alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the creation of a named file stream with the imphash of a well-known hack tool. Logsource: windows / create_stream_hash. Rule: title: HackTool Named File Stream Created id: 19b041f6-e583-40dc-b842-d6fa8011493f status: test description: Detects the creation of a named file stream with the imphash of a well-known hack tool references: - https://github.com/gentilkiwi/mimikatz - https://github.com/topotam/PetitPotam - https://github.com/ohpe/juicy-potato - https://github.com/antonioCoco/RoguePotato - https://www.tarasco.org/security/pwdump_7/ - https://github.com/fortra/nanodump - https://github.com/codewhitesec/HandleKatz - https://github.com/xuanxuan0/DripLoader - https://github.com/hfiref0x/UACME - https://github.com/outflanknl/Dumpert - https://github.com/wavestone-cdt/EDRSandblast author: Florian Roth (Nextron Systems) date: 2022-08-24 modified: 2024-11-23 tags: - attack.stealth - attack.s0139 - attack.t1564.004 logsource: product: windows category: create_stream_hash definition: 'Requirements: Sysmon config with Imphash logging activated' detection: selection: Hash|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=0C106686A31BFE2BA931AE1CF6E9DBC6 - IMPHASH=0D1447D4B3259B3C2A1D4CFB7ECE13C3 - IMPHASH=1B0369A1E06271833F78FFA70FFB4EAF - IMPHASH=4C1B52A19748428E51B14C278D0F58E3 - IMPHASH=4D927A711F77D62CEBD4F322CB57EC6F - IMPHASH=66EE036DF5FC1004D9ED5E9A94A1086A - IMPHASH=672B13F4A0B6F27D29065123FE882DFC - IMPHASH=6BBD59CEA665C4AFCC2814C1327EC91F - IMPHASH=725BB81DC24214F6ECACC0CFB36AD30D - IMPHASH=9528A0E91E28FBB88AD433FEABCA2456 - IMPHASH=9DA6D5D77BE11712527DCAB86DF449A3 - IMPHASH=A6E01BC1AB89F8D91D9EAB72032AAE88 - IMPHASH=B24C5EDDAEA4FE50C6A96A2A133521E4 - IMPHASH=D21BBC50DCC169D7B4D0F01962793154 - IMPHASH=FCC251CCEAE90D22C392215CC9A2D5D6 - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0
Sigma rule: Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been. Logsource: aws / cloudtrail. Rule: title: New Network ACL Entry Added id: e1f7febb-7b94-4234-b5c6-00fb8500f5dd status: test description: 'Detects that network ACL entries have been added to a route table which could indicate that new attack vectors have been opened up in the AWS account. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.defense-impairment - attack.t1686.001 logsource: product: aws service: cloudtrail detection: selection: eventSource: ec2.amazonaws.com eventName: CreateNetworkAclEntry condition: selection falsepositives: - Legitimate use of ACLs to enable customer and staff access from the public internet into a public VPC level: low
Sigma rule: Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, una. Logsource: linux / process_creation. Rule: title: Shell Execution via Nice - Linux id: 093d68c7-762a-42f4-9f46-95e79142571a status: test description: 'Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/nice/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /nice CommandLine|endswith: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP se. Logsource: windows / process_creation. Rule: title: New Generic Credentials Added Via Cmdkey.EXE id: b1ec66c6-f4d1-4b5c-96dd-af28ccae7727 status: test description: 'Detects usage of "cmdkey.exe" to add generic credentials. As an example, this can be used before connecting to an RDP session via command line interface. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-03 modified: 2024-03-05 tags: - attack.credential-access - attack.t1003.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdkey.exe - OriginalFileName: cmdkey.exe selection_cli_generic: CommandLine|contains|windash: ' -g' selection_cli_user: CommandLine|contains|windash: ' -u' selection_cli_password: CommandLine|contains|windash: ' -p' condition: all of selection_* falsepositives: - Legitimate usage for administration purposes level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cmdkey_adding_generic_creds/info.yml simulation: - type: atomic-red-team name: RDP to DomainController technique: T1021.001 atomic_guid: 355d4632-8cb9-449d-91ce-b566d0253d3e
Sigma rule: Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was of. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To AzureWebsites.NET By Non-Browser Process id: 5c80b618-0dbb-46e6-acbb-03d90bcb6d83 related: - id: e043f529-8514-4205-8ab0-7f7d2927b400 type: derived status: test description: 'Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site. ' references: - https://www.sentinelone.com/labs/wip26-espionage-threat-actors-abuse-cloud-infrastructure-in-targeted-telco-attacks/ - https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia - https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/ - https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-06-24 modified: 2024-07-16 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: azurewebsites.net filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_chrome_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_firefox_appdata: Image|startswith: C:\Users\ Image|endswith: \AppData\Local\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_safari: Image|contains: - C:\Program Files (x86)\Safari\ - C:\Program Files\Safari\ Image|endswith: \safari.exe filter_main_defender: Image|contains: - C:\Program Files\Windows Defender Advanced Threat Protection\ - C:\Program Files\Windows Defender\ - C:\Pro
Sigma rule: Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. I. Logsource: windows / dns_query. Rule: title: AppX Package Installation Attempts Via AppInstaller.EXE id: 7cff77e1-9663-46a3-8260-17f2e1aa9d0a related: - id: 180c7c5c-d64b-4a63-86e9-68910451bc8b type: derived status: test description: 'Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL ' references: - https://twitter.com/notwhickey/status/1333900137232523264 - https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/ author: frack113 date: 2021-11-24 modified: 2023-11-09 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: dns_query detection: selection: Image|startswith: C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_ Image|endswith: \AppInstaller.exe condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in. Logsource: windows / process_creation. Rule: title: Capture Credentials with Rpcping.exe id: 93671f99-04eb-4ab4-a161-70d446a84003 status: test description: Detects using Rpcping.exe to send a RPC test connection to the target server (-s) and force the NTLM hash to be sent in the process. references: - https://lolbas-project.github.io/lolbas/Binaries/Rpcping/ - https://twitter.com/vysecurity/status/974806438316072960 - https://twitter.com/vysecurity/status/873181705024266241 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11) author: Julia Fomina, oscd.community date: 2020-10-09 modified: 2025-10-31 tags: - attack.credential-access - attack.t1003 logsource: category: process_creation product: windows detection: selection_main_img: - Image|endswith: \RpcPing.exe - OriginalFileName: \RpcPing.exe selection_main_flag: CommandLine|contains|windash: -s selection_cli_ntlm: CommandLine|contains|windash: -u CommandLine|contains: NTLM selection_cli_ncacn: CommandLine|contains|windash: -t CommandLine|contains: ncacn_np condition: all of selection_main_* and 1 of selection_cli_* falsepositives: - Unlikely level: medium
Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting. Logsource: windows / process_creation. Rule: title: Windows Recall Feature Enabled Via Reg.EXE id: 817f252c-5143-4dae-b418-48c3e9f63728 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_value: CommandLine|contains|all: - Microsoft\Windows\WindowsAI - DisableAIDataAnalysis selection_action_add: CommandLine|contains: - add - '0' selection_action_delete: CommandLine|contains: delete condition: selection_img and selection_value and 1 of selection_action_* falsepositives: - Legitimate use/activation of Windows Recall level: medium
Sigma rule: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands. Logsource: windows / process_creation. Rule: title: PUA - Rclone Execution id: e37db05d-d1f9-49c8-b464-cee1a4b11638 related: - id: a0d63692-a531-4912-ad39-4393325b2a9c type: obsolete - id: cb7286ba-f207-44ab-b9e6-760d82b84253 type: obsolete status: test description: Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc references: - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/ - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a - https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone - https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html author: Bhabesh Raj, Sittikorn S, Aaron Greetham (@beardofbinary) - NCC Group date: 2021-05-10 modified: 2023-03-05 tags: - attack.exfiltration - attack.t1567.002 logsource: product: windows category: process_creation detection: selection_specific_options: CommandLine|contains|all: - '--config ' - '--no-check-certificate ' - ' copy ' selection_rclone_img: - Image|endswith: \rclone.exe - Description: Rsync for cloud storage selection_rclone_cli: CommandLine|contains: - pass - user - copy - sync - config - lsd - remote - ls - mega - pcloud - ftp - ignore-existing - auto-confirm - transfers - multi-thread-streams - 'no-check-certificate ' condition: selection_specific_options or all of selection_rclone_* falsepositives: - Unknown level: high
Sigma rule: Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unau. Logsource: linux / process_creation. Rule: title: Shell Invocation Via Ssh - Linux id: 8737b7f6-8df3-4bb7-b1da-06019b99b687 status: test description: 'Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments. ' references: - https://gtfobins.github.io/gtfobins/ssh/ - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-08-29 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /ssh CommandLine|contains: - ProxyCommand=; - permitlocalcommand=yes - localhost selection_cli: CommandLine|contains: - /bin/bash - /bin/dash - /bin/fish - /bin/sh - /bin/zsh - sh 0<&2 1>&2 - sh 1>&2 0<&2 condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate po. Logsource: windows / process_creation. Rule: title: ConvertTo-SecureString Cmdlet Usage Via CommandLine id: 74403157-20f5-415d-89a7-c505779585cf status: test description: Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-02-01 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains: ConvertTo-SecureString condition: all of selection_* falsepositives: - Legitimate use to pass password to different powershell commands level: medium
Sigma rule: Detects the abuse of the exefile handler in new file association. Used for bypass of security products.. Logsource: windows / registry_set. Rule: title: New File Association Using Exefile id: 44a22d59-b175-4f13-8c16-cbaef5b581ff status: test description: Detects the abuse of the exefile handler in new file association. Used for bypass of security products. references: - https://twitter.com/mrd0x/status/1461041276514623491 author: Andreas Hunkeler (@Karneades) date: 2021-11-19 modified: 2023-08-17 tags: - attack.stealth logsource: category: registry_set product: windows detection: selection: TargetObject|contains: Classes\. Details: exefile condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts. Logsource: windows / registry_set. Rule: title: Potential AMSI COM Server Hijacking id: 160d2780-31f7-4922-8b3a-efce30e63e96 status: test description: Detects changes to the AMSI come server registry key in order disable AMSI scanning functionalities. When AMSI attempts to starts its COM component, it will query its registered CLSID and return a non-existent COM server. This causes a load failure and prevents any scanning methods from being accessed, ultimately rendering AMSI useless references: - https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/ - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-comreg-bypass author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\(Default) filter: Details: '%windir%\system32\amsi.dll' condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects suspicious sub processes of web server processes. Logsource: linux / process_creation. Rule: title: Linux Webshell Indicators id: 818f7b24-0fba-4c49-a073-8b755573b9c7 status: test description: Detects suspicious sub processes of web server processes references: - https://www.acunetix.com/blog/articles/web-shells-101-using-php-introduction-web-shells-part-2/ - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2021-10-15 modified: 2022-12-28 tags: - attack.persistence - attack.t1505.003 logsource: product: linux category: process_creation detection: selection_general: ParentImage|endswith: - /httpd - /lighttpd - /nginx - /apache2 - /node - /caddy selection_tomcat: ParentCommandLine|contains|all: - /bin/java - tomcat selection_websphere: ParentCommandLine|contains|all: - /bin/java - websphere sub_processes: Image|endswith: - /whoami - /ifconfig - /ip - /bin/uname - /bin/cat - /bin/crontab - /hostname - /iptables - /netstat - /pwd - /route condition: 1 of selection_* and sub_processes falsepositives: - Web applications that invoke Linux command line tools level: high
Sigma rule: Detects when a API Token is revoked.. Logsource: okta / okta. Rule: title: Okta API Token Revoked id: cf1dbc6b-6205-41b4-9b88-a83980d2255b status: test description: Detects when a API Token is revoked. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Austin Songer @austinsonger date: 2021-09-12 modified: 2026-04-27 tags: - attack.impact logsource: product: okta service: okta detection: selection: eventType: system.api_token.revoke condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment. Logsource: windows / process_creation. Rule: title: PUA - AdFind.EXE Execution id: 514e7e3e-b3b4-4a67-af60-be20f139198b related: - id: 455b9d50-15a1-4b99-853f-8d37655a4c1b type: similar status: experimental description: Detects execution of Adfind.exe utility, which can be used for reconnaissance in an Active Directory environment references: - https://www.joeware.net/freetools/tools/adfind/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-26 tags: - attack.discovery - attack.t1087.002 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \AdFind.exe - OriginalFileName: AdFind.exe - Hashes|contains: - IMPHASH=d144de8117df2beceaba2201ad304764 - IMPHASH=12ce1c0f3f5837ecc18a3782408fa975 - IMPHASH=bca5675746d13a1f246e2da3c2217492 - IMPHASH=4fbf3f084fbbb2470b80b2013134df35 - IMPHASH=49b639b4acbecc49d72a01f357aa4930 - IMPHASH=53e117a96057eaf19c41380d0e87f1c2 - IMPHASH=680dad9e300346e05a85023965867201 - IMPHASH=21aa085d54992511b9f115355e468782 condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_adfind_execution/info.yml
Sigma rule: Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in. Logsource: windows / registry_set. Rule: title: Bypass UAC Using SilentCleanup Task id: 724ea201-6514-4f38-9739-e5973c34f49a status: test description: 'Detects the setting of the environement variable "windir" to a non default value. Attackers often abuse this variable in order to trigger a UAC bypass via the "SilentCleanup" task. The SilentCleanup task located in %windir%\system32\cleanmgr.exe is an auto-elevated task that can be abused to elevate any file with administrator privileges without prompting UAC. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-9---bypass-uac-using-silentcleanup-task - https://www.reddit.com/r/hacking/comments/ajtrws/bypassing_highest_uac_level_windows_810/ - https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign author: frack113, Nextron Systems date: 2022-01-06 modified: 2024-01-30 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Environment\windir filter_main_default: Details: '%SystemRoot%' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_bypass_uac_using_silentcleanup_task/info.yml simulation: - type: atomic-red-team name: Bypass UAC using SilentCleanup Task technique: T1548.002 atomic_guid: 28104f8a-4ff1-4582-bcf6-699dce156608