alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cl. Logsource: windows / registry_add. Rule: title: Potential Persistence Via Disk Cleanup Handler - Registry id: d4f4e0be-cf12-439f-9e25-4e2cdcf7df5a status: test description: 'Detects when an attacker modifies values of the Disk Cleanup Handler in the registry to achieve persistence. The disk cleanup manager is part of the operating system. It displays the dialog box […] The user has the option of enabling or disabling individual handlers by selecting or clearing their check box in the disk cleanup manager''s UI. Although Windows comes with a number of disk cleanup handlers, they aren''t designed to handle files produced by other applications. Instead, the disk cleanup manager is designed to be flexible and extensible by enabling any developer to implement and register their own disk cleanup handler. Any developer can extend the available disk cleanup services by implementing and registering a disk cleanup handler. ' references: - https://persistence-info.github.io/Data/diskcleanuphandler.html - https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-02-07 tags: - attack.persistence logsource: product: windows category: registry_add detection: selection: EventType: CreateKey TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\VolumeCaches\ filter_main_default_keys: TargetObject|endswith: - \Active Setup Temp Folders - \BranchCache - \Content Indexer Cleaner - \D3D Shader Cache - \Delivery Optimization Files - \Device Driver Packages - \Diagnostic Data Viewer database files - \Downloaded Program Files - \DownloadsFolder - \Feedback Hub Archive log files - \Internet Cache Files - \Language Pack - \Microsoft Office Temp Files - \Offline Pages Files - \Old ChkDsk Files - \Previous Installations - \Recycle Bin - \RetailDemo Offline Content - \Setup Log Files - \System error memory dump files - \System error minidump files - \Temporary Files - \Temporary Setup Files - \Temporary Sync Files - \Thumbnail Cache - \Update Cleanup - \Upgrade Discarded Files - \User file versions - \Windows Defender - \Windows Error Reporting Files - \Windows ESD installation files - \Windows Upgrade Log Files condition: selection and not 1 of filter_main_* falsepositives: - Legitimate new entry added by windows level: medium
Sigma rule: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout. Logsource: windows / registry_set. Rule: title: Suspicious Keyboard Layout Load id: 34aa0252-6039-40ff-951f-939fd6ce47d8 status: test description: Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only references: - https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index - https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files author: Florian Roth (Nextron Systems) date: 2019-10-12 modified: 2023-08-17 tags: - attack.resource-development - attack.t1588.002 logsource: category: registry_set product: windows definition: 'Requirements: Sysmon config that monitors \Keyboard Layout\Preload subkey of the HKLU hives - see https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files' detection: selection_registry: TargetObject|contains: - \Keyboard Layout\Preload\ - \Keyboard Layout\Substitutes\ Details|contains: - 00000429 - 00050429 - 0000042a condition: selection_registry falsepositives: - Administrators or users that actually use the selected keyboard layouts (heavily depends on the organisation's user base) level: medium
Sigma rule: Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux. Logsource: windows / process_creation. Rule: title: Installation of WSL Kali-Linux id: eca8ae39-5c3c-4321-b538-9e64fe25822e status: experimental description: 'Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes. ' references: - https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e - https://learn.microsoft.com/en-us/windows/wsl/install author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-10-10 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_wsl_img: - Image|endswith: \wsl.exe - OriginalFileName: wsl selection_wsl_install: CommandLine|contains: - ' --install ' - ' -i ' selection_wsl_kali: CommandLine|contains: kali condition: all of selection_wsl_* falsepositives: - Legitimate installation or usage of Kali Linux WSL by administrators or security teams level: high
Sigma rule: Detects the creation of log files during a TeamViewer remote session. Logsource: windows / file_event. Rule: title: TeamViewer Remote Session id: 162ab1e4-6874-4564-853c-53ec3ab8be01 status: test description: Detects the creation of log files during a TeamViewer remote session references: - https://www.teamviewer.com/en-us/ author: Florian Roth (Nextron Systems) date: 2022-01-30 tags: - attack.command-and-control - attack.t1219.002 logsource: product: windows category: file_event detection: selection1: TargetFilename|endswith: - \TeamViewer\RemotePrinting\tvprint.db - \TeamViewer\TVNetwork.log selection2: TargetFilename|contains|all: - \TeamViewer - _Logfile.log condition: 1 of selection* falsepositives: - Legitimate uses of TeamViewer in an organisation level: medium
Sigma rule: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump th. Logsource: windows / process_creation. Rule: title: Process Access via TrolleyExpress Exclusion id: 4c0aaedc-154c-4427-ada0-d80ef9c9deb6 status: test description: Detects a possible process memory dump that uses the white-listed Citrix TrolleyExpress.exe filename as a way to dump the lsass process memory references: - https://twitter.com/_xpn_/status/1491557187168178176 - https://www.youtube.com/watch?v=Ie831jF0bb0 author: Florian Roth (Nextron Systems) date: 2022-02-10 modified: 2022-05-13 tags: - attack.stealth - attack.t1218.011 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - \TrolleyExpress 7 - \TrolleyExpress 8 - \TrolleyExpress 9 - \TrolleyExpress.exe 7 - \TrolleyExpress.exe 8 - \TrolleyExpress.exe 9 - '\TrolleyExpress.exe -ma ' renamed: Image|endswith: \TrolleyExpress.exe filter_renamed: OriginalFileName|contains: CtxInstall filter_empty: OriginalFileName: null condition: selection or ( renamed and not 1 of filter* ) falsepositives: - Unknown level: high
Sigma rule: Detects the use of the "capsh" utility to invoke a shell.. Logsource: linux / process_creation. Rule: title: Capsh Shell Invocation - Linux id: db1ac3be-f606-4e3a-89e0-9607cbe6b98a status: test description: 'Detects the use of the "capsh" utility to invoke a shell. ' references: - https://gtfobins.github.io/gtfobins/capsh/#shell - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) date: 2024-09-02 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection: Image|endswith: /capsh CommandLine|endswith: ' --' condition: selection falsepositives: - Unknown level: high
Sigma rule: Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes CronJob id: 1c71e254-6655-42c1-b2d6-5e4718d7fc0a status: test description: 'Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate. Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs. An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster. ' references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/ - https://kubernetes.io/docs/concepts/workloads/controllers/job/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ author: Austin Songer @austinsonger date: 2021-11-22 modified: 2022-12-18 tags: - attack.persistence - attack.t1053.003 - attack.privilege-escalation - attack.execution logsource: product: azure service: activitylogs detection: selection: operationName|startswith: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH - MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH operationName|endswith: - /CRONJOBS/WRITE - /JOBS/WRITE condition: selection falsepositives: - Azure Kubernetes CronJob/Job may be done by a system administrator. - If known behavior is causing false positives, it can be exempted from the rule. level: medium
Sigma rule: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted en. Logsource: linux / process_creation. Rule: title: Nohup Execution id: e4ffe466-6ff8-48d4-94bd-e32d1a6061e2 status: test description: Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments references: - https://gtfobins.github.io/gtfobins/nohup/ - https://en.wikipedia.org/wiki/Nohup - https://www.computerhope.com/unix/unohup.htm author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-06 tags: - attack.execution - attack.t1059.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: /nohup condition: selection falsepositives: - Administrators or installed processes that leverage nohup level: medium
Sigma rule: Detects suspicious user agent strings user by hack tools in proxy logs. Logsource: proxy. Rule: title: Hack Tool User Agent id: c42a3073-30fb-48ae-8c99-c23ada84b103 status: test description: Detects suspicious user agent strings user by hack tools in proxy logs references: - https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb - http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules author: Florian Roth (Nextron Systems) date: 2017-07-08 modified: 2022-07-07 tags: - attack.initial-access - attack.t1190 - attack.credential-access - attack.t1110 logsource: category: proxy detection: selection: c-useragent|contains: - (hydra) - ' arachni/' - ' BFAC ' - ' brutus ' - ' cgichk ' - core-project/1.0 - ' crimscanner/' - datacha0s - dirbuster - domino hunter - dotdotpwn - FHScan Core - floodgate - get-minimal - gootkit auto-rooter scanner - grendel-scan - ' inspath ' - internet ninja - jaascois - ' zmeu ' - masscan - ' metis ' - morfeus fucking scanner - n-stealth - nsauditor - pmafind - security scan - springenwerk - teh forest lobster - toata dragostea - ' vega/' - voideye - webshag - webvulnscan - ' whcc/' - ' Havij' - absinthe - bsqlbf - mysqloit - pangolin - sql power injector - sqlmap - sqlninja - uil2pn - ruler - Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729) condition: selection falsepositives: - Unknown level: high
Sigma rule: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is play. Logsource: azure / riskdetection. Rule: title: Anomalous Token id: 6555754e-5e7f-4a67-ad1c-4041c413a007 status: test description: Indicates that there are abnormal characteristics in the token such as an unusual token lifetime or a token that is played from an unfamiliar location. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow' date: 2023-08-07 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: anomalousToken condition: selection falsepositives: - We recommend investigating the sessions flagged by this detection in the context of other sign-ins from the user. level: high
Sigma rule: Detects password change for the logged-on user's via "ksetup.exe". Logsource: windows / process_creation. Rule: title: Logged-On User Password Change Via Ksetup.EXE id: c9783e20-4793-4164-ba96-d9ee483992c4 status: test description: Detects password change for the logged-on user's via "ksetup.exe" references: - https://learn.microsoft.com/en-gb/windows-server/administration/windows-commands/ksetup author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-06 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \ksetup.exe - OriginalFileName: ksetup.exe selection_cli: CommandLine|contains: ' /ChangePassword ' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as des. Logsource: windows / ps_script. Rule: title: Troubleshooting Pack Cmdlet Execution id: 03409c93-a7c7-49ba-9a4c-a00badf2a153 status: test description: Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS) references: - https://twitter.com/nas_bench/status/1537919885031772161 - https://lolbas-project.github.io/lolbas/Binaries/Msdt/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.stealth - attack.t1202 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Invoke-TroubleshootingPack - C:\Windows\Diagnostics\System\PCW - -AnswerFile - -Unattended condition: selection falsepositives: - Legitimate usage of "TroubleshootingPack" cmdlet for troubleshooting purposes level: medium
Sigma rule: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem. Logsource: linux / process_creation. Rule: title: Container Residence Discovery Via Proc Virtual FS id: 746c86fb-ccda-4816-8997-01386263acc4 status: test description: Detects potential container discovery via listing of certain kernel features in the "/proc" virtual filesystem references: - https://blog.skyplabs.net/posts/container-detection/ - https://stackoverflow.com/questions/20010199/how-to-determine-if-a-process-runs-inside-lxc-docker tags: - attack.discovery - attack.t1082 author: Seth Hanford date: 2023-08-23 logsource: category: process_creation product: linux detection: selection_tools: Image|endswith: - awk - /cat - grep - /head - /less - /more - /nl - /tail selection_procfs_kthreadd: CommandLine|contains: /proc/2/ selection_procfs_target: CommandLine|contains: /proc/ CommandLine|endswith: - /cgroup - /sched condition: selection_tools and 1 of selection_procfs_* falsepositives: - Legitimate system administrator usage of these commands - Some container tools or deployments may use these techniques natively to determine how they proceed with execution, and will need to be filtered level: low
Sigma rule: Exports the target Registry key and hides it in the specified alternate data stream.. Logsource: windows / create_stream_hash. Rule: title: Exports Registry Key To an Alternate Data Stream id: 0d7a9363-af70-4e7b-a3b7-1a176b7fbe84 status: test description: Exports the target Registry key and hides it in the specified alternate data stream. references: - https://lolbas-project.github.io/lolbas/Binaries/Regedit/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Oddvar Moe, Sander Wiebing, oscd.community date: 2020-10-07 modified: 2021-11-27 tags: - attack.stealth - attack.t1564.004 logsource: product: windows category: create_stream_hash detection: selection: Image|endswith: \regedit.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects potentially suspicious processes being spawned by a web server process which could be the result of a successful. Logsource: windows / process_creation. Rule: title: Suspicious Process By Web Server Process id: 8202070f-edeb-4d31-a010-a26c72ac5600 status: test description: 'Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation ' references: - https://media.defense.gov/2020/Jun/09/2002313081/-1/-1/0/CSI-DETECT-AND-PREVENT-WEB-SHELL-MALWARE-20200422.PDF author: Thomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2024-11-26 tags: - attack.persistence - attack.initial-access - attack.t1505.003 - attack.t1190 logsource: category: process_creation product: windows detection: selection_webserver_image: ParentImage|endswith: - \caddy.exe - \httpd.exe - \nginx.exe - \php-cgi.exe - \php.exe - \tomcat.exe - \UMWorkerProcess.exe - \w3wp.exe - \ws_TomcatService.exe selection_webserver_characteristics_tomcat1: ParentImage|endswith: - \java.exe - \javaw.exe ParentImage|contains: - -tomcat- - \tomcat selection_webserver_characteristics_tomcat2: ParentImage|endswith: - \java.exe - \javaw.exe ParentCommandLine|contains: - CATALINA_HOME - catalina.home - catalina.jar selection_anomaly_children: Image|endswith: - \arp.exe - \at.exe - \bash.exe - \bitsadmin.exe - \certutil.exe - \cmd.exe - \cscript.exe - \dsget.exe - \hostname.exe - \nbtstat.exe - \net.exe - \net1.exe - \netdom.exe - \netsh.exe - \nltest.exe - \ntdsutil.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \qprocess.exe - \query.exe - \qwinsta.exe - \reg.exe - \rundll32.exe - \sc.exe - \sh.exe - \wmic.exe - \wscript.exe - \wusa.exe filter_main_fp_1: ParentImage|endswith: \java.exe CommandLine|endswith: Windows\system32\cmd.exe /c C:\ManageEngine\ADManager "Plus\ES\bin\elasticsearch.bat -Enode.name=RMP-NODE1 -pelasticsearch-pid.txt filter_main_fp_2: ParentImage|endswith: \java.exe CommandLine|contains|all: - sc query - ADManager Plus condition: 1 of selection_webserver_* and selection_anomaly_children and not 1 of filter_main_* falsepositives: - Particular web applications may spawn a shell process legitimately level: high
Sigma rule: Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles. Logsource: windows / pipe_created. Rule: title: CobaltStrike Named Pipe Pattern Regex id: 0e7163d4-9e19-4fa7-9be6-000c61aad77a related: - id: 85adeb13-4fc9-4e68-8a4a-c7cb2c336eb7 type: similar - id: d5601f8c-b26f-4ab0-9035-69e11a8d4ad2 type: similar status: test description: Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles references: - https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 - https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752 author: Florian Roth (Nextron Systems) date: 2021-07-30 modified: 2026-06-18 tags: - attack.privilege-escalation - attack.stealth - attack.t1055 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can always use Cobalt Strike, but also you can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: - PipeName|re: \\mojo\.5688\.8052\.(?:183894939787088877|35780273329370473)[0-9a-f]{2} - PipeName|re: \\wkssvc_?[0-9a-f]{2} - PipeName|re: \\ntsvcs[0-9a-f]{2} - PipeName|re: \\DserNamePipe[0-9a-f]{2} - PipeName|re: \\SearchTextHarvester[0-9a-f]{2} - PipeName|re: \\mypipe-(?:f|h)[0-9a-f]{2} - PipeName|re: \\windows\.update\.manager[0-9a-f]{2,3} - PipeName|re: \\ntsvcs_[0-9a-f]{2} - PipeName|re: \\scerpc_?[0-9a-f]{2} - PipeName|re: \\PGMessagePipe[0-9a-f]{2} - PipeName|re: \\MsFteWds[0-9a-f]{2} - PipeName|re: \\f4c3[0-9a-f]{2} - PipeName|re: \\fullduplex_[0-9a-f]{2} - PipeName|re: \\msrpc_[0-9a-f]{4} - PipeName|re: \\win\\msrpc_[0-9a-f]{2} - PipeName|re: \\f53f[0-9a-f]{2}$ - PipeName|re: \\rpc_[0-9a-f]{2} - PipeName|re: \\spoolss_[0-9a-f]{2} - PipeName|re: \\Winsock2\\CatalogChangeListener-[0-9a-f]{3}-0, condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant.. Logsource: azure / auditlogs. Rule: title: Certificate-Based Authentication Enabled id: c2496b41-16a9-4016-a776-b23f8910dc58 status: test description: Detects when certificate based authentication has been enabled in an Azure Active Directory tenant. references: - https://posts.specterops.io/passwordless-persistence-and-privilege-escalation-in-azure-98a01310be3f - https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ author: Harjot Shah Singh, '@cyb3rjy0t' date: 2024-03-26 tags: - attack.credential-access - attack.persistence - attack.privilege-escalation - attack.defense-impairment - attack.t1556 logsource: product: azure service: auditlogs detection: selection: OperationName: Authentication Methods Policy Update TargetResources.modifiedProperties|contains: AuthenticationMethodsPolicy condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems sin. Logsource: windows / process_creation. Rule: title: Suspicious Kernel Dump Using Dtrace id: 7124aebe-4cd7-4ccb-8df0-6d6b93c96795 status: test description: Detects suspicious way to dump the kernel on Windows systems using dtrace.exe, which is available on Windows systems since Windows 10 19H1 references: - https://twitter.com/0gtweet/status/1474899714290208777?s=12 - https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace author: Florian Roth (Nextron Systems) date: 2021-12-28 tags: - attack.discovery - attack.t1082 logsource: product: windows category: process_creation detection: selection_plain: Image|endswith: \dtrace.exe CommandLine|contains: lkd(0) selection_obfuscated: CommandLine|contains|all: - syscall:::return - lkd( condition: 1 of selection* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump/info.yml