alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects triggering of AMSI by Windows Defender.. Logsource: windows / windefend. Rule: title: Windows Defender AMSI Trigger Detected id: ea9bf0fa-edec-4fb8-8b78-b119f2528186 status: stable description: Detects triggering of AMSI by Windows Defender. references: - https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps author: Bhabesh Raj date: 2020-09-14 modified: 2022-12-07 tags: - attack.execution - attack.t1059 logsource: product: windows service: windefend detection: selection: EventID: 1116 SourceName: AMSI condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to pre. Logsource: windows / process_creation. Rule: title: SafeBoot Registry Key Deleted Via Reg.EXE id: fc0e89b5-adb0-43c1-b749-c12a10ec37de related: - id: d7662ff6-9e97-4596-a61d-9839e32dee8d type: similar status: test description: Detects execution of "reg.exe" commands with the "delete" flag on safe boot registry keys. Often used by attacker to prevent safeboot execution of security products references: - https://www.trendmicro.com/en_us/research/22/e/avoslocker-ransomware-variant-abuses-driver-file-to-disable-anti-Virus-scans-log4shell.html author: Nasreddine Bencherchali (Nextron Systems), Tim Shelton date: 2022-08-08 modified: 2023-02-04 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: reg.exe - OriginalFileName: reg.exe selection_delete: CommandLine|contains|all: - ' delete ' - \SYSTEM\CurrentControlSet\Control\SafeBoot condition: all of selection_* falsepositives: - Unlikely level: high
Sigma rule: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently acc. Logsource: windows / ps_classic_start. Rule: title: Use Get-NetTCPConnection id: b366adb4-d63d-422d-8a2c-186463b5ded0 status: test description: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell author: frack113 date: 2021-12-10 modified: 2023-10-27 tags: - attack.discovery - attack.t1049 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: Get-NetTCPConnection condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module. Logsource: windows / process_creation. Rule: title: Rundll32 Execution Without Parameters id: 5bb68627-3198-40ca-b458-49f973db8752 status: test description: Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec exploit module references: - https://bczyz1.github.io/2021/01/30/psexec.html author: Bartlomiej Czyz, Relativity date: 2021-01-31 modified: 2023-02-28 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1570 - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection: CommandLine: - rundll32.exe - rundll32 condition: selection falsepositives: - False positives may occur if a user called rundll32 from CLI with no options level: high
Sigma rule: Detects setting proxy configuration. Logsource: linux / process_creation. Rule: title: Connection Proxy id: 72f4ab3f-787d-495d-a55d-68c2ff46cf4c status: test description: Detects setting proxy configuration author: Ömer Günal date: 2020-06-17 modified: 2022-10-05 tags: - attack.command-and-control - attack.t1090 logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - http_proxy= - https_proxy= condition: selection falsepositives: - Legitimate administration activities level: low
Sigma rule: Potential adversaries stopping ETW providers recording loaded .NET assemblies.. Logsource: windows / registry_set. Rule: title: ETW Logging Disabled In .NET Processes - Sysmon Registry id: bf4fc428-dcc3-4bbd-99fe-2422aeee2544 related: - id: a4c90ea1-2634-4ca0-adbb-35eae169b6fc type: similar status: test description: Potential adversaries stopping ETW providers recording loaded .NET assemblies. references: - https://twitter.com/_xpn_/status/1268712093928378368 - https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr - https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables - https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38 - https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39 - https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_ - https://bunnyinside.com/?term=f71e8cb9c76a - http://managed670.rssing.com/chan-5590147/all_p1.html - https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code - https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/ - https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-06-05 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: product: windows category: registry_set detection: selection_etw_enabled: TargetObject|endswith: SOFTWARE\Microsoft\.NETFramework\ETWEnabled Details: DWORD (0x00000000) selection_complus: TargetObject|endswith: - \COMPlus_ETWEnabled - \COMPlus_ETWFlags Details: - 0 - DWORD (0x00000000) condition: 1 of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects the execution of a renamed version of the Plink binary. Logsource: windows / process_creation. Rule: title: Renamed Plink Execution id: 1c12727d-02bf-45ff-a9f3-d49806a3cf43 status: test description: Detects the execution of a renamed version of the Plink binary references: - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-06 modified: 2023-02-03 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: - OriginalFileName: Plink - CommandLine|contains|all: - ' -l forward' - ' -P ' - ' -R ' filter: Image|endswith: \plink.exe condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects Obfuscated Powershell via use Rundll32 in Scripts. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation Via Use Rundll32 - PowerShell Module id: 88a22f69-62f9-4b8a-aa00-6b0212f2f05a related: - id: a5a30a6e-75ca-4233-8b8c-42e0f2037d3b type: derived status: test description: Detects Obfuscated Powershell via use Rundll32 in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2019-10-08 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - '&&' - rundll32 - shell32.dll - shellexec_rundll Payload|contains: - value - invoke - comspec - iex condition: selection_4103 falsepositives: - Unknown level: high
Sigma rule: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection packag. Logsource: windows / driver_load. Rule: title: WinDivert Driver Load id: 679085d5-f427-4484-9f58-1dc30a7c426d status: test description: Detects the load of the Windiver driver, a powerful user-mode capture/sniffing/modification/blocking/re-injection package for Windows references: - https://reqrypt.org/windivert-doc.html - https://rastamouse.me/ntlm-relaying-via-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-07-30 modified: 2024-11-23 tags: - attack.credential-access - attack.collection - attack.defense-impairment - attack.t1599.001 - attack.t1557.001 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|contains: - \WinDivert.sys - \WinDivert64.sys - \NordDivert.sys - \lingtiwfp.sys - \eswfp.sys - Hashes|contains: - IMPHASH=0604bb7cb4bb851e2168d5c7d9399087 - IMPHASH=2e5f0e649d97f32b03c09e4686d0574f - IMPHASH=52f8aa269f69f0edad9e8fcdaedce276 - IMPHASH=c0e5d314da39dbf65a2dbff409cc2c76 - IMPHASH=58623490691babe8330adc81cd04a663 - IMPHASH=8ee39b48656e4d6b8459d7ba7da7438b - IMPHASH=45ee545ae77e8d43fc70ede9efcd4c96 - IMPHASH=a1b2e245acd47e4a348e1a552a02859a - IMPHASH=2a5f85fe4609461c6339637594fa9b0a - IMPHASH=6b2c6f95233c2914d1d488ee27531acc - IMPHASH=9f2fdd3f9ab922bbb0560a7df46f4342 - IMPHASH=d8a719865c448b1bd2ec241e46ac1c88 - IMPHASH=0ea54f8c9af4a2fe8367fa457f48ed38 - IMPHASH=9d519ae0a0864d6d6ae3f8b6c9c70af6 - IMPHASH=a74929edfc3289895e3f2885278947ae - IMPHASH=a66b476c2d06c370f0a53b5537f2f11e - IMPHASH=bdcd836a46bc2415773f6b5ea77a46e4 - IMPHASH=c28cd6ccd83179e79dac132a553693d9 condition: selection falsepositives: - Legitimate WinDivert driver usage level: high
Sigma rule: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns). Logsource: windows / process_creation. Rule: title: Process Creation Using Sysnative Folder id: 3c1b5fb0-c72f-45ba-abd1-4d4c353144ab status: test description: Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns) references: - https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/ author: Max Altgelt (Nextron Systems) date: 2022-08-23 modified: 2025-10-08 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: category: process_creation product: windows detection: selection: - CommandLine|contains: :\Windows\Sysnative\ - Image|contains: :\Windows\Sysnative\ filter_main_ngen: Image|contains: - C:\Windows\Microsoft.NET\Framework64\v - C:\Windows\Microsoft.NET\Framework\v - C:\Windows\Microsoft.NET\FrameworkArm\v - C:\Windows\Microsoft.NET\FrameworkArm64\v Image|endswith: \ngen.exe CommandLine|contains: install filter_optional_xampp: CommandLine|contains|all: - '"C:\Windows\sysnative\cmd.exe"' - \xampp\ - \catalina_start.bat condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects VBScript content stored into registry keys as seen being used by UNC2452 group. Logsource: windows / registry_set. Rule: title: VBScript Payload Stored in Registry id: 46490193-1b22-4c29-bdd6-5bf63907216f status: test description: Detects VBScript content stored into registry keys as seen being used by UNC2452 group references: - https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ author: Florian Roth (Nextron Systems) date: 2021-03-05 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion Details|contains: - 'vbscript:' - 'jscript:' - mshtml, - RunHTMLApplication - Execute( - CreateObject - window.close filter: TargetObject|contains: Software\Microsoft\Windows\CurrentVersion\Run filter_dotnet: Image|endswith: \msiexec.exe TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\ Details|contains: - \Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll - <\Microsoft.mshtml,fileVersion= - _mshtml_dll_ - <\Microsoft.mshtml,culture= condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Sigma rule: Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microso. Logsource: m365 / threat_detection. Rule: title: Activity from Suspicious IP Addresses id: a3501e8e-af9e-43c6-8cd6-9360bdaae498 status: test description: 'Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence. These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account. ' references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1573 logsource: service: threat_detection product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Activity from suspicious IP addresses status: success condition: selection falsepositives: - Unknown level: medium
Sigma rule: Identifies when a Firewall Rule Configuration is Modified or Deleted.. Logsource: azure / activitylogs. Rule: title: Azure Firewall Rule Configuration Modified or Deleted id: 2a7d64cf-81fa-4daf-ab1b-ab80b789c067 status: test description: Identifies when a Firewall Rule Configuration is Modified or Deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/DELETE - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/WRITE - MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/DELETE condition: selection falsepositives: - Firewall Rule Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Firewall Rule Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shti. Logsource: windows / registry_set. Rule: title: Lsass Full Dump Request Via DumpType Registry Settings id: 33efc23c-6ea2-4503-8cfe-bdf82ce8f719 status: test description: Detects the setting of the "DumpType" registry value to "2" which stands for a "Full Dump". Technique such as LSASS Shtinkering requires this value to be "2" in order to dump LSASS. references: - https://github.com/deepinstinct/Lsass-Shtinkering - https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps - https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf author: '@pbssubhash' date: 2022-12-08 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: - \SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\DumpType - \SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps\lsass.exe\DumpType Details: DWORD (0x00000002) condition: selection falsepositives: - Legitimate application that needs to do a full dump of their process level: high
Sigma rule: Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember".. Logsource: windows / process_creation. Rule: title: User Added to Remote Desktop Users Group id: ffa28e60-bdb1-46e0-9f82-05f7a61cc06e related: - id: ad720b90-25ad-43ff-9b5e-5c841facc8e5 type: similar - id: 10fb649c-3600-4d37-b1e6-56ea90bb7e09 type: similar status: test description: Detects addition of users to the local Remote Desktop Users group via "Net" or "Add-LocalGroupMember". references: - https://www.microsoft.com/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/ author: Florian Roth (Nextron Systems) date: 2021-12-06 modified: 2022-09-09 tags: - attack.initial-access - attack.persistence - attack.lateral-movement - attack.t1133 - attack.t1136.001 - attack.t1021.001 logsource: category: process_creation product: windows detection: selection_main: - CommandLine|contains|all: - 'localgroup ' - ' /add' - CommandLine|contains|all: - 'Add-LocalGroupMember ' - ' -Group ' selection_group: CommandLine|contains: - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto condition: all of selection_* falsepositives: - Administrative activity level: high
Sigma rule: Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986. Logsource: windows / security. Rule: title: Remote PowerShell Sessions Network Connections (WinRM) id: 13acf386-b8c6-4fe0-9a6e-c4756b974698 status: test description: Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986 references: - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-09-12 modified: 2022-10-09 tags: - attack.execution - attack.t1059.001 logsource: product: windows service: security detection: selection: EventID: 5156 DestPort: - 5985 - 5986 LayerRTID: 44 condition: selection falsepositives: - Legitimate use of remote PowerShell execution level: high
Sigma rule: Detects instances where an SMB service on an OpenCanary node has had a file open request.. Logsource: opencanary / application. Rule: title: OpenCanary - SMB File Open Request id: 22777c9e-873a-4b49-855f-6072ab861a52 status: test description: Detects instances where an SMB service on an OpenCanary node has had a file open request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.lateral-movement - attack.collection - attack.t1021 - attack.t1005 logsource: category: application product: opencanary detection: selection: logtype: 5000 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurity. Logsource: windows / process_creation. Rule: title: Suspicious Kerberos Ticket Request via CLI id: caa9a802-8bd8-4b9e-a5cd-4d6221670219 related: - id: a861d835-af37-4930-bcd6-5b178bfb54df type: similar status: experimental description: 'Detects suspicious Kerberos ticket requests via command line using System.IdentityModel.Tokens.KerberosRequestorSecurityToken class. Threat actors may use command line interfaces to request Kerberos tickets for service accounts in order to perform offline password cracking attacks commonly known as Kerberoasting or other Kerberos ticket abuse techniques like silver ticket attacks. ' references: - https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-18 tags: - attack.credential-access - attack.t1558.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - powershell.exe - pwsh.dll selection_cli: CommandLine|contains|all: - System.IdentityModel.Tokens.KerberosRequestorSecurityToken - .GetRequest() condition: all of selection_* falsepositives: - Legitimate command line usage by administrators or security tools. level: high
Sigma rule: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for e. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Execution Of PDQDeployRunner id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 related: - id: d679950c-abb7-43a6-80fb-2a480c4fc450 type: similar status: test description: Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on a remote machines references: - https://twitter.com/malmoeb/status/1550483085472432128 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-22 modified: 2024-05-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_parent: ParentImage|contains: \PDQDeployRunner- selection_child: - Image|endswith: - \bash.exe - \certutil.exe - \cmd.exe - \csc.exe - \cscript.exe - \dllhost.exe - \mshta.exe - \msiexec.exe - \regsvr32.exe - \rundll32.exe - \scriptrunner.exe - \wmic.exe - \wscript.exe - \wsl.exe - Image|contains: - :\ProgramData\ - :\Users\Public\ - :\Windows\TEMP\ - \AppData\Local\Temp - CommandLine|contains: - ' -decode ' - ' -enc ' - ' -encodedcommand ' - ' -w hidden' - DownloadString - FromBase64String - http - 'iex ' - Invoke- condition: all of selection_* falsepositives: - Legitimate use of the PDQDeploy tool to execute these commands level: medium
Sigma rule: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet. Logsource: windows / registry_set. Rule: title: Wdigest Enable UseLogonCredential id: d6a9b252-c666-4de6-8806-5561bbbd3bdc status: test description: Detects potential malicious modification of the property value of UseLogonCredential from HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest to enable clear-text credentials references: - https://threathunterplaybook.com/hunts/windows/190510-RegModWDigestDowngrade/notebook.html - https://support.microsoft.com/en-us/topic/microsoft-security-advisory-update-to-improve-credentials-protection-and-management-may-13-2014-93434251-04ac-b7f3-52aa-9f951c14b649 - https://github.com/redcanaryco/atomic-red-team/blob/73fcfa1d4863f6a4e17f90e54401de6e30a312bb/atomics/T1112/T1112.md#atomic-test-3---modify-registry-to-store-logon-credentials author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-09-12 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: WDigest\UseLogonCredential Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects external disk drives or plugged-in USB devices.. Logsource: windows / security. Rule: title: External Disk Drive Or USB Storage Device Was Recognized By The System id: f69a87ea-955e-4fb4-adb2-bb9fd6685632 status: test description: Detects external disk drives or plugged-in USB devices. references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416 author: Keith Wright date: 2019-11-20 modified: 2024-02-09 tags: - attack.t1091 - attack.t1200 - attack.lateral-movement - attack.initial-access logsource: product: windows service: security detection: selection_eid: EventID: 6416 selection_field: - ClassName: DiskDrive - DeviceDescription: USB Mass Storage Device condition: all of selection_* falsepositives: - Likely level: low