alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detect usage of the "ssh.exe" binary as a proxy to launch other programs.. Logsource: windows / process_creation. Rule: title: Program Executed Using Proxy/Local Command Via SSH.EXE id: 7d6d30b8-5b91-4b90-a891-46cccaf29598 status: test description: Detect usage of the "ssh.exe" binary as a proxy to launch other programs. references: - https://lolbas-project.github.io/lolbas/Binaries/Ssh/ - https://github.com/LOLBAS-Project/LOLBAS/pull/211/files - https://gtfobins.github.io/gtfobins/ssh/ - https://man.openbsd.org/ssh_config#ProxyCommand - https://man.openbsd.org/ssh_config#LocalCommand author: frack113, Nasreddine Bencherchali date: 2022-12-29 modified: 2025-10-16 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_parent: ParentImage: C:\Windows\System32\OpenSSH\sshd.exe selection_cli_img: - Image|endswith: \ssh.exe - Product: OpenSSH for Windows - Hashes|contains: - IMPHASH=55b4964d29aad5438b9e950052dbbbc0 - IMPHASH=334d66c33503ccbf647c15b47c27eef4 - IMPHASH=27b0da080ef92afb37983d30d839141e - IMPHASH=977eb4c263d384e47daa0712d34713ab - IMPHASH=3eaadce9ae43d5a918bb082065815c3b - IMPHASH=980fe6cf0d996ab1eedf877222e722aa - IMPHASH=5f959422308ac3d721010d66647e100e - IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b - IMPHASH=dd335f759b6d5d6a8382b71dd9d65791 selection_cli_flags: - CommandLine|contains: ProxyCommand= - CommandLine|contains|all: - PermitLocalCommand=yes - ' LocalCommand' condition: selection_parent or all of selection_cli_* falsepositives: - Legitimate usage for administration purposes level: medium
Sigma rule: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network fil. Logsource: windows / ps_script. Rule: title: Change User Agents with WebRequest id: d4488827-73af-4f8d-9244-7b7662ef046e status: test description: 'Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols author: frack113 date: 2022-01-23 modified: 2025-07-18 tags: - attack.command-and-control - attack.t1071.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_webrequest: ScriptBlockText|contains: - Invoke-WebRequest - Invoke-RestMethod - ' irm ' - 'iwr ' selection_useragent: ScriptBlockText|contains: '-UserAgent ' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hi. Logsource: windows / process_creation. Rule: title: Deny Service Access Using Security Descriptor Tampering Via Sc.EXE id: 99cf1e02-00fb-4c0d-8375-563f978dfd37 related: - id: 98c5aeef-32d5-492f-b174-64a691896d25 type: similar - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detects suspicious DACL modifications to deny access to a service that affects critical trustees. This can be used to hide services or make them unstoppable. references: - https://www.sans.org/blog/red-team-tactics-hiding-windows-services/ - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings author: Jonhnathan Ribeiro, oscd.community date: 2020-10-16 modified: 2023-02-28 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sdset: CommandLine|contains|all: - sdset - D; selection_trustee: CommandLine|contains: - ;IU - ;SU - ;BA - ;SY - ;WD condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects driver load of the Process Hacker tool. Logsource: windows / driver_load. Rule: title: PUA - Process Hacker Driver Load id: 67add051-9ee7-4ad3-93ba-42935615ae8d related: - id: 10cb6535-b31d-4512-9962-513dcbc42cc1 type: similar status: test description: Detects driver load of the Process Hacker tool references: - https://processhacker.sourceforge.io/ author: Florian Roth (Nextron Systems) date: 2022-11-16 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - cve.2021-21551 - attack.t1543 logsource: category: driver_load product: windows detection: selection: - ImageLoaded|endswith: \kprocesshacker.sys - Hashes|contains: - IMPHASH=821D74031D3F625BCBD0DF08B70F1E77 - IMPHASH=F86759BB4DE4320918615DC06E998A39 - IMPHASH=0A64EEB85419257D0CE32BD5D55C3A18 - IMPHASH=6E7B34DFC017700B1517B230DF6FF0D0 condition: selection falsepositives: - Legitimate use of process hacker or system informer by developers or system administrators level: high
Sigma rule: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory. Logsource: windows / process_creation. Rule: title: HackTool - Dumpert Process Dumper Execution id: 2704ab9e-afe2-4854-a3b1-0c0706d03578 status: test description: Detects the use of Dumpert process dumper, which dumps the lsass.exe process memory references: - https://github.com/outflanknl/Dumpert - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/ author: Florian Roth (Nextron Systems) date: 2020-02-04 modified: 2025-01-22 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Hashes|contains: MD5=09D278F9DE118EF09163C6140255C690 - CommandLine|contains: Dumpert.dll condition: selection falsepositives: - Very unlikely level: critical
Sigma rule: Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Wind. Logsource: windows / process_creation. Rule: title: NewActiveScriptEventConsumer Creation Attempt via Wmic.EXE id: ebef4391-1a81-4761-a40a-1db446c0e625 status: test description: 'Detects the attempt to create an ActiveScriptEventConsumer via WMIC.EXE. An ActiveScriptEventConsumer is a built-in Windows Management Instrumentation (WMI) class that automatically executes a predefined script (in VBScript or JScript) whenever a specific system event occurs. Adversaries often abuse ActiveScriptEventConsumer to maintain persistence on a compromised host by executing a malicious script whenever a specific event occurs. ' references: - https://twitter.com/johnlatwc/status/1408062131321270282?s=12 - https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf author: Florian Roth (Nextron Systems) date: 2021-06-25 modified: 2026-06-19 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: wmic.exe - Image|endswith: \WMIC.exe selection_cli: CommandLine|contains|all: - ActiveScriptEventConsumer - ' CREATE ' condition: all of selection_* falsepositives: - Legitimate software creating script event consumers level: high
Sigma rule: Detects when an an application is removed from Google Workspace.. Logsource: gcp / google_workspace.admin. Rule: title: Google Workspace Application Removed id: ee2803f0-71c8-4831-b48b-a1fc57601ee4 status: test description: Detects when an an application is removed from Google Workspace. references: - https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3 - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION - https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST author: Austin Songer date: 2021-08-26 modified: 2023-10-11 tags: - attack.impact logsource: product: gcp service: google_workspace.admin detection: selection: eventService: admin.googleapis.com eventName: - REMOVE_APPLICATION - REMOVE_APPLICATION_FROM_WHITELIST condition: selection falsepositives: - Application being removed may be performed by a System Administrator. level: medium
Sigma rule: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO.. Logsource: windows / process_creation. Rule: title: LOLBIN Execution From Abnormal Drive id: d4ca7c59-e9e4-42d8-bf57-91a776efcb87 related: - id: 5b80cf53-3a46-4adc-960b-05ec19348d74 type: similar status: test description: Detects LOLBINs executing from an abnormal or uncommon drive such as a mounted ISO. references: - https://thedfirreport.com/2021/12/13/diavol-ransomware/ - https://www.scythe.io/library/threat-emulation-qakbot - https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/ author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Angelo Violetti - SEC Consult '@angelo_violetti', Aaron Herman date: 2022-01-25 modified: 2023-08-29 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \calc.exe - \certutil.exe - \cmstp.exe - \cscript.exe - \installutil.exe - \mshta.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe - OriginalFileName: - CALC.EXE - CertUtil.exe - CMSTP.EXE - cscript.exe - installutil.exe - MSHTA.EXE - REGSVR32.EXE - RUNDLL32.EXE - wscript.exe filter_main_currentdirectory: CurrentDirectory|contains: C:\ filter_main_empty: CurrentDirectory: '' filter_main_null: CurrentDirectory: null condition: selection and not 1 of filter_main_* falsepositives: - Rare false positives could occur on servers with multiple drives. level: medium
Sigma rule: Detects suspicious command with /dev/tcp. Logsource: linux. Rule: title: Suspicious Use of /dev/tcp id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c status: test description: Detects suspicious command with /dev/tcp references: - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/ - https://book.hacktricks.xyz/shells/shells/linux - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan author: frack113 date: 2021-12-10 modified: 2023-01-06 tags: - attack.reconnaissance logsource: product: linux detection: keywords: - cat </dev/tcp/ - exec 3<>/dev/tcp/ - echo >/dev/tcp/ - bash -i >& /dev/tcp/ - sh -i >& /dev/udp/ - 0<&196;exec 196<>/dev/tcp/ - exec 5<>/dev/tcp/ - (sh)0>/dev/tcp/ - bash -c 'bash -i >& /dev/tcp/ - echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ condition: keywords falsepositives: - Unknown level: medium
Sigma rule: Detects enumeration of Kubernetes secrets.. Logsource: kubernetes / application / audit. Rule: title: Kubernetes Secrets Enumeration id: eeb3e9e1-b685-44e4-9232-6bb701f925b5 related: - id: 7ee0b4aa-d8d4-4088-b661-20efdf41a04c type: derived status: test description: Detects enumeration of Kubernetes secrets. references: - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1552.007 - attack.credential-access logsource: category: application product: kubernetes service: audit detection: selection: verb: list objectRef.resource: secrets condition: selection falsepositives: - The Kubernetes dashboard occasionally accesses the kubernetes-dashboard-key-holder secret level: low
Sigma rule: Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.. Logsource: windows / ps_module. Rule: title: HackTool - Evil-WinRm Execution - PowerShell Module id: 9fe55ea2-4cd6-4491-8a54-dd6871651b51 status: test description: 'Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility. ' references: - https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb - https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-25 tags: - attack.lateral-movement logsource: product: windows category: ps_module detection: selection_wsm: ContextInfo|contains: - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\wsmprovhost.exe selection_payload_1: Payload|contains: - value="(get-location).path - value="(get-item*).length - 'Invoke-Binary ' - Donut-Loader -process_id*-donutfile - Bypass-4MSI - IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','') selection_payload_2: Payload|contains|all: - $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\" - Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath selection_payload_3: Payload|contains|all: - $a += \"$($_.FullName.Replace('\\','/'))/\"}else{ $a += \"$($_.FullName.Replace('\\', '/'))\" } - $a=@();$ condition: selection_wsm and 1 of selection_payload_* falsepositives: - Unknown level: high
Sigma rule: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against. Logsource: windows / process_creation. Rule: title: HackTool - Hashcat Password Cracker Execution id: 39b31e81-5f5f-4898-9c0e-2160cfc0f9bf status: test description: Execute Hashcat.exe with provided SAM file from registry of Windows and Password list to crack against references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1110.002/T1110.002.md#atomic-test-1---password-cracking-with-hashcat - https://hashcat.net/wiki/doku.php?id=hashcat author: frack113 date: 2021-12-27 modified: 2023-02-04 tags: - attack.credential-access - attack.t1110.002 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \hashcat.exe selection_cli: CommandLine|contains|all: - '-a ' - '-m 1000 ' - '-r ' condition: 1 of selection_* falsepositives: - Tools that use similar command line flags and values level: high
Sigma rule: BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished.. Logsource: windows / process_creation. Rule: title: Monitoring For Persistence Via BITS id: b9cbbc17-d00d-4e3d-a827-b06d03d2380d status: test description: 'BITS will allow you to schedule a command to execute after a successful download to notify you that the job is finished. When the job runs on the system the command specified in the BITS job will be executed. This can be abused by actors to create a backdoor within the system and for persistence. It will be chained in a BITS job to schedule the download of malware/additional binaries and execute the program after being downloaded. ' references: - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html - http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html - https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394 author: Sreeman date: 2020-10-29 modified: 2024-01-25 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_cli_notify_1: CommandLine|contains: /SetNotifyCmdLine selection_cli_notify_2: CommandLine|contains: - '%COMSPEC%' - cmd.exe - regsvr32.exe selection_cli_add_1: CommandLine|contains: /Addfile selection_cli_add_2: CommandLine|contains: - 'http:' - 'https:' - 'ftp:' - 'ftps:' condition: selection_img and (all of selection_cli_notify_* or all of selection_cli_add_*) falsepositives: - Unknown level: medium
Sigma rule: The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load o. Logsource: windows / process_creation. Rule: title: Tasks Folder Evasion id: cc4e02ba-9c06-48e2-b09e-2500cace9ae0 status: test description: 'The Tasks folder in system32 and syswow64 are globally writable paths. Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr ' references: - https://twitter.com/subTee/status/1216465628946563073 - https://gist.github.com/am0nsec/8378da08f848424e4ab0cc5b317fdd26 author: Sreeman date: 2020-01-13 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: process_creation detection: selection1: CommandLine|contains: - 'echo ' - 'copy ' - 'type ' - file createnew selection2: CommandLine|contains: - ' C:\Windows\System32\Tasks\' - ' C:\Windows\SysWow64\Tasks\' condition: all of selection* falsepositives: - Unknown level: high
Sigma rule: Detects ScreenConnect program starts that establish a remote access to a system.. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Installation Execution id: 75bfe6e6-cd8e-429e-91d3-03921e1d7962 status: test description: Detects ScreenConnect program starts that establish a remote access to a system. references: - https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies author: Florian Roth (Nextron Systems) date: 2021-02-11 modified: 2024-02-26 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - e=Access& - y=Guest& - '&p=' - '&c=' - '&k=' condition: selection falsepositives: - Legitimate use by administrative staff level: medium
Sigma rule: Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern ". Logsource: zeek / dns. Rule: title: Suspicious DNS Query Indicating Kerberos Coercion via DNS Object SPN Spoofing - Network id: 5588576c-5898-4fac-bcdd-7475a60e8f43 related: - id: b07e58cf-cacc-4135-8473-ccb2eba63dd2 type: similar - id: e7a21b5f-d8c4-4ae5-b8d9-93c5d3f28e1c type: similar status: experimental description: 'Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073. ' references: - https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 - https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-06-20 tags: - attack.collection - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.t1557.001 - attack.t1187 logsource: product: zeek service: dns detection: selection: query|contains|all: - UWhRCA - BAAAA condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folde. Logsource: windows / registry_set. Rule: title: Suspicious Application Allowed Through Exploit Guard id: 42205c73-75c8-4a63-9db1-e3782e06fda0 status: test description: Detects applications being added to the "allowed applications" list of exploit guard in order to bypass controlled folder settings references: - https://www.microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-05 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection_key: TargetObject|contains: SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications selection_paths: TargetObject|contains: - \Users\Public\ - \AppData\Local\Temp\ - \Desktop\ - \PerfLogs\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Unlikely level: high
Sigma rule: Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a proc. Logsource: windows / process_creation. Rule: title: Winrar Compressing Dump Files id: 1ac14d38-3dfc-4635-92c7-e3fd1c5f5bfc related: - id: ec570e53-4c76-45a9-804d-dc3f355ff7a7 type: similar status: test description: Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration. references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ author: Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2023-09-12 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \rar.exe - \winrar.exe - Description: Command line RAR selection_extension: CommandLine|contains: - .dmp - .dump - .hdmp condition: all of selection_* falsepositives: - Legitimate use of WinRAR with a command line in which ".dmp" or ".dump" appears accidentally - Legitimate use of WinRAR to compress WER ".dmp" files for troubleshooting level: medium
Sigma rule: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary contro. Logsource: windows / process_creation. Rule: title: Root Certificate Installed From Susp Locations id: 5f6a601c-2ecb-498b-9c33-660362323afa status: test description: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. references: - https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/ - https://learn.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2023-01-16 tags: - attack.defense-impairment - attack.t1553.004 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - Import-Certificate - ' -FilePath ' - Cert:\LocalMachine\Root CommandLine|contains: - \AppData\Local\Temp\ - :\Windows\TEMP\ - \Desktop\ - \Downloads\ - \Perflogs\ - :\Users\Public\ condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe. Logsource: windows / security. Rule: title: Remote Task Creation via ATSVC Named Pipe id: f6de6525-4509-495a-8a82-1f8b0ed73a00 status: test description: Detects remote task creation via at.exe or API interacting with ATSVC namedpipe references: - https://web.archive.org/web/20230409194125/https://blog.menasec.net/2019/03/threat-hunting-25-scheduled-tasks-for.html author: Samir Bousseaden date: 2019-04-03 modified: 2024-08-01 tags: - attack.privilege-escalation - attack.execution - attack.lateral-movement - attack.persistence - car.2013-05-004 - car.2015-04-001 - attack.t1053.002 logsource: product: windows service: security definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure detection: selection: EventID: 5145 ShareName: \\\\\*\\IPC$ RelativeTargetName: atsvc AccessList|contains: WriteData condition: selection falsepositives: - Unknown level: medium