alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detect set UseActionCenterExperience to 0 to disable the Windows security center notification. Logsource: windows / registry_set. Rule: title: Disable Windows Security Center Notifications id: 3ae1a046-f7db-439d-b7ce-b8b366b81fa6 status: test description: Detect set UseActionCenterExperience to 0 to disable the Windows security center notification references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: Windows\CurrentVersion\ImmersiveShell\UseActionCenterExperience Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_disable_security_center_notifications/info.yml simulation: - type: atomic-red-team name: Disable Windows Security Center Notifications technique: T1112 atomic_guid: 45914594-8df6-4ea9-b3cc-7eb9321a807e
Sigma rule: Detects instances where an SNMP service on an OpenCanary node has had an OID request.. Logsource: opencanary / application. Rule: title: OpenCanary - SNMP OID Request id: e9856028-fd4e-46e6-b3d1-10f7ceb95078 status: test description: Detects instances where an SNMP service on an OpenCanary node has had an OID request. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.discovery - attack.lateral-movement - attack.t1016 - attack.t1021 logsource: category: application product: opencanary detection: selection: logtype: 13001 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is try. Logsource: windows / file_event. Rule: title: PDF File Created By RegEdit.EXE id: 145095eb-e273-443b-83d0-f9b519b7867b status: test description: 'Detects the creation of a file with the ".pdf" extension by the "RegEdit.exe" process. This indicates that a user is trying to print/save a registry key as a PDF in order to potentially extract sensitive information and bypass defenses. ' references: - https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-08 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: Image|endswith: \regedit.exe TargetFilename|endswith: .pdf condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load mali. Logsource: windows / process_creation. Rule: title: Suspicious FromBase64String Usage On Gzip Archive - Process Creation id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f related: - id: df69cb1d-b891-4cd9-90c7-d617d90100ce type: similar status: test description: Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43 author: frack113 date: 2022-12-23 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - FromBase64String - MemoryStream - H4sI condition: selection falsepositives: - Legitimate administrative script level: medium
Sigma rule: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often us. Logsource: windows / ps_script. Rule: title: Potential Active Directory Enumeration Using AD Module - PsScript id: 9e620995-f2d8-4630-8430-4afd89f77604 related: - id: 70bc5215-526f-4477-963c-a47a5c9ebd12 type: similar - id: 74176142-4684-4d8a-8b0a-713257e7df8e type: similar status: test description: Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration. references: - https://github.com/samratashok/ADModule - https://twitter.com/cyb3rops/status/1617108657166061568?s=20 - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges author: frack113, Nasreddine Bencherchali date: 2023-01-22 tags: - attack.reconnaissance - attack.discovery - attack.impact logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enable' detection: selection_generic: ScriptBlockText|contains|all: - 'Import-Module ' - Microsoft.ActiveDirectory.Management.dll selection_specific: ScriptBlockText|contains: ipmo Microsoft.ActiveDirectory.Management.dll condition: 1 of selection_* falsepositives: - Legitimate use of the library for administrative activity level: medium
Sigma rule: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often bein. Logsource: windows / process_creation. Rule: title: Permission Check Via Accesschk.EXE id: c625d754-6a3d-4f65-9c9a-536aea960d37 status: test description: Detects the usage of the "Accesschk" utility, an access and privilege audit tool developed by SysInternal and often being abused by attacker to verify process privileges references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43 - https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW - https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat - https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat author: Teymur Kheirkhabarov (idea), Mangatas Tondang, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-13 modified: 2026-06-29 tags: - attack.discovery - attack.t1069.001 logsource: product: windows category: process_creation detection: selection_img: - Product|endswith: AccessChk - Description|contains: Reports effective permissions - Image|endswith: - \accesschk.exe - \accesschk64.exe - \accesschk64a.exe - OriginalFileName: accesschk.exe selection_cli: CommandLine|contains: - 'uwcqv ' - 'kwsu ' - 'qwsu ' - 'uwdqs ' condition: all of selection* falsepositives: - System administrator Usage level: medium
Sigma rule: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation). Logsource: windows / process_creation. Rule: title: Shell Process Spawned by Java.EXE id: dff1e1cc-d3fd-47c8-bfc2-aeb878a754c0 related: - id: 0d34ed8b-1c12-4ff2-828c-16fc860b766d type: similar status: test description: Detects shell spawned from Java host process, which could be a sign of exploitation (e.g. log4j exploitation) references: - https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/ author: Andreas Hunkeler (@Karneades), Nasreddine Bencherchali date: 2021-12-17 modified: 2024-01-18 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \java.exe Image|endswith: - \bash.exe - \cmd.exe - \powershell.exe - \pwsh.exe filter_main_build: ParentImage|contains: build CommandLine|contains: build condition: selection and not 1 of filter_main_* falsepositives: - Legitimate calls to system binaries - Company specific internal usage level: medium
Sigma rule: Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or. Logsource: windows / process_creation. Rule: title: File Recovery From Backup Via Wbadmin.EXE id: 6fe4aa1e-0531-4510-8be2-782154b73b48 related: - id: 84972c80-251c-4c3a-9079-4f00aad93938 type: derived status: test description: 'Detects the recovery of files from backups via "wbadmin.exe". Attackers can restore sensitive files such as NTDS.DIT or Registry Hives from backups in order to potentially extract credentials. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery - https://lolbas-project.github.io/lolbas/Binaries/Wbadmin/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2024-05-10 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection_cli: CommandLine|contains|all: - ' recovery' - recoveryTarget - itemtype:File condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects execution of regsvr32 where the DLL is located in a potentially suspicious location.. Logsource: windows / process_creation. Rule: title: Regsvr32 Execution From Potential Suspicious Location id: 9525dc73-0327-438c-8c04-13c0e037e9da related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects execution of regsvr32 where the DLL is located in a potentially suspicious location. references: - https://web.archive.org/web/20171001085340/https://subt0x10.blogspot.com/2017/04/bypass-application-whitelisting-script.html - https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/ author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_cli: CommandLine|contains: - :\ProgramData\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Some installers might execute "regsvr32" with DLLs located in %TEMP% or in %PROGRAMDATA%. Apply additional filters if necessary. level: medium
Sigma rule: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.. Logsource: windows / process_creation. Rule: title: InfDefaultInstall.exe .inf Execution id: ce7cf472-6fcc-490a-9481-3786840b5d9b status: test description: Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution - https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/ author: frack113 date: 2021-07-13 modified: 2022-10-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - 'InfDefaultInstall.exe ' - '.inf' condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers.. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Regsvr32 HTTP/FTP Pattern id: 867356ee-9352-41c9-a8f2-1be690d78216 related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects regsvr32 execution to download/install/register new DLLs that are hosted on Web or FTP servers. references: - https://twitter.com/mrd0x/status/1461041276514623491 - https://twitter.com/tccontre18/status/1480950986650832903 - https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/ author: Florian Roth (Nextron Systems) date: 2023-05-24 modified: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \regsvr32.exe - OriginalFileName: REGSVR32.EXE selection_flag: CommandLine|contains: - ' /i' - ' -i' selection_protocol: CommandLine|contains: - ftp - http condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file. Logsource: windows / process_creation. Rule: title: Potential Binary Proxy Execution Via Cdb.EXE id: b5c7395f-e501-4a08-94d4-57fe7a9da9d2 status: test description: Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/ - https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html - https://twitter.com/nas_bench/status/1534957360032120833 author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-26 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1106 - attack.t1218 - attack.t1127 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cdb.exe - OriginalFileName: CDB.Exe selection_cli: CommandLine|contains: - ' -c ' - ' -cf ' condition: all of selection* falsepositives: - Legitimate use of debugging tools level: medium
Sigma rule: Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled. Logsource: aws / cloudtrail. Rule: title: AWS EnableRegion Command Monitoring id: a5ffb6ea-c784-4e01-b30a-deb6e58ca2ab status: experimental description: 'Detects the use of the EnableRegion command in AWS CloudTrail logs. While AWS has 30+ regions, some of them are enabled by default, others must be explicitly enabled in each account separately. There may be situations where security monitoring does not cover some new AWS regions. Monitoring the EnableRegion command is important for identifying potential persistence mechanisms employed by adversaries, as enabling additional regions can facilitate continued access and operations within an AWS environment. ' references: - https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html author: Ivan Saakov, Sergey Zelenskiy date: 2025-10-19 tags: - attack.persistence logsource: product: aws service: cloudtrail detection: selection: eventName: EnableRegion eventSource: account.amazonaws.com condition: selection falsepositives: - Legitimate use of the EnableRegion command by authorized administrators. level: medium
Sigma rule: Detects disabling of Windows Defender Real-time Protection. As this event doesn't contain a lot of information on who in. Logsource: windows / windefend. Rule: title: Windows Defender Real-time Protection Disabled id: b28e58e4-2a72-4fae-bdee-0fbe904db642 related: - id: fe34868f-6e0e-4882-81f6-c43aa8f15b62 type: obsolete status: stable description: 'Detects disabling of Windows Defender Real-time Protection. As this event doesn''t contain a lot of information on who initiated this action you might want to reduce it to a "medium" level if this occurs too many times in your environment ' references: - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://craigclouditpro.wordpress.com/2020/03/04/hunting-malicious-windows-defender-activity/ author: Ján Trenčanský, frack113 date: 2020-07-28 modified: 2023-11-22 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5001 condition: selection falsepositives: - Administrator actions (should be investigated) - Seen being triggered occasionally during Windows 8 Defender Updates level: high
Sigma rule: Detects execution of "dsquery.exe" for domain trust discovery. Logsource: windows / process_creation. Rule: title: Domain Trust Discovery Via Dsquery id: 3bad990e-4848-4a78-9530-b427d854aac0 related: - id: b23fcb74-b1cb-4ff7-a31d-bfe2a7ba453b type: similar - id: 77815820-246c-47b8-9741-e0def3f57308 type: obsolete status: test description: Detects execution of "dsquery.exe" for domain trust discovery references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md - https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843 author: E.M. Anhaus, Tony Lambert, oscd.community, omkar72 date: 2019-10-24 modified: 2023-02-02 tags: - attack.discovery - attack.t1482 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsquery.exe - OriginalFileName: dsquery.exe selection_cli: CommandLine|contains: trustedDomain condition: all of selection_* falsepositives: - Legitimate use of the utilities by legitimate user for legitimate reason level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery/info.yml simulation: - type: atomic-red-team name: Windows - Discover domain trusts with dsquery technique: T1482 atomic_guid: 4700a710-c821-4e17-a3ec-9e4c81d6845f
Sigma rule: Detects command execution via ScreenConnect RMM. Logsource: windows / application. Rule: title: Remote Access Tool - ScreenConnect Command Execution id: 076ebe48-cc05-4d8f-9d41-89245cd93a14 related: - id: b1f73849-6329-4069-bc8f-78a604bb8b23 type: similar status: test description: Detects command execution via ScreenConnect RMM references: - https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling - https://github.com/SigmaHQ/sigma/pull/4467 author: Ali Alwashali date: 2023-10-10 tags: - attack.execution - attack.t1059.003 logsource: service: application product: windows detection: selection: Provider_Name: ScreenConnect EventID: 200 Data|contains: Executed command of length condition: selection falsepositives: - Legitimate use of ScreenConnect level: low
Sigma rule: Detects usage of the Chisel tunneling tool via the commandline arguments. Logsource: windows / process_creation. Rule: title: PUA - Chisel Tunneling Tool Execution id: 8b0e12da-d3c3-49db-bb4f-256703f380e5 related: - id: cf93e05e-d798-4d9e-b522-b0248dc61eaf type: similar status: test description: Detects usage of the Chisel tunneling tool via the commandline arguments references: - https://github.com/jpillora/chisel/ - https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/ - https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/ author: Florian Roth (Nextron Systems) date: 2022-09-13 modified: 2023-02-13 tags: - attack.command-and-control - attack.t1090.001 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \chisel.exe selection_param1: CommandLine|contains: - 'exe client ' - 'exe server ' selection_param2: CommandLine|contains: - -socks5 - -reverse - ' r:' - ':127.0.0.1:' - '-tls-skip-verify ' - :socks condition: selection_img or all of selection_param* falsepositives: - Some false positives may occur with other tools with similar commandlines level: high
Sigma rule: Detects loading of known malicious drivers via their hash.. Logsource: windows / driver_load. Rule: title: Malicious Driver Load id: 05296024-fe8a-4baf-8f3d-9a5f5624ceb2 status: test description: Detects loading of known malicious drivers via their hash. references: - https://loldrivers.io/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2023-12-02 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 - attack.t1068 logsource: product: windows category: driver_load detection: selection: Hashes|contains: - MD5=5be61a24f50eb4c94d98b8a82ef58dcf - MD5=d70a80fc73dd43469934a7b1cc623c76 - MD5=3b71eab204a5f7ed77811e41fed73105 - MD5=528ce5ce19eb34f401ef024de7ddf222 - MD5=ae548418b491cd3f31618eb9e5730973 - MD5=72f53f55898548767e0276c472be41e8 - MD5=508faa4647f305a97ed7167abc4d1330 - MD5=ed2b653d55c03f0bffa250372d682b75 - MD5=0d2ba47286f1c68e87622b3a16bf9d92 - MD5=3164bd6c12dd0fe1bdf3b833d56323b9 - MD5=70fd7209ce5c013a1f9e699b5cc86cdc - MD5=c71be7b112059d2dc84c0f952e04e6cc - MD5=acac842a46f3501fe407b1db1b247a0b - MD5=01c2e4d8234258451083d6ce4e8910b7 - MD5=c8541a9cef64589593e999968a0385b9 - MD5=e172a38ade3aa0a2bc1bf9604a54a3b5 - MD5=6fcf56f6ca3210ec397e55f727353c4a - MD5=2b80be31fbb11d4c1ef6d6a80b2e0c16 - MD5=07056573d464b0f5284f7e3acedd4a3f - MD5=c7b7f1edb9bbef174e6506885561d85d - MD5=d5918d735a23f746f0e83f724c4f26e5 - MD5=84763d8ca9fe5c3bff9667b2adf667de - MD5=fb593b1f1f80d20fc7f4b818065c64b6 - MD5=909f3fc221acbe999483c87d9ead024a - MD5=e29f6311ae87542b3d693c1f38e4e3ad - MD5=aeb0801f22d71c7494e884d914446751 - MD5=3f11a94f1ac5efdd19767c6976da9ba4 - MD5=be6318413160e589080df02bb3ca6e6a - MD5=0b311af53d2f4f77d30f1aed709db257 - MD5=d075d56dfce6b9b13484152b1ef40f93 - MD5=27384ec4c634701012a2962c30badad2 - MD5=5eb2c576597dd21a6b44557c237cf896 - MD5=f56db4eba3829c0918413b5c0b42f00f - MD5=e27b2486aa5c256b662812b465b6036c - MD5=db86dfd7aefbb5be6728a63461b0f5f3 - MD5=04a88f5974caa621cee18f34300fc08a - MD5=5129d8fd53d6a4aba81657ab2aa5d243 - MD5=cd2c641788d5d125c316ed739c69bb59 - MD5=7073cd0085fcba1cd7d3568f9e6d652c - MD5=24f0f2b4b3cdae11de1b81c537df41c7 - MD5=88bea56ae9257b40063785cf47546024 - MD5=63060b756377fce2ce4ab9d079ca732f - MD5=50b39072d0ee9af5ef4824eca34be6e3 - MD5=57c18a8f5d1ba6d015e4d5bc698e3624 - MD5=7d26985a5048bad57d9c223362f3d55c - MD5=ba54a0dbe2685e66e21d41b4529b3528 - MD5=4ad8fd9e83d7200bd7f8d0d4a9abfb11 - MD5=b52f51bbe6b49d0b475d943c29c4d4cb - MD5=a837302307dace2a00d07202b661bce2 - MD5=78a122d926ccc371d60c861600c310f3 - MD5=bdb305aa0806f8b38b7ce43c927fe919 - MD5=27053e964667318e1b370150cbca9138 - MD5=6a4fbc
Sigma rule: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection. Logsource: windows / process_creation. Rule: title: Use NTFS Short Name in Image id: 3ef5605c-9eb9-47b0-9a71-b727e6aa5c3b related: - id: dd6b39d9-d9be-4a3b-8fe0-fe3c6a5c1795 type: similar status: test description: Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection references: - https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/ - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10) - https://twitter.com/jonasLyk/status/1555914501802921984 author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-06 modified: 2023-07-20 tags: - attack.stealth - attack.t1564.004 logsource: category: process_creation product: windows detection: selection: Image|contains: - ~1.bat - ~1.dll - ~1.exe - ~1.hta - ~1.js - ~1.msi - ~1.ps1 - ~1.tmp - ~1.vbe - ~1.vbs - ~2.bat - ~2.dll - ~2.exe - ~2.hta - ~2.js - ~2.msi - ~2.ps1 - ~2.tmp - ~2.vbe - ~2.vbs filter_main_generic_parent: ParentImage: C:\Windows\explorer.exe filter_optional_webex: ParentImage|endswith: \WebEx\WebexHost.exe filter_optional_thor: ParentImage|endswith: \thor\thor64.exe filter_optional_winzip: Image: C:\PROGRA~1\WinZip\WZPREL~1.EXE filter_optional_vcred: Image|endswith: \VCREDI~1.EXE condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Software Installers level: medium