alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially. Logsource: windows / ps_script. Rule: title: Potential Persistence Via Security Descriptors - ScriptBlock id: 2f77047c-e6e9-4c11-b088-a3de399524cd status: test description: Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project. references: - https://github.com/HarmJ0y/DAMP author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-05 tags: - attack.persistence - attack.privilege-escalation - attack.defense-impairment logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - win32_Trustee - win32_Ace - .AccessMask - .AceType - .SetSecurityDescriptor ScriptBlockText|contains: - \Lsa\JD - \Lsa\Skew1 - \Lsa\Data - \Lsa\GBG condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right.. Logsource: windows / process_access. Rule: title: Suspicious LSASS Access Via MalSecLogon id: 472159c5-31b9-4f56-b794-b766faa8b0a7 status: test description: Detects suspicious access to LSASS handle via a call trace to "seclogon.dll" with a suspicious access right. references: - https://twitter.com/SBousseaden/status/1541920424635912196 - https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml - https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html author: Samir Bousseaden (original elastic rule), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: \svchost.exe GrantedAccess: '0x14c0' CallTrace|contains: seclogon.dll condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects common command used to enable bpf kprobes tracing. Logsource: linux / process_creation. Rule: title: Enable BPF Kprobes Tracing id: 7692f583-bd30-4008-8615-75dab3f08a99 status: test description: Detects common command used to enable bpf kprobes tracing references: - https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/ - https://bpftrace.org/ - https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-25 tags: - attack.execution - attack.stealth logsource: category: process_creation product: linux detection: selection: CommandLine|contains|all: - echo 1 > - /sys/kernel/debug/tracing/events/kprobes/ CommandLine|contains: - /myprobe/enable - /myretprobe/enable condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious connections from Microsoft Sync Center to non-private IPs.. Logsource: windows / network_connection. Rule: title: Microsoft Sync Center Suspicious Network Connections id: 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b status: test description: Detects suspicious connections from Microsoft Sync Center to non-private IPs. references: - https://redcanary.com/blog/intelligence-insights-november-2021/ author: elhoim date: 2022-04-28 modified: 2024-03-12 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 - attack.t1218 - attack.execution logsource: product: windows category: network_connection detection: selection: Image|endswith: \mobsync.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects Obfuscated use of Clip.exe to execute PowerShell. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation CLIP+ Launcher id: b222df08-0e07-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Clip.exe to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-13 modified: 2022-11-17 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - cmd - '&&' - 'clipboard]::' - -f CommandLine|contains: - /c - /r condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects registry modifications to the 'ms-settings' protocol handler, which is frequently targeted for UAC bypass or per. Logsource: windows / process_creation. Rule: title: Registry Modification of MS-settings Protocol Handler id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563 related: - id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7 type: similar status: test description: 'Detects registry modifications to the ''ms-settings'' protocol handler, which is frequently targeted for UAC bypass or persistence. Attackers can modify this registry to execute malicious code with elevated privileges by hijacking the command execution path. ' references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.trendmicro.com/en_us/research/25/f/water-curse.html author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.defense-impairment - attack.t1548.002 - attack.t1546.001 - attack.t1112 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_reg_cli: CommandLine|contains: add selection_pwsh_cli: CommandLine|contains: - New-ItemProperty - Set-ItemProperty - 'ni ' - 'sp ' selection_cli_key: CommandLine|contains: \ms-settings\shell\open\command condition: (all of selection_reg_* or all of selection_pwsh_*) and selection_cli_key falsepositives: - Unknown level: medium
Sigma rule: Detects the use of NirCmd tool for command execution as SYSTEM user. Logsource: windows / process_creation. Rule: title: PUA - NirCmd Execution As LOCAL SYSTEM id: d9047477-0359-48c9-b8c7-792cedcdc9c4 status: test description: Detects the use of NirCmd tool for command execution as SYSTEM user references: - https://www.nirsoft.net/utils/nircmd.html - https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/ - https://www.nirsoft.net/utils/nircmd2.html#using author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-24 modified: 2023-02-13 tags: - attack.execution - attack.t1569.002 - attack.s0029 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' runassystem ' condition: selection falsepositives: - Legitimate use by administrators level: high
Sigma rule: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process usin. Logsource: windows / image_load. Rule: title: Aruba Network Service Potential DLL Sideloading id: 90ae0469-0cee-4509-b67f-e5efcef040f7 status: test description: Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking references: - https://twitter.com/wdormann/status/1616581559892545537?t=XLCBO9BziGzD7Bmbt8oMEQ&s=09 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-03-15 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: \arubanetsvc.exe ImageLoaded|endswith: - \wtsapi32.dll - \msvcr100.dll - \msvcp100.dll - \dbghelp.dll - \dbgcore.dll - \wininet.dll - \iphlpapi.dll - \version.dll - \cryptsp.dll - \cryptbase.dll - \wldp.dll - \profapi.dll - \sspicli.dll - \winsta.dll - \dpapi.dll filter: ImageLoaded|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the. Logsource: windows / process_creation. Rule: title: Cab File Extraction Via Wusa.EXE From Potentially Suspicious Paths id: c74c0390-3e20-41fd-a69a-128f0275a5ea related: - id: 59b39960-5f9d-4a49-9cef-1e4d2c1d0cb9 type: derived status: test description: 'Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths. ' references: - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://www.echotrail.io/insights/search/wusa.exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-11-28 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_root: Image|endswith: \wusa.exe CommandLine|contains: '/extract:' selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, un. Logsource: linux / process_creation. Rule: title: Shell Execution via Rsync - Linux id: e2326866-609f-4015-aea9-7ec634e8aa04 status: experimental description: 'Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/rsync/#shell author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Florian Roth date: 2024-09-02 modified: 2025-01-18 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: - /rsync - /rsyncd CommandLine|contains: ' -e ' selection_cli: CommandLine|contains: - '/ash ' - '/bash ' - '/dash ' - '/csh ' - '/sh ' - '/zsh ' - '/tcsh ' - '/ksh ' - '''ash ' - '''bash ' - '''dash ' - '''csh ' - '''sh ' - '''zsh ' - '''tcsh ' - '''ksh ' condition: all of selection_* falsepositives: - Legitimate cases in which "rsync" is used to execute a shell level: high
Sigma rule: Detects if the secret scanning feature is disabled for an enterprise or repository.. Logsource: github / audit. Rule: title: Github Secret Scanning Feature Disabled id: 3883d9a0-fd0f-440f-afbb-445a2a799bb8 status: test description: Detects if the secret scanning feature is disabled for an enterprise or repository. references: - https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning author: Muhammad Faisal (@faisalusuf) date: 2024-03-07 modified: 2024-07-19 tags: - attack.defense-impairment - attack.t1685 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - business_secret_scanning.disable - business_secret_scanning.disabled_for_new_repos - repository_secret_scanning.disable - secret_scanning_new_repos.disable - secret_scanning.disable condition: selection falsepositives: - Allowed administrative activities. level: high
Sigma rule: Detects a suspicious child process of Script Event Consumer (scrcons.exe).. Logsource: windows / process_creation. Rule: title: Script Event Consumer Spawning Process id: f6d1dd2f-b8ce-40ca-bc23-062efb686b34 status: test description: Detects a suspicious child process of Script Event Consumer (scrcons.exe). references: - https://redcanary.com/blog/child-processes/ - https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html author: Sittikorn S date: 2021-06-21 modified: 2022-07-14 tags: - attack.execution - attack.t1047 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \scrcons.exe Image|endswith: - \svchost.exe - \dllhost.exe - \powershell.exe - \pwsh.exe - \wscript.exe - \cscript.exe - \schtasks.exe - \regsvr32.exe - \mshta.exe - \rundll32.exe - \msiexec.exe - \msbuild.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j). Logsource: windows / process_creation. Rule: title: Suspicious Processes Spawned by Java.EXE id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d related: - id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 type: similar status: test description: Detects suspicious processes spawned from a Java host process which could indicate a sign of exploitation (e.g. log4j) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Florian Roth date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \AppVLP.exe - \bitsadmin.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \hh.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \query.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \scrcons.exe - \scriptrunner.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe condition: selection falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: high
Sigma rule: Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privile. Logsource: linux / auditd. Rule: title: Potential Abuse of Linux Magic System Request Key id: ea61bb82-a5e0-42e6-8537-91d29500f1b9 status: experimental description: 'Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf. ' references: - https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel - https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html author: Milad Cheraghi date: 2025-05-23 tags: - attack.execution - attack.t1059.004 - attack.impact - attack.t1529 - attack.t1489 - attack.t1499 logsource: product: linux service: auditd definition: 'Required auditd configuration: -w /proc/sysrq-trigger -p wa -k sysrq -w /proc/sys/kernel/sysrq -p wa -k sysrq ' detection: selection: type: PATH name|endswith: - /sysrq - /sysctl.conf - /sysrq-trigger condition: selection falsepositives: - Legitimate administrative activity level: medium
Sigma rule: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg". Logsource: windows / file_event. Rule: title: Suspicious File Created Via OneNote Application id: fcc6d700-68d9-4241-9a1a-06874d621b06 status: test description: Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ - https://twitter.com/MaD_c4t/status/1623414582382567424 - https://labs.withsecure.com/publications/detecting-onenote-abuse - https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/ - https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-09 modified: 2023-02-27 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: - \onenote.exe - \onenotem.exe - \onenoteim.exe TargetFilename|contains: \AppData\Local\Temp\OneNote\ TargetFilename|endswith: - .bat - .chm - .cmd - .dll - .exe - .hta - .htm - .html - .js - .lnk - .ps1 - .vbe - .vbs - .wsf condition: selection falsepositives: - False positives should be very low with the extensions list cited. Especially if you don't heavily utilize OneNote. - Occasional FPs might occur if OneNote is used internally to share different embedded documents level: high
Sigma rule: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.. Logsource: proxy. Rule: title: Potential Base64 Encoded User-Agent id: 894a8613-cf12-48b3-8e57-9085f54aa0c3 related: - id: d443095b-a221-4957-a2c4-cd1756c9b747 type: derived status: test description: Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding. references: - https://blogs.jpcert.or.jp/en/2022/07/yamabot.html - https://deviceatlas.com/blog/list-of-user-agent-strings#desktop author: Florian Roth (Nextron Systems), Brian Ingram (update) date: 2022-07-08 modified: 2023-05-04 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|endswith: '=' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects usage of attrib.exe to hide files from users.. Logsource: windows / process_creation. Rule: title: Hiding Files with Attrib.exe id: 4281cb20-2994-4580-aa63-c8b86d019934 status: test description: Detects usage of attrib.exe to hide files from users. references: - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/ - https://www.uptycs.com/blog/lolbins-are-no-laughing-matter author: Sami Ruohonen date: 2019-01-16 modified: 2023-03-14 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \attrib.exe - OriginalFileName: ATTRIB.EXE selection_cli: CommandLine|contains: ' +h ' filter_main_msiexec: CommandLine|contains: '\desktop.ini ' filter_optional_intel: ParentImage|endswith: \cmd.exe CommandLine: +R +H +S +A \\\*.cui ParentCommandLine: C:\\WINDOWS\\system32\\\*.bat condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - IgfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe) - Msiexec.exe hiding desktop.ini level: medium
Sigma rule: Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngro. Logsource: windows / network_connection. Rule: title: Communication To Ngrok Tunneling Service Initiated id: 1d08ac94-400d-4469-a82f-daee9a908849 related: - id: 18249279-932f-45e2-b37a-8925f2597670 type: similar status: test description: 'Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download. ' references: - https://twitter.com/hakluke/status/1587733971814977537/photo/1 - https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent author: Florian Roth (Nextron Systems) date: 2022-11-03 modified: 2024-02-02 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1568.002 - attack.t1572 - attack.t1090 - attack.t1102 - attack.s0508 logsource: category: network_connection product: windows detection: selection: DestinationHostname|contains: - tunnel.us.ngrok.com - tunnel.eu.ngrok.com - tunnel.ap.ngrok.com - tunnel.au.ngrok.com - tunnel.sa.ngrok.com - tunnel.jp.ngrok.com - tunnel.in.ngrok.com condition: selection falsepositives: - Legitimate use of the ngrok service. level: high
Sigma rule: Detects a suspicious curl process start on linux with set useragent options. Logsource: linux / process_creation. Rule: title: Suspicious Curl Change User Agents - Linux id: b86d356d-6093-443d-971c-9b07db583c68 related: - id: 3286d37a-00fd-41c2-a624-a672dcd34e60 type: derived status: test description: Detects a suspicious curl process start on linux with set useragent options references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: process_creation product: linux detection: selection: Image|endswith: /curl CommandLine|contains: - ' -A ' - ' --user-agent ' condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium
Sigma rule: Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential p. Logsource: windows / network_connection. Rule: title: Suspicious Wordpad Outbound Connections id: 786cdae8-fefb-4eb2-9227-04e34060db01 status: test description: 'Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms. ' references: - https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-15 tags: - attack.command-and-control - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \wordpad.exe filter_main_ports: DestinationPort: - 80 - 139 - 443 - 445 - 465 - 587 - 993 - 995 condition: selection and not 1 of filter_main_* falsepositives: - Other ports can be used, apply additional filters accordingly level: medium
Sigma rule: Detects the attack technique pass the hash which is used to move laterally inside the network. Logsource: windows / security. Rule: title: Pass the Hash Activity 2 id: 8eef149c-bd26-49f2-9e5a-9b00e3af499b status: stable description: Detects the attack technique pass the hash which is used to move laterally inside the network references: - https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events - https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis - https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/ author: Dave Kennedy, Jeff Warren (method) / David Vassallo (rule) date: 2019-06-14 modified: 2022-10-05 tags: - attack.lateral-movement - attack.t1550.002 logsource: product: windows service: security definition: The successful use of PtH for lateral movement between workstations would trigger event ID 4624 detection: selection_logon3: EventID: 4624 SubjectUserSid: S-1-0-0 LogonType: 3 LogonProcessName: NtLmSsp KeyLength: 0 selection_logon9: EventID: 4624 LogonType: 9 LogonProcessName: seclogo filter: TargetUserName: ANONYMOUS LOGON condition: 1 of selection_* and not filter falsepositives: - Administrator activity level: medium