alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExe. Logsource: windows / process_creation. Rule: title: HackTool - Impersonate Execution id: cf0c254b-22f1-4b2b-8221-e137b3c0af94 status: test description: Detects execution of the Impersonate tool. Which can be used to manipulate tokens on a Windows computers remotely (PsExec/WmiExec) or interactively references: - https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ - https://github.com/sensepost/impersonate author: Sai Prashanth Pulisetti @pulisettis date: 2022-12-21 modified: 2024-11-23 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.001 - attack.t1134.003 logsource: product: windows category: process_creation detection: selection_commandline_exe: CommandLine|contains: impersonate.exe selection_commandline_opt: CommandLine|contains: - ' list ' - ' exec ' - ' adduser ' selection_hash: Hashes|contains: - MD5=9520714AB576B0ED01D1513691377D01 - SHA256=E81CC96E2118DC4FBFE5BAD1604E0AC7681960143E2101E1A024D52264BB0A8A - IMPHASH=0A358FFC1697B7A07D0E817AC740DF62 condition: all of selection_commandline_* or selection_hash falsepositives: - Unknown level: medium
Sigma rule: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or. Logsource: windows / process_creation. Rule: title: Suspicious Redirection to Local Admin Share id: ab9e3b40-0c85-4ba1-aede-455d226fd124 status: test description: Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers references: - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html author: Florian Roth (Nextron Systems) date: 2022-01-16 modified: 2023-12-28 tags: - attack.exfiltration - attack.t1048 logsource: category: process_creation product: windows detection: selection_redirect: CommandLine|contains: '>' selection_share: CommandLine|contains: - \\\\127.0.0.1\\admin$\\ - \\\\localhost\\admin$\\ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects when a user downloads a file by using CertOC.exe. Logsource: windows / process_creation. Rule: title: File Download via CertOC.EXE id: 70ad0861-d1fe-491c-a45f-fa48148a300d related: - id: b86f6dea-0b2f-41f5-bdcc-a057bd19cd6a type: similar status: test description: Detects when a user downloads a file by using CertOC.exe references: - https://lolbas-project.github.io/lolbas/Binaries/Certoc/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-05-16 modified: 2023-10-18 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certoc.exe - OriginalFileName: CertOC.exe selection_cli: CommandLine|contains|all: - -GetCACAPS - http condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects when a process tries to access the memory of svchost to potentially dump credentials.. Logsource: windows / process_access. Rule: title: Credential Dumping Attempt Via Svchost id: 174afcfa-6e40-4ae9-af64-496546389294 status: test description: Detects when a process tries to access the memory of svchost to potentially dump credentials. references: - Internal Research author: Florent Labouyrie date: 2021-04-30 modified: 2022-10-09 tags: - attack.privilege-escalation - attack.t1548 logsource: product: windows category: process_access detection: selection: TargetImage|endswith: \svchost.exe GrantedAccess: '0x143a' filter_main_known_processes: SourceImage|endswith: - \services.exe - \msiexec.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects the modification of the PortProxy registry key which is used for port forwarding.. Logsource: windows / registry_event. Rule: title: New PortProxy Registry Entry Added id: a54f842a-3713-4b45-8c84-5f136fdebd3c status: test description: Detects the modification of the PortProxy registry key which is used for port forwarding. references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html - https://adepts.of0x.cc/netsh-portproxy-code/ - https://www.dfirnotes.net/portproxy_detection/ author: Andreas Hunkeler (@Karneades) date: 2021-06-22 modified: 2024-03-25 tags: - attack.lateral-movement - attack.command-and-control - attack.t1090 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: \Services\PortProxy\v4tov4\tcp\ condition: selection falsepositives: - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723) - Synergy Software KVM (https://symless.com/synergy) level: medium
Sigma rule: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which. Logsource: windows / file_event. Rule: title: Suspicious MSExchangeMailboxReplication ASPX Write id: 7280c9f3-a5af-45d0-916a-bc01cb4151c9 status: test description: Detects suspicious activity in which the MSExchangeMailboxReplication process writes .asp and .apsx files to disk, which could be a sign of ProxyShell exploitation references: - https://redcanary.com/blog/blackbyte-ransomware/ author: Florian Roth (Nextron Systems) date: 2022-02-25 tags: - attack.initial-access - attack.t1190 - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: \MSExchangeMailboxReplication.exe TargetFilename|endswith: - .aspx - .asp condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Cabinet File Expansion id: 9f107a84-532c-41af-b005-8d12a607639f status: test description: Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks references: - https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll - https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/ author: Bhabesh Raj, X__Junior (Nextron Systems) date: 2021-07-30 modified: 2024-11-13 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_cmd: Image|endswith: \expand.exe CommandLine|contains|windash: '-F:' selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\ProgramData - :\Users\Public\ - :\Windows\Temp\ - \Admin$\ - \AppData\Local\Temp\ - \AppData\Roaming\ - \C$\ - \Temporary Internet selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ filter_optional_dell: ParentImage: C:\Program Files (x86)\Dell\UpdateService\ServiceShell.exe CommandLine|contains: C:\ProgramData\Dell\UpdateService\Temp\ condition: selection_cmd and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - System administrator Usage level: medium
Sigma rule: Detects the use of Tor or Tor-Browser to connect to onion routing networks. Logsource: windows / process_creation. Rule: title: Tor Client/Browser Execution id: 62f7c9bf-9135-49b2-8aeb-1e54a6ecc13c status: test description: Detects the use of Tor or Tor-Browser to connect to onion routing networks references: - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/ author: frack113 date: 2022-02-20 modified: 2025-10-27 tags: - attack.command-and-control - attack.t1090.003 logsource: category: process_creation product: windows detection: selection: - Description: Tor Browser - Product: Tor Browser - Image|endswith: - \tor.exe - \Tor Browser\Browser\firefox.exe condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_tor_execution/info.yml
Sigma rule: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension.. Logsource: windows / process_creation. Rule: title: Suspicious Response File Execution Via Odbcconf.EXE id: 2d32dd6f-3196-4093-b9eb-1ad8ab088ca5 related: - id: 5f03babb-12db-4eec-8c82-7b4cb5580868 type: derived - id: 65d2be45-8600-4042-b4c0-577a1ff8a60e type: obsolete status: test description: Detects execution of "odbcconf" with the "-f" flag in order to load a response file with a non-".rsp" extension. references: - https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16 - https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/ - https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-22 modified: 2024-03-13 tags: - attack.stealth - attack.t1218.008 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \odbcconf.exe - OriginalFileName: odbcconf.exe selection_cli: CommandLine|contains|windash: ' -f ' filter_main_rsp_ext: CommandLine|contains: .rsp filter_main_runonce_odbc: ParentImage: C:\Windows\System32\runonce.exe Image: C:\Windows\System32\odbcconf.exe CommandLine|contains: .exe /E /F "C:\WINDOWS\system32\odbcconf.tmp" condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unlikely level: high
Sigma rule: Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP si. Logsource: windows / system. Rule: title: KrbRelayUp Service Installation id: e97d9903-53b2-41fc-8cb9-889ed4093e80 status: test description: Detects service creation from KrbRelayUp tool used for privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings) references: - https://github.com/Dec0ne/KrbRelayUp author: Sittikorn S, Tim Shelton date: 2022-05-11 modified: 2022-10-05 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: system detection: selection: EventID: 7045 ServiceName: KrbSCM condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be instal. Logsource: linux / auditd. Rule: title: Clipboard Collection with Xclip Tool - Auditd id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf status: test description: 'Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/ author: Pawel Mazur date: 2021-09-24 modified: 2022-11-26 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low
Sigma rule: Detects when a new owner is added to an application. This gives that account privileges to make modifications and config. Logsource: azure / auditlogs. Rule: title: Added Owner To Application id: 74298991-9fc4-460e-a92e-511aa60baec1 status: test description: Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#new-owner author: Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik' date: 2022-06-02 tags: - attack.t1552 - attack.credential-access logsource: product: azure service: auditlogs detection: selection: properties.message: Add owner to application condition: selection falsepositives: - When a new application owner is added by an administrator level: medium
Sigma rule: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a. Logsource: windows / process_creation. Rule: title: Potential Data Stealing Via Chromium Headless Debugging id: 3e8207c5-fcd2-4ea6-9418-15d45b4890e4 related: - id: b3d34dc5-2efd-4ae3-845f-8ec14921f449 type: derived status: test description: Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control references: - https://github.com/defaultnamehere/cookie_crimes/ - https://mango.pdf.zone/stealing-chrome-cookies-without-a-password - https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/ - https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-23 tags: - attack.credential-access - attack.collection - attack.stealth - attack.t1185 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - --remote-debugging- - --user-data-dir - --headless condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0. Logsource: windows / ps_classic_start. Rule: title: PowerShell Downgrade Attack - PowerShell id: 6331d09b-4785-4c13-980f-f96661356249 status: test description: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0 references: - http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/ author: Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements) date: 2017-03-22 modified: 2023-10-27 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_classic_start detection: selection: Data|contains: EngineVersion=2. filter_main: Data|contains: HostVersion=2. condition: selection and not filter_main falsepositives: - Unknown level: medium
Sigma rule: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring". Logsource: windows / windefend. Rule: title: Microsoft Defender Tamper Protection Trigger id: 49e5bc24-8b86-49f1-b743-535f332c2856 status: stable description: Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring" references: - https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection - https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide author: Bhabesh Raj, Nasreddine Bencherchali date: 2021-07-05 modified: 2022-12-06 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: windefend detection: selection: EventID: 5013 Value|endswith: - \Windows Defender\DisableAntiSpyware - \Windows Defender\DisableAntiVirus - \Windows Defender\Scan\DisableArchiveScanning - \Windows Defender\Scan\DisableScanningNetworkFiles - \Real-Time Protection\DisableRealtimeMonitoring - \Real-Time Protection\DisableBehaviorMonitoring - \Real-Time Protection\DisableIOAVProtection - \Real-Time Protection\DisableScriptScanning condition: selection falsepositives: - Administrator might try to disable defender features during testing (must be investigated) level: high
Sigma rule: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a netw. Logsource: windows / process_creation. Rule: title: Suspicious Scan Loop Network id: f8ad2e2c-40b6-4117-84d7-20b89896ab23 status: test description: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md - https://ss64.com/nt/for.html - https://ss64.com/ps/foreach-object.html author: frack113 date: 2022-03-12 tags: - attack.execution - attack.t1059 - attack.discovery - attack.t1018 logsource: category: process_creation product: windows detection: selection_loop: CommandLine|contains: - 'for ' - 'foreach ' selection_tools: CommandLine|contains: - nslookup - ping condition: all of selection_* falsepositives: - Legitimate script level: medium
Sigma rule: Detects potentially suspicious child processes of a ClickOnce deployment application. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of ClickOnce Application id: 67bc0e75-c0a9-4cfc-8754-84a505b63c04 status: test description: Detects potentially suspicious child processes of a ClickOnce deployment application references: - https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-12 tags: - attack.execution - attack.stealth logsource: category: process_creation product: windows detection: selection: ParentImage|contains: \AppData\Local\Apps\2.0\ Image|endswith: - \calc.exe - \cmd.exe - \cscript.exe - \explorer.exe - \mshta.exe - \net.exe - \net1.exe - \nltest.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \reg.exe - \regsvr32.exe - \rundll32.exe - \schtasks.exe - \werfault.exe - \wscript.exe condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files.. Logsource: windows / process_creation. Rule: title: Remote CHM File Download/Execution Via HH.EXE id: f57c58b3-ee69-4ef5-9041-455bf39aaa89 status: test description: Detects the usage of "hh.exe" to execute/download remotely hosted ".chm" files. references: - https://www.splunk.com/en_us/blog/security/follina-for-protocol-handlers.html - https://github.com/redcanaryco/atomic-red-team/blob/1cf4dd51f83dcb0ebe6ade902d6157ad2dbc6ac8/atomics/T1218.001/T1218.001.md - https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-29 modified: 2024-01-31 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: HH.exe - Image|endswith: \hh.exe selection_cli: CommandLine|contains: - http:// - https:// - \\\\ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto. Logsource: windows / file_access. Rule: title: Access To Crypto Currency Wallets By Uncommon Applications id: f41b0311-44f9-44f0-816d-dd45e39d4bc8 status: test description: 'Detects file access requests to crypto currency files by uncommon processes. Could indicate potential attempt of crypto currency wallet stealing. ' references: - Internal Research author: X__Junior (Nextron Systems) date: 2024-07-29 tags: - attack.t1003 - attack.credential-access logsource: category: file_access product: windows definition: 'Requirements: Microsoft-Windows-Kernel-File ETW provider' detection: selection: - FileName|contains: - \AppData\Roaming\Ethereum\keystore\ - \AppData\Roaming\EthereumClassic\keystore\ - \AppData\Roaming\monero\wallets\ - FileName|endswith: - \AppData\Roaming\Bitcoin\wallet.dat - \AppData\Roaming\BitcoinABC\wallet.dat - \AppData\Roaming\BitcoinSV\wallet.dat - \AppData\Roaming\DashCore\wallet.dat - \AppData\Roaming\DogeCoin\wallet.dat - \AppData\Roaming\Litecoin\wallet.dat - \AppData\Roaming\Ripple\wallet.dat - \AppData\Roaming\Zcash\wallet.dat filter_main_system: Image: System filter_main_generic: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\system32\ - C:\Windows\SysWOW64\ filter_optional_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\ Image|endswith: - \MpCopyAccelerator.exe - \MsMpEng.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Antivirus, Anti-Spyware, Anti-Malware Software - Backup software - Legitimate software installed on partitions other than "C:\" - Searching software such as "everything.exe" level: medium
Sigma rule: Detects process connections to a Monero crypto mining pool. Logsource: linux / network_connection. Rule: title: Linux Crypto Mining Pool Connections id: a46c93b7-55ed-4d27-a41b-c259456c4746 status: stable description: Detects process connections to a Monero crypto mining pool references: - https://www.poolwatch.io/coin/monero author: Florian Roth (Nextron Systems) date: 2021-10-26 tags: - attack.impact - attack.t1496 logsource: product: linux category: network_connection detection: selection: DestinationHostname: - pool.minexmr.com - fr.minexmr.com - de.minexmr.com - sg.minexmr.com - ca.minexmr.com - us-west.minexmr.com - pool.supportxmr.com - mine.c3pool.com - xmr-eu1.nanopool.org - xmr-eu2.nanopool.org - xmr-us-east1.nanopool.org - xmr-us-west1.nanopool.org - xmr-asia1.nanopool.org - xmr-jp1.nanopool.org - xmr-au1.nanopool.org - xmr.2miners.com - xmr.hashcity.org - xmr.f2pool.com - xmrpool.eu - pool.hashvault.pro - moneroocean.stream - monerocean.stream condition: selection falsepositives: - Legitimate use of crypto miners level: high
Sigma rule: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SA. Logsource: windows / ps_script. Rule: title: Winlogon Helper DLL id: 851c506b-6b7c-4ce2-8802-c703009d03c0 status: test description: 'Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete. Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md author: Timur Zinniatullin, oscd.community date: 2019-10-21 modified: 2022-07-07 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.004 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: CurrentVersion\Winlogon selection2: ScriptBlockText|contains: - Set-ItemProperty - New-Item condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects the execution of msiexec.exe from an uncommon directory. Logsource: windows / process_creation. Rule: title: Potential MsiExec Masquerading id: e22a6eb2-f8a5-44b5-8b44-a2dbd47b1144 status: test description: Detects the execution of msiexec.exe from an uncommon directory references: - https://twitter.com/200_okay_/status/1194765831911215104 author: Florian Roth (Nextron Systems) date: 2019-11-14 modified: 2023-02-21 tags: - attack.stealth - attack.t1036.005 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \msiexec.exe - OriginalFileName: \msiexec.exe filter: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ condition: selection and not filter falsepositives: - Unknown level: high