alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and. Logsource: windows / process_creation. Rule: title: Renamed MegaSync Execution id: 643bdcac-8b82-49f4-9fd9-25a90b929f3b status: test description: Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti. references: - https://redcanary.com/blog/rclone-mega-extortion/ author: Sittikorn S date: 2021-06-22 modified: 2023-02-03 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation detection: selection: OriginalFileName: megasync.exe filter: Image|endswith: \megasync.exe condition: selection and not filter falsepositives: - Software that illegally integrates MegaSync in a renamed form - Administrators that have renamed MegaSync level: high
Sigma rule: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters. Logsource: windows / network_connection. Rule: title: Suspicious Network Connection Binary No CommandLine id: 20384606-a124-4fec-acbb-8bd373728613 status: test description: Detects suspicious network connections made by a well-known Windows binary run with no command line parameters references: - https://redcanary.com/blog/raspberry-robin/ author: Florian Roth (Nextron Systems) date: 2022-07-03 tags: - attack.stealth logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe CommandLine|endswith: - \regsvr32.exe - \rundll32.exe - \dllhost.exe filter_no_cmdline: CommandLine: '' filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Unknown level: high
Sigma rule: Detects the deletion of registry keys containing the MSTSC connection history. Logsource: windows / registry_delete. Rule: title: Terminal Server Client Connection History Cleared - Registry id: 07bdd2f5-9c58-4f38-aec8-e101bb79ef8d status: test description: Detects the deletion of registry keys containing the MSTSC connection history references: - https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer - http://woshub.com/how-to-clear-rdp-connections-history/ - https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html author: Christian Burkard (Nextron Systems) date: 2021-10-19 modified: 2023-02-08 tags: - attack.persistence - attack.stealth - attack.defense-impairment - attack.t1070 - attack.t1112 logsource: category: registry_delete product: windows detection: selection1: EventType: DeleteValue TargetObject|contains: \Microsoft\Terminal Server Client\Default\MRU selection2: EventType: DeleteKey TargetObject|contains: \Microsoft\Terminal Server Client\Servers\ condition: 1 of selection* falsepositives: - Unknown level: high
Sigma rule: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host. Logsource: windows / security. Rule: title: WCE wceaux.dll Access id: 1de68c67-af5c-4097-9c85-fe5578e09e67 status: test description: Detects wceaux.dll access while WCE pass-the-hash remote command execution on source host references: - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://jpcertcc.github.io/ToolAnalysisResultSheet author: Thomas Patzke date: 2017-06-14 modified: 2025-01-30 tags: - attack.credential-access - attack.t1003 - attack.s0005 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 ObjectName|endswith: \wceaux.dll condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript. Logsource: macos / process_creation. Rule: title: Suspicious Installer Package Child Process id: e0cfaecd-602d-41af-988d-f6ccebb2af26 status: test description: Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters references: - https://redcanary.com/blog/clipping-silver-sparrows-wings/ - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_installer_package_spawned_network_event.toml author: Sohan G (D4rkCiph3r) date: 2023-02-18 tags: - attack.t1059 - attack.t1059.007 - attack.t1071 - attack.t1071.001 - attack.execution - attack.command-and-control logsource: category: process_creation product: macos detection: selection_installer: ParentImage|endswith: - /package_script_service - /installer Image|endswith: - /sh - /bash - /dash - /python - /ruby - /perl - /php - /javascript - /osascript - /tclsh - /curl - /wget CommandLine|contains: - preinstall - postinstall condition: selection_installer falsepositives: - Legitimate software uses the scripts (preinstall, postinstall) level: medium
Sigma rule: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with th. Logsource: windows / process_creation. Rule: title: AgentExecutor PowerShell Execution id: 7efd2c8d-8b18-45b7-947d-adfe9ed04f61 related: - id: c0b40568-b1e9-4b03-8d6c-b096da6da9ab type: similar status: test description: Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument author: Nasreddine Bencherchali (Nextron Systems), memory-shards references: - https://twitter.com/lefterispan/status/1286259016436514816 - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/ - https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension - https://twitter.com/jseerden/status/1247985304667066373/photo/1 date: 2022-12-24 modified: 2024-08-07 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image: \AgentExecutor.exe - OriginalFileName: AgentExecutor.exe selection_cli: CommandLine|contains: - ' -powershell' - ' -remediationScript' filter_main_intune: ParentImage|endswith: \Microsoft.Management.Services.IntuneWindowsAgent.exe condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate use via Intune management. You exclude script paths and names to reduce FP rate level: medium
Sigma rule: Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to overri. Logsource: windows / process_creation. Rule: title: Allow Service Access Using Security Descriptor Tampering Via Sc.EXE id: 6c8fbee5-dee8-49bc-851d-c3142d02aa47 related: - id: a537cfc3-4297-4789-92b5-345bfd845ad0 type: similar status: test description: Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. This can be used to override access restrictions set by previous ACLs. references: - https://twitter.com/0gtweet/status/1628720819537936386 - https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/ - https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-28 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1543.003 logsource: category: process_creation product: windows detection: selection_sc: - Image|endswith: \sc.exe - OriginalFileName: sc.exe selection_sdset: CommandLine|contains|all: - sdset - A; selection_trustee: CommandLine|contains: - ;IU - ;SU - ;BA - ;SY - ;WD filter_optional_hexnode: ParentImage: C:\Hexnode\Hexnode Agent\Current\HexnodeAgent.exe condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers comm. Logsource: windows / ps_script. Rule: title: Access to Browser Login Data id: fc028194-969d-4122-8abe-0470d5b8f12f related: - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d type: obsolete - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b type: similar status: test description: 'Adversaries may acquire credentials from web browsers by reading files specific to the target browser. Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future. Web browsers typically store the credentials in an encrypted format within a credential store. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md author: frack113 date: 2022-01-30 tags: - attack.credential-access - attack.t1555.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - Copy-Item - -Destination selection_path: ScriptBlockText|contains: - \Opera Software\Opera Stable\Login Data - \Mozilla\Firefox\Profiles - \Microsoft\Edge\User Data\Default - \Google\Chrome\User Data\Default\Login Data - \Google\Chrome\User Data\Default\Login Data For Account condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects blocked load attempts of revoked drivers. Logsource: windows / codeintegrity-operational. Rule: title: CodeIntegrity - Blocked Driver Load With Revoked Certificate id: 9b72b82d-f1c5-4632-b589-187159bc6ec1 status: test description: Detects blocked load attempts of revoked drivers references: - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-06 tags: - attack.persistence - attack.privilege-escalation - attack.t1543 logsource: product: windows service: codeintegrity-operational detection: selection: EventID: 3023 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel. Logsource: windows / registry_set. Rule: title: Disable Windows Event Logging Via Registry id: 2f78da12-f7c7-430b-8b19-a28f269b77a3 status: test description: Detects tampering with the "Enabled" registry key in order to disable Windows logging of a Windows event channel references: - https://twitter.com/WhichbufferArda/status/1543900539280293889 - https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-07-04 modified: 2024-03-25 tags: - attack.defense-impairment - attack.t1685.001 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\ TargetObject|endswith: \Enabled Details: DWORD (0x00000000) filter_main_wevutil: Image: C:\Windows\system32\wevtutil.exe filter_main_iis: Image|startswith: C:\Windows\winsxs\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\Windows\System32\svchost.exe TargetObject|contains: - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-FileInfoMinifilter - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-ASN1\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Kernel-AppCompat\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Runtime\Error\ - \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-CAPI2/Operational\ filter_main_trusted_installer: Image: C:\Windows\servicing\TrustedInstaller.exe TargetObject|contains: \Microsoft\Windows\CurrentVersion\WINEVT\Channels\Microsoft-Windows-Compat-Appraiser filter_optional_empty: Image: '' filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Rare falsepositives may occur from legitimate administrators disabling specific event log for troubleshooting level: high
Sigma rule: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz. Logsource: windows / security. Rule: title: Successful Overpass the Hash Attempt id: 192a0330-c20b-4356-90b6-7b7049ae0b87 status: test description: Detects successful logon with logon type 9 (NewCredentials) which matches the Overpass the Hash behavior of e.g Mimikatz's sekurlsa::pth module. references: - https://web.archive.org/web/20220419045003/https://cyberwardog.blogspot.com/2017/04/chronicles-of-threat-hunter-hunting-for.html author: Roberto Rodriguez (source), Dominik Schaudel (rule) date: 2018-02-12 modified: 2021-11-27 tags: - attack.lateral-movement - attack.s0002 - attack.t1550.002 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 9 LogonProcessName: seclogo AuthenticationPackageName: Negotiate condition: selection falsepositives: - Runas command-line tool using /netonly parameter level: high
Sigma rule: Detects the pattern of a pipe name as used by the hack tool CoercedPotato. Logsource: windows / pipe_created. Rule: title: HackTool - CoercedPotato Named Pipe Creation id: 4d0083b3-580b-40da-9bba-626c19fe4033 status: test description: Detects the pattern of a pipe name as used by the hack tool CoercedPotato references: - https://blog.hackvens.fr/articles/CoercedPotato.html - https://github.com/hackvens/CoercedPotato author: Florian Roth (Nextron Systems) date: 2023-10-11 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|contains: \coerced\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects potential suspicious winget package installation from a suspicious source.. Logsource: windows / create_stream_hash. Rule: title: Potential Suspicious Winget Package Installation id: a3f5c081-e75b-43a0-9f5b-51f26fe5dba2 status: test description: Detects potential suspicious winget package installation from a suspicious source. references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 tags: - attack.persistence - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|startswith: '[ZoneTransfer] ZoneId=3' Contents|contains: - ://1 - ://2 - ://3 - ://4 - ://5 - ://6 - ://7 - ://8 - ://9 TargetFilename|endswith: :Zone.Identifier TargetFilename|contains: \AppData\Local\Temp\WinGet\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or u. Logsource: windows / security. Rule: title: Group Policy Abuse for Privilege Addition id: 1c480e10-7ee1-46d4-8ed2-85f9789e3ce4 status: test description: 'Detects the first occurrence of a modification to Group Policy Object Attributes to add privileges to user accounts or use them to add users as local admins. ' author: Elastic, Josh Nickels, Marius Rothenbücher references: - https://www.elastic.co/guide/en/security/current/group-policy-abuse-for-privilege-addition.html#_setup_275 date: 2024-09-04 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows service: security definition: 'Requirements: The "Audit Directory Service Changes" logging policy must be configured in order to receive events.' detection: selection: EventID: 5136 AttributeLDAPDisplayName: gPCMachineExtensionNames AttributeValue|contains: - 827D319E-6EAC-11D2-A4EA-00C04F79F83A - 803E14A0-B4FB-11D0-A0D0-00A0C90F574B condition: selection falsepositives: - Users allowed to perform these modifications (user found in field SubjectUserName) level: medium
Sigma rule: Detects PowerShell script execution via input stream redirect. Logsource: windows / process_creation. Rule: title: Run PowerShell Script from Redirected Input Stream id: c83bf4b5-cdf0-437c-90fa-43d734f7c476 status: test description: Detects PowerShell script execution via input stream redirect references: - https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Powershell.yml - https://twitter.com/Moriarty_Meng/status/984380793383370752 author: Moriarty Meng (idea), Anton Kutepov (rule), oscd.community date: 2020-10-17 modified: 2021-11-27 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|re: \s-\s*< condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs. Logsource: windows / process_creation. Rule: title: HackTool - SharpEvtMute Execution id: bedfc8ad-d1c7-4e37-a20e-e2b0dbee759c related: - id: 49329257-089d-46e6-af37-4afce4290685 type: similar status: test description: Detects the use of SharpEvtHook, a tool that tampers with the Windows event logs references: - https://github.com/bats3c/EvtMute author: Florian Roth (Nextron Systems) date: 2022-09-07 modified: 2023-02-14 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows category: process_creation detection: selection: - Image|endswith: \SharpEvtMute.exe - Description: SharpEvtMute - CommandLine|contains: - '--Filter "rule ' - --Encoded --Filter \" condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.. Logsource: linux / process_creation. Rule: title: ESXi VM List Discovery Via ESXCLI id: 5f1573a7-363b-4114-9208-ad7a61de46eb status: test description: Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs. references: - https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/ - https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html - https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/ - https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html author: Cedric Maurugeon date: 2023-09-04 tags: - attack.discovery - attack.execution - attack.t1033 - attack.t1007 - attack.t1059.012 logsource: category: process_creation product: linux detection: selection: Image|endswith: /esxcli CommandLine|contains: vm process CommandLine|endswith: ' list' condition: selection falsepositives: - Legitimate administration activities level: medium
Sigma rule: Detects powershell scripts that import modules from suspicious directories. Logsource: windows / process_creation. Rule: title: Import PowerShell Modules From Suspicious Directories - ProcCreation id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3 related: - id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab type: similar status: test description: Detects powershell scripts that import modules from suspicious directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-10 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Import-Module "$Env:Temp\ - Import-Module '$Env:Temp\ - Import-Module $Env:Temp\ - Import-Module "$Env:Appdata\ - Import-Module '$Env:Appdata\ - Import-Module $Env:Appdata\ - Import-Module C:\Users\Public\ - ipmo "$Env:Temp\ - ipmo '$Env:Temp\ - ipmo $Env:Temp\ - ipmo "$Env:Appdata\ - ipmo '$Env:Appdata\ - ipmo $Env:Appdata\ - ipmo C:\Users\Public\ condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects the modification of an EC2 snapshot's permissions to enable access from another account. Logsource: aws / cloudtrail. Rule: title: AWS Snapshot Backup Exfiltration id: abae8fec-57bd-4f87-aff6-6e3db989843d status: test description: Detects the modification of an EC2 snapshot's permissions to enable access from another account references: - https://www.justice.gov/file/1080281/download author: Darin Smith date: 2021-05-17 modified: 2021-08-19 tags: - attack.exfiltration - attack.t1537 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: ec2.amazonaws.com eventName: ModifySnapshotAttribute condition: selection_source falsepositives: - Valid change to a snapshot's permissions level: medium
Sigma rule: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking.. Logsource: windows / security. Rule: title: Weak Encryption Enabled and Kerberoast id: f6de9536-0441-4b3f-a646-f4e00f300ffd status: test description: Detects scenario where weak encryption is enabled for a user profile which could be used for hash/password cracking. references: - https://adsecurity.org/?p=2053 - https://blog.harmj0y.net/redteaming/another-word-on-delegation/ author: '@neu5ron' date: 2017-07-30 modified: 2021-11-27 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows service: security definition: 'Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Audit Policies\Account Management\Audit User Account Management' detection: selection: EventID: 4738 olduac_des: OldUacValue|endswith: - 8??? - 9??? - A??? - B??? - C??? - D??? - E??? - F??? newuac_des: NewUacValue|endswith: - 8??? - 9??? - A??? - B??? - C??? - D??? - E??? - F??? olduac_preauth: OldUacValue|endswith: - 1???? - 3???? - 5???? - 7???? - 9???? - B???? - D???? - F???? newuac_preauth: NewUacValue|endswith: - 1???? - 3???? - 5???? - 7???? - 9???? - B???? - D???? - F???? olduac_encrypted: OldUacValue|endswith: - 8?? - 9?? - A?? - B?? - C?? - D?? - E?? - F?? newuac_encrypted: NewUacValue|endswith: - 8?? - 9?? - A?? - B?? - C?? - D?? - E?? - F?? condition: selection and ((newuac_des and not olduac_des) or (newuac_preauth and not olduac_preauth) or (newuac_encrypted and not olduac_encrypted)) falsepositives: - Unknown level: high