alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects attempts to create and add an account to the admin group via "sysadminctl". Logsource: macos / process_creation. Rule: title: User Added To Admin Group Via Sysadminctl id: 652c098d-dc11-4ba6-8566-c20e89042f2b related: - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b type: obsolete status: test description: Detects attempts to create and add an account to the admin group via "sysadminctl" references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos - https://ss64.com/osx/sysadminctl.html author: Sohan G (D4rkCiph3r) date: 2023-03-19 tags: - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1078.003 logsource: category: process_creation product: macos detection: selection: Image|endswith: /sysadminctl CommandLine|contains|all: - ' -addUser ' - ' -admin ' condition: selection falsepositives: - Legitimate administration activities level: medium
Sigma rule: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.. Logsource: windows / process_creation. Rule: title: Cloudflared Tunnel Connections Cleanup id: 7050bba1-1aed-454e-8f73-3f46f09ce56a status: test description: Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections. references: - https://github.com/cloudflare/cloudflared - https://developers.cloudflare.com/cloudflare-one/connections/connect-apps author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-17 modified: 2023-12-21 tags: - attack.command-and-control - attack.t1102 - attack.t1090 - attack.t1572 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - ' tunnel ' - 'cleanup ' CommandLine|contains: - '-config ' - '-connector-id ' condition: selection falsepositives: - Legitimate usage of Cloudflared. level: medium
Sigma rule: Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential. Logsource: linux / process_creation. Rule: title: Python Spawning Pretty TTY Via PTY Module id: c4042d54-110d-45dd-a0e1-05c47822c937 related: - id: 32e62bc7-3de0-4bb1-90af-532978fe42c0 type: similar status: test description: 'Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity. ' references: - https://www.volexity.com/blog/2022/06/02/zero-day-exploitation-of-atlassian-confluence/ author: Nextron Systems date: 2022-06-03 modified: 2024-11-04 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: linux detection: selection_img: - Image|endswith: - /python - /python2 - /python3 - Image|contains: - /python2. - /python3. selection_cli_import: CommandLine|contains: - import pty - 'from pty ' selection_cli_spawn: CommandLine|contains: spawn condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects remote RPC calls to read information about scheduled tasks via SASec. Logsource: rpc_firewall / application. Rule: title: Recon Activity via SASec id: 0a3ff354-93fc-4273-8a03-1078782de5b7 status: test description: Detects remote RPC calls to read information about scheduled tasks via SASec references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:378e52b0-c0a9-11cf-822d-00aa0051e40f"' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 378e52b0-c0a9-11cf-822d-00aa0051e40f filter: OpNum: - 0 - 1 condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse tha. Logsource: windows / network_connection. Rule: title: Network Connection Initiated To Cloudflared Tunnels Domains id: 7cd1dcdc-6edf-4896-86dc-d1f19ad64903 related: - id: a1d9eec5-33b2-4177-8d24-27fe754d0812 type: derived status: test description: 'Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. ' references: - https://defr0ggy.github.io/research/Abusing-Cloudflared-A-Proxy-Service-To-Host-Share-Applications/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - Internal Research author: Kamran Saifullah, Nasreddine Bencherchali (Nextron Systems) date: 2024-05-27 tags: - attack.exfiltration - attack.command-and-control - attack.t1567 - attack.t1572 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - .v2.argotunnel.com - protocol-v2.argotunnel.com - trycloudflare.com - update.argotunnel.com condition: selection falsepositives: - Legitimate use of cloudflare tunnels will also trigger this. level: medium
Sigma rule: Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information dis. Logsource: macos / process_creation. Rule: title: System Information Discovery Using Ioreg id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0 status: test description: 'Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings. ' references: - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html author: Joseliyo Sanchez, @Joseliyo_Jstnk date: 2023-12-20 modified: 2024-01-02 tags: - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /ioreg - CommandLine|contains: ioreg selection_cmd1: CommandLine|contains: - -l - -c selection_cmd2: CommandLine|contains: - AppleAHCIDiskDriver - IOPlatformExpertDevice - Oracle - Parallels - USB Vendor Name - VirtualBox - VMware condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Sigma rule: Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to. Logsource: windows / process_creation. Rule: title: Suspicious Copy From or To System Directory id: fff9d2b7-e11c-4a69-93d3-40ef66189767 related: - id: 855bc8b5-2ae8-402e-a9ed-b889e6df1900 type: derived status: test description: 'Detects a suspicious copy operation that tries to copy a program from system (System32, SysWOW64, WinSxS) directories to another on disk. Often used to move LOLBINs such as ''certutil'' or ''desktopimgdownldr'' to a different location with a different name in order to bypass detections based on locations. ' references: - https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120 - https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html - https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/ author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems) date: 2020-07-03 modified: 2026-03-16 tags: - attack.stealth - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_img_cmd: Image|endswith: \cmd.exe CommandLine|contains: 'copy ' selection_img_pwsh: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - copy-item - ' copy ' - 'cpi ' - ' cp ' selection_img_other: - Image|endswith: - \robocopy.exe - \xcopy.exe - OriginalFileName: - robocopy.exe - XCOPY.EXE selection_target: CommandLine|re|i: \s['"]?C:\\Windows\\(?:System32|SysWOW64|WinSxS) filter_optional_avira: Image|endswith: \cmd.exe CommandLine|contains|all: - /c copy - \Temp\ - \avira_system_speedup.exe CommandLine|contains: - C:\Program Files\Avira\ - C:\Program Files (x86)\Avira\ condition: 1 of selection_img_* and selection_target and not 1 of filter_optional_* falsepositives: - Depend on scripts and administrative tools used in the monitored environment (For example an admin scripts like https://www.itexperience.net/sccm-batch-files-and-32-bits-processes-on-64-bits-os/) - When cmd.exe and xcopy.exe are called directly - When the command contains the keywords but not in the correct order level: medium
Sigma rule: Detects suspicious user agent strings used in APT malware in proxy logs. Logsource: proxy. Rule: title: APT User Agent id: 6ec820f2-e963-4801-9127-d8b2dce4d31b status: test description: Detects suspicious user agent strings used in APT malware in proxy logs references: - Internal Research author: Florian Roth (Nextron Systems), Markus Neis date: 2019-11-12 modified: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection: c-useragent: - SJZJ (compatible; MSIE 6.0; Win32) - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/20.0 - 'User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC' - Mozilla/4.0 (compatible; MSIE 7.4; Win32;32-bit) - webclient - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/200 - Mozilla/4.0 (compatible; MSI 6.0; - Mozilla/5.0 (Windows NT 6.3; WOW64; rv:28.0) Gecko/20100101 Firefox/28.0 - Mozilla/5.0 (Windows NT 6.2; WOW64; rv:20.0) Gecko/20100101 Firefox/ - Mozilla/5.0 (Windows NT 6.; WOW64; rv:20.0) Gecko/20100101 Firefox/2 - Mozilla/4.0 - Netscape - Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-EN; rv:1.7.12) Gecko/20100719 Firefox/1.0.7 - Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.13) Firefox/3.6.13 GTB7.1 - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NETCLR 2.0.50727) - Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1) - Mozilla/4.0 (compatible; MSIE 11.0; Windows NT 6.1; SV1) - Mozilla/4.0 (compatible; MSIE 8.0; Win32) - Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 - Mozilla/6.1 (compatible; MSIE 9.0; Windows NT 5.3; Trident/5.0) - Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) - Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko - Mozilla v5.1 * - MSIE 8.0 - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) - Mozilla/4.0 (compatible; RMS) - Mozilla/4.0 (compatible; MSIE 6.0; DynGate) - O/9.27 (W; U; Z) - Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; Trident/5.0* - Mozilla/5.0 (Windows NT 9; * - hots scot - Mozilla/5.0 (compatible; MSIE 10.0; Windows NT) - Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 - Mozilla/5.0 (Windows NT 6.2; Win32; rv:47.0) - Mozilla/4.0 (compatibl
Sigma rule: Detects execution of the Windows Kernel Debugger "kd.exe".. Logsource: windows / process_creation. Rule: title: Windows Kernel Debugger Execution id: 27ee9438-90dc-4bef-904b-d3ef927f5e7e status: test description: Detects execution of the Windows Kernel Debugger "kd.exe". references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-15 modified: 2024-04-24 tags: - attack.privilege-escalation - attack.stealth logsource: category: process_creation product: windows detection: selection: - Image|endswith: \kd.exe - OriginalFileName: kd.exe condition: selection falsepositives: - Rare occasions of legitimate cases where kernel debugging is necessary in production. Investigation is required level: medium
Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files.. Logsource: windows / process_creation. Rule: title: Suspicious Download Via Certutil.EXE id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b related: - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2025-12-01 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: http condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_download/info.yml
Sigma rule: Detects keywords that could indicate clearing PowerShell history. Logsource: windows / ps_script. Rule: title: Clear PowerShell History - PowerShell id: 26b692dc-1722-49b2-b496-a8258aa6371d related: - id: dfba4ce1-e0ea-495f-986e-97140f31af2d type: derived status: test description: Detects keywords that could indicate clearing PowerShell history references: - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community date: 2022-01-25 modified: 2022-12-02 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection1a: ScriptBlockText|contains: - del - Remove-Item - rm selection1b: ScriptBlockText|contains: (Get-PSReadlineOption).HistorySavePath selection_2: ScriptBlockText|contains|all: - Set-PSReadlineOption - –HistorySaveStyle - SaveNothing selection_3: ScriptBlockText|contains|all: - Set-PSReadlineOption - -HistorySaveStyle - SaveNothing condition: 1 of selection_* or all of selection1* falsepositives: - Legitimate PowerShell scripts level: medium
Sigma rule: Detects a highly relevant Antivirus alert that reports a web shell. It's highly recommended to tune this rule to the spe. Logsource: antivirus. Rule: title: Antivirus - Web Shell Detection Signature id: fdf135a2-9241-4f96-a114-bb404948f736 status: test description: 'Detects a highly relevant Antivirus alert that reports a web shell. It''s highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. ' references: - https://www.nextron-systems.com/?s=antivirus - https://github.com/tennc/webshell - https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection - https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection - https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection - https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection - https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection - https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection - https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection - https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection author: Florian Roth (Nextron Systems), Arnim Rupp date: 2018-09-09 modified: 2026-06-29 tags: - attack.persistence - attack.t1505.003 logsource: category: antivirus detection: selection: - Signature|startswith: - ASP. - IIS/BackDoor - JAVA/Backdoor - JSP. - Perl. - PHP. - Troj/ASP - Troj/JSP - Troj/PHP - VBS/Uxor - Signature|contains: - ASP_ - 'ASP:' - ASP.Agent - ASP/ - Aspdoor - ASPXSpy - Backdoor.ASP - Backdoor.Java - Backdoor.JSP - Backdoor.PHP - Backdoor.VBS - Backdoor/ASP - Backdoor/Java - Backdoor/JSP - Backdoor/PHP - Backdoor/VBS - C99shell - Chopper - filebrowser - JSP_ - 'JSP:' - JSP.Agent - JSP/ - 'Perl:' - Perl/ - PHP_ - 'PHP:' - PHP.Agent - PHP/ - PHPShell - PShlSpy - SinoChoper - Trojan.ASP - Trojan.JSP - Trojan.PHP - Trojan.VBS - VBS.Agent - VBS/Agent - Webshell condition: selection falsepositives: - Unlikely level: high
Sigma rule: Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log. Logsource: windows / msexchange-management. Rule: title: Exchange Set OabVirtualDirectory ExternalUrl Property id: 9db37458-4df2-46a5-95ab-307e7f29e675 status: test description: Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log references: - https://twitter.com/OTR_Community/status/1371053369071132675 author: Jose Rodriguez @Cyb3rPandaH date: 2021-03-15 modified: 2023-01-23 tags: - attack.persistence - attack.t1505.003 logsource: product: windows service: msexchange-management detection: keywords: '|all': - Set-OabVirtualDirectory - ExternalUrl - Page_Load - script condition: keywords falsepositives: - Unknown level: high
Sigma rule: Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundle. Logsource: windows / process_creation. Rule: title: Uncommon Link.EXE Parent Process id: 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6 status: test description: 'Detects an uncommon parent process of "LINK.EXE". Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation. Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity. This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location. By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious. ' references: - https://twitter.com/0gtweet/status/1560732860935729152 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-22 modified: 2024-06-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: Image|endswith: \link.exe CommandLine|contains: LINK / filter_main_visual_studio: ParentImage|startswith: - C:\Program Files\Microsoft Visual Studio\ - C:\Program Files (x86)\Microsoft Visual Studio\ ParentImage|contains: - \VC\bin\ - \VC\Tools\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detect execution of suspicious double extension files in ParentCommandLine. Logsource: windows / process_creation. Rule: title: Suspicious Parent Double Extension File Execution id: 5e6a80c8-2d45-4633-9ef4-fa2671a39c5c related: - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 type: derived status: test description: Detect execution of suspicious double extension files in ParentCommandLine references: - https://www.virustotal.com/gui/file/7872d8845a332dce517adae9c3389fde5313ff2fed38c2577f3b498da786db68/behavior - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2023-01-06 modified: 2023-02-28 tags: - attack.stealth - attack.t1036.007 logsource: category: process_creation product: windows detection: selection: - ParentImage|endswith: - .doc.lnk - .docx.lnk - .xls.lnk - .xlsx.lnk - .ppt.lnk - .pptx.lnk - .rtf.lnk - .pdf.lnk - .txt.lnk - .doc.js - .docx.js - .xls.js - .xlsx.js - .ppt.js - .pptx.js - .rtf.js - .pdf.js - .txt.js - ParentCommandLine|contains: - .doc.lnk - .docx.lnk - .xls.lnk - .xlsx.lnk - .ppt.lnk - .pptx.lnk - .rtf.lnk - .pdf.lnk - .txt.lnk - .doc.js - .docx.js - .xls.js - .xlsx.js - .ppt.js - .pptx.js - .rtf.js - .pdf.js - .txt.js condition: selection falsepositives: - Unknown level: high
Sigma rule: Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal. Logsource: windows / process_creation. Rule: title: Suspicious Where Execution id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a status: test description: 'Adversaries may enumerate browser bookmarks to learn more about compromised hosts. Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2021-12-13 modified: 2022-06-29 tags: - attack.discovery - attack.t1217 logsource: category: process_creation product: windows detection: where_exe: - Image|endswith: \where.exe - OriginalFileName: where.exe where_opt: CommandLine|contains: - places.sqlite - cookies.sqlite - formhistory.sqlite - logins.json - key4.db - key3.db - sessionstore.jsonlz4 - History - Bookmarks - Cookies - Login Data condition: all of where_* falsepositives: - Unknown level: low
Sigma rule: DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel. Logsource: windows / ps_script. Rule: title: Powershell DNSExfiltration id: d59d7842-9a21-4bc6-ba98-64bfe0091355 status: test description: DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048/T1048.md#atomic-test-3---dnsexfiltration-doh - https://github.com/Arno0x/DNSExfiltrator author: frack113 date: 2022-01-07 tags: - attack.exfiltration - attack.t1048 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: - ScriptBlockText|contains: Invoke-DNSExfiltrator - ScriptBlockText|contains|all: - ' -i ' - ' -d ' - ' -p ' - ' -doh ' - ' -t ' condition: selection_cmdlet falsepositives: - Legitimate script level: high