alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service. Logsource: windows / process_creation. Rule: title: Suspicious NTLM Authentication on the Printer Spooler Service id: bb76d96b-821c-47cf-944b-7ce377864492 status: test description: Detects a privilege elevation attempt by coercing NTLM authentication on the Printer Spooler service references: - https://twitter.com/med0x2e/status/1520402518685200384 - https://github.com/elastic/detection-rules/blob/dd224fb3f81d0b4bf8593c5f02a029d647ba2b2d/rules/windows/credential_access_relay_ntlm_auth_via_http_spoolss.toml author: Elastic (idea), Tobias Michalski (Nextron Systems) date: 2022-05-04 modified: 2023-02-09 tags: - attack.privilege-escalation - attack.credential-access - attack.t1212 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - C:\windows\system32\davclnt.dll,DavSetCookie - http CommandLine|contains: - spoolss - srvsvc - /print/pipe/ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task. Logsource: windows / process_creation. Rule: title: Discovery of a System Time id: b243b280-65fe-48df-ba07-6ddea7646427 status: test description: Identifies use of various commands to query a systems time. This technique may be used before executing a scheduled task or to discover the time zone of a target system. references: - https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2022-06-28 tags: - attack.discovery - attack.t1124 logsource: category: process_creation product: windows detection: selection_time: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: time selection_w32tm: Image|endswith: \w32tm.exe CommandLine|contains: tz condition: 1 of selection_* falsepositives: - Legitimate use of the system utilities to discover system time for legitimate reason level: low
Sigma rule: Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are use. Logsource: windows / file_event. Rule: title: Self Extraction Directive File Created In Potentially Suspicious Location id: 760e75d8-c3b5-409b-a9bf-6130b4c4603f related: - id: ab90dab8-c7da-4010-9193-563528cfa347 type: derived status: test description: 'Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location. These files are used by the "iexpress.exe" utility in order to create self extracting packages. Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries. ' references: - https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html - https://en.wikipedia.org/wiki/IExpress - https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2024-02-05 tags: - attack.stealth - attack.t1218 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - :\ProgramData\ - :\Temp\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - :\Windows\Temp\ - \AppData\Local\Temp\ TargetFilename|endswith: .sed condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child rela. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of DiskShadow.EXE id: 9f546b25-5f12-4c8d-8532-5893dcb1e4b8 related: - id: fa1a7e52-3d02-435b-81b8-00da14dd66c1 type: similar - id: 1dde5376-a648-492e-9e54-4241dd9b0c7f type: similar - id: 56b1dde8-b274-435f-a73a-fb75eb81262a type: similar - id: 0c2f8629-7129-4a8a-9897-7e0768f13ff2 type: similar status: test description: Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules. references: - https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/ - https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration - https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4 - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow - https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf - https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware - https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-15 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \diskshadow.exe Image|endswith: - \certutil.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe condition: selection falsepositives: - False postitve can occur in cases where admin scripts levreage the "exec" flag to execute applications level: medium
Sigma rule: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand. Logsource: windows / process_creation. Rule: title: Possible Privilege Escalation via Weak Service Permissions id: d937b75f-a665-4480-88a5-2f20e9f9b22a status: test description: Detection of sc.exe utility spawning by user with Medium integrity level to change service ImagePath or FailureCommand references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://pentestlab.blog/2017/03/30/weak-service-permissions/ author: Teymur Kheirkhabarov date: 2019-10-26 modified: 2024-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.011 logsource: category: process_creation product: windows detection: scbynonadmin: Image|endswith: \sc.exe IntegrityLevel: - Medium - S-1-16-8192 selection_binpath: CommandLine|contains|all: - config - binPath selection_failure: CommandLine|contains|all: - failure - command condition: scbynonadmin and 1 of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory. Logsource: windows / process_creation. Rule: title: Renamed CreateDump Utility Execution id: 1a1ed54a-2ba4-4221-94d5-01dee560d71e related: - id: 515c8be5-e5df-4c5e-8f6d-a4a2f05e4b48 type: similar status: test description: Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory references: - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://twitter.com/bopin2020/status/1366400799199272960 author: Florian Roth (Nextron Systems) date: 2022-09-20 modified: 2023-02-14 tags: - attack.stealth - attack.t1036 - attack.t1003.001 - attack.credential-access logsource: category: process_creation product: windows detection: selection_pe: OriginalFileName: FX_VER_INTERNALNAME_STR selection_cli: - CommandLine|contains|all: - ' -u ' - ' -f ' - .dmp - CommandLine|contains|all: - ' --full ' - ' --name ' - .dmp filter: Image|endswith: \createdump.exe condition: 1 of selection_* and not filter falsepositives: - Command lines that use the same flags level: high
Sigma rule: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library.. Logsource: windows / process_creation. Rule: title: Code Execution via Pcwutl.dll id: 9386d78a-7207-4048-9c9f-a93a7c2d1c05 status: test description: Detects launch of executable by calling the LaunchApplication function from pcwutl.dll library. references: - https://lolbas-project.github.io/lolbas/Libraries/Pcwutl/ - https://twitter.com/harr0ey/status/989617817849876488 author: Julia Fomina, oscd.community date: 2020-10-05 modified: 2023-02-09 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE selection_cli: CommandLine|contains|all: - pcwutl - LaunchApplication condition: all of selection_* falsepositives: - Use of Program Compatibility Troubleshooter Helper level: medium
Sigma rule: Attackers can use print.exe for remote file copy. Logsource: windows / process_creation. Rule: title: Abusing Print Executable id: bafac3d6-7de9-4dd9-8874-4a1194b493ed status: test description: Attackers can use print.exe for remote file copy references: - https://lolbas-project.github.io/lolbas/Binaries/Print/ - https://twitter.com/Oddvarmoe/status/985518877076541440 author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative date: 2020-10-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \print.exe CommandLine|startswith: print CommandLine|contains|all: - /D - .exe filter_print: CommandLine|contains: print.exe condition: selection and not filter_print falsepositives: - Unknown level: medium
Sigma rule: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capabili. Logsource: windows / process_creation. Rule: title: Potential Register_App.Vbs LOLScript Abuse id: 28c8f68b-098d-45af-8d43-8089f3e35403 status: test description: Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 - https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs author: Austin Songer @austinsonger date: 2021-11-05 modified: 2022-07-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cscript.exe - \wscript.exe - OriginalFileName: - cscript.exe - wscript.exe selection_cli: CommandLine|contains: '.vbs -register ' condition: all of selection* falsepositives: - Other VB scripts that leverage the same starting command line flags level: medium
Sigma rule: Detects specific commands commonly used to remove or empty the syslog. Logsource: linux. Rule: title: Commands to Clear or Remove the Syslog - Builtin id: e09eb557-96d2-4de9-ba2d-30f712a5afd3 status: test description: Detects specific commands commonly used to remove or empty the syslog references: - https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474 author: Max Altgelt (Nextron Systems) date: 2021-09-10 modified: 2022-11-26 tags: - attack.impact - attack.t1565.001 logsource: product: linux detection: selection: - rm /var/log/syslog - rm -r /var/log/syslog - rm -f /var/log/syslog - rm -rf /var/log/syslog - mv /var/log/syslog - ' >/var/log/syslog' - ' > /var/log/syslog' falsepositives: - /syslog. condition: selection and not falsepositives falsepositives: - Log rotation level: high
Sigma rule: Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose thei. Logsource: azure / signinlogs. Rule: title: Applications That Are Using ROPC Authentication Flow id: 55695bc0-c8cf-461f-a379-2535f563c854 status: test description: 'Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. The application then uses those credentials to authenticate the user against the identity provider. ' references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-01 tags: - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation - attack.initial-access logsource: product: azure service: signinlogs detection: selection: properties.message: ROPC condition: selection falsepositives: - Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow level: medium
Sigma rule: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence. Logsource: okta / okta. Rule: title: Okta Admin Role Assignment Created id: 139bdd4b-9cd7-49ba-a2f4-744d0a8f5d8c status: test description: Detects when a new admin role assignment is created. Which could be a sign of privilege escalation or persistence references: - https://developer.okta.com/docs/reference/api/system-log/ - https://developer.okta.com/docs/reference/api/event-types/ author: Nikita Khalimonenkov date: 2023-01-19 modified: 2026-04-27 tags: - attack.persistence logsource: product: okta service: okta detection: selection: eventType: iam.resourceset.bindings.add condition: selection falsepositives: - Legitimate creation of a new admin role assignment level: medium
Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|contains|all: - new-object - text.encoding]::ascii ScriptBlockText|contains: - system.io.compression.deflatestream - system.io.streamreader ScriptBlockText|endswith: readtoend condition: selection_4104 falsepositives: - Unknown level: medium
Sigma rule: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer sec. Logsource: windows / process_creation. Rule: title: Disabled IE Security Features id: fb50eb7a-5ab1-43ae-bcc9-091818cb8424 status: test description: Detects command lines that indicate unwanted modifications to registry keys that disable important Internet Explorer security features references: - https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/ author: Florian Roth (Nextron Systems) date: 2020-06-19 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection1: CommandLine|contains|all: - ' -name IEHarden ' - ' -value 0 ' selection2: CommandLine|contains|all: - ' -name DEPOff ' - ' -value 1 ' selection3: CommandLine|contains|all: - ' -name DisableFirstRunCustomize ' - ' -value 2 ' condition: 1 of selection* falsepositives: - Unknown level: high
Sigma rule: Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no long. Logsource: windows / process_creation. Rule: title: Execution Of Non-Existing File id: 71158e3f-df67-472b-930e-7d287acaa3e1 status: test description: 'Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques. ' references: - https://pentestlaboratories.com/2021/12/08/process-ghosting/ - https://www.elastic.co/blog/process-ghosting-a-new-executable-image-tampering-attack author: Max Altgelt (Nextron Systems) date: 2021-12-09 modified: 2026-07-05 tags: - attack.stealth - attack.privilege-escalation - attack.t1055 logsource: category: process_creation product: windows detection: filter_main_image_absolute_path: Image|contains: \ filter_optional_null: Image: null filter_optional_empty: Image: - '-' - '' filter_optional_4688: - Image: - MemCompression - Registry - System - vmmem - vmmemWSL - CommandLine: - MemCompression - Registry - vmmem - vmmemWSL condition: not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon c. Logsource: windows / process_creation. Rule: title: Security Tools Keyword Lookup Via Findstr.EXE id: 4fe074b4-b833-4081-8f24-7dcfeca72b42 related: - id: fe63010f-8823-4864-a96b-a7b4a0f7b929 type: derived status: test description: 'Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results. This detection focuses on the keywords that the attacker might use as a filter. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/987e3ca988ae3cff4b9f6e388c139c05bf44bbb8/atomics/T1518.001/T1518.001.md#atomic-test-1---security-software-discovery - https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/ - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-10-20 modified: 2023-11-14 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|endswith: - ' avira' - ' avira"' - ' cb' - ' cb"' - ' cylance' - ' cylance"' - ' defender' - ' defender"' - ' kaspersky' - ' kaspersky"' - ' kes' - ' kes"' - ' mc' - ' mc"' - ' sec' - ' sec"' - ' sentinel' - ' sentinel"' - ' symantec' - ' symantec"' - ' virus' - ' virus"' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_security_keyword_lookup/info.yml simulation: - type: atomic-red-team name: Security Software Discovery technique: T1518.001 atomic_guid: f92a380f-ced9-491f-b338-95a991418ce2
Sigma rule: Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration.. Logsource: aws / cloudtrail. Rule: title: Restore Public AWS RDS Instance id: c3f265c7-ff03-4056-8ab2-d486227b4599 status: test description: Detects the recovery of a new public database instance from a snapshot. It may be a part of data exfiltration. references: - https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py author: faloker date: 2020-02-12 modified: 2022-10-09 tags: - attack.exfiltration - attack.t1020 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: rds.amazonaws.com responseElements.publiclyAccessible: 'true' eventName: RestoreDBInstanceFromDBSnapshot condition: selection_source falsepositives: - Unknown level: high
Sigma rule: Detects a suspicious curl process start the adds a file to a web request. Logsource: linux / process_creation. Rule: title: Suspicious Curl File Upload - Linux id: 00b90cc1-17ec-402c-96ad-3a8117d7a582 related: - id: 00bca14a-df4e-4649-9054-3f2aa676bc04 type: derived status: test description: Detects a suspicious curl process start the adds a file to a web request references: - https://twitter.com/d1r4c/status/1279042657508081664 - https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file - https://curl.se/docs/manpage.html - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems), Cedric MAURUGEON (Update) date: 2022-09-15 modified: 2023-05-02 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1105 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /curl selection_cli: - CommandLine|contains: - ' --form' - ' --upload-file ' - ' --data ' - ' --data-' - CommandLine|re: \s-[FTd]\s filter_optional_localhost: CommandLine|contains: - ://localhost - ://127.0.0.1 condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Scripts created by developers and admins level: medium
Sigma rule: Identifies when a user has been assigned a privilege role and are not using that role.. Logsource: azure / pim. Rule: title: Roles Are Not Being Used id: 8c6ec464-4ae4-43ac-936a-291da66ed13d status: test description: Identifies when a user has been assigned a privilege role and are not using that role. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: redundantAssignmentAlertIncident condition: selection falsepositives: - Investigate if potential generic account that cannot be removed. level: high
Sigma rule: Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST.. Logsource: opencanary / application. Rule: title: OpenCanary - HTTP POST Login Attempt id: af1ac430-df6b-4b38-b976-0b52f07a0252 status: test description: 'Detects instances where an HTTP service on an OpenCanary node has had login attempt via Form POST. ' references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.initial-access - attack.t1190 logsource: category: application product: opencanary detection: selection: logtype: 3001 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects DLL sideloading of "dbgcore.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGCORE.DLL id: 9ca2bf31-0570-44d8-a543-534c47c33ed7 status: test description: Detects DLL sideloading of "dbgcore.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-06 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbgcore.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_steam: ImageLoaded|endswith: \Steam\bin\cef\cef.win7x64\dbgcore.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbgcore.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium