alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set. Logsource: windows / msexchange-management. Rule: title: ProxyLogon MSExchange OabVirtualDirectory id: 550d3350-bb8a-4ff3-9533-2ba533f4a1c0 status: test description: Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory references: - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c author: Florian Roth (Nextron Systems) date: 2021-08-09 modified: 2023-01-23 tags: - attack.t1587.001 - attack.resource-development logsource: product: windows service: msexchange-management detection: keywords_cmdlet: '|all': - OabVirtualDirectory - ' -ExternalUrl ' keywords_params: - eval(request - http://f/<script - '"unsafe"};' - function Page_Load() condition: keywords_cmdlet and keywords_params falsepositives: - Unlikely level: critical
Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data.. Logsource: windows / ps_script. Rule: title: Automated Collection Command PowerShell id: c1dda054-d638-4c16-afc8-53e007f3fbc5 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md author: frack113 date: 2021-07-28 modified: 2022-12-25 tags: - attack.collection - attack.t1119 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ext: ScriptBlockText|contains: - .doc - .docx - .xls - .xlsx - .ppt - .pptx - .rtf - .pdf - .txt selection_cmd: ScriptBlockText|contains|all: - Get-ChildItem - ' -Recurse ' - ' -Include ' condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects Obfuscated Powershell via use MSHTA in Scripts. Logsource: windows / security. Rule: title: Invoke-Obfuscation Via Use MSHTA - Security id: 9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a related: - id: 7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4 type: derived status: test description: Detects Obfuscated Powershell via use MSHTA in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows service: security definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697 detection: selection: EventID: 4697 ServiceFileName|contains|all: - mshta - vbscript:createobject - .run - window.close condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the execution of "reg.exe" to alter registry keys that would replace the user's desktop background. This is a co. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Desktop Background Change Using Reg.EXE id: 8cbc9475-8d05-4e27-9c32-df960716c701 related: - id: 85b88e05-dadc-430b-8a9e-53ff1cd30aae type: similar status: test description: 'Detects the execution of "reg.exe" to alter registry keys that would replace the user''s desktop background. This is a common technique used by malware to change the desktop background to a ransom note or other image. ' references: - https://www.attackiq.com/2023/09/20/emulating-rhysida/ - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/ - https://www.trendmicro.com/en_us/research/23/h/an-overview-of-the-new-rhysida-ransomware.html - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI author: Stephen Lincoln @slincoln-aiq (AttackIQ) date: 2023-12-21 tags: - attack.persistence - attack.impact - attack.defense-impairment - attack.t1112 - attack.t1491.001 logsource: product: windows category: process_creation detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_flag: CommandLine|contains: add selection_keys: CommandLine|contains: - Control Panel\Desktop - CurrentVersion\Policies\ActiveDesktop - CurrentVersion\Policies\System selection_cli_reg_1: CommandLine|contains|all: - /v NoChangingWallpaper - /d 1 selection_cli_reg_2: CommandLine|contains|all: - /v Wallpaper - /t REG_SZ selection_cli_reg_3: CommandLine|contains|all: - /v WallpaperStyle - /d 2 condition: all of selection_reg_* and selection_keys and 1 of selection_cli_reg_* falsepositives: - Administrative scripts that change the desktop background to a company logo or other image. level: medium
Sigma rule: Detects the restoration of files from the defender quarantine. Logsource: windows / windefend. Rule: title: Win Defender Restored Quarantine File id: bc92ca75-cd42-4d61-9a37-9d5aa259c88b status: test description: Detects the restoration of files from the defender quarantine references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 1009 condition: selection falsepositives: - Legitimate administrator activity restoring a file level: high
Sigma rule: Detects suspicious new RUN key element pointing to an executable in a suspicious folder. Logsource: windows / registry_set. Rule: title: New RUN Key Pointing to Suspicious Folder id: 02ee49e2-e294-4d0f-9278-f5b3212fc588 status: experimental description: Detects suspicious new RUN key element pointing to an executable in a suspicious folder references: - https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2018-08-25 modified: 2025-10-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_target: TargetObject|contains: - \Software\Microsoft\Windows\CurrentVersion\Run - \Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run - \Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run selection_suspicious_paths_1: Details|contains: - :\Perflogs - :\ProgramData' - :\Windows\Temp - :\Temp - \AppData\Local\Temp - \AppData\Roaming - :\$Recycle.bin - :\Users\Default - :\Users\public - '%temp%' - '%tmp%' - '%Public%' - '%AppData%' selection_suspicious_paths_user_1: Details|contains: :\Users\ selection_suspicious_paths_user_2: Details|contains: - \Favorites - \Favourites - \Contacts - \Music - \Pictures - \Documents - \Photos filter_main_windows_update: TargetObject|contains: \Microsoft\Windows\CurrentVersion\RunOnce\ Image|startswith: C:\Windows\SoftwareDistribution\Download\ Details|contains|all: - 'rundll32.exe ' - C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 Details|contains: - \AppData\Local\Temp\ - C:\Windows\Temp\ filter_optional_spotify: Image|endswith: - C:\Program Files\Spotify\Spotify.exe - C:\Program Files (x86)\Spotify\Spotify.exe - \AppData\Roaming\Spotify\Spotify.exe TargetObject|endswith: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Spotify Details|endswith: Spotify.exe --autostart --minimized condition: selection_target and (selection_suspicious_paths_1 or (all of selection_suspicious_paths_user_* )) and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software using weird folders for updates level: high
Sigma rule: Detects the creation of a named pipe seen used by known APTs or malware.. Logsource: windows / pipe_created. Rule: title: Malicious Named Pipe Created id: fe3ac066-98bb-432a-b1e7-a5229cb39d4a status: test description: Detects the creation of a named pipe seen used by known APTs or malware. references: - https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/ - https://securelist.com/faq-the-projectsauron-apt/75533/ - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://www.us-cert.gov/ncas/alerts/TA17-117A - https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html - https://thedfirreport.com/2020/06/21/snatch-ransomware/ - https://github.com/RiccardoAncarani/LiquidSnake - https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity - https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a - https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf - https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/ - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ author: Florian Roth (Nextron Systems), blueteam0ps, elhoim date: 2017-11-06 modified: 2023-08-07 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: - \46a676ab7f179e511e30dd2dc41bd388 - \583da945-62af-10e8-4902-a8f205c72b2e - \6e7645c4-32c5-4fe3-aabf-e94c2f4370e7 - \9f81f59bc58452127884ce513865ed20 - \adschemerpc - \ahexec - \AnonymousPipe - \bc31a7 - \bc367 - \bizkaz - \csexecsvc - \dce_3d - \e710f28d59aa529d6792ca6ff0ca1b34 - \gruntsvc - \isapi_dg - \isapi_dg2 - \isapi_http - \jaccdpqnvbrrxlaf - \lsassw - \NamePipe_MoreWindows - \pcheap_reuse - \Posh* - \rpchlp_3 - \sdlrpc - \svcctl - \testPipe -
Sigma rule: Detects loaded unsigned image on the system. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Unsigned Image Loaded id: c92c24e7-f595-493f-9c98-53d5142f5c18 status: test description: Detects loaded unsigned image on the system references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.privilege-escalation logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3037 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malw. Logsource: macos / process_creation. Rule: title: Payload Decoded and Decrypted via Built-in Utilities id: 234dc5df-40b5-49d1-bf53-0d44ce778eca status: test description: Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer. references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-5d42c3d772e04f1e8d0eb60f5233bc79def1ea73105a2d8822f44164f77ef823 author: Tim Rauch (rule), Elastic (idea) date: 2022-10-17 tags: - attack.stealth - attack.t1059 - attack.t1204 - attack.execution - attack.t1140 - attack.s0482 - attack.s0402 logsource: category: process_creation product: macos detection: selection: Image|endswith: /openssl CommandLine|contains|all: - /Volumes/ - enc - -base64 - ' -d ' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious msiexec process starts with web addresses as parameter. Logsource: windows / process_creation. Rule: title: MsiExec Web Install id: f7b5f842-a6af-4da5-9e95-e32478f3cd2f related: - id: 8150732a-0c9d-4a99-82b9-9efb9b90c40c type: similar status: test description: Detects suspicious msiexec process starts with web addresses as parameter references: - https://blog.trendmicro.com/trendlabs-security-intelligence/attack-using-windows-installer-msiexec-exe-leads-lokibot/ author: Florian Roth (Nextron Systems) date: 2018-02-09 modified: 2022-01-07 tags: - attack.stealth - attack.t1218.007 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' msiexec' - :// condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Sigma rule: Detects a "winlogon.exe" process that initiate network communications with public IP addresses. Logsource: windows / network_connection. Rule: title: Outbound Network Connection To Public IP Via Winlogon id: 7610a4ea-c06d-495f-a2ac-0a696abcfd3b status: test description: Detects a "winlogon.exe" process that initiate network communications with public IP addresses references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Christopher Peacock @securepeacock, SCYTHE @scythe_io date: 2023-04-28 modified: 2024-03-12 tags: - attack.execution - attack.command-and-control - attack.stealth - attack.t1218.011 logsource: category: network_connection product: windows detection: selection: Image|endswith: \winlogon.exe Initiated: 'true' filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Communication to other corporate systems that use IP addresses from public address spaces level: medium
Sigma rule: Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which mig. Logsource: azure / signinlogs. Rule: title: User Access Blocked by Azure Conditional Access id: 9a60e676-26ac-44c3-814b-0c2a8b977adf status: test description: 'Detect access has been blocked by Conditional Access policies. The access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.credential-access - attack.initial-access - attack.stealth - attack.t1110 - attack.t1078.004 logsource: product: azure service: signinlogs detection: selection: ResultType: 53003 condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects RDP session hijacking by using MSTSC shadowing. Logsource: windows / process_creation. Rule: title: Potential MSTSC Shadowing Activity id: 6ba5a05f-b095-4f0a-8654-b825f4f16334 status: test description: Detects RDP session hijacking by using MSTSC shadowing references: - https://twitter.com/kmkz_security/status/1220694202301976576 - https://github.com/kmkz/Pentesting/blob/47592e5e160d3b86c2024f09ef04ceb87d204995/Post-Exploitation-Cheat-Sheet author: Florian Roth (Nextron Systems) date: 2020-01-24 modified: 2023-02-05 tags: - attack.lateral-movement - attack.t1563.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - noconsentprompt - 'shadow:' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects a potentially suspicious powershell script executions from temporary folder. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Powershell Script Execution From Temp Folder id: a6a39bdb-935c-4f0a-ab77-35f4bbf44d33 status: test description: Detects a potentially suspicious powershell script executions from temporary folder references: - https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/ author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton date: 2021-07-14 modified: 2026-02-17 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - \Windows\Temp - \Temporary Internet - \AppData\Local\Temp - \AppData\Roaming\Temp - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' filter_optional_vscode: CommandLine|contains: -WindowStyle hidden -Verb runAs filter_optional_amazon_ec2: CommandLine|contains: \Windows\system32\config\systemprofile\AppData\Local\Temp\Amazon\EC2-Windows\ filter_optional_generic: CommandLine|contains: - ' >' - Out-File - ConvertTo-Json filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: selection and not 1 of filter_optional_* falsepositives: - Administrative scripts level: medium
Sigma rule: Detection well-known mimikatz command line arguments. Logsource: windows / process_creation. Rule: title: HackTool - Mimikatz Execution id: a642964e-bead-4bed-8910-1bb4d63e3b4d status: test description: Detection well-known mimikatz command line arguments references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://tools.thehacker.recipes/mimikatz/modules author: Teymur Kheirkhabarov, oscd.community, David ANDRE (additional keywords), Tim Shelton date: 2019-10-22 modified: 2023-02-21 tags: - attack.credential-access - attack.t1003.001 - attack.t1003.002 - attack.t1003.004 - attack.t1003.005 - attack.t1003.006 logsource: category: process_creation product: windows detection: selection_tools_name: CommandLine|contains: - DumpCreds - mimikatz selection_function_names: CommandLine|contains: - ::aadcookie - ::detours - ::memssp - ::mflt - ::ncroutemon - ::ngcsign - ::printnightmare - ::skeleton - ::preshutdown - ::mstsc - ::multirdp selection_module_names: CommandLine|contains: - 'rpc::' - 'token::' - 'crypto::' - 'dpapi::' - 'sekurlsa::' - 'kerberos::' - 'lsadump::' - 'privilege::' - 'process::' - 'vault::' condition: 1 of selection_* falsepositives: - Unlikely level: high
Sigma rule: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe. Logsource: windows / file_event. Rule: title: WScript or CScript Dropper - File id: 002bdb95-0cf1-46a6-9e08-d38c128a6127 related: - id: cea72823-df4d-4567-950c-0b579eaf0846 type: derived status: test description: Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe references: - WScript or CScript Dropper (cea72823-df4d-4567-950c-0b579eaf0846) author: Tim Shelton date: 2022-01-10 modified: 2026-02-17 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: file_event product: windows detection: selection: Image|endswith: - \wscript.exe - \cscript.exe TargetFilename|contains: - :\Perflogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\ - :\Windows\Temp\ - \AppData\Local\Temp - \AppData\Roaming\Temp - \Start Menu\Programs\Startup\ - \Temporary Internet TargetFilename|endswith: - .js - .jse - .vba - .vbe - .vbs - .wsf - .wsh condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects execution of javascript code using "mshta.exe".. Logsource: windows / process_creation. Rule: title: Suspicious JavaScript Execution Via Mshta.EXE id: 67f113fa-e23d-4271-befa-30113b3e08b1 status: test description: Detects execution of javascript code using "mshta.exe". references: - https://eqllib.readthedocs.io/en/latest/analytics/6bc283c4-21f2-4aed-a05c-a9a3ffa95dd4.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2023-02-07 tags: - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: MSHTA.EXE selection_cli: CommandLine|contains: javascript condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects usage of "MSOHTMED" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via MSOHTMED.EXE id: 459f2f98-397b-4a4a-9f47-6a5ec2f1c69d status: test description: Detects usage of "MSOHTMED" to download arbitrary files references: - https://github.com/LOLBAS-Project/LOLBAS/pull/238/files author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MSOHTMED.exe - OriginalFileName: MsoHtmEd.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then per. Logsource: windows / ps_script. Rule: title: Suspicious New-PSDrive to Admin Share id: 1c563233-030e-4a07-af8c-ee0490a66d3a status: test description: Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2 author: frack113 date: 2022-08-13 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - New-PSDrive - '-psprovider ' - filesystem - '-root ' - \\\\ - $ condition: selection falsepositives: - Unknown level: medium