alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for. Logsource: windows / process_creation. Rule: title: PUA - NimScan Execution id: 4fd6b1c7-19b8-4488-97f6-00f0924991a3 status: test description: 'Detects usage of NimScan, a portscanner utility. In early 2025, adversaries were observed using this utility to scan for open ports on remote hosts in a compromised environment. This rule identifies the execution of NimScan based on the process image name and specific hash values associated with different versions of the tool. ' references: - https://x.com/cyberfeeddigest/status/1887041526397587859 - https://github.com/elddy/NimScan author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-02-05 tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \NimScan.exe - Hashes|contains: - IMPHASH=41BB1C7571B3A724EB83A1D2B96DBB8C - IMPHASH=B1B6ADACB172795480179EFD18A29549 - IMPHASH=0D1F896DC7642AD8384F9042F30279C2 condition: selection falsepositives: - Legitimate administrator activity level: medium
Sigma rule: Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused b. Logsource: macos / process_creation. Rule: title: JAMF MDM Execution id: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49 status: test description: 'Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices. ' references: - https://github.com/MythicAgents/typhon/ - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html author: Jay Pandit date: 2023-08-22 tags: - attack.execution logsource: category: process_creation product: macos detection: selection: Image|endswith: /jamf CommandLine|contains: - createAccount - manage - removeFramework - removeMdmProfile - resetPassword - setComputerName condition: selection falsepositives: - Legitimate use of the JAMF CLI tool by IT support and administrators level: low
Sigma rule: Detects a potentially suspicious execution from an uncommon folder.. Logsource: windows / process_creation. Rule: title: Process Execution From A Potentially Suspicious Folder id: 3dfd06d2-eaf4-4532-9555-68aca59f57c4 status: test description: Detects a potentially suspicious execution from an uncommon folder. references: - https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt - https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses - https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/ - https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md author: Florian Roth (Nextron Systems), Tim Shelton date: 2019-01-16 modified: 2024-07-12 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: Image|contains: - :\Perflogs\ - :\Users\All Users\ - :\Users\Default\ - :\Users\NetworkService\ - :\Windows\addins\ - :\Windows\debug\ - :\Windows\Fonts\ - :\Windows\Help\ - :\Windows\IME\ - :\Windows\Media\ - :\Windows\repair\ - :\Windows\security\ - :\Windows\System32\Tasks\ - :\Windows\Tasks\ - $Recycle.bin - \config\systemprofile\ - \Intel\Logs\ - \RSA\MachineKeys\ filter_optional_ibm: Image|startswith: C:\Users\Public\IBM\ClientSolutions\Start_Programs\ filter_optional_citrix: Image|startswith: C:\Windows\SysWOW64\config\systemprofile\Citrix\UpdaterBinaries\ Image|endswith: \CitrixReceiverUpdater.exe condition: selection and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actor. Logsource: windows / process_creation. Rule: title: Remote Access Tool - Potential MeshAgent Execution - Windows id: 2fbbe9ff-0afc-470b-bdc0-592198339968 related: - id: 22c45af6-f590-4d44-bab3-b5b2d2a2b6d9 type: similar status: experimental description: 'Detects potential execution of MeshAgent which is a tool used for remote access. Historical data shows that threat actors rename MeshAgent binary to evade detection. Matching command lines with the ''--meshServiceName'' argument can indicate that the MeshAgent is being used for remote access. ' references: - https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access - https://thecyberexpress.com/ukraine-hit-by-meshagent-malware-campaign/ - https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ - https://www.security.com/threat-intelligence/medusa-ransomware-attacks author: Norbert Jaśniewicz (AlphaSOC) date: 2025-05-19 tags: - attack.command-and-control - attack.t1219.002 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: --meshServiceName condition: selection falsepositives: - Environments that legitimately use MeshAgent level: medium
Sigma rule: Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the se. Logsource: windows / registry_set. Rule: title: MaxMpxCt Registry Value Changed id: 0e6a9e62-627e-496c-aef5-bfa39da29b5e status: test description: 'Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic. ' references: - https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps - https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware - https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 - https://www.sentinelone.com/labs/blackcat-ransomware-highly-configurable-rust-driven-raas-on-the-prowl-for-victims/ author: Nasreddine Bencherchali (Nextron Systems) date: 2024-03-19 tags: - attack.stealth - attack.t1070.005 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Services\LanmanServer\Parameters\MaxMpxCt condition: selection falsepositives: - Unknown level: low
Sigma rule: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud.. Logsource: gcp / gcp.audit. Rule: title: Google Cloud VPN Tunnel Modified or Deleted id: 99980a85-3a61-43d3-ac0f-b68d6b4797b1 status: test description: Identifies when a VPN Tunnel Modified or Deleted in Google Cloud. references: - https://any-api.com/googleapis_com/compute/docs/vpnTunnels author: Austin Songer @austinsonger date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact logsource: product: gcp service: gcp.audit detection: selection: gcp.audit.method_name: - compute.vpnTunnels.insert - compute.vpnTunnels.delete condition: selection falsepositives: - VPN Tunnel being modified or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - VPN Tunnel modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adve. Logsource: aws / cloudtrail. Rule: title: SES Identity Has Been Deleted id: 20f754db-d025-4a8f-9d74-e0037e999a9a status: test description: Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities references: - https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/ author: Janantha Marasinghe date: 2022-12-13 modified: 2022-12-28 tags: - attack.stealth - attack.t1070 logsource: product: aws service: cloudtrail detection: selection: eventSource: ses.amazonaws.com eventName: DeleteIdentity condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects Obfuscated use of Environment Variables to execute PowerShell. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation VAR+ Launcher - PowerShell id: 0adfbc14-0ed1-11eb-adc1-0242ac120002 status: test description: Detects Obfuscated use of Environment Variables to execute PowerShell references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Jonathan Cheong, oscd.community date: 2020-10-15 modified: 2024-04-05 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*" condition: selection_4104 falsepositives: - Unknown level: high
Sigma rule: Detects programs on a Windows system that should not write an archive to disk. Logsource: windows / file_event. Rule: title: Legitimate Application Dropped Archive id: 654fcc6d-840d-4844-9b07-2c3300e54a26 status: test description: Detects programs on a Windows system that should not write an archive to disk references: - https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326 author: frack113, Florian Roth date: 2022-08-21 tags: - attack.stealth - attack.t1218 logsource: product: windows category: file_event detection: selection: Image|endswith: - \winword.exe - \excel.exe - \powerpnt.exe - \msaccess.exe - \mspub.exe - \eqnedt32.exe - \visio.exe - \wordpad.exe - \wordview.exe - \certutil.exe - \certoc.exe - \CertReq.exe - \Desktopimgdownldr.exe - \esentutl.exe - \finger.exe - \notepad.exe - \AcroRd32.exe - \RdrCEF.exe - \mshta.exe - \hh.exe TargetFilename|endswith: - .zip - .rar - .7z - .diagcab - .appx condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\M. Logsource: windows / process_creation. Rule: title: File Download Via InstallUtil.EXE id: 75edd216-1939-4c73-8d61-7f3a0d85b5cc status: test description: 'Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\" ' references: - https://github.com/LOLBAS-Project/LOLBAS/pull/239 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \InstallUtil.exe - OriginalFileName: InstallUtil.exe selection_cli: CommandLine|contains: - ftp:// - http:// - https:// condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution. Logsource: windows / system. Rule: title: Important Windows Eventlog Cleared id: 100ef69e-3327-481c-8e5c-6d80d9507556 related: - id: a62b37e0-45d3-48d9-a517-90c1a1b0186b type: derived status: test description: Detects the clearing of one of the Windows Core Eventlogs. e.g. caused by "wevtutil cl" command execution references: - https://twitter.com/deviouspolack/status/832535435960209408 - https://www.hybrid-analysis.com/sample/027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745?environmentId=100 author: Florian Roth (Nextron Systems), Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2022-05-17 modified: 2023-11-15 tags: - attack.defense-impairment - attack.t1685.005 - car.2016-04-002 logsource: product: windows service: system detection: selection: EventID: 104 Provider_Name: Microsoft-Windows-Eventlog Channel: - Microsoft-Windows-PowerShell/Operational - Microsoft-Windows-Sysmon/Operational - PowerShellCore/Operational - Security - System - Windows PowerShell condition: selection falsepositives: - Rollout of log collection agents (the setup routine often includes a reset of the local Eventlog) - System provisioning (system reset before the golden image creation) level: high
Sigma rule: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files'). Logsource: windows / process_creation. Rule: title: Remote Access Tool - RURAT Execution From Unusual Location id: e01fa958-6893-41d4-ae03-182477c5e77d status: test description: Detects execution of Remote Utilities RAT (RURAT) from an unusual location (outside of 'C:\Program Files') references: - https://redcanary.com/blog/misbehaving-rats/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-19 modified: 2023-03-05 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rutserv.exe - \rfusclient.exe - Product: Remote Utilities filter: Image|startswith: - C:\Program Files\Remote Utilities - C:\Program Files (x86)\Remote Utilities condition: selection and not filter falsepositives: - Unknown level: medium
Sigma rule: Detects user permission data export attempt.. Logsource: bitbucket / audit. Rule: title: Bitbucket User Permissions Export Attempt id: 87cc6698-3e07-4ba2-9b43-a85a73e151e2 status: test description: Detects user permission data export attempt. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/users-and-groups-776640439.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.reconnaissance - attack.collection - attack.discovery - attack.t1213 - attack.t1082 - attack.t1591.004 logsource: product: bitbucket service: audit definition: 'Requirements: "Advance" log level is required to receive these audit events.' detection: selection: auditType.category: Users and groups auditType.action: - User details export failed - User details export started - User details exported condition: selection falsepositives: - Legitimate user activity. level: medium
Sigma rule: Detects potential DLL sideloading of "dbghelp.dll". Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of DBGHELP.DLL id: 6414b5cd-b19d-447e-bb5e-9f03940b5784 status: test description: Detects potential DLL sideloading of "dbghelp.dll" references: - https://hijacklibs.net/ author: Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research) date: 2022-10-25 modified: 2025-10-07 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \dbghelp.dll filter_main_generic: ImageLoaded|startswith: - C:\Program Files (x86)\ - C:\Program Files\ - C:\Windows\SoftwareDistribution\ - C:\Windows\System32\ - C:\Windows\SystemTemp\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_optional_anaconda: ImageLoaded|endswith: - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\amd64\dbghelp.dll - \Anaconda3\Lib\site-packages\vtrace\platforms\windll\i386\dbghelp.dll filter_optional_epicgames: ImageLoaded|endswith: - \Epic Games\Launcher\Engine\Binaries\ThirdParty\DbgHelp\dbghelp.dll - \Epic Games\MagicLegends\x86\dbghelp.dll filter_optional_opera: ImageLoaded|contains: opera\Opera Installer Temp\opera_package ImageLoaded|endswith: \assistant\dbghelp.dll condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate applications loading their own versions of the DLL mentioned in this rule level: medium
Sigma rule: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension. Logsource: windows / process_creation. Rule: title: Cscript/Wscript Uncommon Script Extension Execution id: 99b7460d-c9f1-40d7-a316-1f36f61d52ee status: test description: Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2023-06-19 tags: - attack.execution - attack.t1059.005 - attack.t1059.007 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: - wscript.exe - cscript.exe - Image|endswith: - \wscript.exe - \cscript.exe selection_extension: CommandLine|contains: - .csv - .dat - .doc - .gif - .jpeg - .jpg - .png - .ppt - .txt - .xls - .xml condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI b. Logsource: windows / file_event. Rule: title: UEFI Persistence Via Wpbbin - FileCreation id: e94b9ddc-eec5-4bb8-8a58-b9dc5f4e185f status: test description: Detects creation of a file named "wpbbin" in the "%systemroot%\system32\" directory. Which could be indicative of UEFI based persistence method references: - https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c - https://persistence-info.github.io/Data/wpbbin.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-18 tags: - attack.persistence - attack.stealth - attack.t1542.001 logsource: product: windows category: file_event detection: selection: TargetFilename: C:\Windows\System32\wpbbin.exe condition: selection falsepositives: - Legitimate usage of the file by hardware manufacturer such as lenovo (Thanks @0gtweet for the tip) level: high
Sigma rule: Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish p. Logsource: macos / file_event. Rule: title: Startup Item File Created - MacOS id: dfe8b941-4e54-4242-b674-6b613d521962 status: test description: 'Detects the creation of a startup item plist file, that automatically get executed at boot initialization to establish persistence. Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1037.005/T1037.005.md - https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html author: Alejandro Ortuno, oscd.community date: 2020-10-14 modified: 2024-08-11 tags: - attack.persistence - attack.privilege-escalation - attack.t1037.005 logsource: category: file_event product: macos detection: selection: TargetFilename|startswith: - /Library/StartupItems/ - /System/Library/StartupItems TargetFilename|endswith: .plist condition: selection falsepositives: - Legitimate administration activities level: low
Sigma rule: Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-b. Logsource: windows / registry_delete. Rule: title: Windows Credential Guard Related Registry Value Deleted - Registry id: d645ef86-2396-48a1-a2b6-b629ca3f57ff related: - id: c17d47b7-dcd6-4109-87eb-d1817bd4cbc9 type: similar status: experimental description: 'Detects attempts to disable Windows Credential Guard by deleting registry values. Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Adversaries may disable Credential Guard to gain access to sensitive credentials stored in the system, such as NTLM hashes and Kerberos tickets, which can be used for lateral movement and privilege escalation. ' references: - https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50 - https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-12-26 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_delete product: windows detection: selection: TargetObject|endswith: - \DeviceGuard\EnableVirtualizationBasedSecurity - \DeviceGuard\LsaCfgFlags - \DeviceGuard\RequirePlatformSecurityFeatures - \Lsa\LsaCfgFlags condition: selection falsepositives: - Unlikely level: high regression_tests_path: regression_data/rules/windows/registry/registry_delete/registry_delete_disable_credential_guard/info.yml
Sigma rule: Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for f. Logsource: windows / file_event. Rule: title: Suspicious Executable File Creation id: 74babdd6-a758-4549-9632-26535279e654 status: test description: 'Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths. ' references: - https://medium.com/@SumitVerma101/windows-privilege-escalation-part-1-unquoted-service-path-c7a011a8d8ae - https://app.any.run/tasks/76c69e2d-01e8-49d9-9aea-fb7cc0c4d3ad/ author: frack113 date: 2022-09-05 modified: 2023-12-11 tags: - attack.stealth - attack.t1564 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - :\$Recycle.Bin.exe - :\Documents and Settings.exe - :\MSOCache.exe - :\PerfLogs.exe - :\Recovery.exe - .bat.exe - .sys.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Transferring files with well-known filenames (sensitive files with credential data) using network shares. Logsource: windows / security. Rule: title: Transferring Files with Credential Data via Network Shares id: 910ab938-668b-401b-b08c-b596e80fdca5 related: - id: 2e69f167-47b5-4ae7-a390-47764529eff5 type: similar status: test description: Transferring files with well-known filenames (sensitive files with credential data) using network shares references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment author: Teymur Kheirkhabarov, oscd.community date: 2019-10-22 modified: 2025-07-11 tags: - attack.credential-access - attack.t1003.002 - attack.t1003.001 - attack.t1003.003 logsource: product: windows service: security detection: selection_eid: EventID: 5145 selection_object: - RelativeTargetName|contains: - \mimidrv - \lsass - \windows\minidump\ - \hiberfil - \sqldmpr - RelativeTargetName: - Windows\NTDS\ntds.dit - Windows\System32\config\SAM - Windows\System32\config\SECURITY - Windows\System32\config\SYSTEM condition: all of selection_* falsepositives: - Transferring sensitive files for legitimate administration work by legitimate administrator level: medium