alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects remote RPC calls to create or execute a scheduled task. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ITaskSchedulerService id: ace3ff54-e7fd-46bd-8ea0-74b49a0aca1d status: test description: Detects remote RPC calls to create or execute a scheduled task references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.lateral-movement - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:86d35949-83c9-4044-b424-db363231fd0c"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 86d35949-83c9-4044-b424-db363231fd0c OpNum: - 1 - 3 - 4 - 10 - 11 - 12 - 13 - 14 - 15 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects instances where a GIT service on an OpenCanary node has had Git Clone request.. Logsource: opencanary / application. Rule: title: OpenCanary - GIT Clone Request id: 4fe17521-aef3-4e6a-9d6b-4a7c8de155a8 status: test description: Detects instances where a GIT service on an OpenCanary node has had Git Clone request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.collection - attack.t1213 logsource: category: application product: opencanary detection: selection: logtype: 16001 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass au. Logsource: azure / auditlogs. Rule: title: Disabled MFA to Bypass Authentication Mechanisms id: 7ea78478-a4f9-42a6-9dcd-f861816122bf status: test description: Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms. references: - https://learn.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory - https://research.splunk.com/cloud/482dd42a-acfa-486b-a0bb-d6fcda27318e/ - https://analyticsrules.exchange/analyticrules/65c78944-930b-4cae-bd79-c3664ae30ba7/ - https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/azure/persistence_entra_id_mfa_disabled_for_user author: '@ionsor' date: 2022-02-08 modified: 2026-04-30 tags: - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: operationName: Disable Strong Authentication properties.result: success condition: selection falsepositives: - Authorized modification by administrators level: medium
Sigma rule: Detects relevant commands often related to malware or hacking activity. Logsource: linux / auditd. Rule: title: Suspicious Commands Linux id: 1543ae20-cbdf-4ec1-8d12-7664d667a825 status: test description: Detects relevant commands often related to malware or hacking activity references: - Internal Research - mostly derived from exploit code including code in MSF author: Florian Roth (Nextron Systems) date: 2017-12-12 modified: 2022-10-05 tags: - attack.execution - attack.t1059.004 logsource: product: linux service: auditd detection: cmd1: type: EXECVE a0: chmod a1: 777 cmd2: type: EXECVE a0: chmod a1: u+s cmd3: type: EXECVE a0: cp a1: /bin/ksh cmd4: type: EXECVE a0: cp a1: /bin/sh condition: 1 of cmd* falsepositives: - Admin activity level: medium
Sigma rule: Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress. Logsource: windows / process_creation. Rule: title: Compressed File Creation Via Tar.EXE id: 418a3163-3247-4b7b-9933-dcfcb7c52ea9 status: test description: 'Detects execution of "tar.exe" in order to create a compressed file. Adversaries may abuse various utilities to compress or encrypt data before exfiltration. ' references: - https://unit42.paloaltonetworks.com/chromeloader-malware/ - https://lolbas-project.github.io/lolbas/Binaries/Tar/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage author: Nasreddine Bencherchali (Nextron Systems), AdmU3 date: 2023-12-19 tags: - attack.collection - attack.exfiltration - attack.t1560 - attack.t1560.001 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \tar.exe - OriginalFileName: bsdtar selection_create: CommandLine|contains: - -c - -r - -u condition: all of selection_* falsepositives: - Likely level: low
Sigma rule: Detects a suspicious call to the user32.dll function that locks the user workstation. Logsource: windows / process_creation. Rule: title: Suspicious Workstation Locking via Rundll32 id: 3b5b0213-0460-4e3f-8937-3abf98ff7dcc status: test description: Detects a suspicious call to the user32.dll function that locks the user workstation references: - https://app.any.run/tasks/2aef9c63-f944-4763-b3ef-81eee209d128/ author: frack113 date: 2022-06-04 modified: 2023-02-09 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection_call_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_call_parent: ParentImage|endswith: \cmd.exe selection_call_cli: CommandLine|contains: user32.dll, selection_function: CommandLine|contains: LockWorkStation condition: all of selection_* falsepositives: - Scripts or links on the user desktop used to lock the workstation instead of Windows+L or the menu option level: medium
Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 3 id: f9578658-9e71-4711-b634-3f9b50cd3c06 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 🦆 - 🦅 - 🦉 - 🦇 - 🐺 - 🐗 - 🐴 - 🦄 - 🐝 - 🪱 - 🐛 - 🦋 - 🐌 - 🐞 - 🐜 - 🪰 - 🪲 - 🪳 - 🦟 - 🦗 - 🕷 - 🕸 - 🦂 - 🐢 - 🐍 - 🦎 - 🦖 - 🦕 - 🐙 - 🦑 - 🦐 - 🦞 - 🦀 - 🪸 - 🐡 - 🐠 - 🐟 - 🐬 - 🐳 - 🐋 - 🦈 - 🐊 - 🐅 - 🐆 - 🦓 - 🦍 - 🦧 - 🦣 - 🐘 - 🦛 - 🦏 - 🐪 - 🐫 - 🦒 - 🦘 - 🦬 - 🐃 - 🐂 - 🐄 - 🐎 - 🐖 - 🐏 - 🐑 - 🦙 - 🐐 - 🦌 - 🐕 - 🐩 - 🦮 - 🐕‍🦺 - 🐈 - 🐈‍⬛ - 🪶 - 🐓 - 🦃 - 🦤 - 🦚 - 🦜 - 🦢 - 🦩 - 🕊 - 🐇 - 🦝 - 🦨 - 🦡 - 🦫 - 🦦 - 🦥 - 🐁 - 🐀 - 🐿 - 🦔 - 🐾 - 🐉 - 🐲 - 🌵 - 🎄 - 🌲 - 🌳 - 🌴 - 🪹 - 🪺 - 🪵 - 🌱 - 🌿 - ☘️ - 🍀 - 🎍 - 🪴 - 🎋 - 🍃 - 🍂 - 🍁 - 🍄 - 🐚 - 🪨 - 🌾 - 💐 - 🌷 - 🪷 - 🌹 - 🥀 - 🌺 - 🌸 - 🌼 - 🌻 - 🌞 - 🌝 - 🌛 - 🌜 - 🌚 - 🌕 - 🌖 - 🌗 - 🌘 - 🌑 - 🌒 - 🌓 - 🌔 - 🌙 - 🌎 - 🌍 - 🌏 - 🪐 - 💫 - ⭐️ - 🌟 - ✨ - ⚡️ - ☄️ - 💥 - 🔥 - 🌪 - 🌈 - ☀️ - 🌤 - ⛅️ - 🌥 - ☁️ - 🌦 - 🌧 - ⛈ - 🌩 - 🌨 - ❄️ - ☃️ - ⛄️ - 🌬 - 💨 - 💧 - 💦 - 🫧 - ☔️ - ☂️ - 🌊 - 🌫🍏 - 🍎 - 🍐 - 🍊 - 🍋 - 🍌 - 🍉 - 🍇 - 🍓 - 🫐 - 🍈 - 🍒 - 🍑 - 🥭 - 🍍 - 🥥 - 🥝 - 🍅 - 🍆 - 🥑 - 🥦 - 🥬 - 🥒 - 🌶 - 🫑 - 🌽 - 🥕 - 🫒 - 🧄 - 🧅 - 🥔 - 🍠 - 🫘 - 🥐 - 🥯 - 🍞 - 🥖 - 🥨 - 🧀 - 🥚 - 🍳 - 🧈 - 🥞 - 🧇 - 🥓 - 🥩 - 🍗 - 🍖 - 🦴 - 🌭 - 🍔 - 🍟 - 🍕 - 🫓 - 🥪 - 🥙 - 🧆 - 🌮 - 🌯 - 🫔 - 🥗 - 🥘 - 🫕 - 🥫 - 🍝 - 🍜 - 🍲 - 🍛 - 🍣 - 🍱 - 🥟 - 🦪 - 🍤 - 🍙 - 🍚 - 🍘 - 🍥 - 🥠 - 🥮 - 🍢 - 🍡 - 🍧 - 🍨 - 🍦 - 🥧 - 🧁 - 🍰 - 🎂 - 🍮 - 🍭 - 🍬 - 🍫 - 🍿 - 🍩 - 🍪 - 🌰 - 🥜 - 🍯 - 🥛 - 🍼 - 🫖 - ☕️ - 🍵 - 🧃 - 🥤 - 🧋 - 🫙 - 🍶 - 🍺 - 🍻 - 🥂 - 🍷 - 🫗 - 🥃 - 🍸 - 🍹 - 🧉 - 🍾 - 🧊 - 🥄 - 🍴 - 🍽 - 🥣 - 🥡 - 🥢 - 🧂 - ⚽️ - 🏀 - 🏈 - ⚾️ - 🥎 - 🎾 - 🏐 - 🏉 - 🥏 - 🎱 - 🪀 - 🏓 - 🏸 - 🏒 - 🏑 - 🥍 - 🏏 - 🪃 - 🥅 - ⛳️ - 🪁 - 🏹 - 🎣 - 🤿 - 🥊 - 🥋 - 🎽 - 🛹 - 🛼 - 🛷 - ⛸ - 🥌 - 🎿 - ⛷ - 🏂 - 🪂 - 🏋️‍♀️ - 🏋️ - 🏋️‍♂️ - 🤼‍♀️ - 🤼 - 🤼‍♂️ - 🤸‍♀️ - 🤸 - 🤸‍♂️ - ⛹️‍♀️ - ⛹️ - ⛹️‍♂️ - 🤺 - 🤾‍♀️ - 🤾 - 🤾‍♂️ - 🏌️‍♀️ - 🏌️ - 🏌️‍♂️ - 🏇 - 🧘‍♀️ - 🧘 - 🧘‍♂️ - 🏄‍♀️ - 🏄 - 🏄‍♂️ - 🏊‍♀️ - 🏊 - 🏊‍♂️ - 🤽‍♀️ - 🤽 - 🤽‍♂️ - 🚣‍♀️ - 🚣 - 🚣‍♂️ - 🧗‍♀️ - 🧗 - 🧗‍♂️ - 🚵‍♀️ - 🚵 - 🚵‍♂️ - 🚴‍♀️ - 🚴 - 🚴‍♂️ - 🏆 - 🥇 - 🥈 - 🥉 - 🏅 - 🎖 - 🏵 - 🎗 - 🎫 - 🎟 - 🎪 - 🤹 - 🤹‍♂️ - 🤹‍♀️ - 🎭 - 🩰 - 🎨 - 🎬 - 🎤 - 🎧 - 🎼 - 🎹 - 🥁 - 🪘 - 🎷 - 🎺 - 🪗 - 🎸 - 🪕 - 🎻 - 🎲 - ♟ - 🎯 - 🎳 - 🎮 - 🎰 - 🧩 - 🚗 - 🚕 - 🚙 - 🚌 - 🚎 - 🏎 - 🚓 - 🚑 - 🚒 - 🚐 - 🛻 - 🚚 - 🚛 - 🚜 - 🦯 - 🦽 - 🦼 - 🛴 - 🚲 - 🛵 - 🏍 - 🛺 - 🚨 - 🚔 - 🚍 - 🚘 - 🚖 - 🛞 - 🚡 - 🚠 - 🚟 - 🚃 - 🚋 - 🚞 - 🚝 - 🚄 - 🚅 - 🚈 - 🚂 - 🚆 - 🚇 - 🚊 - 🚉 - ✈️ - 🛫 - 🛬 - 🛩 - 💺 - 🛰 - 🚀 - 🛸 - 🚁 - 🛶 - ⛵️ - 🚤 - 🛥 - 🛳 - ⛴ - 🚢 - ⚓️ - 🛟
Sigma rule: Detects a suspicious RDP session redirect using tscon.exe. Logsource: windows / process_creation. Rule: title: Suspicious RDP Redirect Using TSCON id: f72aa3e8-49f9-4c7d-bd74-f8ab84ff9bbb status: test description: Detects a suspicious RDP session redirect using tscon.exe references: - http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html - https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 - https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/ author: Florian Roth (Nextron Systems) date: 2018-03-17 modified: 2023-05-16 tags: - attack.lateral-movement - attack.t1563.002 - attack.t1021.001 - car.2013-07-002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: ' /dest:rdp-tcp#' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects usage of "IMEWDBLD.exe" to download arbitrary files. Logsource: windows / process_creation. Rule: title: Arbitrary File Download Via IMEWDBLD.EXE id: 863218bd-c7d0-4c52-80cd-0a96c09f54af related: - id: 8d7e392e-9b28-49e1-831d-5949c6281228 type: derived status: test description: Detects usage of "IMEWDBLD.exe" to download arbitrary files references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download - https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/ author: Swachchhanda Shrawan Poudel date: 2023-11-09 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \IMEWDBLD.exe - OriginalFileName: imewdbld.exe selection_cli: CommandLine|contains: - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan. Logsource: opencanary / application. Rule: title: OpenCanary - NMAP NULL Scan id: 68b8547b-107f-43f3-97fb-900a7d63c190 status: experimental description: Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Marco Pedrinazzi (@pedrinazziM) date: 2026-01-06 tags: - attack.discovery - attack.t1046 logsource: category: application product: opencanary detection: selection: logtype: 5003 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order t. Logsource: windows / security. Rule: title: Important Scheduled Task Deleted/Disabled id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad related: - id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 type: similar - id: 9ac94dc8-9042-493c-ba45-3b5e7c86b980 type: similar - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar status: test description: Detects when adversaries stop services or processes by deleting or disabling their respective scheduled tasks in order to conduct data destructive activities references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4699 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4701 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-05 modified: 2023-03-13 tags: - attack.execution - attack.privilege-escalation - attack.persistence - attack.t1053.005 logsource: product: windows service: security definition: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to allow this detection. We also recommend extracting the Command field from the embedded XML in the event data. detection: selection: EventID: - 4699 - 4701 TaskName|contains: - \Windows\SystemRestore\SR - \Windows\Windows Defender\ - \Windows\BitLocker - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ - \Windows\UpdateOrchestrator\Schedule - \Windows\ExploitGuard filter_main_defender_update: EventID: 4699 SubjectUserName|endswith: $ TaskName|contains: \Windows\Windows Defender\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable/info.yml simulation: - type: atomic-red-team name: Windows - Disable the SR scheduled task technique: T1490 atomic_guid: 1c68c68d-83a4-4981-974e-8993055fa034
Sigma rule: Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help. Logsource: windows / file_event. Rule: title: Office Macro File Download id: 0e29e3a7-1ad8-40aa-b691-9f82ecd33d66 related: - id: 91174a41-dc8f-401b-be89-7bfc140612a0 type: similar status: test description: 'Detects the creation of a new office macro files on the system via an application (browser, mail client). This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md - https://learn.microsoft.com/en-us/deployoffice/compat/office-file-format-reference author: Nasreddine Bencherchali (Nextron Systems) date: 2022-01-23 modified: 2025-10-29 tags: - attack.initial-access - attack.t1566.001 logsource: category: file_event product: windows detection: selection_processes: Image|endswith: - \RuntimeBroker.exe - \outlook.exe - \thunderbird.exe - \brave.exe - \chrome.exe - \firefox.exe - \iexplore.exe - \maxthon.exe - \MicrosoftEdge.exe - \msedge.exe - \msedgewebview2.exe - \opera.exe - \safari.exe - \seamonkey.exe - \vivaldi.exe - \whale.exe selection_ext: - TargetFilename|endswith: - .docm - .dotm - .xlsm - .xltm - .potm - .pptm - TargetFilename|contains: - .docm:Zone - .dotm:Zone - .xlsm:Zone - .xltm:Zone - .potm:Zone - .pptm:Zone condition: all of selection_* falsepositives: - Legitimate macro files downloaded from the internet - Legitimate macro files sent as attachments via emails level: low
Sigma rule: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is requi. Logsource: windows / raw_access_thread. Rule: title: Potential Defense Evasion Via Raw Disk Access By Uncommon Tools id: db809f10-56ce-4420-8c86-d6a7d793c79c status: test description: Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-12-03 tags: - attack.stealth - attack.t1006 logsource: product: windows category: raw_access_thread detection: filter_main_floppy: Device|contains: floppy filter_main_generic: Image|startswith: - C:\$WINDOWS.~BT\ - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\CCM\ - C:\Windows\explorer.exe - C:\Windows\servicing\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemApps\ - C:\Windows\SysWOW64\ - C:\Windows\uus\ - C:\Windows\WinSxS\ filter_main_system_images: Image: - Registry - System filter_main_windefender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: - \MsMpEng.exe - \MpDefenderCoreService.exe filter_main_microsoft_appdata: Image|startswith: C:\Users\ Image|contains|all: - \AppData\ - \Microsoft\ filter_main_ssd_nvme: Image|startswith: C:\Windows\Temp\ Image|endswith: - \Executables\SSDUpdate.exe - \HostMetadata\NVMEHostmetadata.exe filter_main_null: Image: null filter_main_systemsettings: Image: C:\Windows\ImmersiveControlPanel\SystemSettings.exe filter_main_update: Image|startswith: C:\$WinREAgent\Scratch\ filter_optional_github_desktop: Image|startswith: C:\Users\ Image|contains: \AppData\Local\GitHubDesktop\app- Image|endswith: \resources\app\git\mingw64\bin\git.exe filter_optional_nextron: Image|startswith: C:\Windows\Temp\asgard2-agent\ Image|endswith: \thor.exe filter_optional_Keybase: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Keybase\upd.exe condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Likely level: low
Sigma rule: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$).. Logsource: windows / security. Rule: title: SMB Create Remote File Admin Share id: b210394c-ba12-4f89-9117-44a2464b9511 status: test description: Look for non-system accounts SMB accessing a file with write (0x2) access mask via administrative share (i.e C$). references: - https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml - https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file author: Jose Rodriguez (@Cyb3rPandaH), OTR (Open Threat Research) date: 2020-08-06 modified: 2025-10-17 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security detection: selection: EventID: 5145 ShareName|endswith: C$ AccessMask: '0x2' filter_main_subjectusername: SubjectUserName|endswith: $ filter_optional_local_ip: IpAddress: ::1 condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.. Logsource: zeek / rdp. Rule: title: Publicly Accessible RDP Service id: 1fc0809e-06bf-4de3-ad52-25e5263b7623 status: test description: 'Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service. ' author: Josh Brower @DefensiveDepth date: 2020-08-22 modified: 2024-03-13 tags: - attack.lateral-movement - attack.t1021.001 logsource: product: zeek service: rdp detection: selection: id.orig_h|cidr: - ::1/128 - 10.0.0.0/8 - 127.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - 2620:83:8000::/48 - fc00::/7 - fe80::/10 condition: not selection falsepositives: - Although it is recommended to NOT have RDP exposed to the internet, verify that this is a) allowed b) the server has not already been compromised via some brute force or remote exploit since it has been exposed to the internet. Work to secure the server if you are unable to remove it from being exposed to the internet. level: high
Sigma rule: Detects attempts to disable the Windows Firewall using PowerShell. Logsource: windows / process_creation. Rule: title: Windows Firewall Disabled via PowerShell id: 12f6b752-042d-483e-bf9c-915a6d06ad75 related: - id: 488b44e7-3781-4a71-888d-c95abfacf44d type: similar status: test description: Detects attempts to disable the Windows Firewall using PowerShell references: - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Tim Rauch, Elastic (idea) date: 2022-09-14 modified: 2023-02-13 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_name: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_args: CommandLine|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: CommandLine|contains: - ' -All ' - Public - Domain - Private condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects execution of MemProcFS a memory forensics tool with the '-device' parameter. MemProcFS mounts physical memory as. Logsource: windows / process_creation. Rule: title: PUA - Memory Dump Mount Via MemProcFS id: 8a1b2c3d-4e5f-6789-abcd-ef1234567890 status: experimental description: 'Detects execution of MemProcFS a memory forensics tool with the ''-device'' parameter. MemProcFS mounts physical memory as a virtual file system, allowing direct access to process memory and system structures. Threat actors were seen abusing this utility to mount memory dumps and then extract sensitive information from processes like LSASS or extract registry hives to obtain credentials, LSA secrets, SAM data, and cached domain credentials. MemProcFS usage that is not part of authorized forensic analysis should be treated as suspicious and warrants further investigation. ' references: - https://github.com/ufrisk/MemProcFS - https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html# - https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-04-27 tags: - attack.credential-access - attack.t1003 - attack.t1003.001 - attack.t1003.004 - attack.t1003.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \MemProcFS.exe - OriginalFileName: MemProcFS.exe - Description: MemProcFS selection_cli: CommandLine|contains: -device condition: all of selection_* falsepositives: - Legitimate use during memory forensics; if not part of authorized analysis, warrants urgent investigation level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_memprocfs/info.yml
Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.. Logsource: windows / process_creation. Rule: title: AddinUtil.EXE Execution From Uncommon Directory id: 6120ac2a-a34b-42c0-a9bd-1fb9f459f348 status: test description: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory. references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 modified: 2025-02-24 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe filter_main_legit_location: Image|contains: - :\Windows\Microsoft.NET\Framework\ - :\Windows\Microsoft.NET\Framework64\ - :\Windows\Microsoft.NET\FrameworkArm\ - :\Windows\Microsoft.NET\FrameworkArm64\ - :\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium