alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Dump Credentials from Windows Credential Manager With PowerShell id: 99c49d9c-34ea-45f7-84a7-4751ae6b2cbc status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_kiddie: ScriptBlockText|contains: - Get-PasswordVaultCredentials - Get-CredManCreds selection_rename_Password: ScriptBlockText|contains|all: - New-Object - Windows.Security.Credentials.PasswordVault selection_rename_credman: ScriptBlockText|contains|all: - New-Object - Microsoft.CSharp.CSharpCodeProvider - '[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())' - Collections.ArrayList - System.CodeDom.Compiler.CompilerParameters condition: 1 of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any too. Logsource: windows / registry_set. Rule: title: Hide Schedule Task Via Index Value Tamper id: 5b16df71-8615-4f7f-ac9b-6c43c0509e61 related: - id: acd74772-5f88-45c7-956b-6a7b36c294d2 type: similar - id: 526cc8bc-1cdc-48ad-8b26-f19bff969cec type: similar status: test description: 'Detects when the "index" value of a scheduled task is modified from the registry Which effectively hides it from any tooling such as "schtasks /query" (Read the referenced link for more information about the effects of this technique) ' references: - https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-26 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ - Index Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity. Logsource: windows / ps_script. Rule: title: Suspicious TCP Tunnel Via PowerShell Script id: bd33d2aa-497e-4651-9893-5c5364646595 status: test description: Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity references: - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-08 tags: - attack.command-and-control - attack.t1090 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - '[System.Net.HttpWebRequest]' - System.Net.Sockets.TcpListener - AcceptTcpClient condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects when an attempt at deactivating or resetting MFA.. Logsource: okta / okta. Rule: title: Okta MFA Reset or Deactivated id: 50e068d7-1e6b-4054-87e5-0a592c40c7e0 status: test description: Detects when an attempt at deactivating or resetting MFA. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-21 modified: 2026-04-27 tags: - attack.persistence - attack.credential-access - attack.defense-impairment - attack.t1556.006 logsource: product: okta service: okta detection: selection: eventType: - user.mfa.factor.deactivate - user.mfa.factor.reset_all condition: selection falsepositives: - If a MFA reset or deactivated was performed by a system administrator. level: medium
Sigma rule: Indicates that a password spray attack has been successfully performed.. Logsource: azure / riskdetection. Rule: title: Password Spray Activity id: 28ecba0a-c743-4690-ad29-9a8f6f25a6f9 status: test description: Indicates that a password spray attack has been successfully performed. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1110 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: passwordSpray condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Sigma rule: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised ac. Logsource: windows / ps_script. Rule: title: Clearing Windows Console History id: bde47d4b-9987-405c-94c7-b080410e8ea7 status: test description: Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. references: - https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/ - https://www.shellhacks.com/clear-history-powershell/ - https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics author: Austin Songer @austinsonger date: 2021-11-25 modified: 2022-12-25 tags: - attack.stealth - attack.t1070 - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1: ScriptBlockText|contains: Clear-History selection2a: ScriptBlockText|contains: - Remove-Item - rm selection2b: ScriptBlockText|contains: - ConsoleHost_history.txt - (Get-PSReadlineOption).HistorySavePath condition: selection1 or selection2a and selection2b falsepositives: - Unknown level: high
Sigma rule: Detects usage of system utilities to discover system network connections. Logsource: linux / process_creation. Rule: title: System Network Connections Discovery - Linux id: 4c519226-f0cd-4471-bd2f-6fbb2bb68a79 status: test description: Detects usage of system utilities to discover system network connections references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2023-01-17 tags: - attack.discovery - attack.t1049 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /who - /w - /last - /lsof - /netstat filter_landscape_sysinfo: ParentCommandLine|contains: /usr/bin/landscape-sysinfo Image|endswith: /who condition: selection and not 1 of filter_* falsepositives: - Legitimate activities level: low
Sigma rule: Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escala. Logsource: windows / registry_set. Rule: title: Add Port Monitor Persistence in Registry id: 944e8941-f6f6-4ee8-ac05-1c224e923c0e status: test description: 'Adversaries may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation. A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.010/T1547.010.md author: frack113 date: 2021-12-30 modified: 2024-03-25 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.010 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Control\Print\Monitors\ Details|endswith: .dll filter_optional_cutepdf: Image: C:\Windows\System32\spoolsv.exe TargetObject|contains: \Control\Print\Monitors\CutePDF Writer Monitor v4.0\Driver Details: cpwmon64_v40.dll User|contains: - AUTHORI - AUTORI filter_optional_monvnc: TargetObject|contains: \Control\Print\Monitors\MONVNC\Driver filter_optional_vnc: TargetObject|contains|all: - Control\Print\Environments\ - \Drivers\ - \VNC Printer condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_add_port_monitor/info.yml simulation: - type: atomic-red-team name: Add Port Monitor persistence in Registry technique: T1547.010 atomic_guid: d34ef297-f178-4462-871e-9ce618d44e50
Sigma rule: Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hos. Logsource: windows / network_connection. Rule: title: Local Network Connection Initiated By Script Interpreter id: 08249dc0-a28d-4555-8ba5-9255a198e08c related: - id: 992a6cae-db6a-43c8-9cec-76d7195c96fc type: derived status: test description: 'Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/28d190330fe44de6ff4767fc400cc10fa7cd6540/atomics/T1105/T1105.md author: frack113 date: 2022-08-28 modified: 2024-05-31 tags: - attack.command-and-control - attack.t1105 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \wscript.exe - \cscript.exe DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection falsepositives: - Legitimate scripts level: medium
Sigma rule: Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM reg. Logsource: windows / process_creation. Rule: title: Sensitive File Access Via Volume Shadow Copy Backup id: f57f8d16-1f39-4dcb-a604-6c73d9b54b3d status: test description: 'Detects a command that accesses the VolumeShadowCopy in order to extract sensitive files such as the Security or SAM registry hives or the AD database (ntds.dit) ' references: - https://twitter.com/vxunderground/status/1423336151860002816?s=20 - https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection - https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/ author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems) date: 2021-08-09 modified: 2024-01-18 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains: \\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy selection_2: CommandLine|contains: - \\NTDS.dit - \\SYSTEM - \\SECURITY condition: all of selection_* falsepositives: - Unlikely level: high
Sigma rule: Well-known DNS Exfiltration tools execution. Logsource: windows / process_creation. Rule: title: DNS Exfiltration and Tunneling Tools Execution id: 98a96a5a-64a0-4c42-92c5-489da3866cb0 status: test description: Well-known DNS Exfiltration tools execution references: - https://github.com/iagox86/dnscat2 - https://github.com/yarrick/iodine author: Daniil Yugoslavskiy, oscd.community date: 2019-10-24 modified: 2021-11-27 tags: - attack.exfiltration - attack.t1048.001 - attack.command-and-control - attack.t1071.004 - attack.t1132.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \iodine.exe - Image|contains: \dnscat2 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable t. Logsource: windows / image_load. Rule: title: Python Image Load By Non-Python Process id: cbb56d62-4060-40f7-9466-d8aaf3123f83 status: test description: 'Detects the image load of "Python Core" by a non-Python process. This might be indicative of a execution of executable that has been bundled from Python code. Various tools like Py2Exe, PyInstaller, and cx_Freeze are used to bundle Python code into standalone executables. Threat actors often use these tools to bundle malicious Python scripts into executables, sometimes to obfuscate the code or to bypass security measures. ' references: - https://www.py2exe.org/ - https://unit42.paloaltonetworks.com/unit-42-technical-analysis-seaduke/ author: Patrick St. John, OTR (Open Threat Research) date: 2020-05-03 modified: 2025-08-18 tags: - attack.stealth - attack.t1027.002 logsource: product: windows category: image_load detection: selection: Description: Python Core filter_main_generic: - Image|contains: Python - Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ - C:\ProgramData\Anaconda3\ filter_optional_null_image: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate Py2Exe Binaries - Known false positive caused with Python Anaconda - Various legitimate software is bundled from Python code into executables level: low
Sigma rule: Detects usage of "msedge_proxy.exe" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSEDGE_PROXY.EXE id: e84d89c4-f544-41ca-a6af-4b92fd38b023 status: test description: Detects usage of "msedge_proxy.exe" to download arbitrary files references: - https://lolbas-project.github.io/lolbas/Binaries/msedge_proxy/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msedge_proxy.exe - OriginalFileName: msedge_proxy.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer s. Logsource: windows / ps_script. Rule: title: Powershell Suspicious Win32_PnPEntity id: b26647de-4feb-4283-af6b-6117661283c5 status: test description: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1120/T1120.md author: frack113 date: 2021-08-23 modified: 2022-12-25 tags: - attack.discovery - attack.t1120 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Win32_PnPEntity condition: selection falsepositives: - Admin script level: low
Sigma rule: Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child rela. Logsource: windows / process_creation. Rule: title: Windows Binary Executed From WSL id: ed825c86-c009-4014-b413-b76003e33d35 status: test description: 'Detects the execution of Windows binaries from within a WSL instance. This could be used to masquerade parent-child relationships ' references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-14 tags: - attack.execution - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection: Image|re: '[a-zA-Z]:\\' CurrentDirectory|contains: \\\\wsl.localhost condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections. Logsource: windows / registry_set. Rule: title: Disabled Windows Defender Eventlog id: fcddca7c-b9c0-4ddf-98da-e1e2d18b0157 status: test description: Detects the disabling of the Windows Defender eventlog as seen in relation to Lockbit 3.0 infections references: - https://twitter.com/WhichbufferArda/status/1543900539280293889/photo/2 author: Florian Roth (Nextron Systems) date: 2022-07-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Windows Defender/Operational\Enabled Details: DWORD (0x00000000) condition: selection falsepositives: - Other Antivirus software installations could cause Windows to disable that eventlog (unknown) level: high
Sigma rule: Detects service installation in suspicious folder appdata. Logsource: windows / system. Rule: title: Service Installation in Suspicious Folder id: 5e993621-67d4-488a-b9ae-b420d08b96cb status: test description: Detects service installation in suspicious folder appdata author: pH-T (Nextron Systems) references: - Internal Research date: 2022-03-18 modified: 2024-01-18 tags: - attack.persistence - attack.privilege-escalation - car.2013-09-005 - attack.t1543.003 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: - \AppData\ - \\\\127.0.0.1 - \\\\localhost filter_optional_zoom: ServiceName: Zoom Sharing Service ImagePath|contains: :\Program Files\Common Files\Zoom\Support\CptService.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects potential DLL sideloading of "chrome_frame_helper.dll". Logsource: windows / image_load. Rule: title: Potential Chrome Frame Helper DLL Sideloading id: 72ca7c75-bf85-45cd-aca7-255d360e423c status: test description: Detects potential DLL sideloading of "chrome_frame_helper.dll" references: - https://hijacklibs.net/entries/3rd_party/google/chrome_frame_helper.html author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-08-17 modified: 2023-05-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \chrome_frame_helper.dll filter_main_path: ImageLoaded|startswith: - C:\Program Files\Google\Chrome\Application\ - C:\Program Files (x86)\Google\Chrome\Application\ filter_optional_user_path: ImageLoaded|contains: \AppData\local\Google\Chrome\Application\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects the addition of a new module to an IIS server.. Logsource: windows / iis-configuration. Rule: title: New Module Module Added To IIS Server id: dd857d3e-0c6e-457b-9b48-e82ae7f86bd7 status: test description: Detects the addition of a new module to an IIS server. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://www.microsoft.com/en-us/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ - https://learn.microsoft.com/en-us/iis/get-started/introduction-to-iis/iis-modules-overview author: frack113 date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration|contains: /system.webServer/modules/add filter_main_builtin: NewValue: - AnonymousAuthenticationModule - CustomErrorModule - DefaultDocumentModule - DirectoryListingModule - FileCacheModule - HttpCacheModule - HttpLoggingModule - ProtocolSupportModule - RequestFilteringModule - StaticCompressionModule - StaticFileModule - TokenCacheModule - UriCacheModule filter_main_remove: NewValue: '' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate administrator activity level: medium
Sigma rule: Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID. Logsource: windows / process_creation. Rule: title: LSASS Process Reconnaissance Via Findstr.EXE id: fe63010f-8823-4864-a96b-a7b4a0f7b929 status: test description: Detects findstring commands that include the keyword lsass, which indicates recon actviity for the LSASS process PID references: - https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1 author: Florian Roth (Nextron Systems) date: 2022-08-12 modified: 2024-06-04 tags: - attack.credential-access - attack.t1552.006 logsource: category: process_creation product: windows detection: selection_findstr_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_findstr_cli: CommandLine|contains: lsass selection_special: CommandLine|contains|windash: - ' /i "lsass' - ' /i lsass.exe' - findstr "lsass - findstr lsass - findstr.exe "lsass - findstr.exe lsass condition: all of selection_findstr_* or selection_special falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_lsass/info.yml
Sigma rule: Detects usage of bitsadmin downloading a file to a suspicious target folder. Logsource: windows / process_creation. Rule: title: File Download Via Bitsadmin To A Suspicious Target Folder id: 2ddef153-167b-4e89-86b6-757a9e65dcac related: - id: 6e30c82f-a9f8-4aab-b79c-7c12bce6f248 type: obsolete - id: 1cf465a1-2609-4c15-9b66-c32dbe4bfd67 type: similar status: test description: Detects usage of bitsadmin downloading a file to a suspicious target folder references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2025-12-10 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_flags: CommandLine|contains: - ' /transfer ' - ' /create ' - ' /addfile ' selection_folder: CommandLine|contains: - :\Perflogs - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\ - \$Recycle.Bin\ - \AppData\Local\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - '%ProgramData%' - '%public%' - '%temp%' - '%tmp%' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b