alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may the. Logsource: windows / process_creation. Rule: title: HackTool - WinRM Access Via Evil-WinRM id: a197e378-d31b-41c0-9635-cfdf1c1bb423 status: test description: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-3---winrm-access-with-evil-winrm - https://github.com/Hackplayers/evil-winrm author: frack113 date: 2022-01-07 modified: 2023-02-13 tags: - attack.lateral-movement - attack.t1021.006 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ruby.exe CommandLine|contains|all: - '-i ' - '-u ' - '-p ' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects when the macOS Script Editor utility spawns an unusual child process.. Logsource: macos / process_creation. Rule: title: Suspicious Execution via macOS Script Editor id: 6e4dcdd1-e48b-42f7-b2d8-3b413fc58cb4 status: test description: Detects when the macOS Script Editor utility spawns an unusual child process. author: Tim Rauch (rule), Elastic (idea) references: - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-7f541fbc4a4a28a92970e8bf53effea5bd934604429112c920affb457f5b2685 - https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/ date: 2022-10-21 modified: 2022-12-28 logsource: category: process_creation product: macos tags: - attack.defense-impairment - attack.t1566 - attack.t1566.002 - attack.initial-access - attack.t1059 - attack.t1059.002 - attack.t1204 - attack.t1204.001 - attack.execution - attack.persistence - attack.t1553 detection: selection_parent: ParentImage|endswith: /Script Editor selection_img: - Image|endswith: - /curl - /bash - /sh - /zsh - /dash - /fish - /osascript - /mktemp - /chmod - /php - /nohup - /openssl - /plutil - /PlistBuddy - /xattr - /sqlite - /funzip - /popen - Image|contains: - python - perl condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects possible Java payloads in web access logs. Logsource: webserver. Rule: title: Java Payload Strings id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c status: test description: Detects possible Java payloads in web access logs references: - https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/ - https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/ - https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md - https://twitter.com/httpvoid0x2f/status/1532924261035384832 - https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035 author: frack113, Harjot Singh, "@cyb3rjy0t" (update) date: 2022-06-04 modified: 2023-01-19 tags: - cve.2022-26134 - cve.2021-26084 - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - '%24%7B%28%23a%3D%40' - ${(#a=@ - '%24%7B%40java' - ${@java - u0022java - '%2F%24%7B%23' - /${# - new+java. - getRuntime().exec( - getRuntime%28%29.exec%28 condition: keywords falsepositives: - Legitimate apps level: high
Sigma rule: Detects the execution of a renamed Microsoft Teams binary.. Logsource: windows / process_creation. Rule: title: Renamed Microsoft Teams Execution id: 88f46b67-14d4-4f45-ac2c-d66984f22191 status: test description: Detects the execution of a renamed Microsoft Teams binary. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-12 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: OriginalFileName: - msteams.exe - teams.exe filter_main_legit_names: Image|endswith: - \msteams.exe - \teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over. Logsource: windows / ps_script. Rule: title: Testing Usage of Uncommonly Used Port id: adf876b3-f1f8-4aa9-a4e4-a64106feec06 status: test description: 'Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps author: frack113 date: 2022-01-23 tags: - attack.command-and-control - attack.t1571 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Test-NetConnection - '-ComputerName ' - '-port ' filter: ScriptBlockText|contains: - ' 443 ' - ' 80 ' condition: selection and not filter falsepositives: - Legitimate administrative script level: medium
Sigma rule: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to e. Logsource: windows / file_event. Rule: title: ADExplorer Writing Complete AD Snapshot Into .dat File id: 0a1255c5-d732-4b62-ac02-b5152d34fb83 related: - id: 9212f354-7775-4e28-9c9f-8f0a4544e664 type: similar status: experimental description: Detects the dual use tool ADExplorer writing a complete AD snapshot into a .dat file. This can be used by attackers to extract data for Bloodhound, usernames for password spraying or use the meta data for social engineering. The snapshot doesn't contain password hashes but there have been cases, where administrators put passwords in the comment field. references: - https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer - https://github.com/c3c/ADExplorerSnapshot.py/tree/f700904defac330802bbfedd1d8ffd9248f4ee24 - https://www.packetlabs.net/posts/scattered-spider-is-a-young-ransomware-gang-exploiting-large-corporations/ - https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ - https://trustedsec.com/blog/adexplorer-on-engagements author: Arnim Rupp (Nextron Systems), Thomas Patzke date: 2025-07-09 tags: - attack.discovery - attack.t1087.002 - attack.t1069.002 - attack.t1482 logsource: category: file_event product: windows detection: selection: Image|endswith: - \ADExp.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe TargetFilename|endswith: .dat condition: selection falsepositives: - Legitimate use of ADExplorer by administrators creating .dat snapshots level: medium
Sigma rule: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.. Logsource: macos / process_creation. Rule: title: System Shutdown/Reboot - MacOs id: 40b1fbe2-18ea-4ee7-be47-0294285811de status: test description: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1529/T1529.md author: Igor Fits, Mikhail Larin, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.impact - attack.t1529 logsource: product: macos category: process_creation detection: selection: Image|endswith: - /shutdown - /reboot - /halt condition: selection falsepositives: - Legitimate administrative activity level: informational
Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentVersion NT Autorun Keys Modification id: cbf93e5d-ca6c-4722-8bea-e9119007c248 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_nt_current_version_base: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion selection_nt_current_version: TargetObject|contains: - \Winlogon\VmApplet - \Winlogon\Userinit - \Winlogon\Taskman - \Winlogon\Shell - \Winlogon\GpExtensions - \Winlogon\AppSetup - \Winlogon\AlternateShells\AvailableShells - \Windows\IconServiceLib - \Windows\Appinit_Dlls - \Image File Execution Options - \Font Drivers - \Drivers32 - \Windows\Run - \Windows\Load filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_main_legitimate_subkey: TargetObject|contains: \Image File Execution Options\ TargetObject|endswith: - \DisableExceptionChainValidation - \MitigationOptions filter_main_security_extension_dc: Image: C:\Windows\system32\svchost.exe TargetObject|contains: - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval Details: - DWORD (0x00000001) - DWORD (0x00000009) - DWORD (0x000003c0) filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe TargetObject|contains: \runtimebroker.exe\Microsoft.Windows.ShellExperienceHost filter_optional_edge: Image|startswith: C:\Program Files (x86)\Microsoft\Temp\ Image|endswith: \MicrosoftEdgeUpdate.exe filter_optional_avguard: Image|startswith: - C:\Program Files (x86)\Avira\Antivirus\avguard.exe - C:\Program Files\Avira\Antivirus\avguard.exe TargetObject|contains: SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentV
Sigma rule: Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. The. Logsource: windows / file_event. Rule: title: Registry Hive File Staged Outside Standard User Profile Path id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73 status: experimental description: 'Detects the creation of a registry hive file (UsrClass.dat or NTUSER.DAT) outside of the standard user profile path. These files generally contain various user-specific registry settings and are typically located in the user''s profile directory. Staging these files outside of the standard path can be indicative of an attacker attempting to manipulate user registry settings for persistence, privilege escalation, or dump user registry hives for credential harvesting. ' references: - https://github.com/MSNightmare/LegacyHive - https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.privilege-escalation - attack.t1548 - attack.credential-access - attack.t1003 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \UsrClass.dat - \NTUSER.DAT filter_main_usrclass: TargetFilename|endswith: \AppData\Local\Microsoft\Windows\UsrClass.dat filter_main_ntuser: TargetFilename|re|i: ^C:\\Users\\[^\\]+\\NTUSER\.DAT$ filter_main_system: TargetFilename|startswith: - C:\Windows\System32\config\ - C:\Windows\SYSVOL\ - C:\Windows\ServiceProfiles\ condition: selection and not 1 of filter_main_* falsepositives: - Backup or profile migration software - Forensic acquisition tools level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml
Sigma rule: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a. Logsource: windows / process_creation. Rule: title: Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script id: 7aa4e81a-a65c-4e10-9f81-b200eb229d7d related: - id: 236d8e89-ed95-4789-a982-36f4643738ba type: derived status: test description: Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state references: - https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/ - https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-14 tags: - attack.execution - attack.persistence - attack.t1059 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VMwareToolBoxCmd.exe - OriginalFileName: toolbox-cmd.exe selection_cli: CommandLine|contains|all: - ' script ' - ' set ' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers. Logsource: windows / wmi_event. Rule: title: Suspicious Scripting in a WMI Consumer id: fe21810c-2a8c-478f-8dd3-5a287fb2a0e0 status: test description: Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers references: - https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/ - https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19 - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2019-04-15 modified: 2023-09-09 tags: - attack.execution - attack.t1059.005 logsource: product: windows category: wmi_event detection: selection_destination: - Destination|contains|all: - new-object - net.webclient - .downloadstring - Destination|contains|all: - new-object - net.webclient - .downloadfile - Destination|contains: - ' iex(' - ' -nop ' - ' -noprofile ' - ' -decode ' - ' -enc ' - WScript.Shell - System.Security.Cryptography.FromBase64Transform condition: selection_destination falsepositives: - Legitimate administrative scripts level: high
Sigma rule: Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.. Logsource: windows / file_event. Rule: title: .RDP File Created By Uncommon Application id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: derived status: test description: 'Detects creation of a file with an ".rdp" extension by an application that doesn''t commonly create such files. ' references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 modified: 2024-11-01 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .rdp Image|endswith: - \brave.exe - \CCleaner Browser\Application\CCleanerBrowser.exe - \chromium.exe - \firefox.exe - \Google\Chrome\Application\chrome.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \Opera.exe - \Vivaldi.exe - \Whale.exe - \olk.exe - \Outlook.exe - \RuntimeBroker.exe - \Thunderbird.exe - \Discord.exe - \Keybase.exe - \msteams.exe - \Slack.exe - \teams.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the usage of the "net.exe" command to start a service using the "start" flag. Logsource: windows / process_creation. Rule: title: Start Windows Service Via Net.EXE id: 2a072a96-a086-49fa-bcb5-15cc5a619093 status: test description: Detects the usage of the "net.exe" command to start a service using the "start" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.002/T1569.002.md author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community date: 2019-10-21 modified: 2023-03-05 tags: - attack.execution - attack.t1569.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains: ' start ' condition: all of selection_* falsepositives: - Legitimate administrator or user executes a service for legitimate reasons. level: low
Sigma rule: Detects suspicious rules that delete or move messages or folders are set on a user's inbox.. Logsource: azure / riskdetection. Rule: title: Suspicious Inbox Manipulation Rules id: ceb55fd0-726e-4656-bf4e-b585b7f7d572 status: test description: Detects suspicious rules that delete or move messages or folders are set on a user's inbox. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.stealth - attack.t1140 logsource: product: azure service: riskdetection detection: selection: riskEventType: mcasSuspiciousInboxManipulationRules condition: selection falsepositives: - Actual mailbox rules that are moving items based on their workflow. level: high
Sigma rule: Detects a ProcessHacker tool that elevated privileges to a very high level. Logsource: windows / system. Rule: title: ProcessHacker Privilege Elevation id: c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 status: test description: Detects a ProcessHacker tool that elevated privileges to a very high level references: - https://twitter.com/1kwpeter/status/1397816101455765504 author: Florian Roth (Nextron Systems) date: 2021-05-27 modified: 2022-12-25 tags: - attack.persistence - attack.execution - attack.privilege-escalation - attack.t1543.003 - attack.t1569.002 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ServiceName|startswith: ProcessHacker AccountName: LocalSystem condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set defau. Logsource: windows / ps_script. Rule: title: Tamper Windows Defender - ScriptBlockLogging id: 14c71865-6cd3-44ae-adaa-1db923fae5f2 related: - id: ec19ebab-72dc-40e1-9728-4c0b805d722c type: derived status: test description: Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps - https://bidouillesecurity.com/disable-windows-defender-in-powershell/ author: frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2022-01-16 modified: 2024-01-02 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_options_disabling_preference: ScriptBlockText|contains: Set-MpPreference selection_options_disabling_function: ScriptBlockText|contains: - -dbaf $true - -dbaf 1 - -dbm $true - -dbm 1 - -dips $true - -dips 1 - -DisableArchiveScanning $true - -DisableArchiveScanning 1 - -DisableBehaviorMonitoring $true - -DisableBehaviorMonitoring 1 - -DisableBlockAtFirstSeen $true - -DisableBlockAtFirstSeen 1 - -DisableCatchupFullScan $true - -DisableCatchupFullScan 1 - -DisableCatchupQuickScan $true - -DisableCatchupQuickScan 1 - -DisableIntrusionPreventionSystem $true - -DisableIntrusionPreventionSystem 1 - -DisableIOAVProtection $true - -DisableIOAVProtection 1 - -DisableRealtimeMonitoring $true - -DisableRealtimeMonitoring 1 - -DisableRemovableDriveScanning $true - -DisableRemovableDriveScanning 1 - -DisableScanningMappedNetworkDrivesForFullScan $true - -DisableScanningMappedNetworkDrivesForFullScan 1 - -DisableScanningNetworkFiles $true - -DisableScanningNetworkFiles 1 - -DisableScriptScanning $true - -DisableScriptScanning 1 - -MAPSReporting $false - -MAPSReporting 0 - -drdsc $true - -drdsc 1 - -drtm $true - -drtm 1 - -dscrptsc $true - -dscrptsc 1 - -dsmndf $true - -dsmndf 1 - -dsnf $true - -dsnf 1 - -dss $true - -dss 1 selection_other_default_actions_allow: ScriptBlockText|contains: Set-MpPreference selection_other_default_actions_func: ScriptBlockText|contains: - HighThreatDefaultAction Allow - htdefac Allow - LowThreatDefaultAction Allow - ltdefac Allow - ModerateThreatDefaultAction Allow -
Sigma rule: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union). Logsource: windows / process_creation. Rule: title: Disable Windows IIS HTTP Logging id: e4ed6030-ffe5-4e6a-8a8a-ab3c1ab9d94e status: test description: Disables HTTP logging on a Windows IIS web server as seen by Threat Group 3390 (Bronze Union) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.002/T1562.002.md#atomic-test-1---disable-windows-iis-http-logging author: frack113 date: 2022-01-09 modified: 2023-01-22 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - set - config - section:httplogging - dontLog:true condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious ASP.NET Compilation Via AspNetCompiler id: 9f50fe98-fe5c-4a2d-86c7-fad7f63ed622 related: - id: 9ccba514-7cb6-4c5c-b377-700758f2f120 type: similar - id: 4c7f49ee-2638-43bb-b85b-ce676c30b260 type: similar - id: a01b8329-5953-4f73-ae2d-aa01e1f35f00 type: similar status: test description: Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation. references: - https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/ - https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-14 modified: 2025-02-24 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ Image|endswith: \aspnet_compiler.exe CommandLine|contains: - \Users\Public\ - \AppData\Local\Temp\ - \AppData\Local\Roaming\ - :\Temp\ - :\Windows\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ condition: selection falsepositives: - Unknown level: high