alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.. Logsource: windows / image_load. Rule: title: VMGuestLib DLL Sideload id: 70e8e9b4-6a93-4cb7-8cde-da69502e7aff status: test description: Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service. references: - https://decoded.avast.io/martinchlumecky/png-steganography/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-12-01 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|contains|all: - \VMware\VMware Tools\vmStatsProvider\win32 - \vmGuestLib.dll Image|endswith: \Windows\System32\wbem\WmiApSrv.exe filter: Signed: 'true' condition: selection and not filter falsepositives: - FP could occur if the legitimate version of vmGuestLib already exists on the system level: medium
Sigma rule: Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a. Logsource: windows / process_creation. Rule: title: Kavremover Dropped Binary LOLBIN Usage id: d047726b-c71c-4048-a99b-2e2f50dc107d status: test description: Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries. references: - https://nasbench.medium.com/lolbined-using-kaspersky-endpoint-security-kes-installer-to-execute-arbitrary-commands-1c999f1b7fea author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-01 tags: - attack.execution - attack.stealth - attack.t1127 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: ' run run-cmd ' filter_main_legit_parents: ParentImage|endswith: - \cleanapi.exe - \kavremover.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe proces. Logsource: windows / create_remote_thread. Rule: title: Password Dumper Remote Thread in LSASS id: f239b326-2f41-4d6b-9dfa-c846a60ef505 status: stable description: 'Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage. The process in field Process is the malicious program. A single execution can lead to hundreds of events. ' references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/WCE.htm author: Thomas Patzke date: 2017-02-19 modified: 2021-06-21 tags: - attack.credential-access - attack.s0005 - attack.t1003.001 logsource: product: windows category: create_remote_thread detection: selection: TargetImage|endswith: \lsass.exe StartModule: '' condition: selection falsepositives: - Antivirus products level: high
Sigma rule: Detects suspicious PowerShell invocation with a parameter substring. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parameter Substring id: 36210e0d-5b19-485d-a087-c096088885f0 status: test description: Detects suspicious PowerShell invocation with a parameter substring references: - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix) date: 2019-01-16 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -windowstyle h ' - ' -windowstyl h' - ' -windowsty h' - ' -windowst h' - ' -windows h' - ' -windo h' - ' -wind h' - ' -win h' - ' -wi h' - ' -win h ' - ' -win hi ' - ' -win hid ' - ' -win hidd ' - ' -win hidde ' - ' -NoPr ' - ' -NoPro ' - ' -NoProf ' - ' -NoProfi ' - ' -NoProfil ' - ' -nonin ' - ' -nonint ' - ' -noninte ' - ' -noninter ' - ' -nonintera ' - ' -noninterac ' - ' -noninteract ' - ' -noninteracti ' - ' -noninteractiv ' - ' -ec ' - ' -encodedComman ' - ' -encodedComma ' - ' -encodedComm ' - ' -encodedCom ' - ' -encodedCo ' - ' -encodedC ' - ' -encoded ' - ' -encode ' - ' -encod ' - ' -enco ' - ' -en ' - ' -executionpolic ' - ' -executionpoli ' - ' -executionpol ' - ' -executionpo ' - ' -executionp ' - ' -execution bypass' - ' -executio bypass' - ' -executi bypass' - ' -execut bypass' - ' -execu bypass' - ' -exec bypass' - ' -exe bypass' - ' -ex bypass' - ' -ep bypass' - ' /windowstyle h ' - ' /windowstyl h' - ' /windowsty h' - ' /windowst h' - ' /windows h' - ' /windo h' - ' /wind h' - ' /win h' - ' /wi h' - ' /win h ' - ' /win hi ' - ' /win hid ' - ' /win hidd ' - ' /win hidde ' - ' /NoPr ' - ' /NoPro ' - ' /NoProf ' - ' /NoProfi ' - ' /NoProfil ' - ' /nonin ' - ' /nonint ' - ' /noninte ' - ' /noninter ' - ' /nonintera ' - ' /noninterac ' - ' /noninteract ' - ' /noninteracti ' - ' /noninteractiv ' - ' /ec ' - ' /encodedComman ' - ' /encodedComma ' - ' /encodedComm ' - ' /encodedCom ' - ' /encodedCo ' - ' /encodedC ' - ' /encoded ' - ' /encode ' - ' /encod ' - ' /enco ' - ' /en ' - ' /executionpolic ' - ' /executionpoli ' - ' /executionpol ' - ' /executionpo ' - ' /executionp ' - ' /execution bypass' - ' /executio bypass' - ' /executi bypass' - ' /execut bypass' - ' /execu bypass' - ' /exec bypass' - ' /exe bypass' - ' /ex bypass' - ' /ep bypass' condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV. Logsource: windows / process_creation. Rule: title: Powershell Base64 Encoded MpPreference Cmdlet id: c6fb44c6-71f5-49e6-9462-1425d328aee3 status: test description: Detects base64 encoded "MpPreference" PowerShell cmdlet code that tries to modifies or tamper with Windows Defender AV references: - https://learn.microsoft.com/en-us/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md - https://twitter.com/AdamTheAnalyst/status/1483497517119590403 author: Florian Roth (Nextron Systems) date: 2022-03-04 modified: 2023-01-30 tags: - attack.defense-impairment - attack.t1685 logsource: category: process_creation product: windows detection: selection: - CommandLine|base64offset|contains: - 'Add-MpPreference ' - 'Set-MpPreference ' - 'add-mppreference ' - 'set-mppreference ' - CommandLine|contains: - QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA - EAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA - BAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA - UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgA - MAZQB0AC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIA - TAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAA - YQBkAGQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA - EAZABkAC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA - hAGQAZAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA - cwBlAHQALQBtAHAAcAByAGUAZgBlAHIAZQBuAGMAZQAgA - MAZQB0AC0AbQBwAHAAcgBlAGYAZQByAGUAbgBjAGUAIA - zAGUAdAAtAG0AcABwAHIAZQBmAGUAcgBlAG4AYwBlACAA condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the download of a file with a potentially suspicious extension from a .zip top level domain.. Logsource: windows / create_stream_hash. Rule: title: Potentially Suspicious File Download From ZIP TLD id: 0bb4bbeb-fe52-4044-b40c-430a04577ebe status: test description: Detects the download of a file with a potentially suspicious extension from a .zip top level domain. references: - https://twitter.com/cyb3rops/status/1659175181695287297 - https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/ author: Florian Roth (Nextron Systems) date: 2023-05-18 tags: - attack.stealth logsource: product: windows category: create_stream_hash detection: selection: Contents|contains: .zip/ TargetFilename|contains: - .bat:Zone - .dat:Zone - .dll:Zone - .doc:Zone - .docm:Zone - .exe:Zone - .hta:Zone - .pptm:Zone - .ps1:Zone - .rar:Zone - .rtf:Zone - .sct:Zone - .vbe:Zone - .vbs:Zone - .ws:Zone - .wsf:Zone - .xll:Zone - .xls:Zone - .xlsm:Zone - .zip:Zone condition: selection falsepositives: - Legitimate file downloads from a websites and web services that uses the ".zip" top level domain. level: high
Sigma rule: Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality`. Logsource: linux / auditd. Rule: title: ASLR Disabled Via Sysctl or Direct Syscall - Linux id: e497a24e-9345-4a62-9803-b06d7d7cb132 status: experimental description: "Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including:\n - Use of the\ \ `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000)\n - Modification of the /proc/sys/kernel/randomize_va_space\ \ file\n - Execution of the `sysctl` command to set `kernel.randomize_va_space=0`\nDisabling ASLR is often used by attackers\ \ during exploit development or to bypass memory protection mechanisms.\nA successful use of these methods can reduce the\ \ effectiveness of ASLR and make memory corruption attacks more reliable.\n" references: - https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md - https://man7.org/linux/man-pages/man2/personality.2.html - https://manual.cs50.io/2/personality - https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/ author: Milad Cheraghi date: 2025-05-26 modified: 2025-12-05 tags: - attack.privilege-escalation - attack.stealth - attack.defense-impairment - attack.t1685 - attack.t1055.009 logsource: product: linux service: auditd detection: selection_syscall: type: SYSCALL SYSCALL: personality a0: 40000 selection_sysctl: type: EXECVE a0: sysctl a1: -w a2: kernel.randomize_va_space=0 condition: 1 of selection_* falsepositives: - Debugging or legitimate software testing level: high
Sigma rule: Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. T. Logsource: windows / process_creation. Rule: title: Renamed ZOHO Dctask64 Execution id: 340a090b-c4e9-412e-bb36-b4b16fe96f9b status: test description: 'Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution. ' references: - https://twitter.com/gN3mes1s/status/1222088214581825540 - https://twitter.com/gN3mes1s/status/1222095963789111296 - https://twitter.com/gN3mes1s/status/1222095371175911424 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2020-01-28 modified: 2025-01-22 tags: - attack.privilege-escalation - attack.stealth - attack.t1036 - attack.t1055.001 - attack.t1202 - attack.t1218 logsource: category: process_creation product: windows detection: selection: Hashes|contains: - IMPHASH=6834B1B94E49701D77CCB3C0895E1AFD - IMPHASH=1BB6F93B129F398C7C4A76BB97450BBA - IMPHASH=FAA2AC19875FADE461C8D89DCF2710A3 - IMPHASH=F1039CED4B91572AB7847D26032E6BBF filter_main_legit_name: Image|endswith: \dctask64.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: See what commands are being input into the device by other people, full credentials can be in the history. Logsource: cisco / aaa. Rule: title: Cisco Show Commands Input id: b094d9fb-b1ad-4650-9f1a-fb7be9f1d34b status: test description: See what commands are being input into the device by other people, full credentials can be in the history author: Austin Clark date: 2019-08-11 modified: 2023-01-04 tags: - attack.credential-access - attack.t1552.003 logsource: product: cisco service: aaa detection: keywords: - show history - show history all - show logging condition: keywords falsepositives: - Not commonly run by administrators, especially if remote logging is configured level: medium
Sigma rule: Detects potential DLL sideloading of "vivaldi_elf.dll". Logsource: windows / image_load. Rule: title: Potential Vivaldi_elf.DLL Sideloading id: 2092cacb-d77b-4f98-ab0d-32b32f99a054 status: test description: Detects potential DLL sideloading of "vivaldi_elf.dll" references: - https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/ author: X__Junior (Nextron Systems) date: 2023-08-03 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vivaldi_elf.dll filter_main_legit_path: Image|endswith: \Vivaldi\Application\vivaldi.exe ImageLoaded|contains: \Vivaldi\Application\ condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been. Logsource: linux / process_creation. Rule: title: Remote Access Tool - Team Viewer Session Started On Linux Host id: 1f6b8cd4-3e60-47cc-b282-5aa1cbc9182d related: - id: ab70c354-d9ac-4e11-bbb6-ec8e3b153357 type: similar - id: f459ccb4-9805-41ea-b5b2-55e279e2424a type: similar status: test description: 'Detects the command line executed when TeamViewer starts a session started by a remote host. Once a connection has been started, an investigator can verify the connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder. ' references: - Internal Research author: Josh Nickels, Qi Nan date: 2024-03-11 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: /TeamViewer_Service Image|endswith: /TeamViewer_Desktop CommandLine|endswith: /TeamViewer_Desktop --IPCport 5939 --Module 1 condition: selection falsepositives: - Legitimate usage of TeamViewer level: low
Sigma rule: Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections.. Logsource: windows / process_creation. Rule: title: Process Launched Without Image Name id: f208d6d8-d83a-4c2c-960d-877c37da84e5 status: test description: Detect the use of processes with no name (".exe"), which can be used to evade Image-based detections. references: - https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software author: Matt Anderson (Huntress) date: 2024-07-23 tags: - attack.stealth logsource: category: process_creation product: windows detection: selection: Image|endswith: \.exe condition: selection falsepositives: - Rare legitimate software. level: medium
Sigma rule: Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2. Logsource: windows / network_connection. Rule: title: Suspicious Non-Browser Network Communication With Telegram API id: c3dbbc9f-ef1d-470a-a90a-d343448d5875 status: test description: Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2 references: - https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/small-sieve/NCSC-MAR-Small-Sieve.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-19 tags: - attack.command-and-control - attack.exfiltration - attack.t1102 - attack.t1567 - attack.t1105 logsource: product: windows category: network_connection detection: selection: DestinationHostname|contains: api.telegram.org filter_main_brave: Image|endswith: \brave.exe filter_main_chrome: Image: - C:\Program Files\Google\Chrome\Application\chrome.exe - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe filter_main_firefox: Image: - C:\Program Files\Mozilla Firefox\firefox.exe - C:\Program Files (x86)\Mozilla Firefox\firefox.exe filter_main_ie: Image: - C:\Program Files (x86)\Internet Explorer\iexplore.exe - C:\Program Files\Internet Explorer\iexplore.exe filter_main_maxthon: Image|endswith: \maxthon.exe filter_main_edge_1: - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\ - Image|endswith: \WindowsApps\MicrosoftEdge.exe - Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe filter_main_edge_2: Image|startswith: - C:\Program Files (x86)\Microsoft\EdgeCore\ - C:\Program Files\Microsoft\EdgeCore\ Image|endswith: - \msedge.exe - \msedgewebview2.exe filter_main_opera: Image|endswith: \opera.exe filter_main_safari: Image|endswith: \safari.exe filter_main_seamonkey: Image|endswith: \seamonkey.exe filter_main_vivaldi: Image|endswith: \vivaldi.exe filter_main_whale: Image|endswith: \whale.exe condition: selection and not 1 of filter_main_* falsepositives: - Legitimate applications communicating with the Telegram API e.g. web browsers not in the exclusion list, app with an RSS etc. level: medium
Sigma rule: Detects when changes are made to PIM roles. Logsource: azure / auditlogs. Rule: title: Changes To PIM Settings id: db6c06c4-bf3b-421c-aa88-15672b88c743 status: test description: Detects when changes are made to PIM roles references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H' date: 2022-08-09 tags: - attack.initial-access - attack.privilege-escalation - attack.persistence - attack.stealth - attack.t1078.004 logsource: product: azure service: auditlogs detection: selection: properties.message: Update role setting in PIM condition: selection falsepositives: - Legit administrative PIM setting configuration changes level: high
Sigma rule: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection ch. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Encoded Command Patterns id: b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c status: test description: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains references: - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/ author: Florian Roth (Nextron Systems) date: 2022-05-24 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.Exe - pwsh.dll selection_flags: CommandLine|contains: - ' -e ' - ' -en ' - ' -enc ' - ' -enco' selection_encoded: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aWV4I' - ' IAB' - ' PAA' - ' aQBlAHgA' filter_gcworker: ParentImage|contains: - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\ - \gc_worker.exe condition: all of selection_* and not 1 of filter_* falsepositives: - Other tools that work with encoded scripts in the command line instead of script files level: high
Sigma rule: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svc. Logsource: windows / registry_set. Rule: title: Scheduled TaskCache Change by Uncommon Program id: 4720b7df-40c3-48fd-bbdf-fd4b3c464f0d status: test description: Monitor the creation of a new key under 'TaskCache' when a new scheduled task is registered by a process that is not svchost.exe, which is suspicious references: - https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/ - https://labs.f-secure.com/blog/scheduled-task-tampering/ author: Syed Hasan (@syedhasan009) date: 2021-06-18 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1053 - attack.t1053.005 logsource: category: registry_set product: windows detection: selection: TargetObject|contains: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\ filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_other: TargetObject|contains: - Microsoft\Windows\UpdateOrchestrator - Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask\Index - Microsoft\Windows\Flighting\OneSettings\RefreshCache\Index filter_main_mousocoreworker: Image|endswith: C:\Windows\System32\MoUsoCoreWorker.exe filter_main_services: Image|endswith: C:\Windows\System32\services.exe filter_main_tiworker: Image|startswith: C:\Windows\ Image|endswith: \TiWorker.exe filter_main_svchost: Image: C:\WINDOWS\system32\svchost.exe filter_main_ngen: Image|startswith: C:\Windows\Microsoft.NET\Framework Image|endswith: \ngen.exe TargetObject|contains: - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B66B135D-DA06-4FC4-95F8-7458E1D10129} - \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\.NET Framework\.NET Framework NGEN filter_main_office: Image: - C:\Program Files\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files (x86)\Microsoft Office\root\Integration\Integrator.exe - C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe - C:\Program Files (x86)\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe filter_main_msiexec: Image: C:\Windows\System32\msiexec.exe filter_main_explorer: Image: C:\Windows\explorer.exe TargetObject|contains: \Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\PLA\Server Manager Performance Monitor\ filter_main_system: Image: System filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe filter_optional_dropbox_updater: Image: - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe - C:\Program Files\Dropbox\Update
Sigma rule: Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in ord. Logsource: windows / process_creation. Rule: title: Potential Application Whitelisting Bypass via Dnx.EXE id: 81ebd28b-9607-4478-bf06-974ed9d53ed7 status: test description: 'Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code. Attackers might abuse this in order to bypass application whitelisting. ' references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/ - https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/ author: Beyu Denis, oscd.community date: 2019-10-26 modified: 2024-04-24 tags: - attack.stealth - attack.t1218 - attack.t1027.004 logsource: category: process_creation product: windows detection: selection: Image|endswith: \dnx.exe condition: selection falsepositives: - Legitimate use of dnx.exe by legitimate user level: medium
Sigma rule: Detect use of PDQ Deploy remote admin tool. Logsource: windows / process_creation. Rule: title: PDQ Deploy Remote Adminstartion Tool Execution id: d679950c-abb7-43a6-80fb-2a480c4fc450 related: - id: 12b8e9f5-96b2-41e1-9a42-8c6779a5c184 type: similar status: test description: Detect use of PDQ Deploy remote admin tool references: - https://github.com/redcanaryco/atomic-red-team/blob/9e5b12c4912c07562aec7500447b11fa3e17e254/atomics/T1072/T1072.md - https://www.pdq.com/pdq-deploy/ author: frack113 date: 2022-10-01 modified: 2023-01-30 tags: - attack.execution - attack.lateral-movement - attack.t1072 logsource: category: process_creation product: windows detection: selection: - Description: PDQ Deploy Console - Product: PDQ Deploy - Company: PDQ.com - OriginalFileName: PDQDeployConsole.exe condition: selection falsepositives: - Legitimate use level: medium