alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder. Logsource: windows / registry_set. Rule: title: Registry Persistence via Explorer Run Key id: b7916c2a-fa2f-4795-9477-32b731f70f11 status: test description: Detects a possible persistence mechanism using RUN key for Windows Explorer and pointing to a suspicious folder references: - https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/ author: Florian Roth (Nextron Systems), oscd.community date: 2018-07-18 modified: 2023-12-11 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Details|contains: - :\$Recycle.bin\ - :\ProgramData\ - :\Temp\ - :\Users\Default\ - :\Users\Public\ - :\Windows\Temp\ - \AppData\Local\Temp\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects potential persistence using Appx DebugPath. Logsource: windows / registry_set. Rule: title: Potential Persistence Using DebugPath id: df4dc653-1029-47ba-8231-3c44238cc0ae status: test description: Detects potential persistence using Appx DebugPath references: - https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/ - https://github.com/rootm0s/WinPwnage author: frack113 date: 2022-07-27 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.015 logsource: category: registry_set product: windows detection: selection_debug: TargetObject|contains: Classes\ActivatableClasses\Package\Microsoft. TargetObject|endswith: \DebugPath selection_default: TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\PackagedAppXDebug\Microsoft. TargetObject|endswith: \(Default) condition: 1 of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects a BITS transfer job downloading file(s) from a direct IP address.. Logsource: windows / bits-client. Rule: title: BITS Transfer Job Download From Direct IP id: 90f138c1-f578-4ac3-8c49-eecfd847c8b7 related: - id: 99c840f2-2012-46fd-9141-c761987550ef type: similar status: test description: Detects a BITS transfer job downloading file(s) from a direct IP address. references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ - https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 modified: 2023-03-27 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 logsource: product: windows service: bits-client detection: selection: EventID: 16403 RemoteName|contains: - http://1 - http://2 - http://3 - http://4 - http://5 - http://6 - http://7 - http://8 - http://9 - https://1 - https://2 - https://3 - https://4 - https://5 - https://6 - https://7 - https://8 - https://9 filter_optional_local_networks: RemoteName|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. filter_optional_seven_zip: RemoteName|contains: - https://7- - http://7- condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by m. Logsource: windows / process_creation. Rule: title: Greedy File Deletion Using Del id: 204b17ae-4007-471b-917b-b917b315c5db status: test description: Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence. references: - https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase author: frack113 , X__Junior (Nextron Systems) date: 2021-12-02 modified: 2023-09-11 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_del: CommandLine|contains: - 'del ' - 'erase ' selection_extensions: CommandLine|contains: - \\\*.au3 - \\\*.dll - \\\*.exe - \\\*.js condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects the creation of a macro file for Outlook.. Logsource: windows / file_event. Rule: title: New Outlook Macro Created id: 8c31f563-f9a7-450c-bfa8-35f8f32f1f61 related: - id: 117d3d3a-755c-4a61-b23e-9171146d094c type: derived status: test description: Detects the creation of a macro file for Outlook. references: - https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/ author: '@ScoubiMtl' date: 2021-04-05 modified: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.command-and-control - attack.t1137 - attack.t1008 - attack.t1546 logsource: category: file_event product: windows detection: selection: Image|endswith: \outlook.exe TargetFilename|endswith: \Microsoft\Outlook\VbaProject.OTM condition: selection falsepositives: - User genuinely creates a VB Macro for their email level: medium
Sigma rule: Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and. Logsource: windows / ps_script. Rule: title: Potential Suspicious Windows Feature Enabled id: 55c925c1-7195-426b-a136-a9396800e29b related: - id: c740d4cf-a1e9-41de-bb16-8a46a4f57918 type: similar status: test description: 'Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool. Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images ' references: - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system - https://learn.microsoft.com/en-us/windows/wsl/install-on-server author: frack113 date: 2022-09-10 modified: 2022-12-29 tags: - attack.stealth logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Enable-WindowsOptionalFeature - -Online - -FeatureName selection_feature: ScriptBlockText|contains: - TelnetServer - Internet-Explorer-Optional-amd64 - TFTP - SMB1Protocol - Client-ProjFS - Microsoft-Windows-Subsystem-Linux condition: all of selection_* falsepositives: - Legitimate usage of the features listed in the rule. level: medium
Sigma rule: Monitor and alert for Bitlocker key retrieval.. Logsource: azure / auditlogs. Rule: title: Bitlocker Key Retrieval id: a0413867-daf3-43dd-9245-734b3a787942 status: test description: Monitor and alert for Bitlocker key retrieval. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval author: Michael Epping, '@mepples21' date: 2022-06-28 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: Category: KeyManagement OperationName: Read BitLocker key condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects Windows update errors including installation failures and connection issues. Defenders should observe this in ca. Logsource: windows / system. Rule: title: Windows Update Error id: 13cfeb75-9e33-4d04-b0f7-ab8faaa95a59 status: stable description: 'Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren''t installed. ' references: - https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml author: frack113 date: 2021-12-04 modified: 2023-09-07 tags: - attack.impact - attack.resource-development - attack.t1584 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-WindowsUpdateClient EventID: - 16 - 20 - 24 - 213 - 217 condition: selection falsepositives: - Unknown level: informational
Sigma rule: Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfi. Logsource: aws / cloudtrail. Rule: title: AWS User Login Profile Was Modified id: 055fb148-60f8-462d-ad16-26926ce050f1 status: test description: 'Detects activity when someone is changing passwords on behalf of other users. An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. ' references: - https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation author: toffeebr33k date: 2021-08-09 modified: 2024-04-26 tags: - attack.persistence - attack.privilege-escalation - attack.t1098 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: UpdateLoginProfile filter_main_user_identity: userIdentity.arn|fieldref: requestParameters.userName condition: selection and not 1 of filter_main_* falsepositives: - Legitimate user account administration level: high
Sigma rule: Detects the creation of doas.conf file in linux host platform.. Logsource: linux / file_event. Rule: title: Linux Doas Conf File Creation id: 00eee2a5-fdb0-4746-a21d-e43fbdea5681 status: stable description: Detects the creation of doas.conf file in linux host platform. references: - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/ - https://www.makeuseof.com/how-to-install-and-use-doas/ author: Sittikorn S, Teoderick Contreras date: 2022-01-20 modified: 2022-12-31 tags: - attack.privilege-escalation - attack.t1548 logsource: product: linux category: file_event detection: selection: TargetFilename|endswith: /etc/doas.conf condition: selection falsepositives: - Unlikely level: medium
Sigma rule: Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager. Logsource: windows / image_load. Rule: title: Potential RoboForm.DLL Sideloading id: f64c9b2d-b0ad-481d-9d03-7fc75020892a status: test description: Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager references: - https://twitter.com/StopMalvertisin/status/1648604148848549888 - https://twitter.com/t3ft3lb/status/1656194831830401024 - https://www.roboform.com/ author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-05-14 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \roboform.dll - \roboform-x64.dll filter_main_path: Image|startswith: - ' C:\Program Files (x86)\Siber Systems\AI RoboForm\' - ' C:\Program Files\Siber Systems\AI RoboForm\' Image|endswith: - \robotaskbaricon.exe - \robotaskbaricon-x64.exe condition: selection and not 1 of filter_main_* falsepositives: - If installed on a per-user level, the path would be located in "AppData\Local". Add additional filters to reflect this mode of installation level: medium
Sigma rule: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for re. Logsource: linux / process_creation. Rule: title: Print History File Contents id: d7821ff1-4527-4e33-9f84-d0d57fa2fb66 status: test description: Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance references: - https://github.com/sleventyeleven/linuxprivchecker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2022-09-15 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /head - /tail - /more selection_history: - CommandLine|contains: - /.bash_history - /.zsh_history - CommandLine|endswith: - _history - .history - zhistory condition: all of selection* falsepositives: - Legitimate administration activities level: medium
Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / process_creation. Rule: title: Folder Compress To Potentially Suspicious Output Via Compress-Archive Cmdlet id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 related: - id: 71ff406e-b633-4989-96ec-bc49d825a412 type: similar - id: daf7eb81-35fd-410d-9d7a-657837e602bb type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2022-10-09 tags: - attack.collection - attack.t1074.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium
Sigma rule: This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health A. Logsource: azure / activitylogs. Rule: title: Azure Active Directory Hybrid Health AD FS Service Delete id: 48739819-8230-4ee3-a8ea-e0289d1fb0ff status: test description: 'This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant. A threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs. The health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure. ' references: - https://o365blog.com/post/hybridhealthagent/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-08-26 modified: 2023-10-11 tags: - attack.defense-impairment - attack.t1578.003 logsource: product: azure service: activitylogs detection: selection: CategoryValue: Administrative ResourceProviderValue: Microsoft.ADHybridHealthService ResourceId|contains: AdFederationService OperationNameValue: Microsoft.ADHybridHealthService/services/delete condition: selection falsepositives: - Legitimate AAD Health AD FS service instances being deleted in a tenant level: medium
Sigma rule: Detects remote thread creation from CACTUSTORCH as described in references.. Logsource: windows / create_remote_thread. Rule: title: HackTool - CACTUSTORCH Remote Thread Creation id: 2e4e488a-6164-4811-9ea1-f960c7359c40 status: test description: Detects remote thread creation from CACTUSTORCH as described in references. references: - https://twitter.com/SBousseaden/status/1090588499517079552 - https://github.com/mdsecactivebreach/CACTUSTORCH author: '@SBousseaden (detection), Thomas Patzke (rule)' date: 2019-02-01 modified: 2023-05-05 tags: - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1055.012 - attack.t1059.005 - attack.t1059.007 - attack.t1218.005 logsource: product: windows category: create_remote_thread detection: selection: SourceImage|endswith: - \System32\cscript.exe - \System32\wscript.exe - \System32\mshta.exe - \winword.exe - \excel.exe TargetImage|contains: \SysWOW64\ StartModule: null condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects execution of AppleScript of the macOS scripting language AppleScript.. Logsource: macos / process_creation. Rule: title: MacOS Scripting Interpreter AppleScript id: 1bc2e6c5-0885-472b-bed6-be5ea8eace55 status: test description: Detects execution of AppleScript of the macOS scripting language AppleScript. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md - https://redcanary.com/blog/applescript/ author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2026-05-21 tags: - attack.execution - attack.t1059.002 logsource: category: process_creation product: macos detection: selection: Image|endswith: /osascript CommandLine|contains: - ' -e ' - .scpt - .js filter_optional_opencode: ParentImage|endswith: opencode CommandLine|contains|all: - osascript - ' -e ' - set imageData to the clipboard - set fileRef condition: selection and not 1 of filter_optional_* falsepositives: - Application installers might contain scripts as part of the installation process. level: medium
Sigma rule: Detects a service installed by a client which has PID 0 or whose parent has PID 0. Logsource: windows / security. Rule: title: Service Installed By Unusual Client - Security id: c4e92a97-a9ff-4392-9d2d-7a4c642768ca related: - id: 71c276aa-49cd-43d2-b920-2dcd3e6962d5 type: similar status: test description: Detects a service installed by a client which has PID 0 or whose parent has PID 0 references: - https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html - https://www.x86matthew.com/view_post?id=create_svc_rpc - https://twitter.com/SBousseaden/status/1490608838701166596 author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-15 modified: 2023-01-04 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: service: security product: windows definition: 'Requirements: The System Security Extension audit subcategory need to be enabled to log the EID 4697' detection: selection_eid: EventID: 4697 selection_pid: - ClientProcessId: 0 - ParentProcessId: 0 condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option. Logsource: macos / process_creation. Rule: title: Hidden User Creation id: b22a5b36-2431-493a-8be1-0bae56c28ef3 status: test description: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-10 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: macos detection: dscl_create: Image|endswith: /dscl CommandLine|contains: create id_below_500: CommandLine|contains: UniqueID CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2}) ishidden_option_declaration: CommandLine|contains: IsHidden ishidden_option_confirmation: CommandLine|contains: - 'true' - 'yes' - '1' condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation) falsepositives: - Legitimate administration activities level: medium
Sigma rule: This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this com. Logsource: windows / security. Rule: title: Denied Access To Remote Desktop id: 8e5c03fa-b7f0-11ea-b242-07e0576828d9 status: test description: 'This event is generated when an authenticated user who is not allowed to log on remotely attempts to connect to this computer through Remote Desktop. Often, this event can be generated by attackers when searching for available windows servers in the network. ' references: - https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4825 author: Pushkarev Dmitry date: 2020-06-27 modified: 2021-11-27 tags: - attack.lateral-movement - attack.t1021.001 logsource: product: windows service: security detection: selection: EventID: 4825 condition: selection falsepositives: - Valid user was not added to RDP group level: medium
Sigma rule: Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc.. Logsource: windows / file_event. Rule: title: HackTool - Mimikatz Kirbi File Creation id: 9e099d99-44c2-42b6-a6d8-54c3545cab29 related: - id: 034affe8-6170-11ec-844f-0f78aa0c4d66 type: obsolete status: test description: Detects the creation of files created by mimikatz such as ".kirbi", "mimilsa.log", etc. references: - https://cobalt.io/blog/kerberoast-attack-techniques - https://pentestlab.blog/2019/10/21/persistence-security-support-provider/ author: Florian Roth (Nextron Systems), David ANDRE date: 2021-11-08 modified: 2024-06-27 tags: - attack.credential-access - attack.t1558 logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - .kirbi - mimilsa.log condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Detects usage of "find" binary in a suspicious manner to perform discovery. Logsource: linux / process_creation. Rule: title: Potential Discovery Activity Using Find - Linux id: 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf related: - id: 85de3a19-b675-4a51-bfc6-b11a5186c971 type: similar status: test description: Detects usage of "find" binary in a suspicious manner to perform discovery references: - https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-28 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: linux detection: selection: Image|endswith: /find CommandLine|contains: - -perm -4000 - -perm -2000 - -perm 0777 - -perm -222 - -perm -o w - -perm -o x - -perm -u=s - -perm -g=s condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".. Logsource: linux / process_creation. Rule: title: Linux Package Uninstall id: 95d61234-7f56-465c-6f2d-b562c6fedbc4 status: test description: Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg". references: - https://sysdig.com/blog/mitre-defense-evasion-falco - https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command - https://linuxhint.com/uninstall_yum_package/ - https://linuxhint.com/uninstall-debian-packages/ author: Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems) date: 2023-03-09 tags: - attack.stealth - attack.t1070 logsource: product: linux category: process_creation detection: selection_yum: Image|endswith: /yum CommandLine|contains: - erase - remove selection_apt: Image|endswith: - /apt - /apt-get CommandLine|contains: - remove - purge selection_dpkg: Image|endswith: /dpkg CommandLine|contains: - '--remove ' - ' -r ' selection_rpm: Image|endswith: /rpm CommandLine|contains: ' -e ' condition: 1 of selection_* falsepositives: - Administrator or administrator scripts might delete packages for several reasons (debugging, troubleshooting). level: low