alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting. Logsource: zeek / kerberos. Rule: title: Kerberos Network Traffic RC4 Ticket Encryption id: 503fe26e-b5f2-4944-a126-eab405cc06e5 status: test description: Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting references: - https://adsecurity.org/?p=3458 author: sigma date: 2020-02-12 modified: 2021-11-27 tags: - attack.credential-access - attack.t1558.003 logsource: product: zeek service: kerberos detection: selection: request_type: TGS cipher: rc4-hmac computer_acct: service|startswith: $ condition: selection and not computer_acct falsepositives: - Normal enterprise SPN requests activity level: medium
Sigma rule: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190). Logsource: windows / process_creation. Rule: title: Sdiagnhost Calling Suspicious Child Process id: f3d39c45-de1a-4486-a687-ab126124f744 status: test description: Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190) references: - https://twitter.com/nao_sec/status/1530196847679401984 - https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e - https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ - https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/ - https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/ author: Nextron Systems, @Kostastsale date: 2022-06-01 modified: 2024-08-23 tags: - attack.stealth - attack.t1036 - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sdiagnhost.exe Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe - \mshta.exe - \cscript.exe - \wscript.exe - \taskkill.exe - \regsvr32.exe - \rundll32.exe - \calc.exe filter_main_cmd_bits: Image|endswith: \cmd.exe CommandLine|contains: bits filter_main_powershell_noprofile: Image|endswith: \powershell.exe CommandLine|endswith: - -noprofile - - -noprofile condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Netw. Logsource: cisco / aaa. Rule: title: Cisco Dot1x Disabled id: ef0ff092-a24a-4fbc-beea-06c08d53e085 status: experimental description: 'Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface. Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network. This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices. ' references: - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680 - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400 - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220 author: Luc Génaux date: 2026-04-28 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1685 - attack.t1556.004 logsource: product: cisco service: aaa detection: keywords: - access-session port-control force-authorized - authentication port-control force-authorized - dot1x port-control force-authorized - no access-session port-control - no authentication port-control - no dot1x port-control - no dot1x system-auth-control condition: keywords falsepositives: - Administrator troubleshooting connectivity issues level: medium
Sigma rule: Detects default file names outputted by the BloodHound collection tool SharpHound. Logsource: windows / file_event. Rule: title: BloodHound Collection Files id: 02773bed-83bf-469f-b7ff-e676e7d78bab status: test description: Detects default file names outputted by the BloodHound collection tool SharpHound references: - https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection author: C.J. May date: 2022-08-09 modified: 2026-02-19 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 - attack.t1482 - attack.t1069.001 - attack.t1069.002 - attack.execution - attack.t1059.001 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - BloodHound.zip - _computers.json - _containers.json - _gpos.json - _groups.json - _ous.json - _users.json filter_optional_ms_winapps: Image|endswith: \svchost.exe TargetFilename|startswith: C:\Program Files\WindowsApps\Microsoft. TargetFilename|endswith: \pocket_containers.json condition: selection and not 1 of filter_optional_* falsepositives: - Some false positives may arise in some environment and this may require some tuning. Add additional filters or reduce level depending on the level of noise level: high
Sigma rule: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen sourc. Logsource: azure / activitylogs. Rule: title: Rare Subscription-level Operations In Azure id: c1182e02-49a3-481c-b3de-0fadc4091488 status: test description: Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used. references: - https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml author: sawwinnnaung date: 2020-05-07 modified: 2023-10-11 tags: - attack.t1003 - attack.credential-access logsource: product: azure service: activitylogs detection: keywords: - Microsoft.DocumentDB/databaseAccounts/listKeys/action - Microsoft.Maps/accounts/listKeys/action - Microsoft.Media/mediaservices/listKeys/action - Microsoft.CognitiveServices/accounts/listKeys/action - Microsoft.Storage/storageAccounts/listKeys/action - Microsoft.Compute/snapshots/write - Microsoft.Network/networkSecurityGroups/write condition: keywords falsepositives: - Valid change level: medium
Sigma rule: Detects Obfuscated use of stdin to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation STDIN+ Launcher id: 6c96fc76-0eb1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of stdin to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+\" condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Local Administrators Group id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 related: - id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember". references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-08-12 modified: 2023-03-02 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - ' administrators ' - ' administrateur' condition: all of selection_* falsepositives: - Administrative activity level: medium
Sigma rule: Detects when a memory process image does not match the disk image, indicative of process hollowing.. Logsource: windows / process_tampering. Rule: title: Potential Process Hollowing Activity id: c4b890e5-8d8c-4496-8c66-c805753817cd status: test description: Detects when a memory process image does not match the disk image, indicative of process hollowing. references: - https://twitter.com/SecurePeacock/status/1486054048390332423?s=20 - https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Sittikorn S date: 2022-01-25 modified: 2023-11-28 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.012 logsource: product: windows category: process_tampering detection: selection: Type: Image is replaced filter_main_generic: Image|contains: - :\Program Files (x86) - :\Program Files\ - :\Windows\System32\wbem\WMIADAP.exe - :\Windows\SysWOW64\wbem\WMIADAP.exe filter_optional_opera: Image|contains: \AppData\Local\Programs\Opera\ Image|endswith: \opera.exe filter_optional_edge: Image|endswith: \WindowsApps\MicrosoftEdge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, a. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Admission Controller id: a61a3c56-4ce2-4351-a079-88ae4cbd2b58 status: test description: 'Identifies when an admission controller is executed in Azure Kubernetes. A Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server. The behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster. An adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster. For example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials. An adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-18 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078 - attack.credential-access - attack.t1552 - attack.t1552.007 logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/ADMISSIONREGISTRATION.K8S.IO operationName|endswith: - /MUTATINGWEBHOOKCONFIGURATIONS/WRITE - /VALIDATINGWEBHOOKCONFIGURATIONS/WRITE condition: selection falsepositives: - Azure Kubernetes Admissions Controller may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens. Logsource: windows / process_creation. Rule: title: Potentially Suspicious JWT Token Search Via CLI id: 6d3a3952-6530-44a3-8554-cf17c116c615 status: test description: 'Detects potentially suspicious search for JWT tokens via CLI by looking for the string "eyJ0eX" or "eyJhbG". JWT tokens are often used for access-tokens across various applications and services like Microsoft 365, Azure, AWS, Google Cloud, and others. Threat actors may search for these tokens to steal them for lateral movement or privilege escalation. ' references: - https://mrd0x.com/stealing-tokens-from-office-applications/ - https://www.scip.ch/en/?labs.20240523 author: Nasreddine Bencherchali (Nextron Systems), kagebunsher date: 2022-10-25 modified: 2025-10-21 tags: - attack.credential-access - attack.t1528 - attack.t1552.001 logsource: category: process_creation product: windows detection: selection_tools: CommandLine|contains: - 'find ' - find.exe - findstr - 'select-string ' - strings selection_jwt_string: CommandLine|contains: - eyJ0eXAiOi - eyJhbGciOi - ' eyJ0eX' - ' "eyJ0eX"' - ' ''eyJ0eX''' - ' eyJhbG' - ' "eyJhbG"' - ' ''eyJhbG''' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversar. Logsource: windows / ps_script. Rule: title: Execute Invoke-command on Remote Host id: 7b836d7f-179c-4ba4-90a7-a7e60afb48e6 status: test description: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-2---invoke-command - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.4 author: frack113 date: 2022-01-07 tags: - attack.lateral-movement - attack.t1021.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains|all: - 'invoke-command ' - ' -ComputerName ' condition: selection_cmdlet falsepositives: - Legitimate script level: medium
Sigma rule: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file. Logsource: windows / process_creation. Rule: title: User Discovery And Export Via Get-ADUser Cmdlet id: 1114e048-b69c-4f41-bc20-657245ae6e3f related: - id: c2993223-6da8-4b1a-88ee-668b8bf315e9 type: similar status: test description: Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - 'Get-ADUser ' - ' -Filter \*' CommandLine|contains: - ' > ' - ' | Select ' - Out-File - Set-Content - Add-Content condition: all of selection_* falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Sigma rule: Detects execution of the IEExec utility to download and execute files. Logsource: windows / process_creation. Rule: title: File Download And Execution Via IEExec.EXE id: 9801abb8-e297-4dbf-9fbd-57dde0e830ad status: test description: Detects execution of the IEExec utility to download and execute files references: - https://lolbas-project.github.io/lolbas/Binaries/Ieexec/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IEExec.exe - OriginalFileName: IEExec.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attack. Logsource: windows / process_creation. Rule: title: Loaded Module Enumeration Via Tasklist.EXE id: 34275eb8-fa19-436b-b959-3d9ecd53fa1f status: test description: 'Detects the enumeration of a specific DLL or EXE being used by a binary via "tasklist.exe". This is often used by attackers in order to find the specific process identifier (PID) that is using the DLL in question. In order to dump the process memory or perform other nefarious actions. ' references: - https://www.n00py.io/2021/05/dumping-plaintext-rdp-credentials-from-svchost-exe/ - https://pentestlab.blog/tag/svchost/ author: Swachchhanda Shrawan Poudel date: 2024-02-12 modified: 2024-03-13 tags: - attack.t1003 - attack.credential-access logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tasklist.exe - OriginalFileName: tasklist.exe selection_flags: CommandLine|contains|windash: -m selection_module: CommandLine|contains: rdpcorets.dll condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects nltest commands that can be used for information discovery. Logsource: windows / process_creation. Rule: title: Nltest.EXE Execution id: 903076ff-f442-475a-b667-4f246bcc203b related: - id: 5cc90652-4cbd-4241-aa3b-4b462fa5a248 type: similar - id: eeb66bbb-3dde-4582-815a-584aee9fe6d1 type: obsolete status: test description: Detects nltest commands that can be used for information discovery references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/nltest.htm author: Arun Chauhan date: 2023-02-03 tags: - attack.discovery - attack.t1016 - attack.t1018 - attack.t1482 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \nltest.exe - OriginalFileName: nltestrk.exe condition: selection falsepositives: - Legitimate administration activity level: low
Sigma rule: Detects the use of KrbRelay, a Kerberos relaying tool. Logsource: windows / process_creation. Rule: title: HackTool - KrbRelay Execution id: e96253b8-6b3b-4f90-9e59-3b24b99cf9b4 status: test description: Detects the use of KrbRelay, a Kerberos relaying tool references: - https://github.com/cube0x0/KrbRelay author: Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \KrbRelay.exe - OriginalFileName: KrbRelay.exe selection_cli_1: CommandLine|contains|all: - ' -spn ' - ' -clsid ' - ' -rbcd ' selection_cli_2: CommandLine|contains|all: - shadowcred - clsid - spn selection_cli_3: CommandLine|contains|all: - 'spn ' - 'session ' - 'clsid ' condition: 1 of selection_* falsepositives: - Unlikely level: high
Sigma rule: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription. Logsource: azure / auditlogs. Rule: title: App Assigned To Azure RBAC/Microsoft Entra Role id: b04934b2-0a68-4845-8a19-bdfed3a68a7a status: test description: Detects when an app is assigned Azure AD roles, such as global administrator, or Azure RBAC roles, such as subscription owner. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-19 modified: 2024-11-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1098.003 logsource: product: azure service: auditlogs detection: selection: targetResources.type: Service Principal properties.message: - Add member to role - Add eligible member to role - Add scoped member to role condition: selection falsepositives: - When the permission is legitimately needed for the app level: medium
Sigma rule: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploitin. Logsource: linux / sshd. Rule: title: Suspicious OpenSSH Daemon Error id: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc status: test description: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml author: Florian Roth (Nextron Systems) date: 2017-06-30 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: sshd detection: keywords: - unexpected internal error - unknown or unsupported key type - invalid certificate signing key - invalid elliptic curve value - incorrect signature - error in libcrypto - unexpected bytes remain after decoding - 'fatal: buffer_get_string: bad string' - 'Local: crc32 compensation attack' - bad client public DH value - Corrupted MAC on input condition: keywords falsepositives: - Unknown level: medium
Sigma rule: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the f. Logsource: windows / file_event. Rule: title: PSEXEC Remote Execution File Artefact id: 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4 status: test description: Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system references: - https://aboutdfir.com/the-key-to-identify-psexec/ - https://twitter.com/davisrichardg/status/1616518800584704028 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-21 modified: 2023-02-23 tags: - attack.lateral-movement - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1136.002 - attack.t1543.003 - attack.t1570 - attack.s0029 logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\PSEXEC- TargetFilename|endswith: .key condition: selection falsepositives: - Unlikely level: high
Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: zeek / smb_files. Rule: title: Transferring Files with Credential Data via Network Shares - Zeek id: 2e69f167-47b5-4ae7-a390-47764529eff5 related: - id: 910ab938-668b-401b-b08c-b596e80fdca5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: '@neu5ron, Teymur Kheirkhabarov, oscd.community' date: 2020-04-02 modified: 2021-11-27 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: zeek service: smb_files detection: selection: name: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - \sam - \ntds.dit - \security condition: selection falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium
Sigma rule: Detects suspicious DNS queries to Monero mining pools. Logsource: dns. Rule: title: Monero Crypto Coin Mining Pool Lookup id: b593fd50-7335-4682-a36c-4edcb68e4641 status: stable description: Detects suspicious DNS queries to Monero mining pools references: - https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/ author: Florian Roth (Nextron Systems) date: 2021-10-24 tags: - attack.impact - attack.t1496 - attack.exfiltration - attack.t1567 logsource: category: dns detection: selection: query|contains: - pool.minexmr.com - fr.minexmr.com - de.minexmr.com - sg.minexmr.com - ca.minexmr.com - us-west.minexmr.com - pool.supportxmr.com - mine.c3pool.com - xmr-eu1.nanopool.org - xmr-eu2.nanopool.org - xmr-us-east1.nanopool.org - xmr-us-west1.nanopool.org - xmr-asia1.nanopool.org - xmr-jp1.nanopool.org - xmr-au1.nanopool.org - xmr.2miners.com - xmr.hashcity.org - xmr.f2pool.com - xmrpool.eu - pool.hashvault.pro condition: selection falsepositives: - Legitimate crypto coin mining level: high