alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the f. Logsource: windows / process_creation. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation id: 4bf943c6-5146-4273-98dd-e958fd1e3abf status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2026-03-16 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: - CommandLine|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - CommandLine|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - CommandLine|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - CommandLine|re: \$env:ComSpec\[(?:\s*\d{1,3}\s*,){2} - CommandLine|re: \*mdr\*\W\s*\)\.Name - CommandLine|re: \$VerbosePreference\.ToString\( - CommandLine|re: \[String\]\s*\$VerbosePreference condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects Cobalt Strike module/commands accidentally entered in CMD shell. Logsource: windows / process_creation. Rule: title: Operator Bloopers Cobalt Strike Modules id: 4f154fb6-27d1-4813-a759-78b93e0b9c48 related: - id: 647c7b9e-d784-4fda-b9a0-45c565a7b729 type: similar status: test description: Detects Cobalt Strike module/commands accidentally entered in CMD shell references: - https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/content/cobalt-4-5-user-guide.pdf - https://thedfirreport.com/2021/10/04/bazarloader-and-the-conti-leaks/ - https://thedfirreport.com/2022/06/16/sans-ransomware-summit-2022-can-you-detect-this/ author: _pete_0, TheDFIRReport date: 2022-05-06 modified: 2023-01-30 tags: - attack.execution - attack.t1059.003 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: Cmd.Exe - Image|endswith: \cmd.exe selection_cli: CommandLine|contains: - Invoke-UserHunter - Invoke-ShareFinder - Invoke-Kerberoast - Invoke-SMBAutoBrute - Invoke-Nightmare - zerologon - av_query condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen. Logsource: windows / process_creation. Rule: title: Certificate Exported Via PowerShell id: 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb related: - id: aa7a3fce-bef5-4311-9cc1-5f04bb8c308c type: similar status: test description: Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines. references: - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-18 tags: - attack.credential-access - attack.execution - attack.t1552.004 - attack.t1059.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 'Export-PfxCertificate ' - 'Export-Certificate ' condition: selection falsepositives: - Legitimate certificate exports by administrators. Additional filters might be required. level: medium
Sigma rule: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "re. Logsource: windows / process_creation. Rule: title: Scripting/CommandLine Process Spawned Regsvr32 id: ab37a6ec-6068-432b-a64e-2c7bf95b1d22 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \wscript.exe Image|endswith: \regsvr32.exe filter_main_rpcproxy: ParentImage: C:\Windows\System32\cmd.exe CommandLine|endswith: ' /s C:\Windows\System32\RpcProxy\RpcProxy.dll' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate ".bat", ".hta", ".ps1" or ".vbs" scripts leverage legitimately often. Apply additional filter and exclusions as necessary - Some legitimate Windows services level: medium
Sigma rule: Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argume. Logsource: windows / process_creation. Rule: title: Wlrmdr.EXE Uncommon Argument Or Child Process id: 9cfc00b6-bfb7-49ce-9781-ef78503154bb status: experimental description: 'Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries. This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry. ' references: - https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ - https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/ author: frack113, manasmbellani date: 2022-02-16 modified: 2025-10-31 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \wlrmdr.exe selection_child_img: - Image|endswith: \wlrmdr.exe - OriginalFileName: WLRMNDR.EXE selection_child_cli_flags_s: CommandLine|contains|windash: '-s ' selection_child_cli_flags_f: CommandLine|contains|windash: '-f ' selection_child_cli_flags_t: CommandLine|contains|windash: '-t ' selection_child_cli_flags_m: CommandLine|contains|windash: '-m ' selection_child_cli_flags_a: CommandLine|contains|windash: '-a ' selection_child_cli_flags_u: CommandLine|contains|windash: '-u ' filter_main_winlogon: ParentImage: C:\Windows\System32\winlogon.exe filter_main_empty: ParentImage: - '' - '-' filter_main_null: ParentImage: null condition: selection_parent or (all of selection_child_* and not 1 of filter_main_*) falsepositives: - Unknown level: medium
Sigma rule: Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry an. Logsource: windows / process_creation. Rule: title: Suspicious VBoxDrvInst.exe Parameters id: b7b19cb6-9b32-4fc4-a108-73f19acfe262 status: test description: 'Detect VBoxDrvInst.exe run with parameters allowing processing INF file. This allows to create values in the registry and install drivers. For example one could use this technique to obtain persistence via modifying one of Run or RunOnce registry keys ' references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OtherBinaries/VBoxDrvInst.yml - https://twitter.com/pabraeken/status/993497996179492864 author: Konstantin Grishchenko, oscd.community date: 2020-10-06 modified: 2021-11-27 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection: Image|endswith: \VBoxDrvInst.exe CommandLine|contains|all: - driver - executeinf condition: selection falsepositives: - Legitimate use of VBoxDrvInst.exe utility by VirtualBox Guest Additions installation process level: medium
Sigma rule: Identifies when a Virtual Network is modified or deleted in Azure.. Logsource: azure / activitylogs. Rule: title: Azure Virtual Network Modified or Deleted id: bcfcc962-0e4a-4fd9-84bb-a833e672df3f status: test description: Identifies when a Virtual Network is modified or deleted in Azure. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations author: Austin Songer @austinsonger date: 2021-08-08 modified: 2022-08-23 tags: - attack.impact logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.NETWORK/VIRTUALNETWORKGATEWAYS/ - MICROSOFT.NETWORK/VIRTUALNETWORKS/ operationName|endswith: - /WRITE - /DELETE condition: selection falsepositives: - Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects when full data export is attempted an unauthorized user.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Full Data Export Triggered id: 34d81081-03c9-4a7f-91c9-5e46af625cde status: test description: Detects when full data export is attempted an unauthorized user. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.resource-development - attack.t1213.003 - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Data pipeline auditType.action: Unauthorized full data export triggered condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attem. Logsource: linux / syslog. Rule: title: Suspicious Named Error id: c8e35e96-19ce-4f16-aeb6-fd5588dc5365 status: test description: Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/named_rules.xml author: Florian Roth (Nextron Systems) date: 2018-02-20 modified: 2022-10-05 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: syslog detection: keywords: - ' dropping source port zero packet from ' - ' denied AXFR from ' - ' exiting (due to fatal error)' condition: keywords falsepositives: - Unknown level: high
Sigma rule: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files.. Logsource: windows / process_creation. Rule: title: Local File Read Using Curl.EXE id: aa6f6ea6-0676-40dd-b510-6e46f02d8867 status: test description: Detects execution of "curl.exe" with the "file://" protocol handler in order to read local files. references: - https://curl.se/docs/manpage.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-27 tags: - attack.execution logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_cli: CommandLine|contains: file:/// condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_local_file_read/info.yml
Sigma rule: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons. Logsource: windows / create_remote_thread. Rule: title: HackTool - Potential CobaltStrike Process Injection id: 6309645e-122d-4c5b-bb2b-22e4f9c2fa42 status: test description: Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons references: - https://medium.com/@olafhartong/cobalt-strike-remote-threads-detection-206372d11d0f - https://blog.cobaltstrike.com/2018/04/09/cobalt-strike-3-11-the-snake-that-eats-its-tail/ author: Olaf Hartong, Florian Roth (Nextron Systems), Aleksey Potapov, oscd.community date: 2018-11-30 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 logsource: product: windows category: create_remote_thread detection: selection: StartAddress|endswith: - 0B80 - 0C7C - 0C88 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass usi. Logsource: windows / registry_event. Rule: title: Shell Open Registry Keys Manipulation id: 152f3630-77c1-4284-bcc0-4cc68ab2f6e7 related: - id: dd3ee8cc-f751-41c9-ba53-5a32ed47e563 type: similar status: test description: Detects the shell open key manipulation (exefile and ms-settings) used for persistence and the pattern of UAC Bypass using fodhelper.exe, computerdefaults.exe, slui.exe via registry keys (e.g. UACMe 33 or 62) references: - https://github.com/hfiref0x/UACME - https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/ - https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass - https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021] author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2022-01-13 tags: - attack.persistence - attack.privilege-escalation - attack.t1548.002 - attack.t1546.001 logsource: category: registry_event product: windows detection: selection1: EventType: SetValue TargetObject|endswith: Classes\ms-settings\shell\open\command\SymbolicLinkValue Details|contains: \Software\Classes\{ selection2: TargetObject|endswith: Classes\ms-settings\shell\open\command\DelegateExecute selection3: EventType: SetValue TargetObject|endswith: - Classes\ms-settings\shell\open\command\(Default) - Classes\exefile\shell\open\command\(Default) filter_sel3: Details: (Empty) condition: selection1 or selection2 or (selection3 and not filter_sel3) falsepositives: - Unknown level: high
Sigma rule: Detects Windows Pcap driver installation based on a list of associated .sys files.. Logsource: windows / security. Rule: title: Windows Pcap Drivers id: 7b687634-ab20-11ea-bb37-0242ac130002 status: test description: Detects Windows Pcap driver installation based on a list of associated .sys files. references: - https://ragged-lab.blogspot.com/2020/06/capturing-pcap-driver-installations.html#more author: Cian Heasley date: 2020-06-10 modified: 2023-04-14 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains: - pcap - npcap - npf - nm3 - ndiscap - nmnt - windivert - USBPcap - pktmon condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Windows App Activity id: f91ed517-a6ba-471d-9910-b3b4a398c0f3 status: test description: Detects potentially suspicious child process of applications launched from inside the WindowsApps directory. This could be a sign of a rogue ".appx" package installation/execution references: - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-12 modified: 2025-10-07 tags: - attack.stealth logsource: product: windows category: process_creation detection: selection_parent: ParentImage|contains: C:\Program Files\WindowsApps\ selection_susp_img: Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe selection_susp_cli: CommandLine|contains: - cmd /c - Invoke- - Base64 filter_optional_terminal: ParentImage|contains: :\Program Files\WindowsApps\Microsoft.WindowsTerminal ParentImage|endswith: \WindowsTerminal.exe Image|endswith: - \powershell.exe - \cmd.exe - \pwsh.exe filter_optional_sysinternals: ParentImage|startswith: C:\Program Files\WindowsApps\Microsoft.SysinternalsSuite Image|endswith: \cmd.exe condition: selection_parent and 1 of selection_susp_* and not 1 of filter_optional_* falsepositives: - Legitimate packages that make use of external binaries such as Windows Terminal level: medium
Sigma rule: Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command. Logsource: windows / process_creation. Rule: title: Suspicious Windows Update Agent Empty Cmdline id: 52d097e2-063e-4c9c-8fbb-855c8948d135 status: test description: 'Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn''t contain any command line flags ' references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-26 modified: 2023-11-11 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \Wuauclt.exe - OriginalFileName: Wuauclt.exe selection_cli: CommandLine|endswith: - Wuauclt - Wuauclt.exe condition: all of selection* falsepositives: - Unknown level: high
Sigma rule: Detects usage of crontab to list the tasks of the user. Logsource: linux / process_creation. Rule: title: Crontab Enumeration id: 403ed92c-b7ec-4edd-9947-5b535ee12d46 status: test description: Detects usage of crontab to list the tasks of the user references: - https://blogs.jpcert.or.jp/en/2023/05/gobrat.html - https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/ - https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection - https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-06-02 tags: - attack.discovery - attack.t1007 logsource: product: linux category: process_creation detection: selection: Image|endswith: /crontab CommandLine|contains: ' -l' condition: selection falsepositives: - Legitimate use of crontab level: low
Sigma rule: Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to b. Logsource: linux / auditd. Rule: title: Modify System Firewall id: 323ff3f5-0013-4847-bbd4-250b5edb62cc related: - id: 53059bc0-1472-438b-956a-7508a94a91f0 type: similar status: test description: 'Detects the removal of system firewall rules. Adversaries may only delete or modify a specific system firewall rule to bypass controls limiting network usage or access. Detection rules that match only on the disabling of firewalls will miss this. ' references: - https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html - https://blog.aquasec.com/container-security-tnt-container-attack - https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking author: IAI date: 2023-03-06 modified: 2025-10-12 tags: - attack.defense-impairment - attack.t1686 logsource: product: linux service: auditd detection: selection1: type: EXECVE a0: iptables a1|contains: DROP selection2: type: EXECVE a0: firewall-cmd a1|contains: remove selection3: type: EXECVE a0: ufw a1|contains: delete selection4: type: EXECVE a0: nft a1|contains: - delete - flush condition: 1 of selection* falsepositives: - Legitimate admin activity level: medium
Sigma rule: Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\. Logsource: windows / registry_set. Rule: title: Potential Persistence Via App Paths Default Property id: 707e097c-e20f-4f67-8807-1f72ff4500d6 status: test description: 'Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. Which might be used as a method of persistence The entries found under App Paths are used primarily for the following purposes. First, to map an application''s executable file name to that file''s fully qualified path. Second, to prepend information to the PATH environment variable on a per-application, per-process basis. ' references: - https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ - https://learn.microsoft.com/en-us/windows/win32/shell/app-registration author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-10 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.012 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths TargetObject|endswith: - (Default) - Path Details|contains: - \Users\Public - \AppData\Local\Temp\ - \Windows\Temp\ - \Desktop\ - \Downloads\ - '%temp%' - '%tmp%' - iex - Invoke- - rundll32 - regsvr32 - mshta - cscript - wscript - .bat - .hta - .dll - .ps1 condition: selection falsepositives: - Legitimate applications registering their binary from on of the suspicious locations mentioned above (tune it) level: high
Sigma rule: Detects possible Sysmon filter driver unloaded via fltmc.exe. Logsource: windows / process_creation. Rule: title: Sysmon Driver Unloaded Via Fltmc.EXE id: 4d7cda18-1b12-4e52-b45c-d28653210df8 related: - id: 4931188c-178e-4ee7-a348-39e8a7a56821 type: similar status: test description: Detects possible Sysmon filter driver unloaded via fltmc.exe references: - https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon author: Kirill Kiryanov, oscd.community date: 2019-10-23 modified: 2023-02-13 tags: - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1685 - attack.t1685.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \fltMC.exe - OriginalFileName: fltMC.exe selection_cli: CommandLine|contains|all: - unload - sysmon condition: all of selection_* falsepositives: - Unlikely level: high
Sigma rule: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScript. Logsource: windows / image_load. Rule: title: WMI ActiveScriptEventConsumers Activity Via Scrcons.EXE DLL Load id: b439f47d-ef52-4b29-9a2f-57d8a96cb6b8 status: test description: Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity. references: - https://twitter.com/HunterPlaybook/status/1301207718355759107 - https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/ - https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-09-02 modified: 2023-02-22 tags: - attack.lateral-movement - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \scrcons.exe ImageLoaded|endswith: - \vbscript.dll - \wbemdisp.dll - \wshom.ocx - \scrrun.dll condition: selection falsepositives: - Legitimate event consumers - Dell computers on some versions register an event consumer that is known to cause false positives when brightness is changed by the corresponding keyboard button level: medium