alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container. Logsource: kubernetes / application / audit. Rule: title: Potential Sidecar Injection Into Running Deployment id: ad9012a6-e518-4432-9890-f3b82b8fc71f status: test description: 'Detects attempts to inject a sidecar container into a running deployment. A sidecar container is an additional container within a pod, that resides alongside the main container. One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation. By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster. ' references: - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/ author: Leo Tsaousis (@laripping) date: 2024-03-26 tags: - attack.t1609 - attack.execution logsource: category: application product: kubernetes service: audit detection: selection: verb: patch apiGroup: apps objectRef.resource: deployments condition: selection falsepositives: - Unknown level: medium
Sigma rule: Identifies an event where there are there are too many accounts assigned the Global Administrator role.. Logsource: azure / pim. Rule: title: Too Many Global Admins id: 7bbc309f-e2b1-4eb1-8369-131a367d67d3 status: test description: Identifies an event where there are there are too many accounts assigned the Global Administrator role. references: - https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-14 tags: - attack.initial-access - attack.stealth - attack.t1078 - attack.persistence - attack.privilege-escalation logsource: product: azure service: pim detection: selection: riskEventType: tooManyGlobalAdminsAssignedToTenantAlertIncident condition: selection falsepositives: - Investigate if threshold setting in PIM is too low. level: high
Sigma rule: Detects the pattern of a UAC bypass using Windows Event Viewer. Logsource: windows / file_event. Rule: title: UAC Bypass Using EventVwr id: 63e4f530-65dc-49cc-8f80-ccfa95c69d43 status: test description: Detects the pattern of a UAC bypass using Windows Event Viewer references: - https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw - https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g - https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute author: Antonio Cocomazzi (idea), Florian Roth (Nextron Systems) date: 2022-04-27 modified: 2022-11-22 tags: - attack.privilege-escalation - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|endswith: - \Microsoft\Event Viewer\RecentViews - \Microsoft\EventV~1\RecentViews filter: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog,. Logsource: windows / process_creation. Rule: title: Script Interpreter Spawning Credential Scanner - Windows id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 related: - id: f0025a69-e1b7-4dda-a53c-db21fa2d4071 type: similar status: experimental description: 'Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign. ' references: - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-25 tags: - attack.credential-access - attack.t1552 - attack.collection - attack.execution - attack.t1005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: - \node.exe - \bun.exe selection_child: - Image|endswith: - trufflehog.exe - gitleaks.exe - CommandLine|contains: - trufflehog - gitleaks condition: all of selection_* falsepositives: - Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check. level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_script_interpretor_spawn_credential_scanner/info.yml
Sigma rule: Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspiciou. Logsource: linux. Rule: title: Potential Suspicious BPF Activity - Linux id: 0fadd880-6af3-4610-b1e5-008dc3a11b8a status: test description: Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system. references: - https://redcanary.com/blog/ebpf-malware/ - https://man7.org/linux/man-pages/man7/bpf-helpers.7.html author: Red Canary (idea), Nasreddine Bencherchali date: 2023-01-25 tags: - attack.persistence - attack.stealth logsource: product: linux detection: selection: - bpf_probe_write_user condition: selection falsepositives: - Unknown level: high
Sigma rule: Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Using Coregen.exe id: 0fa66f66-e3f6-4a9c-93f8-4f2610b00171 status: test description: Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/ author: frack113 date: 2022-12-31 tags: - attack.privilege-escalation - attack.stealth - attack.t1218 - attack.t1055 logsource: category: image_load product: windows detection: selection: Image|endswith: \coregen.exe filter_main_legit_paths: ImageLoaded|startswith: - C:\Program Files (x86)\Microsoft Silverlight\ - C:\Program Files\Microsoft Silverlight\ - C:\Windows\System32\ - C:\Windows\SysWOW64\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects user data export activity.. Logsource: bitbucket / audit. Rule: title: Bitbucket User Details Export Attempt Detected id: 5259cbf2-0a75-48bf-b57a-c54d6fabaef3 status: test description: Detects user data export activity. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://support.atlassian.com/security-and-access-policies/docs/export-user-accounts author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.collection - attack.reconnaissance - attack.discovery - attack.t1213 - attack.t1082 - attack.t1591.004 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Users and groups auditType.action: - User permissions export failed - User permissions export started - User permissions exported condition: selection falsepositives: - Legitimate user activity. level: medium
Sigma rule: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN. Logsource: windows / security. Rule: title: Password Dumper Activity on LSASS id: aa1697b7-d611-4f9a-9cb2-5125b4ccfd5c status: test description: Detects process handle on LSASS process with certain access mask and object type SAM_DOMAIN references: - https://twitter.com/jackcr/status/807385668833968128 author: sigma date: 2017-02-12 modified: 2022-10-09 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows service: security detection: selection: EventID: 4656 ProcessName|endswith: \lsass.exe AccessMask: '0x705' ObjectType: SAM_DOMAIN condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects usage of Dsacls to grant over permissive permissions. Logsource: windows / process_creation. Rule: title: Potentially Over Permissive Permissions Granted Using Dsacls.EXE id: 01c42d3c-242d-4655-85b2-34f1739632f7 status: test description: Detects usage of Dsacls to grant over permissive permissions references: - https://ss64.com/nt/dsacls.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsacls.exe - OriginalFileName: DSACLS.EXE selection_flag: CommandLine|contains: ' /G ' selection_permissions: CommandLine|contains: - GR - GE - GW - GA - WP - WD condition: all of selection_* falsepositives: - Legitimate administrators granting over permissive permissions to users level: medium
Sigma rule: Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspici. Logsource: windows / process_creation. Rule: title: Potential LSASS Process Dump Via Procdump id: 5afee48e-67dd-4e03-a783-f74259dcf998 status: stable description: 'Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump. This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers. LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory. Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/procdump - https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 - https://x.com/wietze/status/1958302556033065292?s=12 author: Florian Roth (Nextron Systems) date: 2018-10-30 modified: 2025-10-19 tags: - attack.stealth - attack.t1036 - attack.credential-access - attack.t1003.001 - car.2013-05-009 logsource: category: process_creation product: windows detection: selection_flags: CommandLine|contains|windash: - ' -ma ' - ' -mm ' - ' -mp ' selection_process: CommandLine|contains: - ' ls' - ' keyiso' - ' samss' condition: all of selection_* falsepositives: - Unlikely, because no one should dump an lsass process memory - Another tool that uses command line flags similar to ProcDump level: high
Sigma rule: Detects Windows PowerShell Web Access. Logsource: proxy. Rule: title: Windows PowerShell User Agent id: c8557060-9221-4448-8794-96320e6f3e74 status: test description: Detects Windows PowerShell Web Access references: - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest author: Florian Roth (Nextron Systems) date: 2017-03-13 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent|contains: ' WindowsPowerShell/' condition: selection falsepositives: - Administrative scripts that download files from the Internet - Administrative scripts that retrieve certain website contents level: medium
Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - ScreenConnect Execution id: 57bff678-25d1-4d6c-8211-8ca106d12053 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-5---screenconnect-application-download-and-install-on-windows author: frack113 date: 2022-02-13 modified: 2023-03-05 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: - Description: ScreenConnect Service - Product: ScreenConnect - Company: ScreenConnect Software condition: selection falsepositives: - Legitimate usage of the tool level: medium
Sigma rule: Detects unauthorized access attempts to a resource.. Logsource: bitbucket / audit. Rule: title: Bitbucket Unauthorized Access To A Resource id: 7215374a-de4f-4b33-8ba5-70804c9251d3 status: test description: Detects unauthorized access attempts to a resource. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.resource-development - attack.t1586 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Security auditType.action: Unauthorized access to a resource condition: selection falsepositives: - Access attempts to non-existent repositories or due to outdated plugins. Usually "Anonymous" user is reported in the "author.name" field in most cases. level: critical
Sigma rule: Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in. Logsource: windows / process_creation. Rule: title: Wusa.EXE Executed By Parent Process Located In Suspicious Location id: ef64fc9c-a45e-43cc-8fd8-7d75d73b4c99 status: test description: 'Detects execution of the "wusa.exe" (Windows Update Standalone Installer) utility by a parent process that is located in a suspicious location. Attackers could instantiate an instance of "wusa.exe" in order to bypass User Account Control (UAC). They can duplicate the access token from "wusa.exe" to gain elevated privileges. ' references: - https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document author: X__Junior (Nextron Systems) date: 2023-11-26 modified: 2024-08-15 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \wusa.exe selection_paths_1: ParentImage|contains: - :\Perflogs\ - :\Users\Public\ - :\Windows\Temp\ - \Appdata\Local\Temp\ - \Temporary Internet selection_paths_2: - ParentImage|contains|all: - :\Users\ - \Favorites\ - ParentImage|contains|all: - :\Users\ - \Favourites\ - ParentImage|contains|all: - :\Users\ - \Contacts\ - ParentImage|contains|all: - :\Users\ - \Pictures\ filter_main_msu: CommandLine|contains: .msu condition: selection_img and 1 of selection_paths_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application.. Logsource: windows / security. Rule: title: Suspicious Teams Application Related ObjectAcess Event id: 25cde13e-8e20-4c29-b949-4e795b76f16f status: test description: Detects an access to authentication tokens and accounts of Microsoft Teams desktop application. references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 tags: - attack.credential-access - attack.t1528 logsource: product: windows service: security detection: selection: EventID: 4663 ObjectName|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter: ProcessName|contains: \Microsoft\Teams\current\Teams.exe condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissio. Logsource: linux / process_creation. Rule: title: Chmod Targeting Sensitive Directories id: 6419afd1-3742-47a5-a7e6-b50386cd15f8 status: test description: 'Detects chmod targeting files in sensitive directory paths on Linux systems. Attackers may use chmod to change permissions of files in these directories to maintain persistence, escalate privileges, or disrupt system operations. ' references: - https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/ - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-03 modified: 2026-03-18 tags: - attack.defense-impairment - attack.t1222.002 logsource: product: linux category: process_creation detection: selection: Image|endswith: /chmod CommandLine|contains: - /tmp/ - /.Library/ - /etc/ - /opt/ filter_main_update_shells: CommandLine|contains: chmod --reference=/etc/shells ParentCommandLine|endswith: /update-shells filter_main_postinst: CommandLine|contains: /etc/ ParentCommandLine|contains|all: - /var/lib/dpkg/info/ - .postinst configure filter_main_apt_key: CommandLine|startswith: chmod 700 /tmp/apt-key-gpghome. filter_main_mkinitramfs: CommandLine|startswith: chmod 755 /var/tmp/mkinitramfs filter_main_landscape: CommandLine: chmod 0775 /etc/landscape/ filter_main_ubuntu_apparmor: CommandLine: chmod 644 /etc/apparmor.d/tunables/home.d/ubuntu condition: selection and not 1 of filter_main_* falsepositives: - Some false positives are to be expected. Apply additional filters as needed before pushing to production. level: medium
Sigma rule: Detects some Empire PowerShell UAC bypass methods. Logsource: windows / process_creation. Rule: title: HackTool - Empire PowerShell UAC Bypass id: 3268b746-88d8-4cd3-bffc-30077d02c787 status: stable description: Detects some Empire PowerShell UAC bypass methods references: - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64 - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-FodHelperBypass.ps1#L64 author: Ecco date: 2019-08-30 modified: 2023-02-21 tags: - attack.privilege-escalation - attack.t1548.002 - car.2019-04-001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ' -NoP -NonI -w Hidden -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update)' - ' -NoP -NonI -c $x=$((gp HKCU:Software\Microsoft\Windows Update).Update);' condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct dat. Logsource: windows / process_creation. Rule: title: Delete Important Scheduled Task id: dbc1f800-0fe0-4bc0-9c66-292c2abe3f78 related: - id: 9e3cb244-bdb8-4632-8c90-6079c8f4f16d type: similar - id: 7595ba94-cf3b-4471-aa03-4f6baa9e5fad type: similar status: test description: Detects when adversaries stop services or processes by deleting their respective scheduled tasks in order to conduct data destructive activities references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 modified: 2026-03-11 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli_delete: CommandLine|contains|windash: /delete selection_cli_task: CommandLine|contains: - \Windows\BitLocker - \Windows\ExploitGuard - \Windows\SystemRestore\SR - \Windows\UpdateOrchestrator\ - \Windows\Windows Defender\ - \Windows\WindowsBackup\ - \Windows\WindowsUpdate\ condition: all of selection_* falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_schtasks_delete/info.yml
Sigma rule: Detects possible command execution by web application/web shell. Logsource: linux / auditd. Rule: title: Webshell Remote Command Execution id: c0d3734d-330f-4a03-aae2-65dacc6a8222 status: test description: Detects possible command execution by web application/web shell references: - Personal Experience of the Author - https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/ author: Ilyas Ochkov, Beyu Denis, oscd.community date: 2019-10-12 modified: 2025-12-05 tags: - attack.persistence - attack.t1505.003 logsource: product: linux service: auditd definition: 'Required auditd configuration: -a always,exit -F arch=b32 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execve -F euid=33 -k detect_execve_www -a always,exit -F arch=b32 -S execveat -F euid=33 -k detect_execve_www -a always,exit -F arch=b64 -S execveat -F euid=33 -k detect_execve_www Change the number "33" to the ID of your WebServer user. Default: www-data:x:33:33 ' detection: selection: type: SYSCALL SYSCALL: - execve - execveat euid: 33 condition: selection falsepositives: - Admin activity - Crazy web applications level: critical
Sigma rule: Detects the presence and execution of Inveigh via dropped artefacts. Logsource: windows / file_event. Rule: title: HackTool - Inveigh Execution Artefacts id: bb09dd3e-2b78-4819-8e35-a7c1b874e449 status: test description: Detects the presence and execution of Inveigh via dropped artefacts references: - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs - https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs - https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-24 modified: 2024-06-27 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Inveigh-Log.txt - \Inveigh-Cleartext.txt - \Inveigh-NTLMv1Users.txt - \Inveigh-NTLMv2Users.txt - \Inveigh-NTLMv1.txt - \Inveigh-NTLMv2.txt - \Inveigh-FormInput.txt - \Inveigh.dll - \Inveigh.exe - \Inveigh.ps1 - \Inveigh-Relay.ps1 condition: selection falsepositives: - Unlikely level: critical
Sigma rule: Shadow Copies storage symbolic link creation using operating systems utilities. Logsource: windows / process_creation. Rule: title: VolumeShadowCopy Symlink Creation Via Mklink id: 40b19fa6-d835-400c-b301-41f3a2baacaf status: stable description: Shadow Copies storage symbolic link creation using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2023-03-06 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - mklink - HarddiskVolumeShadowCopy condition: selection falsepositives: - Legitimate administrator working with shadow copies, access for backup purposes level: high