alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being esta. Logsource: linux / file_event. Rule: title: New Cron File Created id: 6c4e2f43-d94d-4ead-b64d-97e53fa2bd05 status: experimental description: 'Detects the creation of cron files in Cron directories, which could indicate potential persistence mechanisms being established by an attacker. Note that not all cron file creations are malicious - legitimate system administration activities and software installations may also create cron files. This detection should be investigated in context, considering factors such as the user creating the file, the timing of creation, and the contents of the cron job. Focus investigation on unexpected cron files created by non-administrative users or during suspicious timeframes. Additionally, it is recommended to review the contents of the newly created cron files to assess their intent. Furthermore, it is suggested to baseline normal cron file creation and apply additional filters to reduce false positives based on the specific environment. ' references: - https://github.com/microsoft/MSTIC-Sysmon/blob/f1477c0512b0747c1455283069c21faec758e29d/linux/configs/attack-based/persistence/T1053.003_Cron_Activity.xml - https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/ - https://www.elastic.co/security-labs/primer-on-persistence-mechanisms - https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2026-04-28 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053.003 logsource: product: linux category: file_event detection: selection_cron_dirs: TargetFilename|startswith: - /etc/cron.d/ - /etc/cron.daily/ - /etc/cron.hourly/ - /etc/cron.monthly/ - /etc/cron.weekly/ - /var/spool/cron/crontabs/ - /var/spool/cron/root selection_cron_special_files: TargetFilename|contains: - /etc/cron.allow - /etc/cron.deny - /etc/crontab filter_optional_legit_cron: TargetFilename: - /etc/cron.daily/apt - /etc/cron.daily/dpkg - /etc/cron.daily/passwd - /etc/crontabs/root condition: 1 of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administrative tasks, package managers, containers, configuration management tools, cloud agents, or system maintenance operations might cause false positives. Apply baselining before deployment. level: low
Sigma rule: Collect pertinent data from the configuration files. Logsource: cisco / aaa. Rule: title: Cisco Collect Data id: cd072b25-a418-4f98-8ebc-5093fb38fe1a status: test description: Collect pertinent data from the configuration files references: - https://blog.router-switch.com/2013/11/show-running-config/ - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.discovery - attack.credential-access - attack.collection - attack.t1087.001 - attack.t1552.001 - attack.t1005 logsource: product: cisco service: aaa detection: keywords: - show running-config - show startup-config - show archive config - more condition: keywords falsepositives: - Commonly run by administrators level: low
Sigma rule: Detects technique used by MAZE ransomware to enumerate directories using Powershell. Logsource: windows / ps_script. Rule: title: Powershell Directory Enumeration id: 162e69a7-7981-4344-84a9-0f1c9a217a52 status: test description: Detects technique used by MAZE ransomware to enumerate directories using Powershell references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md - https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents author: frack113 date: 2022-03-17 tags: - attack.discovery - attack.t1083 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - foreach - Get-ChildItem - '-Path ' - '-ErrorAction ' - SilentlyContinue - 'Out-File ' - -append condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell Module id: 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e related: - id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 type: derived status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4103 falsepositives: - Unknown level: high
Sigma rule: Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote atta. Logsource: windows / process_creation. Rule: title: OneNote.EXE Execution of Malicious Embedded Scripts id: 84b1706c-932a-44c4-ae28-892b28a25b94 status: test description: 'Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories. ' references: - https://bazaar.abuse.ch/browse/tag/one/ author: '@kostastsale' date: 2023-02-02 tags: - attack.stealth - attack.t1218.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \onenote.exe Image|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \wscript.exe CommandLine|contains: - \exported\ - \onenoteofflinecache_files\ condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects a when net.exe is called with a password in the command line. Logsource: windows / process_creation. Rule: title: Password Provided In Command Line Of Net.EXE id: d4498716-1d52-438f-8084-4a603157d131 status: test description: Detects a when net.exe is called with a password in the command line references: - Internal Research author: Tim Shelton (HAWK.IO) date: 2021-12-09 modified: 2023-02-21 tags: - attack.initial-access - attack.persistence - attack.privilege-escalation - attack.lateral-movement - attack.stealth - attack.t1021.002 - attack.t1078 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_cli: CommandLine|contains|all: - ' use ' - :*\\ - /USER:* * filter_main_empty: CommandLine|endswith: ' ' condition: all of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files. Logsource: windows / process_creation. Rule: title: File Download with Headless Browser id: 0e8cfe08-02c9-4815-a2f8-0d157b7ed33e related: - id: ef9dcfed-690c-4c5d-a9d1-482cd422225c type: derived status: test description: Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files references: - https://twitter.com/mrd0x/status/1478234484881436672?s=12 - https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html author: Sreeman, Florian Roth (Nextron Systems) date: 2022-01-04 modified: 2025-10-07 tags: - attack.command-and-control - attack.stealth - attack.t1105 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains|all: - --headless - dump-dom - http filter_optional_edge_1: Image|startswith: - C:\Program Files (x86)\Microsoft\Edge\Application\ - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files (x86)\Microsoft\EdgeWebView\ - C:\Program Files\Microsoft\Edge\Application\ - C:\Program Files\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeWebView\ - C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge Image|endswith: - \msedge.exe - \msedgewebview2.exe - \MicrosoftEdge.exe CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom filter_optional_edge_2: Image|contains: - \AppData\Local\Microsoft\WindowsApps\ - \Windows\SystemApps\Microsoft.MicrosoftEdge Image|endswith: - \msedge.exe - \MicrosoftEdge.exe CommandLine|contains: --headless --disable-gpu --disable-extensions --disable-plugins --mute-audio --no-first-run --incognito --aggressive-cache-discard --dump-dom condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_file_download/info.yml
Sigma rule: Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on. Logsource: windows / process_creation. Rule: title: Recon Command Output Piped To Findstr.EXE id: ccb5742c-c248-4982-8c5c-5571b9275ad3 related: - id: fe63010f-8823-4864-a96b-a7b4a0f7b929 type: derived status: test description: 'Detects the execution of a potential recon command where the results are piped to "findstr". This is meant to trigger on inline calls of "cmd.exe" via the "/c" or "/k" for example. Attackers often time use this technique to extract specific information they require in their reconnaissance phase. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1057/T1057.md#atomic-test-6---discover-specific-process---tasklist - https://www.hhs.gov/sites/default/files/manage-engine-vulnerability-sector-alert-tlpclear.pdf - https://www.trendmicro.com/en_us/research/22/d/spring4shell-exploited-to-deploy-cryptocurrency-miners.html author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2023-07-06 modified: 2025-10-08 tags: - attack.discovery - attack.t1057 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - ipconfig*|*find - net*|*find - netstat*|*find - ping*|*find - systeminfo*|*find - tasklist*|*find - whoami*|*find filter_optional_xampp: CommandLine|contains|all: - cmd.exe /c TASKLIST /V | - FIND /I - \xampp\ - \catalina_start.bat condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_findstr_recon_pipe_output/info.yml
Sigma rule: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, Amm. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Simple Help Execution id: 95e60a2b-4705-444b-b7da-ba0ea81a3ee2 status: test description: 'An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land) ' references: - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 author: Nasreddine Bencherchali (Nextron Systems) date: 2024-02-23 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: Image|contains: - \JWrapper-Remote Access\ - \JWrapper-Remote Support\ Image|endswith: \SimpleService.exe condition: selection falsepositives: - Legitimate usage of the tool level: medium
Sigma rule: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs. Logsource: proxy. Rule: title: Exploit Framework User Agent id: fdd1bfb5-f60b-4a35-910e-f36ed3d0b32f status: test description: Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs references: - https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings/ author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2025-01-18 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - Internet Explorer * - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2) - Mozilla/4.0 (compatible; Metasploit RSPEC) - Mozilla/4.0 (compatible; MSIE 6.1; Windows NT) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; Trident/4.0; SIMBAR={7DB0F6DE-8DE7-4841-9084-28FA914B0F2E}; SLCC1; .N - Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/4.0.221.6 Safari/525.13 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MAAU) - Mozilla/5.0 - Mozilla/4.0 (compatible; SPIPE/1.0 - Mozilla/5.0 (Windows NT 6.3; rv:39.0) Gecko/20100101 Firefox/35.0 - Sametime Community Agent - X-FORWARDED-FOR - DotDotPwn v2.1 - SIPDROID - Mozilla/5.0 (Windows NT 10.0; Win32; x32; rv:60.0) - Mozilla/6.0 (X11; Linux x86_64; rv:24.0) Gecko/20140205 Firefox/27.0 Iceweasel/25.3.0 - '*wordpress hash grabber*' - '*exploit*' - Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 condition: selection falsepositives: - Unknown level: high
Sigma rule: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential. Logsource: windows / process_creation. Rule: title: Private Keys Reconnaissance Via CommandLine Tools id: 213d6a77-3d55-4ce8-ba74-fcfef741974e status: test description: Adversaries may search for private key certificate files on compromised systems for insecurely stored credential references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.004/T1552.004.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-07-20 modified: 2023-03-06 tags: - attack.credential-access - attack.t1552.004 logsource: category: process_creation product: windows detection: selection_cmd_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cmd_cli: CommandLine|contains: 'dir ' selection_pwsh_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_pwsh_cli: CommandLine|contains: 'Get-ChildItem ' selection_findstr: - Image|endswith: \findstr.exe - OriginalFileName: FINDSTR.EXE selection_ext: CommandLine|contains: - .key - .pgp - .gpg - .ppk - .p12 - .pem - .pfx - .cer - .p7b - .asc condition: selection_ext and (all of selection_cmd_* or all of selection_pwsh_* or selection_findstr) falsepositives: - Unknown level: medium
Sigma rule: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading. Logsource: windows / process_creation. Rule: title: Scheduled Task Creation Masquerading as System Processes id: 9f8573c9-22b4-40e3-89c1-72bc2b8d49ab status: experimental description: Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence. references: - https://tria.ge/241015-l98snsyeje/behavioral2 author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.stealth - attack.t1053.005 - attack.t1036.004 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_cli: CommandLine|contains|windash: ' /create ' CommandLine|contains: - ' audiodg' - ' conhost' - ' dwm.exe' - ' explorer' - ' lsass' - ' lsm' - ' mmc' - ' msiexec' - ' regsvr32' - ' rundll32' - ' services' - ' spoolsv' - ' svchost' - ' taskeng' - ' taskhost' - ' wininit' - ' winlogon' condition: all of selection_* falsepositives: - Legitimate system administration tasks scheduling trusted system processes. level: high
Sigma rule: Detects specific combinations of encoding methods in PowerShell via the commandline. Logsource: windows / process_creation. Rule: title: Potential Encoded PowerShell Patterns In CommandLine id: cdf05894-89e7-4ead-b2b0-0a5f97a90f2f related: - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6 type: similar status: test description: Detects specific combinations of encoding methods in PowerShell via the commandline references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65 author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton date: 2020-10-11 modified: 2023-01-26 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_to_1: CommandLine|contains: - ToInt - ToDecimal - ToByte - ToUint - ToSingle - ToSByte selection_to_2: CommandLine|contains: - ToChar - ToString - String selection_gen_1: CommandLine|contains|all: - char - join selection_gen_2: CommandLine|contains|all: - split - join condition: selection_img and (all of selection_to_* or 1 of selection_gen_*) falsepositives: - Unknown level: low
Sigma rule: Detects an attempt to execute code or create service on remote host via winrm.vbs.. Logsource: windows / process_creation. Rule: title: Remote Code Execute via Winrm.vbs id: 9df0dd3a-1a5c-47e3-a2bc-30ed177646a0 status: test description: Detects an attempt to execute code or create service on remote host via winrm.vbs. references: - https://twitter.com/bohops/status/994405551751815170 - https://redcanary.com/blog/lateral-movement-winrm-wmi/ - https://lolbas-project.github.io/lolbas/Scripts/Winrm/ author: Julia Fomina, oscd.community date: 2020-10-07 modified: 2023-03-03 tags: - attack.stealth - attack.t1216 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cscript.exe - OriginalFileName: cscript.exe selection_cli: CommandLine|contains|all: - winrm - invoke Create wmicimv2/Win32_ - -r:http condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Manag. Logsource: windows / ps_script. Rule: title: Powershell WMI Persistence id: 9e07f6e7-83aa-45c6-998e-0af26efd0a85 status: test description: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Persistence.psm1#L545 author: frack113 date: 2021-08-19 modified: 2022-12-25 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_ioc: - ScriptBlockText|contains|all: - 'New-CimInstance ' - '-Namespace root/subscription ' - '-ClassName __EventFilter ' - '-Property ' - ScriptBlockText|contains|all: - 'New-CimInstance ' - '-Namespace root/subscription ' - '-ClassName CommandLineEventConsumer ' - '-Property ' condition: selection_ioc falsepositives: - Unknown level: medium
Sigma rule: Detects actions that clear the local ShimCache and remove forensic evidence. Logsource: windows / process_creation. Rule: title: ShimCache Flush id: b0524451-19af-4efa-a46f-562a977f792e status: stable description: Detects actions that clear the local ShimCache and remove forensic evidence references: - https://medium.com/@blueteamops/shimcache-flush-89daff28d15e author: Florian Roth (Nextron Systems) date: 2021-02-01 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: process_creation product: windows detection: selection1a: CommandLine|contains|all: - rundll32 - apphelp.dll selection1b: CommandLine|contains: - ShimFlushCache - '#250' selection2a: CommandLine|contains|all: - rundll32 - kernel32.dll selection2b: CommandLine|contains: - BaseFlushAppcompatCache - '#46' condition: ( selection1a and selection1b ) or ( selection2a and selection2b ) falsepositives: - Unknown level: high
Sigma rule: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can ha. Logsource: azure / auditlogs. Rule: title: Change to Authentication Method id: 4d78a000-ab52-4564-88a5-7ab5242b20c7 status: test description: Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts author: AlertIQ date: 2021-10-10 modified: 2022-12-25 tags: - attack.privilege-escalation - attack.credential-access - attack.defense-impairment - attack.t1556 - attack.persistence - attack.t1098 logsource: product: azure service: auditlogs detection: selection: LoggedByService: Authentication Methods Category: UserManagement OperationName: User registered security info condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine. Logsource: windows / registry_set. Rule: title: Allow RDP Remote Assistance Feature id: 37b437cf-3fc5-4c8e-9c94-1d7c9aff842b status: test description: Detect enable rdp feature to allow specific user to rdp connect on the targeted machine references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md author: frack113 date: 2022-08-19 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: System\CurrentControlSet\Control\Terminal Server\fAllowToGetHelp Details: DWORD (0x00000001) condition: selection falsepositives: - Legitimate use of the feature (alerts should be investigated either way) level: medium regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_allow_rdp_remote_assistance_feature/info.yml simulation: - type: atomic-red-team name: Allow RDP Remote Assistance Feature technique: T1112 atomic_guid: 86677d0e-0b5e-4a2b-b302-454175f9aa9e