alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects when a repository or an organization is being transferred to another location.. Logsource: github / audit. Rule: title: Github Repository/Organization Transferred id: 04ad83ef-1a37-4c10-b57a-81092164bf33 status: test description: Detects when a repository or an organization is being transferred to another location. references: - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository - https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership - https://docs.github.com/en/migrations - https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration author: Romain Gaillard (@romain-gaillard) date: 2024-07-29 tags: - attack.persistence - attack.exfiltration - attack.t1020 - attack.t1537 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - migration.create - org.transfer_outgoing - org.transfer - repo.transfer_outgoing condition: selection falsepositives: - Allowed administrative activities. level: medium
Sigma rule: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply. Logsource: windows / file_event. Rule: title: Potential Persistence Via Microsoft Office Add-In id: 8e1cb247-6cf6-42fa-b440-3f27d57e9936 status: test description: Detects potential persistence activity via startup add-ins that load when Microsoft Office starts (.wll/.xll are simply .dll fit for Word or Excel). references: - Internal Research - https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence - https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md author: NVISO date: 2020-05-11 modified: 2023-02-08 tags: - attack.persistence - attack.t1137.006 logsource: category: file_event product: windows detection: selection_wlldropped: TargetFilename|contains: \Microsoft\Word\Startup\ TargetFilename|endswith: .wll selection_xlldropped: TargetFilename|contains: \Microsoft\Excel\Startup\ TargetFilename|endswith: .xll selection_xladropped: TargetFilename|contains: Microsoft\Excel\XLSTART\ TargetFilename|endswith: .xlam selection_generic: TargetFilename|contains: \Microsoft\Addins\ TargetFilename|endswith: - .xlam - .xla - .ppam condition: 1 of selection_* falsepositives: - Legitimate add-ins level: high
Sigma rule: Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common d. Logsource: windows / process_creation. Rule: title: IIS WebServer Log Deletion via CommandLine Utilities id: 0649be4a-aeb0-45b0-b89e-7f1668f6d9c0 related: - id: 3eb8c339-a765-48cc-a150-4364c04652bf type: similar status: experimental description: 'Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection. ' references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-02 tags: - attack.stealth - attack.t1070 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - cmd.exe - powershell.exe - powershell_ise.exe - pwsh.dll selection_cli_del: CommandLine|contains: - 'del ' - 'erase ' - 'rm ' - 'remove-item ' - 'rmdir ' selection_cli_iis_dir: CommandLine|contains: \inetpub\logs\ condition: all of selection_* falsepositives: - Deletion of IIS logs that are older than a certain retention period as part of regular maintenance activities. - Legitimate schedule tasks or scripts that clean up log files regularly. level: medium
Sigma rule: Detects suspicious process run from unusual locations. Logsource: windows / process_creation. Rule: title: Suspicious Process Start Locations id: 15b75071-74cc-47e0-b4c6-b43744a62a2b status: test description: Detects suspicious process run from unusual locations references: - https://car.mitre.org/wiki/CAR-2013-05-002 author: juju4, Jonhnathan Ribeiro, oscd.community date: 2019-01-16 modified: 2022-01-07 tags: - attack.stealth - attack.t1036 - car.2013-05-002 logsource: category: process_creation product: windows detection: selection: - Image|contains: - :\RECYCLER\ - :\SystemVolumeInformation\ - Image|startswith: - C:\Windows\Tasks\ - C:\Windows\debug\ - C:\Windows\fonts\ - C:\Windows\help\ - C:\Windows\drivers\ - C:\Windows\addins\ - C:\Windows\cursors\ - C:\Windows\system32\tasks\ condition: selection falsepositives: - False positives depend on scripts and administrative tools used in the monitored environment level: medium
Sigma rule: Detects when an account was created and deleted in a short period of time.. Logsource: azure / auditlogs. Rule: title: Account Created And Deleted Within A Close Time Frame id: 6f583da0-3a90-4566-a4ed-83c09fe18bbf status: test description: Detects when an account was created and deleted in a short period of time. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts author: Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton date: 2022-08-11 modified: 2022-08-18 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: auditlogs detection: selection: properties.message: - Add user - Delete user Status: Success condition: selection falsepositives: - Legit administrative action level: high
Sigma rule: Detects changes to the registry values related to outlook security settings. Logsource: windows / registry_set. Rule: title: Outlook Security Settings Updated - Registry id: c3cefdf4-6703-4e1c-bad8-bf422fc5015a related: - id: 6763c6c8-bd01-4687-bc8d-4fa52cf8ba08 type: similar status: test description: Detects changes to the registry values related to outlook security settings references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137/T1137.md - https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings author: frack113 date: 2021-12-28 modified: 2026-01-09 tags: - attack.persistence - attack.t1137 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \SOFTWARE\Microsoft\Office\ - \Outlook\Security\ filter_main_outlook: Image|startswith: - C:\Program Files\Microsoft Office\ - C:\Program Files (x86)\Microsoft Office\ Image|endswith: \OUTLOOK.EXE condition: selection and not 1 of filter_main_* falsepositives: - Administrative activity level: medium
Sigma rule: Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from. Logsource: windows / process_access. Rule: title: Lsass Memory Dump via Comsvcs DLL id: a49fa4d5-11db-418c-8473-1e014a8dd462 status: test description: Detects adversaries leveraging the MiniDump export function from comsvcs.dll via rundll32 to perform a memory dump from lsass. references: - https://twitter.com/shantanukhande/status/1229348874298388484 - https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/ author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2023-11-29 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_access product: windows detection: selection: TargetImage|endswith: \lsass.exe SourceImage|endswith: \rundll32.exe CallTrace|contains: comsvcs.dll condition: selection falsepositives: - Unknown level: high
Sigma rule: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build. Logsource: windows / process_creation. Rule: title: Curl Download And Execute Combination id: 21dd6d38-2b18-4453-9404-a0fe4a0cc288 status: test description: Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later. references: - https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983 author: Sreeman, Nasreddine Bencherchali (Nextron Systems) date: 2020-01-13 modified: 2024-03-05 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|windash: ' -c ' CommandLine|contains|all: - 'curl ' - http - -o - '&' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects activity when The Windows Defender Firewall service failed to load Group Policy. Logsource: windows / firewall-as. Rule: title: The Windows Defender Firewall Service Failed To Load Group Policy id: 7ec15688-fd24-4177-ba43-1a950537ee39 status: test description: Detects activity when The Windows Defender Firewall service failed to load Group Policy references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) author: frack113 date: 2022-02-19 modified: 2023-01-17 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows service: firewall-as detection: selection: EventID: 2009 condition: selection level: low
Sigma rule: Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file v. Logsource: windows / file_event. Rule: title: Potential RipZip Attack on Startup Folder id: a6976974-ea6f-4e97-818e-ea08625c52cb status: test description: 'Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation. ' references: - https://twitter.com/jonasLyk/status/1549338335243534336?t=CrmPocBGLbDyE4p6zTX1cg&s=19 author: Greg (rule) date: 2022-07-21 modified: 2023-01-05 tags: - attack.privilege-escalation - attack.persistence - attack.t1547 logsource: category: file_event product: windows detection: selection: TargetFilename|contains|all: - \Microsoft\Windows\Start Menu\Programs\Startup - .lnk.{0AFACED1-E828-11D1-9187-B532F1E9575D} Image|endswith: \explorer.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This ca. Logsource: windows / process_creation. Rule: title: Use of Pcalua For Execution id: 0955e4e1-c281-4fb9-9ee1-5ee7b4b754d2 related: - id: fa47597e-90e9-41cd-ab72-c3b74cfb0d02 type: obsolete status: test description: Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting. references: - https://lolbas-project.github.io/lolbas/Binaries/Pcalua/ - https://pentestlab.blog/2020/07/06/indirect-command-execution/ author: Nasreddine Bencherchali (Nextron Systems), E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2022-06-14 modified: 2023-01-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: \pcalua.exe CommandLine|contains: ' -a' condition: selection falsepositives: - Legitimate use by a via a batch script or by an administrator. level: medium
Sigma rule: Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware. Logsource: windows / registry_set. Rule: title: AMSI Disabled via Registry Modification id: aa37cbb0-da36-42cb-a90f-fdf216fc7467 related: - id: 7dbbcac2-57a0-45ac-b306-ff30a8bd2981 type: similar status: experimental description: 'Detects attempts to disable AMSI (Anti-Malware Scan Interface) by modifying the AmsiEnable registry value. Anti-Malware Scan Interface (AMSI) is a security feature in Windows that allows applications and services to integrate with anti-malware products for enhanced protection against malicious content. Adversaries may attempt to disable AMSI to evade detection by security software, allowing them to execute malicious scripts or code without being scanned. ' references: - https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d - https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal - https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-25 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Microsoft\Windows Script\Settings\AmsiEnable Details: DWORD (0x00000000) condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_amsi_disable/info.yml simulation: - type: atomic-red-team name: AMSI Bypass - Create AMSIEnable Reg Key technique: T1562.001 atomic_guid: 728eca7b-0444-4f6f-ac36-437e3d751dc0
Sigma rule: Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker. Logsource: windows / process_creation. Rule: title: PUA - Process Hacker Execution id: 811e0002-b13b-4a15-9d00-a613fce66e42 related: - id: 5722dff1-4bdd-4949-86ab-fbaf707e767a type: similar status: test description: 'Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes. ' references: - https://processhacker.sourceforge.io/ - https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/ author: Florian Roth (Nextron Systems) date: 2022-10-10 modified: 2024-11-23 tags: - attack.discovery - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1622 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|contains: \ProcessHacker_ - Image|endswith: \ProcessHacker.exe - OriginalFileName: - ProcessHacker.exe - Process Hacker - Description: Process Hacker - Product: Process Hacker - Hashes|contains: - MD5=68F9B52895F4D34E74112F3129B3B00D - MD5=B365AF317AE730A67C936F21432B9C71 - SHA1=A0BDFAC3CE1880B32FF9B696458327CE352E3B1D - SHA1=C5E2018BF7C0F314FED4FD7FE7E69FA2E648359E - SHA256=D4A0FE56316A2C45B9BA9AC1005363309A3EDC7ACF9E4DF64D326A0FF273E80F - SHA256=BD2C2CF0631D881ED382817AFCCE2B093F4E412FFB170A719E2762F250ABFEA4 - IMPHASH=3695333C60DEDECDCAFF1590409AA462 - IMPHASH=04DE0AD9C37EB7BD52043D2ECAC958DF condition: selection falsepositives: - While sometimes 'Process Hacker is used by legitimate administrators, the execution of Process Hacker must be investigated and allowed on a case by case basis level: medium
Sigma rule: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer f. Logsource: windows / process_creation. Rule: title: Suspicious Cabinet File Execution Via Msdt.EXE id: dc4576d4-7467-424f-9eee-fd2b02855fe0 related: - id: 6545ce61-a1bd-4119-b9be-fcbee42c0cf3 type: obsolete status: test description: Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190 references: - https://twitter.com/nas_bench/status/1537896324837781506 - https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab - https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0 - https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd author: Nasreddine Bencherchali (Nextron Systems), GossiTheDog, frack113 date: 2022-06-21 modified: 2024-03-13 tags: - attack.stealth - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \msdt.exe - OriginalFileName: msdt.exe selection_cmd: CommandLine|contains|windash: ' -cab ' condition: all of selection_* falsepositives: - Legitimate usage of ".diagcab" files level: medium
Sigma rule: Detects a flashplayer update from an unofficial location. Logsource: proxy. Rule: title: Flash Player Update from Suspicious Location id: 4922a5dd-6743-4fc2-8e81-144374280997 status: test description: Detects a flashplayer update from an unofficial location references: - https://gist.github.com/roycewilliams/a723aaf8a6ac3ba4f817847610935cfb author: Florian Roth (Nextron Systems) date: 2017-10-25 modified: 2022-08-08 tags: - attack.initial-access - attack.stealth - attack.t1189 - attack.execution - attack.t1204.002 - attack.t1036.005 logsource: category: proxy detection: selection: - c-uri|contains: /flash_install.php - c-uri|endswith: /install_flash_player.exe filter: cs-host|endswith: .adobe.com condition: selection and not filter falsepositives: - Unknown flash download locations level: high
Sigma rule: Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the. Logsource: windows / process_creation. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Process id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 related: - id: 8839e550-52d7-4958-9f2f-e13c1e736838 type: similar status: experimental description: 'Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains|all: - ' add ' - \SYSTEM\CurrentControlSet\Control\MiniNt selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd1: CommandLine|contains: - 'New-Item ' - 'ni ' selection_powershell_cmd2: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\MiniNt condition: all of selection_reg_* or all of selection_powershell_* falsepositives: - Highly Unlikely level: high
Sigma rule: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the. Logsource: windows / registry_set. Rule: title: Potential Credential Dumping Attempt Using New NetworkProvider - REG id: 0442defa-b4a2-41c9-ae2c-ea7042fc4701 related: - id: baef1ec6-2ca9-47a3-97cc-4cf2bda10b77 type: similar status: test description: Detects when an attacker tries to add a new network provider in order to dump clear text credentials, similar to how the NPPSpy tool does it references: - https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade - https://github.com/gtworek/PSBits/tree/master/PasswordStealing/NPPSpy author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-23 modified: 2023-08-17 tags: - attack.credential-access - attack.t1003 logsource: category: registry_set product: windows detection: selection: TargetObject|contains|all: - \System\CurrentControlSet\Services\ - \NetworkProvider filter: TargetObject|contains: - \System\CurrentControlSet\Services\WebClient\NetworkProvider - \System\CurrentControlSet\Services\LanmanWorkstation\NetworkProvider - \System\CurrentControlSet\Services\RDPNP\NetworkProvider filter_valid_procs: Image: C:\Windows\System32\poqexec.exe condition: selection and not 1 of filter* falsepositives: - Other legitimate network providers used and not filtred in this rule level: medium
Sigma rule: Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to s. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of Setres.EXE id: 835e75bf-4bfd-47a4-b8a6-b766cac8bcb7 status: test description: 'Detects uncommon child process of Setres.EXE. Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution. It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Setres/ - https://twitter.com/0gtweet/status/1583356502340870144 - https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html - https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11) author: '@gott_cyber, Nasreddine Bencherchali (Nextron Systems)' date: 2022-12-11 modified: 2024-06-26 tags: - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \setres.exe Image|contains: \choice filter_main_legit_location: Image|endswith: - C:\Windows\System32\choice.exe - C:\Windows\SysWOW64\choice.exe condition: selection and not 1 of filter_main_* falsepositives: - Unlikely level: high
Sigma rule: Detects usage of base64 utility to decode arbitrary base64-encoded text. Logsource: macos / process_creation. Rule: title: Decode Base64 Encoded Text -MacOs id: 719c22d7-c11a-4f2c-93a6-2cfdd5412f68 status: test description: Detects usage of base64 utility to decode arbitrary base64-encoded text references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-26 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: macos detection: selection: Image: /usr/bin/base64 CommandLine|contains: -d condition: selection falsepositives: - Legitimate activities level: low
Sigma rule: Detects usage of the "type" command to download/upload data from WebDAV server. Logsource: windows / process_creation. Rule: title: Potential Download/Upload Activity Using Type Command id: aa0b3a82-eacc-4ec3-9150-b5a9a3e3f82f status: test description: Detects usage of the "type" command to download/upload data from WebDAV server references: - https://mr0range.com/a-new-lolbin-using-the-windows-type-command-to-upload-download-files-81d7b6179e22 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-14 tags: - attack.command-and-control - attack.t1105 logsource: product: windows category: process_creation detection: selection_upload: CommandLine|contains|all: - 'type ' - ' > \\\\' selection_download: CommandLine|contains|all: - type \\\\ - ' > ' condition: 1 of selection_* falsepositives: - Unknown level: medium