alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where t. Logsource: windows / ps_module. Rule: title: Zip A Folder With PowerShell For Staging In Temp - PowerShell Module id: daf7eb81-35fd-410d-9d7a-657837e602bb related: - id: 71ff406e-b633-4989-96ec-bc49d825a412 type: similar - id: b7a3c9a3-09ea-4934-8864-6a32cacd98d9 type: similar - id: 85a8e5ba-bd03-4bfb-bbfa-a4409a8f8b98 type: similar status: test description: 'Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2021-07-20 modified: 2023-12-18 tags: - attack.collection - attack.t1074.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains|all: - Compress-Archive -Path*-DestinationPath $env:TEMP - Compress-Archive -Path*-DestinationPath*\AppData\Local\Temp\ - Compress-Archive -Path*-DestinationPath*:\Windows\Temp\ condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious IIS native-code module installations via command line. Logsource: windows / process_creation. Rule: title: IIS Native-Code Module Command Line Installation id: 9465ddf4-f9e4-4ebd-8d98-702df3a93239 status: test description: Detects suspicious IIS native-code module installations via command line references: - https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/ - https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ author: Florian Roth (Nextron Systems) date: 2019-12-11 modified: 2024-03-13 tags: - attack.persistence - attack.t1505.003 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \appcmd.exe - OriginalFileName: appcmd.exe selection_cli: CommandLine|contains|all: - install - module CommandLine|contains|windash: '-name:' filter_iis_setup: ParentImage: C:\Windows\System32\inetsrv\iissetup.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown as it may vary from organisation to organisation how admins use to install IIS modules level: medium
Sigma rule: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or M. Logsource: m365 / threat_management. Rule: title: Suspicious OAuth App File Download Activities id: ee111937-1fe7-40f0-962a-0eb44d57d174 status: test description: Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. references: - https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy - https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference author: Austin Songer @austinsonger date: 2021-08-23 modified: 2022-10-09 tags: - attack.exfiltration logsource: service: threat_management product: m365 detection: selection: eventSource: SecurityComplianceCenter eventName: Suspicious OAuth app file download activities status: success condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts at. Logsource: windows / ps_script. Rule: title: WMIC Unquoted Services Path Lookup - PowerShell id: 09658312-bc27-4a3b-91c5-e49ab9046d1b related: - id: 68bcd73b-37ef-49cb-95fc-edc809730be6 type: similar status: test description: Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts references: - https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py - https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1 - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2022-11-25 tags: - attack.execution - attack.t1047 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'Get-WmiObject ' - 'gwmi ' ScriptBlockText|contains|all: - ' Win32_Service ' - Name - DisplayName - PathName - StartMode condition: selection falsepositives: - Unknown level: medium
Sigma rule: Commandline to launch powershell with a base64 payload. Logsource: windows / process_creation. Rule: title: Suspicious Execution of Powershell with Base64 id: fb843269-508c-4b76-8b8d-88679db22ce7 status: test description: Commandline to launch powershell with a base64 payload references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets - https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ - https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/ author: frack113 date: 2022-01-02 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' - ' -ec ' filter_encoding: CommandLine|contains: ' -Encoding ' filter_azure: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: medium
Sigma rule: Detects potential overwriting and deletion of a file using DD.. Logsource: linux / process_creation. Rule: title: DD File Overwrite id: 2953194b-e33c-4859-b9e8-05948c167447 status: test description: Detects potential overwriting and deletion of a file using DD. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-2---macoslinux---overwrite-file-with-dd author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC date: 2021-10-15 modified: 2022-07-07 tags: - attack.impact - attack.t1485 logsource: product: linux category: process_creation detection: selection1: Image: - /bin/dd - /usr/bin/dd selection2: CommandLine|contains: of= selection3: CommandLine|contains: - if=/dev/zero - if=/dev/null condition: all of selection* falsepositives: - Any user deleting files that way. level: low
Sigma rule: Detects the use of Windows Defender MpCmdRun.EXE to download files. Logsource: windows / process_creation. Rule: title: File Download Via Windows Defender MpCmpRun.EXE id: 46123129-1024-423e-9fae-43af4a0fa9a5 status: test description: Detects the use of Windows Defender MpCmdRun.EXE to download files references: - https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866 - https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/ author: Matthew Matchen date: 2020-09-04 modified: 2023-11-09 tags: - attack.stealth - attack.t1218 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: MpCmdRun.exe - Image|endswith: \MpCmdRun.exe - CommandLine|contains: MpCmdRun.exe - Description: Microsoft Malware Protection Command Line Utility selection_cli: CommandLine|contains|all: - DownloadFile - url condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permission. Logsource: windows / ps_script. Rule: title: Potentially Suspicious Call To Win32_NTEventlogFile Class - PSScript id: e2812b49-bae0-4b21-b366-7c142eafcde2 status: test description: Detects usage of the WMI class "Win32_NTEventlogFile" in a potentially suspicious way (delete, backup, change permissions, etc.) from a PowerShell script references: - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/aa394225(v=vs.85) author: Nasreddine Bencherchali (Nextron Systems) date: 2023-07-13 tags: - attack.defense-impairment logsource: category: ps_script product: windows definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection_class: ScriptBlockText|contains: Win32_NTEventlogFile selection_function: ScriptBlockText|contains: - .BackupEventlog( - .ChangeSecurityPermissions( - .ChangeSecurityPermissionsEx( - .ClearEventLog( - .Delete( - .DeleteEx( - .Rename( - .TakeOwnerShip( - .TakeOwnerShipEx( condition: all of selection_* falsepositives: - Legitimate administration and backup scripts level: medium
Sigma rule: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by. Logsource: windows / process_creation. Rule: title: Boot Configuration Tampering Via Bcdedit.EXE id: 1444443e-6757-43e4-9ea4-c8fc705f79a2 status: stable description: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_set: CommandLine|contains: set selection_cli: - CommandLine|contains|all: - bootstatuspolicy - ignoreallfailures - CommandLine|contains|all: - recoveryenabled - 'no' condition: all of selection_* falsepositives: - Unlikely level: high simulation: - type: atomic-red-team name: Windows - Disable Windows Recovery Console Repair technique: T1490 atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81
Sigma rule: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class. Logsource: windows / image_load. Rule: title: Potential DCOM InternetExplorer.Application DLL Hijack - Image Load id: f354eba5-623b-450f-b073-0b5b2773b6aa related: - id: e554f142-5cf3-4e55-ace9-a1b59e0def65 type: obsolete - id: 2f7979ae-f82b-45af-ac1d-2b10e93b0baa type: similar status: test description: Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteDCOMIErtUtilDLLHijack/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR), wagga date: 2020-10-12 modified: 2022-12-18 tags: - attack.lateral-movement - attack.t1021.002 - attack.t1021.003 logsource: product: windows category: image_load detection: selection: Image|endswith: \Internet Explorer\iexplore.exe ImageLoaded|endswith: \Internet Explorer\iertutil.dll condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects execution of PktMon, a tool that captures network packets.. Logsource: windows / process_creation. Rule: title: PktMon.EXE Execution id: f956c7c1-0f60-4bc5-b7d7-b39ab3c08908 status: test description: Detects execution of PktMon, a tool that captures network packets. references: - https://lolbas-project.github.io/lolbas/Binaries/Pktmon/ author: frack113 date: 2022-03-17 modified: 2023-06-23 tags: - attack.discovery - attack.credential-access - attack.t1040 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \pktmon.exe - OriginalFileName: PktMon.exe condition: selection falsepositives: - Legitimate use level: medium
Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data. Logsource: windows / ps_script. Rule: title: Recon Information for Export with PowerShell id: a9723fcc-881c-424c-8709-fd61442ab3c3 status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md author: frack113 date: 2021-07-30 modified: 2022-12-25 tags: - attack.collection - attack.t1119 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_action: ScriptBlockText|contains: - 'Get-Service ' - 'Get-ChildItem ' - 'Get-Process ' selection_redirect: ScriptBlockText|contains: '> $env:TEMP\' condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for. Logsource: windows / driver_load. Rule: title: Vulnerable HackSys Extreme Vulnerable Driver Load id: 295c9289-acee-4503-a571-8eacaef36b28 status: test description: Detects the load of HackSys Extreme Vulnerable Driver which is an intentionally vulnerable Windows driver developed for security enthusiasts to learn and polish their exploitation skills at Kernel level and often abused by threat actors references: - https://github.com/hacksysteam/HackSysExtremeVulnerableDriver author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-18 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1543.003 logsource: product: windows category: driver_load detection: selection: - ImageLoaded|endswith: \HEVD.sys - Hashes|contains: - IMPHASH=f26d0b110873a1c7d8c4f08fbeab89c5 - IMPHASH=c46ea2e651fd5f7f716c8867c6d13594 condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detection use of the command "split" to split files into parts and possible transfer.. Logsource: linux / auditd. Rule: title: Split A File Into Pieces - Linux id: 2dad0cba-c62a-4a4f-949f-5f6ecd619769 status: test description: Detection use of the command "split" to split files into parts and possible transfer. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1030/T1030.md author: Igor Fits, oscd.community date: 2020-10-15 modified: 2022-11-28 tags: - attack.exfiltration - attack.t1030 logsource: product: linux service: auditd detection: selection: type: SYSCALL comm: split condition: selection falsepositives: - Legitimate administrative activity level: low
Sigma rule: Identifies when an ElastiCache security group has been modified or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS ElastiCache Security Group Modified or Deleted id: 7c797da2-9cf2-4523-ba64-33b06339f0cc status: test description: Identifies when an ElastiCache security group has been modified or deleted. references: - https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml author: Austin Songer @austinsonger date: 2021-07-24 modified: 2022-10-09 tags: - attack.impact - attack.t1531 logsource: product: aws service: cloudtrail detection: selection: eventSource: elasticache.amazonaws.com eventName: - DeleteCacheSecurityGroup - AuthorizeCacheSecurityGroupIngress - RevokeCacheSecurityGroupIngress - AuthorizeCacheSecurityGroupEgress - RevokeCacheSecurityGroupEgress condition: selection falsepositives: - A ElastiCache security group deletion may be done by a system or network administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Security Group deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Sigma rule: Detects a suspicious WinRAR execution in a folder which is not the default installation folder. Logsource: windows / process_creation. Rule: title: WinRAR Execution in Non-Standard Folder id: 4ede543c-e098-43d9-a28f-dd784a13132f status: test description: Detects a suspicious WinRAR execution in a folder which is not the default installation folder references: - https://twitter.com/cyb3rops/status/1460978167628406785 author: Florian Roth (Nextron Systems), Tigzy date: 2021-11-17 modified: 2025-07-16 tags: - attack.collection - attack.t1560.001 logsource: category: process_creation product: windows detection: selection: - Image|endswith: - \rar.exe - \winrar.exe - Description: - Command line RAR - WinRAR filter_main_unrar: Image|endswith: \UnRAR.exe filter_main_path: Image|contains: - :\Program Files (x86)\WinRAR\ - :\Program Files\WinRAR\ filter_optional_temp: Image|contains: :\Windows\Temp\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate use of WinRAR in a folder of a software that bundles WinRAR level: medium
Sigma rule: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option.. Logsource: windows / iis-configuration. Rule: title: ETW Logging/Processing Option Disabled On IIS Server id: a5b40a90-baf5-4bf7-a6f7-373494881d22 status: test description: Detects changes to of the IIS server configuration in order to disable/remove the ETW logging/processing option. references: - https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis - https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ - https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/ author: frack113, Nasreddine Bencherchali date: 2024-10-06 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1505.004 logsource: product: windows service: iis-configuration detection: selection: EventID: 29 Configuration|endswith: '@logTargetW3C' OldValue|contains: ETW filter_main_etw_added: NewValue|contains: ETW condition: selection and not 1 of filter_main_* falsepositives: - Legitimate administrator activity level: medium
Sigma rule: Detects disabling, deleting and updating of a Trail. Logsource: aws / cloudtrail. Rule: title: AWS CloudTrail Important Change id: 4db60cc0-36fb-42b7-9b58-a5b53019fb74 status: test description: Detects disabling, deleting and updating of a Trail references: - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html author: vitaliy0x1 date: 2020-01-21 modified: 2022-10-09 tags: - attack.defense-impairment - attack.t1685.002 logsource: product: aws service: cloudtrail detection: selection_source: eventSource: cloudtrail.amazonaws.com eventName: - StopLogging - UpdateTrail - DeleteTrail condition: selection_source falsepositives: - Valid change in a Trail level: medium
Sigma rule: Detects access to ADMIN$ network share. Logsource: windows / security. Rule: title: Access To ADMIN$ Network Share id: 098d7118-55bc-4912-a836-dc6483a8d150 status: test description: Detects access to ADMIN$ network share references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140 author: Florian Roth (Nextron Systems) date: 2017-03-04 modified: 2024-01-16 tags: - attack.lateral-movement - attack.t1021.002 logsource: product: windows service: security definition: 'Requirements: The advanced audit policy setting "Object Access > Audit File Share" must be configured for Success/Failure' detection: selection: EventID: 5140 ShareName: Admin$ filter_main_computer_account: SubjectUserName|endswith: $ condition: selection and not 1 of filter_* falsepositives: - Legitimate administrative activity level: low
Sigma rule: Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive. Logsource: aws / cloudtrail. Rule: title: PUA - AWS TruffleHog Execution id: a840e606-7c8c-4684-9bc1-eb6b6155127f status: experimental description: 'Detects the execution of TruffleHog, a popular open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. It has been reported to be used by threat actors for credential harvesting. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-21 tags: - attack.credential-access - attack.t1555 - attack.t1003 logsource: product: aws service: cloudtrail detection: selection: userAgent: TruffleHog condition: selection falsepositives: - Legitimate use of TruffleHog by security teams for credential scanning. level: medium
Sigma rule: Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML.. Logsource: aws / cloudtrail. Rule: title: AWS Suspicious SAML Activity id: f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e status: test description: Identifies when suspicious SAML activity has occurred in AWS. An adversary could gain backdoor access via SAML. references: - https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html - https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html author: Austin Songer date: 2021-09-22 modified: 2022-12-18 tags: - attack.initial-access - attack.lateral-movement - attack.persistence - attack.privilege-escalation - attack.stealth - attack.t1078 - attack.t1548 - attack.t1550 - attack.t1550.001 logsource: product: aws service: cloudtrail detection: selection_sts: eventSource: sts.amazonaws.com eventName: AssumeRoleWithSAML selection_iam: eventSource: iam.amazonaws.com eventName: UpdateSAMLProvider condition: 1 of selection_* falsepositives: - Automated processes that uses Terraform may lead to false positives. - SAML Provider could be updated by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - SAML Provider being updated from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow un. Logsource: aws / cloudtrail. Rule: title: AWS Bedrock Guardrail Updated id: 1c722651-254a-4b04-a9f4-99b62a2d0a1f status: experimental description: 'Detects updates to an Amazon Bedrock guardrail, which may indicate attempts to weaken model safety controls and allow unsafe or unauthorized model responses. ' references: - https://docs.aws.amazon.com/bedrock/latest/APIReference/API_UpdateGuardrail.html author: Marco Pedrinazzi (@pedrinazziM) (InTheCyber) date: 2026-07-10 tags: - attack.defense-impairment - attack.t1685 logsource: product: aws service: cloudtrail detection: selection: eventName: UpdateGuardrail eventSource: bedrock.amazonaws.com condition: selection falsepositives: - Legitimate guardrail updates by authorized identities. level: medium