alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance. Logsource: windows / ps_module. Rule: title: Malicious PowerShell Scripts - PoshModule id: 41025fd7-0466-4650-a813-574aaacbe7f4 related: - id: f331aa1f-8c53-4fc3-b083-cc159bc971cb type: similar - id: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2 type: obsolete status: test description: Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance references: - https://github.com/PowerShellMafia/PowerSploit - https://github.com/NetSPI/PowerUpSQL - https://github.com/CsEnox/EventViewer-UACBypass - https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu - https://github.com/nettitude/Invoke-PowerThIEf - https://github.com/S3cur3Th1sSh1t/WinPwn - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1 - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-23 modified: 2025-12-10 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_generic: ContextInfo|contains: - Add-ConstrainedDelegationBackdoor.ps1 - Add-Exfiltration.ps1 - Add-Persistence.ps1 - Add-RegBackdoor.ps1 - Add-RemoteRegBackdoor.ps1 - Add-ScrnSaveBackdoor.ps1 - BadSuccessor.ps1 - Check-VM.ps1 - ConvertTo-ROT13.ps1 - Copy-VSS.ps1 - Create-MultipleSessions.ps1 - DNS_TXT_Pwnage.ps1 - dnscat2.ps1 - Do-Exfiltration.ps1 - DomainPasswordSpray.ps1 - Download_Execute.ps1 - Download-Execute-PS.ps1 - Enabled-DuplicateToken.ps1 - Enable-DuplicateToken.ps1 -
Sigma rule: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility. Logsource: macos / process_creation. Rule: title: Potential Persistence Via PlistBuddy id: 65d506d3-fcfe-4071-b4b2-bcefe721bbbb status: test description: Detects potential persistence activity using LaunchAgents or LaunchDaemons via the PlistBuddy utility references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://www.manpagez.com/man/8/PlistBuddy/ author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.001 - attack.t1543.004 logsource: category: process_creation product: macos detection: selection: Image|endswith: /PlistBuddy CommandLine|contains|all: - RunAtLoad - 'true' CommandLine|contains: - LaunchAgents - LaunchDaemons condition: selection falsepositives: - Unknown level: high
Sigma rule: TeamViewer_Desktop.exe is create during install. Logsource: windows / file_event. Rule: title: Installation of TeamViewer Desktop id: 9711de76-5d4f-4c50-a94f-21e4e8f8384d status: test description: TeamViewer_Desktop.exe is create during install references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-1---teamviewer-files-detected-test-on-windows author: frack113 date: 2022-01-28 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: \TeamViewer_Desktop.exe condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Ping/Copy Command Combination id: ded2b07a-d12f-4284-9b76-653e37b6c8b0 status: test description: 'Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2023-07-18 modified: 2024-03-06 tags: - attack.stealth - attack.t1070.004 logsource: category: process_creation product: windows detection: selection_cmd: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_action: CommandLine|contains|all: - ping - 'copy ' selection_cli_1: CommandLine|contains|windash: ' -n ' selection_cli_2: CommandLine|contains|windash: ' -y ' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based. Logsource: macos / process_creation. Rule: title: Suspicious MacOS Firmware Activity id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099 status: test description: Detects when a user manipulates with Firmward Password on MacOS. NOTE - this command has been disabled on silicon-based apple computers. references: - https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml - https://www.manpagez.com/man/8/firmwarepasswd/ - https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web author: Austin Songer @austinsonger date: 2021-09-30 modified: 2022-10-09 tags: - attack.impact logsource: category: process_creation product: macos detection: selection1: Image: /usr/sbin/firmwarepasswd CommandLine|contains: - setpasswd - full - delete - check condition: selection1 falsepositives: - Legitimate administration activities level: medium
Sigma rule: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes. Logsource: windows / process_creation. Rule: title: PUA- IOX Tunneling Tool Execution id: d7654f02-e04b-4934-9838-65c46f187ebc status: test description: Detects the use of IOX - a tool for port forwarding and intranet proxy purposes references: - https://github.com/EddieIvan01/iox author: Florian Roth (Nextron Systems) date: 2022-10-08 modified: 2024-11-23 tags: - attack.command-and-control - attack.t1090 logsource: category: process_creation product: windows detection: selection: Image|endswith: \iox.exe selection_commandline: CommandLine|contains: - '.exe fwd -l ' - '.exe fwd -r ' - '.exe proxy -l ' - '.exe proxy -r ' selection_hashes: Hashes|contains: - MD5=9DB2D314DD3F704A02051EF5EA210993 - SHA1=039130337E28A6623ECF9A0A3DA7D92C5964D8DD - SHA256=C6CF82919B809967D9D90EA73772A8AA1C1EB3BC59252D977500F64F1A0D6731 condition: 1 of selection* falsepositives: - Legitimate use level: high
Sigma rule: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permi. Logsource: windows / process_creation. Rule: title: Suspicious Recursive Takeown id: 554601fb-9b71-4bcc-abf4-21a611be4fde status: test description: Adversaries can interact with the DACLs using built-in Windows commands takeown which can grant adversaries higher permissions on specific files and folders references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.001/T1222.001.md#atomic-test-1---take-ownership-using-takeown-utility author: frack113 date: 2022-01-30 modified: 2022-11-21 tags: - attack.defense-impairment - attack.t1222.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: \takeown.exe CommandLine|contains|all: - '/f ' - /r condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: medium
Sigma rule: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID. Logsource: azure / signinlogs. Rule: title: Account Lockout id: 2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a status: test description: Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.credential-access - attack.t1110 logsource: product: azure service: signinlogs detection: selection: ResultType: 50053 condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. Logsource: windows / image_load. Rule: title: Potential SmadHook.DLL Sideloading id: 24b6cf51-6122-469e-861a-22974e9c1e5b status: test description: Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus references: - https://research.checkpoint.com/2023/malware-spotlight-camaro-dragons-tinynote-backdoor/ - https://www.qurium.org/alerts/targeted-malware-against-crph/ author: X__Junior (Nextron Systems) date: 2023-06-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: - \SmadHook32c.dll - \SmadHook64c.dll filter_main_legit_path: Image: - C:\Program Files (x86)\SMADAV\SmadavProtect32.exe - C:\Program Files (x86)\SMADAV\SmadavProtect64.exe - C:\Program Files\SMADAV\SmadavProtect32.exe - C:\Program Files\SMADAV\SmadavProtect64.exe ImageLoaded|startswith: - C:\Program Files (x86)\SMADAV\ - C:\Program Files\SMADAV\ condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Sigma rule: Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service. Logsource: windows / security. Rule: title: Password Change on Directory Service Restore Mode (DSRM) Account id: 53ad8e36-f573-46bf-97e4-15ba5bf4bb51 related: - id: b61e87c0-50db-4b2e-8986-6a2be94b33b0 type: similar status: stable description: 'Detects potential attempts made to set the Directory Services Restore Mode administrator password. The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password in order to obtain persistence. ' references: - https://adsecurity.org/?p=1714 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794 author: Thomas Patzke date: 2017-02-19 modified: 2020-08-23 tags: - attack.privilege-escalation - attack.persistence - attack.t1098 logsource: product: windows service: security detection: selection: EventID: 4794 condition: selection falsepositives: - Initial installation of a domain controller. level: high
Sigma rule: Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll,. Logsource: zeek / http. Rule: title: HTTP Request to Low Reputation TLD or Suspicious File Extension id: 68c2c604-92ad-468b-bf4a-aac49adad08c status: experimental description: 'Detects HTTP requests to low reputation TLDs (e.g. .xyz, .top, .ru) or ending in suspicious file extensions (.exe, .dll, .hta), which may indicate malicious activity. ' references: - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows - https://www.spamhaus.org/reputation-statistics/cctlds/domains/ author: '@signalblur, Corelight' date: 2025-02-26 tags: - attack.initial-access - attack.command-and-control logsource: product: zeek service: http detection: selection_suspicious_tld: host|endswith: - .bid - .by - .cf - .click - .cm - .ga - .gq - .ir - .kp - .loan - .ml - .mm - .party - .pw - .ru - .su - .sy - .tk - .top - .tv - .ve - .work - .xyz selection_malicious_ext: uri|endswith: - .bat - .bin - .cmd - .cpl - .dll - .dylib - .elf - .exe - .hta - .iso - .jar - .js - .lnk - .msi - .pif - .ps1 - .py - .reg - .scr - .sh - .so - .vbs - .wsf selection_malicious_mime: resp_mime_types: - application/vnd.microsoft.portable-executable - application/x-bat - application/x-dosexec - application/x-elf - application/x-iso9660-image - application/x-java-archive - application/x-ms-shortcut - application/x-msdos-program - application/x-msdownload - application/x-python-code - application/x-sh condition: selection_suspicious_tld and 1 of selection_malicious_* falsepositives: - Rare legitimate software downloads from low quality TLDs level: medium
Sigma rule: Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). U. Logsource: windows / pipe_created. Rule: title: ADFS Database Named Pipe Connection By Uncommon Tool id: 1ea13e8c-03ea-409b-877d-ce5c3d2c1cb3 status: test description: 'Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). Used to access information such as the AD FS configuration settings which contains sensitive information used to sign SAML tokens. ' references: - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml - https://o365blog.com/post/adfs/ - https://github.com/Azure/SimuLand author: Roberto Rodriguez @Cyb3rWard0g date: 2021-10-08 modified: 2023-11-30 tags: - attack.collection - attack.t1005 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName: \MICROSOFT##WID\tsql\query filter_main_generic: Image|endswith: - :\Windows\System32\mmc.exe - :\Windows\system32\svchost.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\mmc.exe - :\Windows\SysWOW64\wsmprovhost.exe - :\Windows\WID\Binn\sqlwriter.exe - \AzureADConnect.exe - \Microsoft.Identity.Health.Adfs.PshSurrogate.exe - \Microsoft.IdentityServer.ServiceHost.exe - \Microsoft.Tri.Sensor.exe - \sqlservr.exe - \tssdis.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects the execution of rundll32 with a command line that doesn't contain a common extension. Logsource: windows / process_creation. Rule: title: Rundll32 Execution With Uncommon DLL Extension id: c3a99af4-35a9-4668-879e-c09aeb4f2bdf status: test description: Detects the execution of rundll32 with a command line that doesn't contain a common extension references: - https://twitter.com/mrd0x/status/1481630810495139841?s=12 author: Tim Shelton, Florian Roth (Nextron Systems), Yassine Oukessou date: 2022-01-13 modified: 2024-04-04 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE filter_main_null: CommandLine: null filter_main_empty: CommandLine: '' filter_main_known_extension: - CommandLine|contains: - '.cpl ' - .cpl, - .cpl" - .cpl' - '.dll ' - .dll, - .dll" - .dll' - '.inf ' - .inf, - .inf" - .inf' - CommandLine|endswith: - .cpl - .dll - '.inf' filter_main_localserver: CommandLine|contains: ' -localserver ' filter_main_zzzzInvokeManagedCustomActionOutOfProc: ParentImage|endswith: \msiexec.exe CommandLine|contains|all: - :\Windows\Installer\ - .tmp - zzzzInvokeManagedCustomActionOutOfProc filter_optional_EdgeUpdate: ParentCommandLine|contains|all: - :\Users\ - \AppData\Local\Microsoft\EdgeUpdate\Install\{ - \EDGEMITMP_ - .tmp\setup.exe - --install-archive= - --previous-version= - --msedgewebview --verbose-logging --do-not-launch-msedge --user-level condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: medium
Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: linux / process_creation. Rule: title: Decode Base64 Encoded Text id: e2072cab-8c9a-459b-b63c-40ae79e27031 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2021-11-27 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: linux detection: selection: Image|endswith: /base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Sigma rule: Detects when an ElastiCache security group has been created.. Logsource: aws / cloudtrail. Rule: title: AWS ElastiCache Security Group Created id: 4ae68615-866f-4304-b24b-ba048dfa5ca7 status: test description: Detects when an ElastiCache security group has been created. references: - https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.persistence - attack.t1136 - attack.t1136.003 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticache.amazonaws.com eventName: CreateCacheSecurityGroup condition: selection falsepositives: - A ElastiCache security group may be created by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security group creations from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Sigma rule: Detects instances where an SSH service on an OpenCanary node has had a connection attempt.. Logsource: opencanary / application. Rule: title: OpenCanary - SSH New Connection Attempt id: cd55f721-5623-4663-bd9b-5229cab5237d status: test description: Detects instances where an SSH service on an OpenCanary node has had a connection attempt. references: - https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration - https://github.com/thinkst/opencanary/blob/a0896adfcaf0328cfd5829fe10d2878c7445138e/opencanary/logger.py#L52 author: Security Onion Solutions date: 2024-03-08 tags: - attack.privilege-escalation - attack.initial-access - attack.lateral-movement - attack.persistence - attack.stealth - attack.t1133 - attack.t1021 - attack.t1078 logsource: category: application product: opencanary detection: selection: logtype: 4000 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects rundll32 loading a renamed comsvcs.dll to dump process memory. Logsource: windows / image_load. Rule: title: Suspicious Renamed Comsvcs DLL Loaded By Rundll32 id: 8cde342c-ba48-4b74-b615-172c330f2e93 status: test description: Detects rundll32 loading a renamed comsvcs.dll to dump process memory references: - https://twitter.com/sbousseaden/status/1555200155351228419 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-14 modified: 2023-02-17 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \rundll32.exe Hashes|contains: - IMPHASH=eed93054cb555f3de70eaa9787f32ebb - IMPHASH=5e0dbdec1fce52daae251a110b4f309d - IMPHASH=eadbccbb324829acb5f2bbe87e5549a8 - IMPHASH=407ca0f7b523319d758a40d7c0193699 - IMPHASH=281d618f4e6271e527e6386ea6f748de filter: ImageLoaded|endswith: \comsvcs.dll condition: selection and not filter falsepositives: - Unlikely level: high
Sigma rule: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attac. Logsource: windows / process_creation. Rule: title: HackTool - CreateMiniDump Execution id: 36d88494-1d43-4dc0-b3fa-35c8fea0ca9d status: test description: Detects the use of CreateMiniDump hack tool used to dump the LSASS process memory for credential extraction on the attacker's machine references: - https://ired.team/offensive-security/credential-access-and-credential-dumping/dumping-lsass-passwords-without-mimikatz-minidumpwritedump-av-signature-bypass author: Florian Roth (Nextron Systems) date: 2019-12-22 modified: 2024-11-23 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \CreateMiniDump.exe - Hashes|contains: IMPHASH=4a07f944a83e8a7c2525efa35dd30e2f condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects remote RPC calls to create or execute a scheduled task via ATSvc. Logsource: rpc_firewall / application. Rule: title: Remote Schedule Task Lateral Movement via ATSvc id: 0fcd1c79-4eeb-4746-aba9-1b458f7a79cb status: test description: Detects remote RPC calls to create or execute a scheduled task via ATSvc references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.privilege-escalation - attack.lateral-movement - attack.execution - attack.persistence - attack.t1053 - attack.t1053.002 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:1ff70682-0a51-30e8-076d-740be8cee98b"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 1ff70682-0a51-30e8-076d-740be8cee98b OpNum: - 0 - 1 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the image load of VSS DLL by uncommon executables. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy Vssapi.dll Load id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 related: - id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 type: similar - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar status: test description: Detects the image load of VSS DLL by uncommon executables references: - https://github.com/ORCx41/DeleteShadowCopies author: frack113 date: 2022-10-31 modified: 2026-05-18 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vssapi.dll filter_main_windows: - Image: - C:\Windows\explorer.exe - C:\Windows\ImmersiveControlPanel\SystemSettings.exe - Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\Temp\{ - C:\Windows\WinSxS\ - C:\$WinREAgent\Scratch\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_null_image: Image: null filter_optional_programdata_packagecache: Image|startswith: C:\ProgramData\Package Cache\ filter_optional_avira: Image|contains|all: - \temp\is- - \avira_system_speedup.tmp condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high