alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Clear command history in network OS which is used for defense evasion. Logsource: cisco / aaa. Rule: title: Cisco Clear Logs id: ceb407f6-8277-439b-951f-e4210e3ed956 status: test description: Clear command history in network OS which is used for defense evasion references: - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609 author: Austin Clark date: 2019-08-12 modified: 2023-05-26 tags: - attack.stealth - attack.t1070.003 logsource: product: cisco service: aaa detection: keywords: - clear logging - clear archive condition: keywords falsepositives: - Legitimate administrators may run these commands level: high
Sigma rule: Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals t. Logsource: windows / process_creation. Rule: title: Potential Execution of Sysinternals Tools id: 7cccd811-7ae9-4ebe-9afd-cb5c406b824b related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived status: test description: Detects command lines that contain the 'accepteula' flag which could be a sign of execution of one of the Sysinternals tools references: - https://twitter.com/Moti_B/status/1008587936735035392 author: Markus Neis date: 2017-08-28 modified: 2024-03-13 tags: - attack.resource-development - attack.t1588.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -accepteula' condition: selection falsepositives: - Legitimate use of SysInternals tools - Programs that use the same command line flag level: low
Sigma rule: This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health. Logsource: windows / security. Rule: title: Azure AD Health Monitoring Agent Registry Keys Access id: ff151c33-45fa-475d-af4f-c2f93571f4fe status: test description: 'This detection uses Windows security events to detect suspicious access attempts to the registry key of Azure AD Health monitoring agent. This detection requires an access control entry (ACE) on the system access control list (SACL) of the following securable object HKLM\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent. ' references: - https://o365blog.com/post/hybridhealthagent/ - https://github.com/OTRF/Set-AuditRule/blob/c3dec5443414231714d850565d364ca73475ade5/rules/registry/aad_connect_health_monitoring_agent.yml author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2022-10-09 tags: - attack.discovery - attack.t1012 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectType: Key ObjectName: \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Online\Reporting\MonitoringAgent filter: ProcessName|contains: - Microsoft.Identity.Health.Adfs.DiagnosticsAgent.exe - Microsoft.Identity.Health.Adfs.InsightsService.exe - Microsoft.Identity.Health.Adfs.MonitoringAgent.Startup.exe - Microsoft.Identity.Health.Adfs.PshSurrogate.exe - Microsoft.Identity.Health.Common.Clients.ResourceMonitor.exe condition: selection and not filter falsepositives: - Unknown level: medium
Sigma rule: Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs. Logsource: windows / ps_script. Rule: title: Suspicious Eventlog Clear id: 0f017df3-8f5a-414f-ad6b-24aff1128278 related: - id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 type: derived status: test description: Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs references: - https://twitter.com/oroneequalsone/status/1568432028361830402 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems) date: 2022-09-12 modified: 2025-10-06 tags: - attack.defense-impairment - attack.t1685.005 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: - ScriptBlockText|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - ScriptBlockText|contains|all: - Eventing.Reader.EventLogSession - ClearLog - ScriptBlockText|contains|all: - Diagnostics.EventLog - Clear condition: selection falsepositives: - Rare need to clear logs before doing something. Sometimes used by installers or cleaner scripts. The script should be investigated to determine if it's legitimate level: medium
Sigma rule: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware. Logsource: windows / file_event. Rule: title: Suspicious File Creation Activity From Fake Recycle.Bin Folder id: cd8b36ac-8e4a-4c2f-a402-a29b8fbd5bca related: - id: 5ce0f04e-3efc-42af-839d-5b3a543b76c0 type: derived status: test description: Detects file write event from/to a fake recycle bin folder that is often used as a staging directory for malware references: - https://www.mandiant.com/resources/blog/infected-usb-steal-secrets - https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/ author: X__Junior (Nextron Systems) date: 2023-07-12 modified: 2023-12-11 tags: - attack.persistence - attack.stealth logsource: category: file_event product: windows detection: selection: - Image|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ - TargetFilename|contains: - RECYCLERS.BIN\ - RECYCLER.BIN\ condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_susp_recycle_bin_fake_exec/info.yml
Sigma rule: Detects the creation of binaries in the WinSxS folder by non-system processes. Logsource: windows / file_event. Rule: title: WinSxS Executable File Creation By Non-System Process id: 34746e8c-5fb8-415a-b135-0abc167e912a related: - id: 64827580-e4c3-4c64-97eb-c72325d45399 type: derived status: test description: Detects the creation of binaries in the WinSxS folder by non-system processes references: - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-11 tags: - attack.execution logsource: category: file_event product: windows detection: selection: TargetFilename|startswith: C:\Windows\WinSxS\ TargetFilename|endswith: .exe filter_main_system_location: Image|startswith: - C:\Windows\Systems32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects the use of the filename DumpStack.log to evade Microsoft Defender. Logsource: windows / process_creation. Rule: title: DumpStack.log Defender Evasion id: 4f647cfa-b598-4e12-ad69-c68dd16caef8 status: test description: Detects the use of the filename DumpStack.log to evade Microsoft Defender references: - https://twitter.com/mrd0x/status/1479094189048713219 author: Florian Roth (Nextron Systems) date: 2022-01-06 modified: 2022-06-17 tags: - attack.defense-impairment logsource: category: process_creation product: windows detection: selection: Image|endswith: \DumpStack.log selection_download: CommandLine|contains: ' -o DumpStack.log' condition: 1 of selection* falsepositives: - Unknown level: critical
Sigma rule: Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network sha. Logsource: linux / process_creation. Rule: title: File and Directory Discovery - Linux id: d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72 status: test description: 'Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad date: 2020-10-19 modified: 2024-12-01 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection_file_with_asterisk: Image|endswith: /file CommandLine|re: (.){200,} selection_recursive_ls: Image|endswith: /ls CommandLine|contains: -R selection_find_execution: Image|endswith: /find selection_tree_execution: Image|endswith: /tree selection_findmnt_execution: Image|endswith: /findmnt selection_locate_execution: Image|endswith: /mlocate condition: 1 of selection_* falsepositives: - Legitimate activities level: informational
Sigma rule: Detects when an end user consents to an application. Logsource: azure / auditlogs. Rule: title: End User Consent id: 9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a status: test description: Detects when an end user consents to an application references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent author: Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow' date: 2022-07-28 tags: - attack.credential-access - attack.t1528 logsource: product: azure service: auditlogs detection: selection: ConsentContext.IsAdminConsent: 'false' condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze se. Logsource: windows / process_creation. Rule: title: PPL Tampering Via WerFaultSecure id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 related: - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c type: similar - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b type: similar status: experimental description: 'Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated. ' references: - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53 - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251 author: Jason (https://github.com/0xbcf) date: 2025-09-23 modified: 2025-11-23 tags: - attack.defense-impairment - attack.t1685 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \WerFaultSecure.exe - OriginalFileName: WerFaultSecure.exe selection_args: CommandLine|contains|all: - ' /h ' - ' /pid ' - ' /tid ' - ' /encfile ' - ' /cancel ' - ' /type ' - ' 268310' condition: all of selection_* falsepositives: - Legitimate usage of WerFaultSecure for debugging purposes level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml
Sigma rule: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM. Logsource: windows / process_creation. Rule: title: Taskmgr as LOCAL_SYSTEM id: 9fff585c-c33e-4a86-b3cd-39312079a65f status: test description: Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM references: - Internal Research author: Florian Roth (Nextron Systems) date: 2018-03-18 modified: 2022-05-27 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: User|contains: - AUTHORI - AUTORI Image|endswith: \taskmgr.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros. Logsource: windows / registry_set. Rule: title: Disable Macro Runtime Scan Scope id: ab871450-37dc-4a3a-997f-6662aa8ae0f1 description: Detects tampering with the MacroRuntimeScanScope registry key to disable runtime scanning of enabled macros status: test date: 2022-10-25 modified: 2023-08-17 author: Nasreddine Bencherchali (Nextron Systems) references: - https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/ - https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope - https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba tags: - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: TargetObject|contains|all: - \SOFTWARE\ - \Microsoft\Office\ - \Common\Security TargetObject|endswith: \MacroRuntimeScanScope Details: DWORD (0x00000000) condition: selection falsepositives: - Unknown level: high
Sigma rule: Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Simila. Logsource: windows / ps_script. Rule: title: Disable-WindowsOptionalFeature Command PowerShell id: 99c4658d-2c5e-4d87-828d-7c066ca537c3 status: test description: 'Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md - https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps author: frack113 date: 2022-09-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Disable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: ScriptBlockText|contains: - Windows-Defender-Gui - Windows-Defender-Features - Windows-Defender - Windows-Defender-ApplicationGuard condition: all of selection* falsepositives: - Unknown level: high
Sigma rule: Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting t. Logsource: windows / registry_set. Rule: title: Windows Recall Feature Enabled - Registry id: 75180c5f-4ea1-461a-a4f6-6e4700c065d4 related: - id: 5dfc1465-8f65-4fde-8eb5-6194380c6a62 type: similar - id: 817f252c-5143-4dae-b418-48c3e9f63728 type: similar status: test description: 'Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary. ' references: - https://learn.microsoft.com/en-us/windows/client-management/manage-recall - https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis author: Sajid Nawaz Khan date: 2024-06-02 tags: - attack.collection - attack.t1113 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Policies\Microsoft\Windows\WindowsAI\DisableAIDataAnalysis Details: DWORD (0x00000000) condition: selection falsepositives: - Legitimate use/activation of Windows Recall level: medium
Sigma rule: Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is. Logsource: windows / process_access. Rule: title: Potential Credential Dumping Activity Via LSASS id: 5ef9853e-4d0e-4a70-846f-a9ca37d876da status: test description: 'Detects process access requests to the LSASS process with specific call trace calls and access masks. This behaviour is expressed by many credential dumping tools such as Mimikatz, NanoDump, Invoke-Mimikatz, Procdump and even the Taskmgr dumping feature. ' references: - https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html - https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md - https://research.splunk.com/endpoint/windows_possible_credential_dumping/ author: Samir Bousseaden, Michael Haag date: 2019-04-03 modified: 2026-06-29 tags: - attack.credential-access - attack.t1003.001 - attack.s0002 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe GrantedAccess|contains: - '0x1038' - '0x1438' - '0x143a' - '0x1fffff' CallTrace|contains: - dbgcore.dll - dbghelp.dll - kernel32.dll - kernelbase.dll - ntdll.dll filter_main_system_user: SourceUser|contains: - AUTHORI - AUTORI filter_optional_thor: CallTrace|contains|all: - :\Windows\Temp\asgard2-agent\ - \thor\thor64.exe+ - '|UNKNOWN(' GrantedAccess: '0x103800' filter_optional_sysmon: SourceImage|endswith: - :\Windows\Sysmon64.exe - :\Windows\Sysmon64a.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Monitor and alert on conditional access changes where non approved actor removed CA Policy.. Logsource: azure / auditlogs. Rule: title: CA Policy Removed by Non Approved Actor id: 26e7c5e2-6545-481e-b7e6-050143459635 status: test description: Monitor and alert on conditional access changes where non approved actor removed CA Policy. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Corissa Koopmans, '@corissalea' date: 2022-07-19 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Delete conditional access policy condition: selection falsepositives: - Misconfigured role permissions - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. level: medium
Sigma rule: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs. Logsource: windows / process_creation. Rule: title: Lolbin Runexehelper Use As Proxy id: cd71385d-fd9b-4691-9b98-2b1f7e508714 status: test description: Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs references: - https://twitter.com/0gtweet/status/1206692239839289344 - https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/ author: frack113 date: 2022-12-29 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \runexehelper.exe condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata. Logsource: windows / process_creation. Rule: title: HackTool - UACMe Akagi Execution id: d38d2fa4-98e6-4a24-aff1-410b0c9ad177 status: test description: Detects the execution of UACMe, a tool used for UAC bypasses, via default PE metadata references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems) date: 2021-08-30 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: process_creation product: windows detection: selection_pe: - Product: UACMe - Company: - REvol Corp - APT 92 - UG North - Hazardous Environments - CD Project Rekt - Description: - UACMe main module - Pentesting utility - OriginalFileName: - Akagi.exe - Akagi64.exe selection_img: Image|endswith: - \Akagi64.exe - \Akagi.exe selection_hashes_sysmon: Hashes|contains: - IMPHASH=767637C23BB42CD5D7397CF58B0BE688 - IMPHASH=14C4E4C72BA075E9069EE67F39188AD8 - IMPHASH=3C782813D4AFCE07BBFC5A9772ACDBDC - IMPHASH=7D010C6BB6A3726F327F7E239166D127 - IMPHASH=89159BA4DD04E4CE5559F132A9964EB3 - IMPHASH=6F33F4A5FC42B8CEC7314947BD13F30F - IMPHASH=5834ED4291BDEB928270428EBBAF7604 - IMPHASH=5A8A8A43F25485E7EE1B201EDCBC7A38 - IMPHASH=DC7D30B90B2D8ABF664FBED2B1B59894 - IMPHASH=41923EA1F824FE63EA5BEB84DB7A3E74 - IMPHASH=3DE09703C8E79ED2CA3F01074719906B condition: 1 of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to. Logsource: windows / process_creation. Rule: title: Whoami.EXE Execution With Output Option id: c30fb093-1109-4dc8-88a8-b30d11c95a5d status: test description: Detects the execution of "whoami.exe" with the "/FO" flag to choose CSV as output format or with redirection options to export the results to a file for later use. references: - https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/ - https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/ - https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 modified: 2023-12-04 tags: - attack.discovery - attack.t1033 - car.2016-03-001 logsource: category: process_creation product: windows detection: selection_main_img: - Image|endswith: \whoami.exe - OriginalFileName: whoami.exe selection_main_cli: CommandLine|contains: - ' /FO CSV' - ' -FO CSV' selection_special: CommandLine|contains: whoami*> condition: all of selection_main_* or selection_special falsepositives: - Unknown level: medium
Sigma rule: Potential threat actor tampering with Sysmon manifest and eventually disabling it. Logsource: windows / security. Rule: title: Sysmon Channel Reference Deletion id: 18beca67-ab3e-4ee3-ba7a-a46ca8d7d0cc status: test description: Potential threat actor tampering with Sysmon manifest and eventually disabling it references: - https://twitter.com/Flangvik/status/1283054508084473861 - https://twitter.com/SecurityJosh/status/1283027365770276866 - https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html - https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-07-14 modified: 2025-10-22 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: product: windows service: security detection: selection1: EventID: 4657 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational ObjectValueName: Enabled NewValue: 0 selection2: EventID: 4663 ObjectName|contains: - WINEVT\Publishers\{5770385f-c22a-43e0-bf4c-06f5698ffbd9} - WINEVT\Channels\Microsoft-Windows-Sysmon/Operational AccessMask: '0x10000' condition: 1 of selection* falsepositives: - Unknown level: high