 💃🏼 - 🕺🏼 - 🕴🏼 - 👩🏼‍🦽 - 🧑🏼‍🦽 - 👨🏼‍🦽 - 👩🏼‍🦼 - 🧑🏼‍🦼 - 👨🏼‍🦼 - 🚶🏼‍♀️ - 🚶🏼 - 🚶🏼‍♂️ - 👩🏼‍🦯 - 🧑🏼‍🦯 - 👨🏼‍🦯 - 🧎🏼‍♀️ - 🧎🏼 - 🧎🏼‍♂️ - 🏃🏼‍♀️ - 🏃🏼 - 🏃🏼‍♂️ - 🧍🏼‍♀️ - 🧍🏼 - 🧍🏼‍♂️ - 👭🏼 - 🧑🏼‍🤝‍🧑🏼 - 👬🏼 - 👫🏼 - 🧗🏼‍♀️ - 🧗🏼 - 🧗🏼‍♂️ - 🏇🏼 - 🏂🏼 - 🏌🏼‍♀️ - 🏌🏼 - 🏌🏼‍♂️ - 🏄🏼‍♀️ - 🏄🏼 - 🏄🏼‍♂️ - 🚣🏼‍♀️ - 🚣🏼 - 🚣🏼‍♂️ - 🏊🏼‍♀️ - 🏊🏼 - 🏊🏼‍♂️ - ⛹🏼‍♀️ - ⛹🏼 - ⛹🏼‍♂️ - 🏋🏼‍♀️ - 🏋🏼 - 🏋🏼‍♂️ - 🚴🏼‍♀️ - 🚴🏼 - 🚴🏼‍♂️ - 🚵🏼‍♀️ - 🚵🏼 - 🚵🏼‍♂️ - 🤸🏼‍♀️ - 🤸🏼 - 🤸🏼‍♂️ - 🤽🏼‍♀️ - 🤽🏼 - 🤽🏼‍♂️ - 🤾🏼‍♀️ - 🤾🏼 - 🤾🏼‍♂️ - 🤹🏼‍♀️ - 🤹🏼 - 🤹🏼‍♂️ - 🧘🏼‍♀️ - 🧘🏼 - 🧘🏼‍♂️ - 🛀🏼 - 🛌🏼 - 👋🏽 - 🤚🏽 - 🖐🏽 - ✋🏽 - 🖖🏽 - 👌🏽 - 🤌🏽 - 🤏🏽 - ✌🏽 - 🤞🏽 - 🫰🏽 - 🤟🏽 - 🤘🏽 - 🤙🏽 - 🫵🏽 - 🫱🏽 - 🫲🏽 - 🫳🏽 - 🫴🏽 - 👈🏽 - 👉🏽 - 👆🏽 - 🖕🏽 - 👇🏽 - ☝🏽 - 👍🏽 - 👎🏽 - ✊🏽 - 👊🏽 - 🤛🏽 - 🤜🏽 - 👏🏽 - 🫶🏽 - 🙌🏽 - 👐🏽 - 🤲🏽 - 🙏🏽 - ✍🏽 - 💪🏽 - 🦵🏽 - 🦶🏽 - 👂🏽 - 🦻🏽 - 👃🏽 - 👶🏽 - 👧🏽 - 🧒🏽 - 👦🏽 - 👩🏽 - 🧑🏽 - 👨🏽 - 👩🏽‍🦱 - 🧑🏽‍🦱 - 👨🏽‍🦱 - 👩🏽‍🦰 - 🧑🏽‍🦰 - 👨🏽‍🦰 - 👱🏽‍♀️ - 👱🏽 - 👱🏽‍♂️ - 👩🏽‍🦳 - 🧑🏽‍🦳 - 👨🏽‍🦳 - 👩🏽‍🦲 - 🧑🏽‍🦲 - 👨🏽‍🦲 - 🧔🏽‍♀️ - 🧔🏽 - 🧔🏽‍♂️ - 👵🏽 - 🧓🏽 - 👴🏽 - 👲🏽 - 👳🏽‍♀️ - 👳🏽 - 👳🏽‍♂️ - 🧕🏽 - 👮🏽‍♀️ - 👮🏽 - 👮🏽‍♂️ - 👷🏽‍♀️ - 👷🏽 - 👷🏽‍♂️ - 💂🏽‍♀️ - 💂🏽 - 💂🏽‍♂️ - 🕵🏽‍♀️ - 🕵🏽 - 🕵🏽‍♂️ - 👩🏽‍⚕️ - 🧑🏽‍⚕️ - 👨🏽‍⚕️ - 👩🏽‍🌾 - 🧑🏽‍🌾 - 👨🏽‍🌾 - 👩🏽‍🍳 - 🧑🏽‍🍳 - 👨🏽‍🍳 - 👩🏽‍🎓 - 🧑🏽‍🎓 - 👨🏽‍🎓 - 👩🏽‍🎤 - 🧑🏽‍🎤 - 👨🏽‍🎤 - 👩🏽‍🏫 - 🧑🏽‍🏫 - 👨🏽‍🏫 - 👩🏽‍🏭 - 🧑🏽‍🏭 - 👨🏽‍🏭 - 👩🏽‍💻 - 🧑🏽‍💻 - 👨🏽‍💻 - 👩🏽‍💼 - 🧑🏽‍💼 - 👨🏽‍💼 - 👩🏽‍🔧 - 🧑🏽‍🔧 - 👨🏽‍🔧 - 👩🏽‍🔬 - 🧑🏽‍🔬 - 👨🏽‍🔬 - 👩🏽‍🎨 - 🧑🏽‍🎨 - 👨🏽‍🎨 - 👩🏽‍🚒 - 🧑🏽‍🚒 - 👨🏽‍🚒 - 👩🏽‍✈️ - 🧑🏽‍✈️ - 👨🏽‍✈️ - 👩🏽‍🚀 - 🧑🏽‍🚀 - 👨🏽‍🚀 - 👩🏽‍⚖️ - 🧑🏽‍⚖️ - 👨🏽‍⚖️ - 👰🏽‍♀️ - 👰🏽 - 👰🏽‍♂️ - 🤵🏽‍♀️ - 🤵🏽 - 🤵🏽‍♂️ - 👸🏽 - 🫅🏽 - 🤴🏽 - 🥷🏽 - 🦸🏽‍♀️ - 🦸🏽 - 🦸🏽‍♂️ - 🦹🏽‍♀️ - 🦹🏽 - 🦹🏽‍♂️ - 🤶🏽 - 🧑🏽‍🎄 - 🎅🏽 - 🧙🏽‍♀️ - 🧙🏽 - 🧙🏽‍♂️ - 🧝🏽‍♀️ - 🧝🏽 - 🧝🏽‍♂️ - 🧛🏽‍♀️ - 🧛🏽 - 🧛🏽‍♂️ - 🧜🏽‍♀️ - 🧜🏽 - 🧜🏽‍♂️ - 🧚🏽‍♀️ - 🧚🏽 - 🧚🏽‍♂️ - 👼🏽 - 🤰🏽 - 🫄🏽 - 🫃🏽 - 🤱🏽 - 👩🏽‍🍼 - 🧑🏽‍🍼 - 👨🏽‍🍼 - 🙇🏽‍♀️ - 🙇🏽 - 🙇🏽‍♂️ - 💁🏽‍♀️ - 💁🏽 - 💁🏽‍♂️ - 🙅🏽‍♀️ - 🙅🏽 - 🙅🏽‍♂️ - 🙆🏽‍♀️ - 🙆🏽 - 🙆🏽‍♂️ - 🙋🏽‍♀️ - 🙋🏽 - 🙋🏽‍♂️ - 🧏🏽‍♀️ - 🧏🏽 - 🧏🏽‍♂️ - 🤦🏽‍♀️ - 🤦🏽 - 🤦🏽‍♂️ - 🤷🏽‍♀️ - 🤷🏽 - 🤷🏽‍♂️ - 🙎🏽‍♀️ - 🙎🏽 - 🙎🏽‍♂️ - 🙍🏽‍♀️ - 🙍🏽 - 🙍🏽‍♂️ - 💇🏽‍♀️ - 💇🏽 - 💇🏽‍♂️ - 💆🏽‍♀️ - 💆🏽 - 💆🏽‍♂️ - 🧖🏽‍♀️ - 🧖🏽 - 🧖🏽‍♂️ - 💃🏽 - 🕺🏽 - 🕴🏽 - 👩
Sigma rule: Detects suspicious process patterns found in logs when CrackMapExec is used. Logsource: windows / process_creation. Rule: title: HackTool - CrackMapExec Process Patterns id: f26307d8-14cd-47e3-a26b-4b4769f24af6 status: test description: Detects suspicious process patterns found in logs when CrackMapExec is used references: - https://mpgn.gitbook.io/crackmapexec/smb-protocol/obtaining-credentials/dump-lsass author: Florian Roth (Nextron Systems) date: 2022-03-12 modified: 2023-02-13 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: process_creation detection: selection_lsass_dump1: CommandLine|contains|all: - 'tasklist /fi ' - Imagename eq lsass.exe CommandLine|contains: - 'cmd.exe /c ' - 'cmd.exe /r ' - 'cmd.exe /k ' - 'cmd /c ' - 'cmd /r ' - 'cmd /k ' User|contains: - AUTHORI - AUTORI selection_lsass_dump2: CommandLine|contains|all: - do rundll32.exe C:\windows\System32\comsvcs.dll, MiniDump - \Windows\Temp\ - ' full' - '%%B' selection_procdump: CommandLine|contains|all: - tasklist /v /fo csv - findstr /i "lsass" condition: 1 of selection* falsepositives: - Unknown level: high
Sigma rule: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility. Logsource: windows / process_creation. Rule: title: Potential Suspicious Registry File Imported Via Reg.EXE id: 62e0298b-e994-4189-bc87-bc699aa62d97 related: - id: 73bba97f-a82d-42ce-b315-9182e76c57b1 type: derived status: test description: Detects the import of '.reg' files from suspicious paths using the 'reg.exe' utility references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/reg-import author: frack113, Nasreddine Bencherchali date: 2022-08-01 modified: 2023-02-05 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_cli: CommandLine|contains: ' import ' selection_paths: CommandLine|contains: - C:\Users\ - '%temp%' - '%tmp%' - '%appdata%' - \AppData\Local\Temp\ - C:\Windows\Temp\ - C:\ProgramData\ condition: all of selection_* falsepositives: - Legitimate import of keys level: medium
Sigma rule: load malicious registered COM objects. Logsource: windows / process_creation. Rule: title: Rundll32 Registered COM Objects id: f1edd233-30b5-4823-9e6a-c4171b24d316 status: test description: load malicious registered COM objects references: - https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md author: frack113 date: 2022-02-13 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains: - '-sta ' - '-localserver ' CommandLine|contains|all: - '{' - '}' condition: all of selection_* falsepositives: - Legitimate use level: high
Sigma rule: Detects known suspicious (default) user-agents related to scanning/recon tools. Logsource: webserver. Rule: title: Suspicious User-Agents Related To Recon Tools id: 19aa4f58-94ca-45ff-bc34-92e533c0994a status: test description: Detects known suspicious (default) user-agents related to scanning/recon tools references: - https://github.com/commixproject/commix/blob/c7f1447371524427bb30abe731235acc7386153b/src/utils/settings.py#L281 - https://github.com/epi052/feroxbuster/blob/ffdf871abe0a358a1531ba4135e208d4dbe8fc31/src/config/utils.rs#L100 - https://github.com/ffuf/ffuf/blob/ce3cf6bd733a24d3a9f024305234c1a6298198eb/pkg/runner/simple.go#L130 - https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92 - https://github.com/nmap/nmap/blob/2e47fa87469fd358ef64689d2d2de7294e385eb8/nselib/http.lua#L160 - https://github.com/OJ/gobuster/blob/d20300cc46096984565e82fb73a45bf8d281b990/libgobuster/helpers.go#L124 - https://github.com/sqlmapproject/sqlmap/blob/be216041e2f255ae43b050d466bd5bf92681e665/lib/core/settings.py#L29 - https://github.com/sullo/nikto/blob/999670cb6a939b6c93840ce666941756e4c5dcf5/program/plugins/nikto_core.plugin#L3515 - https://github.com/urbanadventurer/WhatWeb/blob/d279d93042d034f3fd29d5a893d44ccc0595d3f8/lib/whatweb.rb#L68 - https://github.com/wpscanteam/wpscan/blob/4f1ce142b9768044be3e35bd0cddf1052e35efe8/lib/wpscan/browser.rb#L32 - https://github.com/xmendez/wfuzz/blob/2263cd0932fef333118cd197656f709141bab615/src/wfuzz/facade.py#L43 - https://github.com/zmap/zgrab2/blob/e91fc9860ca6611eb7c6fe7d2fe2be70212a37ba/modules/http/scanner.go#L54 author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton date: 2022-07-19 modified: 2026-06-11 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-user-agent|contains: - commix/ - feroxbuster/ - Fuzz Faster U Fool - GIS - AppSec Team - Project Vision - gobuster/ - Nikto/ - Nmap Scripting Engine - Recon-ng/v - sqlmap/ - WhatWeb/ - Wfuzz/ - WPScan v - zgrab/ condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse sh. Logsource: linux. Rule: title: Suspicious Reverse Shell Command Line id: 738d9bcf-6999-4fdb-b4ac-3033037db8ab status: test description: Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell references: - https://alamot.github.io/reverse_shells/ author: Florian Roth (Nextron Systems) date: 2019-04-02 modified: 2021-11-27 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: - BEGIN {s = "/inet/tcp/0/ - bash -i >& /dev/tcp/ - bash -i >& /dev/udp/ - sh -i >$ /dev/udp/ - sh -i >$ /dev/tcp/ - '&& while read line 0<&5; do' - /bin/bash -c exec 5<>/dev/tcp/ - /bin/bash -c exec 5<>/dev/udp/ - 'nc -e /bin/sh ' - /bin/sh | nc - 'rm -f backpipe; mknod /tmp/backpipe p && nc ' - ;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))) - ;STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>; - /bin/sh -i <&3 >&3 2>&3 - uname -a; w; id; /bin/bash -i - $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()}; - ;os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv('HISTFILE','/dev/null'); - .to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f) - ;while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print - 'socat exec:''bash -li'',pty,stderr,setsid,sigint,sane tcp:' - rm -f /tmp/p; mknod /tmp/p p && - ' | /bin/bash | telnet ' - ',echo=0,raw tcp-listen:' - 'nc -lvvp ' - xterm -display 1 condition: keywords falsepositives: - Unknown level: high