alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.ex. Logsource: windows / process_creation. Rule: title: Hypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLine id: 6225c53a-a96e-4235-b28f-8d7997cd96eb related: - id: 8b7273a4-ba5d-4d8a-b04f-11f2900d043a type: similar status: experimental description: 'Detects the tampering of Hypervisor-protected Code Integrity (HVCI) related registry values via command line tool reg.exe. HVCI uses virtualization-based security to protect code integrity by ensuring that only trusted code can run in kernel mode. Adversaries may tamper with HVCI to load malicious or unsigned drivers, which can be used to escalate privileges, maintain persistence, or evade security mechanisms. ' references: - https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution - https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-01-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \reg.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - reg.exe selection_cli: CommandLine|contains: - 'add ' - 'New-ItemProperty ' - 'Set-ItemProperty ' - 'si ' selection_cli_base: CommandLine|contains: \DeviceGuard selection_cli_key: CommandLine|contains: - EnableVirtualizationBasedSecurity - HypervisorEnforcedCodeIntegrity condition: all of selection_* falsepositives: - Legitimate system administration tasks that require disabling HVCI for troubleshooting purposes when certain drivers or applications are incompatible with it. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hvci_registry_tampering/info.yml simulation: - type: atomic-red-team name: Disable Hypervisor-Enforced Code Integrity (HVCI) technique: T1562.001 atomic_guid: 70bd71e6-eba4-4e00-92f7-617911dbe020
Sigma rule: Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Wi. Logsource: windows / process_creation. Rule: title: Suspicious Uninstall of Windows Defender Feature via PowerShell id: c443012c-7928-43bf-ac20-7eda5efe61ad status: experimental description: 'Detects the use of PowerShell with Uninstall-WindowsFeature or Remove-WindowsFeature cmdlets to disable or remove the Windows Defender GUI feature, a common technique used by adversaries to evade defenses. ' references: - https://learn.microsoft.com/en-us/powershell/module/microsoft.windows.servermanager.migration/uninstall-windowsfeature - https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware author: yxinmiracle date: 2025-08-22 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli_uninstall: CommandLine|contains: - Uninstall-WindowsFeature - Remove-WindowsFeature selection_cli_defender_feature: CommandLine|contains: Windows-Defender condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects disabling Windows Defender PUA protection. Logsource: windows / registry_set. Rule: title: Disable PUA Protection on Windows Defender id: 8ffc5407-52e3-478f-9596-0a7371eafe13 status: test description: Detects disabling Windows Defender PUA protection references: - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html author: Austin Songer @austinsonger date: 2021-08-04 modified: 2023-08-17 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Policies\Microsoft\Windows Defender\PUAProtection Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (a. Logsource: windows / process_creation. Rule: title: Suspicious UltraVNC Execution id: 871b9555-69ca-4993-99d3-35a59f9f3599 status: test description: Detects suspicious UltraVNC command line flag combination that indicate a auto reconnect upon execution, e.g. startup (as seen being used by Gamaredon threat group) references: - https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine - https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution - https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html author: Bhabesh Raj date: 2022-03-04 modified: 2022-03-09 tags: - attack.lateral-movement - attack.g0047 - attack.t1021.005 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - '-autoreconnect ' - '-connect ' - '-id:' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations.. Logsource: windows / process_creation. Rule: title: File Encryption/Decryption Via Gpg4win From Suspicious Locations id: e1e0b7d7-e10b-4ee4-ac49-a4bda05d320d status: test description: Detects usage of Gpg4win to encrypt/decrypt files located in potentially suspicious locations. references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-11-30 modified: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Product: GNU Privacy Guard (GnuPG) - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains: -passphrase selection_paths: CommandLine|contains: - :\PerfLogs\ - :\Temp\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ - \AppData\Roaming\ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects possible malicious execution of JXA in-memory via OSAScript. Logsource: macos / process_creation. Rule: title: JXA In-memory Execution Via OSAScript id: f1408a58-0e94-4165-b80a-da9f96cf6fc3 related: - id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 type: derived status: test description: Detects possible malicious execution of JXA in-memory via OSAScript references: - https://redcanary.com/blog/applescript/ author: Sohan G (D4rkCiph3r) date: 2023-01-31 tags: - attack.t1059.002 - attack.t1059.007 - attack.execution logsource: product: macos category: process_creation detection: selection_main: CommandLine|contains|all: - osascript - ' -e ' - eval - NSData.dataWithContentsOfURL selection_js: - CommandLine|contains|all: - ' -l ' - JavaScript - CommandLine|contains: .js condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been r. Logsource: windows / process_creation. Rule: title: Hacktool Execution - Imphash id: 24e3e58a-646b-4b50-adef-02ef935b9fc8 status: test description: Detects the execution of different Windows based hacktools via their import hash (imphash) even if the files have been renamed references: - Internal Research author: Florian Roth (Nextron Systems) date: 2022-03-04 modified: 2024-11-23 tags: - attack.credential-access - attack.resource-development - attack.t1588.002 - attack.t1003 logsource: category: process_creation product: windows detection: selection: Hashes|contains: - IMPHASH=BCCA3C247B619DCD13C8CDFF5F123932 - IMPHASH=3A19059BD7688CB88E70005F18EFC439 - IMPHASH=bf6223a49e45d99094406777eb6004ba - IMPHASH=23867A89C2B8FC733BE6CF5EF902F2D1 - IMPHASH=A37FF327F8D48E8A4D2F757E1B6E70BC - IMPHASH=F9A28C458284584A93B14216308D31BD - IMPHASH=6118619783FC175BC7EBECFF0769B46E - IMPHASH=959A83047E80AB68B368FDB3F4C6E4EA - IMPHASH=563233BFA169ACC7892451F71AD5850A - IMPHASH=87575CB7A0E0700EB37F2E3668671A08 - IMPHASH=13F08707F759AF6003837A150A371BA1 - IMPHASH=1781F06048A7E58B323F0B9259BE798B - IMPHASH=233F85F2D4BC9D6521A6CAAE11A1E7F5 - IMPHASH=24AF2584CBF4D60BBE5C6D1B31B3BE6D - IMPHASH=632969DDF6DBF4E0F53424B75E4B91F2 - IMPHASH=713C29B396B907ED71A72482759ED757 - IMPHASH=749A7BB1F0B4C4455949C0B2BF7F9E9F - IMPHASH=8628B2608957A6B0C6330AC3DE28CE2E - IMPHASH=8B114550386E31895DFAB371E741123D - IMPHASH=94CB940A1A6B65BED4D5A8F849CE9793 - IMPHASH=9D68781980370E00E0BD939EE5E6C141 - IMPHASH=B18A1401FF8F444056D29450FBC0A6CE - IMPHASH=CB567F9498452721D77A451374955F5F - IMPHASH=730073214094CD328547BF1F72289752 - IMPHASH=17B461A082950FC6332228572138B80C - IMPHASH=DC25EE78E2EF4D36FAA0BADF1E7461C9 - IMPHASH=819B19D53CA6736448F9325A85736792 - IMPHASH=829DA329CE140D873B4A8BDE2CBFAA7E - IMPHASH=C547F2E66061A8DFFB6F5A3FF63C0A74 - IMPHASH=0588081AB0E63BA785938467E1B10CCA - IMPHASH=0D9EC08BAC6C07D9987DFD0F1506587C - IMPHASH=BC129092B71C89B4D4C8CDF8EA590B29 - IMPHASH=4DA924CF622D039D58BCE71CDF05D242 - IMPHASH=E7A3A5C377E2D29324093377D7DB1C66 - IMPHASH=9A9DBEC5C62F0380B4FA5FD31DEFFEDF - IMPHASH=AF8A3976AD71E5D5FDFB67DDB8DADFCE - IMPHASH=0C477898BBF137BBD6F2A54E3B805FF4 - IMPHASH=0CA9F02B537BCEA20D4EA5EB1A9FE338 - IMPHASH=3AB3655E5A14D4EEFC547F4781BF7F9E - IMPHASH=E6F9D5152DA699934B30DAAB206471F6 - IMPHASH=3AD59991CCF1D67339B319B15A41B35D - IMPHASH=FFDD59E0318B85A3E480874D9796D872 - IMPHASH=0CF479628D7CC1EA25EC7998A92F5051 - IMPHASH=07A2D4DCBD6CB2C6A45E6B101F0B6D51 - IMPHASH=D6D0F80386E1380D05CB78E871BC72B1 - IMPHASH=38D9E015591BBFD4929E0D0F4
Sigma rule: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity.. Logsource: windows / process_creation. Rule: title: Potential Defense Evasion Activity Via Emoji Usage In CommandLine - 1 id: 4a30ac0c-b9d6-4e01-b71a-5f851bbf4259 status: test description: Detects the usage of emojis in the command line, this could be a sign of potential defense evasion activity. author: '@Kostastsale, TheDFIRReport' references: - Internal Research tags: - attack.stealth date: 2022-12-05 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - 😀 - 😃 - 😄 - 😁 - 😆 - 😅 - 😂 - 🤣 - 🥲 - 🥹 - ☺️ - 😊 - 😇 - 🙂 - 🙃 - 😉 - 😌 - 😍 - 🥰 - 😘 - 😗 - 😙 - 😚 - 😋 - 😛 - 😝 - 😜 - 🤪 - 🤨 - 🧐 - 🤓 - 😎 - 🥸 - 🤩 - 🥳 - 😏 - 😒 - 😞 - 😔 - 😟 - 😕 - 🙁 - ☹️ - 😣 - 😖 - 😫 - 😩 - 🥺 - 😢 - 😭 - 😮‍💨 - 😤 - 😠 - 😡 - 🤬 - 🤯 - 😳 - 🥵 - 🥶 - 😱 - 😨 - 😰 - 😥 - 😓 - 🫣 - 🤗 - 🫡 - 🤔 - 🫢 - 🤭 - 🤫 - 🤥 - 😶 - 😶‍🌫️ - 😐 - 😑 - 😬 - 🫠 - 🙄 - 😯 - 😦 - 😧 - 😮 - 😲 - 🥱 - 😴 - 🤤 - 😪 - 😵 - 😵‍💫 - 🫥 - 🤐 - 🥴 - 🤢 - 🤮 - 🤧 - 😷 - 🤒 - 🤕 - 🤑 - 🤠 - 😈 - 👿 - 👹 - 👺 - 🤡 - 💩 - 👻 - 💀 - ☠️ - 👽 - 👾 - 🤖 - 🎃 - 😺 - 😸 - 😹 - 😻 - 😼 - 😽 - 🙀 - 😿 - 😾 - 👋 - 🤚 - 🖐 - ✋ - 🖖 - 👌 - 🤌 - 🤏 - ✌️ - 🤞 - 🫰 - 🤟 - 🤘 - 🤙 - 🫵 - 🫱 - 🫲 - 🫳 - 🫴 - 👈 - 👉 - 👆 - 🖕 - 👇 - ☝️ - 👍 - 👎 - ✊ - 👊 - 🤛 - 🤜 - 👏 - 🫶 - 🙌 - 👐 - 🤲 - 🤝 - 🙏 - ✍️ - 💪 - 🦾 - 🦵 - 🦿 - 🦶 - 👣 - 👂 - 🦻 - 👃 - 🫀 - 🫁 - 🧠 - 🦷 - 🦴 - 👀 - 👁 - 👅 - 👄 - 🫦 - 💋 - 🩸 - 👶 - 👧 - 🧒 - 👦 - 👩 - 🧑 - 👨 - 👩‍🦱 - 🧑‍🦱 - 👨‍🦱 - 👩‍🦰 - 🧑‍🦰 - 👨‍🦰 - 👱‍♀️ - 👱 - 👱‍♂️ - 👩‍🦳 - 🧑‍🦳 - 👨‍🦳 - 👩‍🦲 - 🧑‍🦲 - 👨‍🦲 - 🧔‍♀️ - 🧔 - 🧔‍♂️ - 👵 - 🧓 - 👴 - 👲 - 👳‍♀️ - 👳 - 👳‍♂️ - 🧕 - 👮‍♀️ - 👮 - 👮‍♂️ - 👷‍♀️ - 👷 - 👷‍♂️ - 💂‍♀️ - 💂 - 💂‍♂️ - 🕵️‍♀️ - 🕵️ - 🕵️‍♂️ - 👩‍⚕️ - 🧑‍⚕️ - 👨‍⚕️ - 👩‍🌾 - 🧑‍🌾 - 👨‍🌾 - 👩‍🍳 - 🧑‍🍳 - 👨‍🍳 - 👩‍🎓 - 🧑‍🎓 - 👨‍🎓 - 👩‍🎤 - 🧑‍🎤 - 👨‍🎤 - 👩‍🏫 - 🧑‍🏫 - 👨‍🏫 - 👩‍🏭 - 🧑‍🏭 - 👨‍🏭 - 👩‍💻 - 🧑‍💻 - 👨‍💻 - 👩‍💼 - 🧑‍💼 - 👨‍💼 - 👩‍🔧 - 🧑‍🔧 - 👨‍🔧 - 👩‍🔬 - 🧑‍🔬 - 👨‍🔬 - 👩‍🎨 - 🧑‍🎨 - 👨‍🎨 - 👩‍🚒 - 🧑‍🚒 - 👨‍🚒 - 👩‍✈️ - 🧑‍✈️ - 👨‍✈️ - 👩‍🚀 - 🧑‍🚀 - 👨‍🚀 - 👩‍⚖️ - 🧑‍⚖️ - 👨‍⚖️ - 👰‍♀️ - 👰 - 👰‍♂️ - 🤵‍♀️ - 🤵 - 🤵‍♂️ - 👸 - 🫅 - 🤴 - 🥷 - 🦸‍♀️ - 🦸 - 🦸‍♂️ - 🦹‍♀️ - 🦹 - 🦹‍♂️ - 🤶 - 🧑‍🎄 - 🎅 - 🧙‍♀️ - 🧙 - 🧙‍♂️ - 🧝‍♀️ - 🧝 - 🧝‍♂️ - 🧛‍♀️ - 🧛 - 🧛‍♂️ - 🧟‍♀️ - 🧟 - 🧟‍♂️ - 🧞‍♀️ - 🧞 - 🧞‍♂️ - 🧜‍♀️ - 🧜 - 🧜‍♂️ - 🧚‍♀️ - 🧚 - 🧚‍♂️ - 🧌 - 👼 - 🤰 - 🫄 - 🫃 - 🤱 - 👩‍🍼 - 🧑‍🍼 - 👨‍🍼 - 🙇‍♀️ - 🙇 - 🙇‍♂️ - 💁‍♀️ - 💁 - 💁‍♂️ - 🙅‍♀️ - 🙅 - 🙅‍♂️ - 🙆‍♀️ - 🙆 - 🙆‍♂️ - 🙋‍♀️ - 🙋 - 🙋‍♂️ - 🧏‍♀️ - 🧏 - 🧏‍♂️ - 🤦‍♀️ - 🤦 - 🤦‍♂️ - 🤷‍♀️ - 🤷 - 🤷‍♂️ - 🙎‍♀️ - 🙎 - 🙎‍♂️ - 🙍‍♀️ - 🙍 - 🙍‍♂️ - 💇‍♀️ - 💇 - 💇‍♂️ - 💆‍♀️ - 💆 - 💆‍♂️ - 🧖‍♀️ - 🧖 - 🧖‍♂️ - 💅 - 💃 - 🕺 - 👯‍♀️ - 👯 - 👯‍♂️ - 🕴 - 👩‍🦽 - 🧑‍🦽 - 👨‍🦽 - 👩‍🦼 - 🧑‍🦼 - 👨‍🦼 - 🚶‍♀️ - 🚶 - 🚶‍♂️ - 👩‍🦯 - 🧑‍🦯 - 👨‍🦯 - 🧎‍♀️ - 🧎 - 🧎‍♂️ - 🏃‍♀️ - 🏃 - 🏃‍♂️ - 🧍‍♀️ - 🧍 - 🧍‍♂️ - 👭 - 🧑‍🤝‍🧑 - 👬 - 👫 - 👩‍❤️‍👩 - 💑 - 👨‍❤️‍👨 - 👩‍❤️‍👨 - 👩‍❤️‍💋‍👩 - 💏 - 👨‍❤️‍💋‍👨 - 👩‍❤️
Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / file_event. Rule: title: Potential Homoglyph Attack Using Lookalike Characters in Filename id: 4f1707b1-b50b-45b4-b5a2-3978b5a5d0d6 status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-08 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: file_event product: windows detection: selection_upper: TargetFilename|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: TargetFilename|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - File names with legitimate Cyrillic text. Will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Sigma rule: Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.. Logsource: windows / applocker. Rule: title: AppLocker Prevented Application or Script from Running id: 401e5d00-b944-11ea-8f9a-00163ecd60ae status: test description: 'Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running. ' references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker - https://nxlog.co/documentation/nxlog-user-guide/applocker.html author: Pushkarev Dmitry date: 2020-06-28 modified: 2025-12-03 tags: - attack.execution - attack.t1204.002 - attack.t1059.001 - attack.t1059.003 - attack.t1059.005 - attack.t1059.006 - attack.t1059.007 logsource: product: windows service: applocker detection: selection: EventID: - 8004 - 8007 - 8022 - 8025 condition: selection falsepositives: - Unlikely, since this event notifies about blocked application execution. Tune your applocker rules to avoid blocking legitimate applications. level: medium
Sigma rule: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed.. Logsource: windows / registry_set. Rule: title: PowerShell Script Execution Policy Enabled id: 8218c875-90b9-42e2-b60d-0b0069816d10 related: - id: fad91067-08c5-4d1a-8d8c-d96a21b37814 type: derived status: test description: Detects the enabling of the PowerShell script execution policy. Once enabled, this policy allows scripts to be executed. references: - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.PowerShell::EnableScripts author: Nasreddine Bencherchali (Nextron Systems), Thurein Oo date: 2023-10-18 tags: - attack.execution logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Policies\Microsoft\Windows\PowerShell\EnableScripts Details: DWORD (0x00000001) condition: selection falsepositives: - Likely level: low
Sigma rule: Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server ro. Logsource: windows / application. Rule: title: MSSQL Add Account To Sysadmin Role id: 08200f85-2678-463e-9c32-88dce2f073d1 status: test description: Detects when an attacker tries to backdoor the MSSQL server by adding a backdoor account to the sysadmin fixed server role references: - https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-13 modified: 2024-06-26 tags: - attack.persistence logsource: product: windows service: application definition: 'Requirements: MSSQL audit policy must be enabled in order to receive this event in the application log' detection: selection: Provider_Name|contains: MSSQL EventID: 33205 Data|contains|all: - object_name:sysadmin - 'statement:alter server role [sysadmin] add member ' condition: selection falsepositives: - Rare legitimate administrative activity level: high
Sigma rule: Execution of plink to perform data exfiltration and tunneling. Logsource: windows / process_creation. Rule: title: Potential RDP Tunneling Via Plink id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da related: - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d type: similar status: test description: Execution of plink to perform data exfiltration and tunneling references: - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems) date: 2022-08-04 modified: 2023-01-27 tags: - attack.command-and-control - attack.t1572 logsource: category: process_creation product: windows detection: selection_a: Image|endswith: \plink.exe CommandLine|contains: :127.0.0.1:3389 selection_b1: Image|endswith: \plink.exe CommandLine|contains: :3389 selection_b2: CommandLine|contains: - ' -P 443' - ' -P 22' condition: selection_a or all of selection_b* falsepositives: - Unknown level: high
Sigma rule: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltrati. Logsource: windows / file_event. Rule: title: NTDS Exfiltration Filename Patterns id: 3a8da4e0-36c1-40d2-8b29-b3e890d5172a status: test description: Detects creation of files with specific name patterns seen used in various tools that export the NTDS.DIT for exfiltration. references: - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb - https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1 - https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405 author: Florian Roth (Nextron Systems) date: 2022-03-11 modified: 2023-05-05 tags: - attack.credential-access - attack.t1003.003 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \All.cab - .ntds.cleartext condition: selection falsepositives: - Unknown level: high
Sigma rule: Identifies when the same privilege role has multiple activations by the same user.. Logsource: azure / pim. Rule: title: Roles Activated Too Frequently id: 645fd80d-6c07-435b-9e06-7bc1b5656cba status: test description: Identifies when the same privilege role has multiple activations by the same user. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: sequentialActivationRenewalsAlertIncident condition: selection falsepositives: - Investigate where if active time period for a role is set too short. level: high
Sigma rule: Adversaries may modify system firewalls in order to bypass controls limiting network usage. Logsource: windows / process_creation. Rule: title: Netsh Allow Group Policy on Microsoft Defender Firewall id: 347906f3-e207-4d18-ae5b-a9403d6bcdef status: test description: Adversaries may modify system firewalls in order to bypass controls limiting network usage references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior author: frack113 date: 2022-01-09 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1686.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - advfirewall - firewall - set - rule - group= - new - enable=Yes condition: all of selection_* falsepositives: - Legitimate administration activity level: medium
Sigma rule: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery. Logsource: linux / process_creation. Rule: title: Docker Container Discovery Via Dockerenv Listing id: 11701de9-d5a5-44aa-8238-84252f131895 status: test description: Detects listing or file reading of ".dockerenv" which can be a sing of potential container discovery references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /dir - /find - /ls - /stat - /test - grep CommandLine|endswith: .dockerenv condition: selection falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Sigma rule: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Sc. Logsource: windows / ps_script. Rule: title: Windows Screen Capture with CopyFromScreen id: d4a11f63-2390-411c-9adf-d791fd152830 status: test description: 'Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-6---windows-screen-capture-copyfromscreen author: frack113 date: 2021-12-28 modified: 2022-07-07 tags: - attack.collection - attack.t1113 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: .CopyFromScreen condition: selection falsepositives: - Unknown level: medium