alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly w. Logsource: windows / image_load. Rule: title: BaaUpdate.exe Suspicious DLL Load id: 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984 related: - id: 9f38c1db-e2ae-40bf-81d0-5b68f73fb512 type: similar status: experimental description: 'Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking. This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user''s session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94) which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user''s context without needing to steal credentials or use additional techniques to compromise the account. ' references: - https://github.com/rtecCyberSec/BitlockMove author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-18 tags: - attack.stealth - attack.t1218 - attack.lateral-movement - attack.t1021.003 logsource: category: image_load product: windows detection: selection: Image|endswith: \BaaUpdate.exe ImageLoaded|endswith: .dll ImageLoaded|contains: - :\Perflogs\ - :\Users\Default\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \Contacts\ - \Favorites\ - \Favourites\ - \Links\ - \Music\ - \Pictures\ - \ProgramData\ - \Temporary Internet - \Videos\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt. Logsource: windows / process_creation. Rule: title: Process Creation Attempt via Wmic.EXE id: 526be59f-a573-4eea-b5f7-f0973207634d related: - id: 3c89a1e8-0fba-449e-8f1b-8409d6267ec8 type: derived status: test description: 'Detects the attempt to create a process via "wmic" with the "process call create" flag, which might indicate an attempt to execute a malicious process on the compromised host. Adversaries may use wmic to execute a process on the compromised host as part of their attack. This event is triggered on on attempt and process creation can be either successful or unsuccessful. ' references: - https://www.sans.org/blog/wmic-for-incident-response/ - https://github.com/redcanaryco/atomic-red-team/blob/84215139ee5127f8e3a117e063b604812bd71928/atomics/T1047/T1047.md#atomic-test-5---wmi-execute-local-process author: Michael Haag, Florian Roth (Nextron Systems), juju4, oscd.community date: 2019-01-16 modified: 2023-02-14 tags: - attack.execution - attack.t1047 - car.2016-03-002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains|all: - process - call - create condition: all of selection_* falsepositives: - Unknown level: medium simulation: - type: atomic red team name: WMI Execute Local Process technique: T1047 atomic_guid: b3bdfc91-b33e-4c6d-a5c8-d64bee0276b3 regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_process_creation/info.yml
Sigma rule: Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass pro. Logsource: windows / file_event. Rule: title: HackTool - Dumpert Process Dumper Default File id: 93d94efc-d7ad-4161-ad7d-1638c4f908d8 related: - id: 2704ab9e-afe2-4854-a3b1-0c0706d03578 type: derived status: test description: Detects the creation of the default dump file used by Outflank Dumpert tool. A process dumper, which dumps the lsass process memory references: - https://github.com/outflanknl/Dumpert - https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/ author: Florian Roth (Nextron Systems) date: 2020-02-04 modified: 2023-05-09 tags: - attack.credential-access - attack.t1003.001 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: dumpert.dmp condition: selection falsepositives: - Very unlikely level: critical
Sigma rule: Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".. Logsource: windows / process_creation. Rule: title: Uncommon Assistive Technology Applications Execution Via AtBroker.EXE id: f24bcaea-0cd1-11eb-adc1-0242ac120002 status: test description: Detects the start of a non built-in assistive technology applications via "Atbroker.EXE". references: - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ - https://lolbas-project.github.io/lolbas/Binaries/Atbroker/ author: Mateusz Wydra, oscd.community date: 2020-10-12 modified: 2024-03-06 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \AtBroker.exe - OriginalFileName: AtBroker.exe selection_cli: CommandLine|contains: start filter_main_builtin: CommandLine|contains: - animations - audiodescription - caretbrowsing - caretwidth - colorfiltering - cursorindicator - cursorscheme - filterkeys - focusborderheight - focusborderwidth - highcontrast - keyboardcues - keyboardpref - livecaptions - magnifierpane - messageduration - minimumhitradius - mousekeys - Narrator - osk - overlappedcontent - showsounds - soundsentry - speechreco - stickykeys - togglekeys - voiceaccess - windowarranging - windowtracking - windowtrackingtimeout - windowtrackingzorder filter_optional_java: CommandLine|contains: Oracle_JavaAccessBridge condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate, non-default assistive technology applications execution level: medium
Sigma rule: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.. Logsource: azure / auditlogs. Rule: title: Guest User Invited By Non Approved Inviters id: 0b4b72e3-4c53-4d5b-b198-2c58cfef39a9 status: test description: Detects when a user that doesn't have permissions to invite a guest user attempts to invite one. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-10 tags: - attack.privilege-escalation - attack.initial-access - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Invite external user Status: failure condition: selection falsepositives: - A non malicious user is unaware of the proper process level: medium
Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / registry_delete. Rule: title: Windows Recall Feature Enabled - DisableAIDataAnalysis Value Deleted id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 related: - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_delete product: windows detection: selection: EventType: DeleteValue TargetObject|endswith: \Microsoft\Windows\WindowsAI\DisableAIDataAnalysis condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium
Sigma rule: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence. Logsource: windows / file_delete. Rule: title: PowerShell Console History Logs Deleted id: ff301988-c231-4bd0-834c-ac9d73b86586 status: test description: Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 tags: - attack.stealth - attack.t1070 logsource: category: file_delete product: windows detection: selection: TargetFilename|endswith: \PSReadLine\ConsoleHost_history.txt condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit. Logsource: windows / msexchange-management. Rule: title: Remove Exported Mailbox from Exchange Webserver id: 09570ae5-889e-43ea-aac0-0e1221fb3d95 status: test description: Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit references: - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430 author: Christian Burkard (Nextron Systems) date: 2021-08-27 modified: 2023-01-23 tags: - attack.stealth - attack.t1070 logsource: service: msexchange-management product: windows detection: keywords: '|all': - Remove-MailboxExportRequest - ' -Identity ' - ' -Confirm "False"' condition: keywords falsepositives: - Unknown level: high
Sigma rule: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52). Logsource: windows / registry_set. Rule: title: UAC Bypass Abusing Winsat Path Parsing - Registry id: 6597be7b-ac61-4ac8-bef4-d3ec88174853 status: test description: Detects the pattern of UAC Bypass using a path parsing issue in winsat.exe (UACMe 52) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-30 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Root\InventoryApplicationFile\winsat.exe| TargetObject|endswith: \LowerCaseLongPath Details|startswith: c:\users\ Details|endswith: \appdata\local\temp\system32\winsat.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects SILENTTRINITY stager dll loading activity. Logsource: windows / image_load. Rule: title: HackTool - SILENTTRINITY Stager DLL Load id: 75c505b1-711d-4f68-a357-8c3fe37dbf2d related: - id: 03552375-cc2c-4883-bbe4-7958d5a980be type: derived status: test description: Detects SILENTTRINITY stager dll loading activity references: - https://github.com/byt3bl33d3r/SILENTTRINITY author: Aleksey Potapov, oscd.community date: 2019-10-22 modified: 2023-02-17 tags: - attack.command-and-control - attack.t1071 logsource: category: image_load product: windows detection: selection: Description|contains: st2stager condition: selection falsepositives: - Unlikely level: high
Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - NetSupport Execution id: 758ff488-18d5-4cbe-8ec4-02b6285a434f status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md author: frack113 date: 2022-09-25 modified: 2023-03-06 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: NetSupport Client Configurator - Product: NetSupport Remote Control - Company: NetSupport Ltd - OriginalFileName: PCICFGUI.EXE condition: selection falsepositives: - Legitimate use level: medium
Sigma rule: Detects the creation of a remote thread from a Powershell process in an uncommon target process. Logsource: windows / create_remote_thread. Rule: title: Remote Thread Creation Via PowerShell In Uncommon Target id: 99b97608-3e21-4bfe-8217-2a127c396a0e related: - id: eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50 type: similar status: test description: Detects the creation of a remote thread from a Powershell process in an uncommon target process references: - https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html author: Florian Roth (Nextron Systems) date: 2018-06-25 modified: 2023-11-10 tags: - attack.execution - attack.stealth - attack.t1218.011 - attack.t1059.001 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \powershell.exe - \pwsh.exe TargetImage|endswith: - \rundll32.exe - \regsvr32.exe condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the. Logsource: linux / file_event. Rule: title: Triple Cross eBPF Rootkit Default Persistence id: 1a2ea919-d11d-4d1e-8535-06cda13be20f status: test description: Detects the creation of "ebpfbackdoor" files in both "cron.d" and "sudoers.d" directories. Which both are related to the TripleCross persistence method references: - https://github.com/h3xduck/TripleCross/blob/12629558b8b0a27a5488a0b98f1ea7042e76f8ab/apps/deployer.sh author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-05 modified: 2022-12-31 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux category: file_event detection: selection: TargetFilename|endswith: ebpfbackdoor condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in orde. Logsource: windows / ps_script. Rule: title: PowerShell Deleted Mounted Share id: 66a4d409-451b-4151-94f4-a55d559c49b0 status: test description: Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md author: oscd.community, @redcanary, Zach Stanford @svch0st date: 2020-10-08 modified: 2025-10-07 tags: - attack.stealth - attack.t1070.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Remove-SmbShare - Remove-FileShare filter_main_module_load: ScriptBlockText|contains|all: - FileShare.cdxml - Microsoft.PowerShell.Core\Export-ModuleMember - ROOT/Microsoft/Windows/Storage/MSFT_FileShare - ObjectModelWrapper - Cmdletization.MethodParameter condition: selection and not 1 of filter_main_* falsepositives: - Administrators or Power users may remove their shares via cmd line level: medium
Sigma rule: Detects the use of the 'setcap' utility to set the 'setuid' capability (cap_setuid) on a binary file. This capability al. Logsource: linux / process_creation. Rule: title: Linux Setuid Capability Set on a Binary via Setcap Utility id: ed447910-bc30-4575-a598-3a2e49516a7a status: experimental description: 'Detects the use of the ''setcap'' utility to set the ''setuid'' capability (cap_setuid) on a binary file. This capability allows a non privileged process to make arbitrary manipulations of user IDs (UIDs), including setting its current UID to a value that would otherwise be restricted (i.e. UID 0, the root user). This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed. ' references: - https://man7.org/linux/man-pages/man8/setcap.8.html - https://dfir.ch/posts/linux_capabilities/ - https://juggernaut-sec.com/capabilities/#cap_setuid author: Luc Génaux date: 2026-01-24 tags: - attack.privilege-escalation - attack.persistence - attack.t1548 - attack.t1554 logsource: product: linux category: process_creation detection: selection: Image|endswith: /setcap CommandLine|contains: cap_setuid condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) co. Logsource: windows / process_creation. Rule: title: MSHTA Execution with Suspicious File Extensions id: cc7abbd0-762b-41e3-8a26-57ad50d2eea3 status: test description: 'Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection. ' references: - http://blog.sevagas.com/?Hacking-around-HTA-files - https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356 - https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/xml/xslt/xslt-stylesheet-scripting-using-msxsl-script - https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997 - https://twitter.com/mattifestation/status/1326228491302563846 - https://www.virustotal.com/gui/file/c1f27d9795a2eba630db8a043580a0761798f06370fb1317067805f8a845b00c author: Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-02-22 modified: 2025-05-12 tags: - attack.stealth - attack.t1140 - attack.t1218.005 - attack.execution - attack.t1059.007 - cve.2020-1599 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \mshta.exe - OriginalFileName: mshta.exe selection_cli: CommandLine|contains: - .7z - .avi - .bat - .bmp - .conf - .csv - .dll - .doc - .gif - .gz - .ini - .jpe - .jpg - .json - .lnk - .log - .mkv - .mp3 - .mp4 - .pdf - .png - .ppt - .rar - .rtf - .svg - .tar - .tmp - .txt - .xls - .xml - .yaml - .yml - .zip - vbscript condition: all of selection_* falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: high
Sigma rule: Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE". Logsource: windows / application. Rule: title: MSSQL Destructive Query id: 00321fee-ca72-4cce-b011-5415af3b9960 status: experimental description: 'Detects the invocation of MS SQL transactions that are destructive towards table or database data, such as "DROP TABLE" or "DROP DATABASE". ' references: - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16 - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16 - https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16 author: Daniel Degasperi '@d4ns4n_' date: 2025-06-04 tags: - attack.exfiltration - attack.impact - attack.t1485 logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy must be enabled in order to receive this event (event id 33205)' detection: selection: Provider_Name: MSSQLSERVER$AUDIT EventID: 33205 Data|contains: - statement:TRUNCATE TABLE - statement:DROP TABLE - statement:DROP DATABASE condition: selection falsepositives: - Legitimate transaction from a sysadmin. level: medium
Sigma rule: Detects suspicious DNS queries known from Cobalt Strike beacons. Logsource: dns. Rule: title: Cobalt Strike DNS Beaconing id: 2975af79-28c4-4d2f-a951-9095f229df29 status: test description: Detects suspicious DNS queries known from Cobalt Strike beacons references: - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2018-05-10 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1071.004 logsource: category: dns detection: selection1: query|startswith: - aaa.stage. - post.1 selection2: query|contains: .stage.123456. condition: 1 of selection* falsepositives: - Unknown level: critical
Sigma rule: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially su. Logsource: windows / process_creation. Rule: title: Diskshadow Script Mode - Execution From Potential Suspicious Location id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 related: - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f type: similar - id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 type: similar - id: 56b1dde8-b274-435f-a73a-fb75eb81262a type: similar - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 type: similar status: test description: Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location. references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-15 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: diskshadow.exe - Image|endswith: \diskshadow.exe selection_cli: CommandLine|contains|windash: '-s ' selection_paths: CommandLine|contains: - :\Temp\ - :\Windows\Temp\ - \AppData\Local\ - \AppData\Roaming\ - \ProgramData\ - \Users\Public\ condition: all of selection_* falsepositives: - False positives may occur if you execute the script from one of the paths mentioned in the rule. Apply additional filters that fits your org needs. level: medium