alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. Thes. Logsource: windows / ps_script. Rule: title: Suspicious Get-ADReplAccount id: 060c3ef1-fd0a-4091-bf46-e7d625f60b73 status: test description: 'The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation. ' references: - https://www.powershellgallery.com/packages/DSInternals - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount author: frack113 date: 2022-02-06 tags: - attack.credential-access - attack.t1003.006 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Get-ADReplAccount - '-All ' - '-Server ' condition: selection falsepositives: - Legitimate PowerShell scripts level: medium
Sigma rule: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons. Logsource: windows / dns_query. Rule: title: Suspicious Cobalt Strike DNS Beaconing - Sysmon id: f356a9c4-effd-4608-bbf8-408afd5cd006 related: - id: 0d18728b-f5bf-4381-9dcf-915539fff6c2 type: similar status: test description: Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons references: - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/ author: Florian Roth (Nextron Systems) date: 2021-11-09 modified: 2023-01-16 tags: - attack.command-and-control - attack.t1071.004 logsource: product: windows category: dns_query detection: selection1: QueryName|startswith: - aaa.stage. - post.1 selection2: QueryName|contains: .stage.123456. condition: 1 of selection* falsepositives: - Unknown level: critical
Sigma rule: Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attacke. Logsource: windows / process_creation. Rule: title: Insensitive Subfolder Search Via Findstr.EXE id: 04936b66-3915-43ad-a8e5-809eadfd1141 related: - id: bf6c39fc-e203-45b9-9538-05397c1b4f3f type: obsolete status: test description: 'Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Findstr/ - https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/ - https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) date: 2020-10-05 modified: 2024-03-05 tags: - attack.credential-access - attack.command-and-control - attack.stealth - attack.t1218 - attack.t1564.004 - attack.t1552.001 - attack.t1105 logsource: category: process_creation product: windows detection: selection_findstr: - CommandLine|contains: findstr - Image|endswith: findstr.exe - OriginalFileName: FINDSTR.EXE selection_cli_search_subfolder: CommandLine|contains|windash: ' -s ' selection_cli_search_insensitive: CommandLine|contains|windash: ' -i ' condition: selection_findstr and all of selection_cli_search_* falsepositives: - Administrative or software activity level: low
Sigma rule: Indicates that the user's valid credentials have been leaked.. Logsource: azure / riskdetection. Rule: title: Azure AD Account Credential Leaked id: 19128e5e-4743-48dc-bd97-52e5775af817 status: test description: Indicates that the user's valid credentials have been leaked. references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#leaked-credentials - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-03 tags: - attack.t1589 - attack.reconnaissance logsource: product: azure service: riskdetection detection: selection: riskEventType: leakedCredentials condition: selection falsepositives: - A rare hash collision. level: high
Sigma rule: Detects svchost hosting RDP termsvcs communicating with the loopback address. Logsource: windows / security. Rule: title: RDP over Reverse SSH Tunnel WFP id: 5bed80b6-b3e8-428e-a3ae-d3c757589e41 status: test description: Detects svchost hosting RDP termsvcs communicating with the loopback address references: - https://twitter.com/SBousseaden/status/1096148422984384514 - https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/44fbe85f72ee91582876b49678f9a26292a155fb/Command%20and%20Control/DE_RDP_Tunnel_5156.evtx author: Samir Bousseaden date: 2019-02-16 modified: 2022-09-02 tags: - attack.command-and-control - attack.lateral-movement - attack.t1090.001 - attack.t1090.002 - attack.t1021.001 - car.2013-07-002 logsource: product: windows service: security detection: selection: EventID: 5156 sourceRDP: SourcePort: 3389 DestAddress: - 127.* - ::1 destinationRDP: DestPort: 3389 SourceAddress: - 127.* - ::1 filter_app_container: FilterOrigin: AppContainer Loopback filter_thor: Application|endswith: - \thor.exe - \thor64.exe condition: selection and ( sourceRDP or destinationRDP ) and not 1 of filter* falsepositives: - Programs that connect locally to the RDP port level: high
Sigma rule: Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipeliner. Logsource: windows / process_creation. Rule: title: Suspicious AddinUtil.EXE CommandLine Execution id: 631b22a4-70f4-4e2f-9ea8-42f84d9df6d8 status: test description: 'Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \addinutil.exe - OriginalFileName: AddInUtil.exe selection_susp_1_flags: CommandLine|contains: - '-AddInRoot:' - '-PipelineRoot:' selection_susp_1_paths: CommandLine|contains: - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ selection_susp_2: CommandLine|contains: - -AddInRoot:. - -AddInRoot:"." - -PipelineRoot:. - -PipelineRoot:"." CurrentDirectory|contains: - \AppData\Local\Temp\ - \Desktop\ - \Downloads\ - \Users\Public\ - \Windows\Temp\ condition: selection_img and (all of selection_susp_1_* or selection_susp_2) falsepositives: - Unknown level: high
Sigma rule: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~". Logsource: webserver. Rule: title: Successful IIS Shortname Fuzzing Scan id: 7cb02516-6d95-4ffc-8eee-162075e111ac status: test description: When IIS uses an old .Net Framework it's possible to enumerate folders with the symbol "~" references: - https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml - https://www.exploit-db.com/exploits/19525 - https://github.com/lijiejie/IIS_shortname_Scanner author: frack113 date: 2021-10-06 modified: 2023-01-02 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: ~1 cs-uri-query|endswith: a.aspx cs-method: - GET - OPTIONS sc-status: - 200 - 301 condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instan. Logsource: windows / process_creation. Rule: title: Suspicious Chromium Browser Instance Executed With Custom Extension id: 27ba3207-dd30-4812-abbf-5d20c57d474e related: - id: 88d6e60c-759d-4ac1-a447-c0f1466c2d21 type: similar status: test description: Detects a suspicious process spawning a Chromium based browser process with the 'load-extension' flag to start an instance with a custom extension references: - https://redcanary.com/blog/chromeloader/ - https://emkc.org/s/RJjuLa - https://www.mandiant.com/resources/blog/lnk-between-browsers author: Aedan Russell, frack113, X__Junior (Nextron Systems) date: 2022-06-19 modified: 2023-11-28 tags: - attack.persistence - attack.t1176.001 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \cmd.exe - \cscript.exe - \mshta.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \wscript.exe Image|endswith: - \brave.exe - \chrome.exe - \msedge.exe - \opera.exe - \vivaldi.exe CommandLine|contains: --load-extension= condition: selection falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension/info.yml
Sigma rule: Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files. Logsource: windows / process_creation. Rule: title: Use Icacls to Hide File to Everyone id: 4ae81040-fc1c-4249-bfa3-938d260214d9 status: test description: Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files references: - https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/ author: frack113 date: 2022-07-18 modified: 2024-04-29 tags: - attack.stealth - attack.t1564.001 logsource: category: process_creation product: windows detection: selection_icacls: - OriginalFileName: iCACLS.EXE - Image|endswith: \icacls.exe selection_cmd: CommandLine|contains|all: - /deny - '*S-1-1-0:' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox s. Logsource: windows / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 related: - id: 6d8c3d20-a5e1-494f-8412-4571d716cf5c type: similar status: test description: 'Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases ' references: - https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo author: Florian Roth (Nextron Systems) date: 2017-03-19 modified: 2024-03-12 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationPort: - 100 - 198 - 200 - 243 - 473 - 666 - 700 - 743 - 777 - 1443 - 1515 - 1777 - 1817 - 1904 - 1960 - 2443 - 2448 - 3360 - 3675 - 3939 - 4040 - 4433 - 4438 - 4443 - 4444 - 4455 - 5445 - 5552 - 5649 - 6625 - 7210 - 7777 - 8143 - 8843 - 9631 - 9943 - 10101 - 12102 - 12103 - 12322 - 13145 - 13394 - 13504 - 13505 - 13506 - 13507 - 14102 - 14103 - 14154 - 49180 - 65520 - 65535 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 filter_optional_sys_directories: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file. Logsource: windows / ps_script. Rule: title: Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell id: db885529-903f-4c5d-9864-28fe199e6370 related: - id: 435e10e4-992a-4281-96f3-38b11106adde type: similar status: test description: Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/ - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-11-17 tags: - attack.discovery - attack.t1033 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - 'Get-ADComputer ' - ' -Filter \*' ScriptBlockText|contains: - ' | Select ' - Out-File - Set-Content - Add-Content condition: selection falsepositives: - Legitimate admin scripts may use the same technique, it's better to exclude specific computers or users who execute these commands or scripts often level: medium
Sigma rule: Detects the execution of SecurityXploded Tools. Logsource: windows / process_creation. Rule: title: HackTool - SecurityXploded Execution id: 7679d464-4f74-45e2-9e01-ac66c5eb041a status: stable description: Detects the execution of SecurityXploded Tools references: - https://securityxploded.com/ - https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/ author: Florian Roth (Nextron Systems) date: 2018-12-19 modified: 2023-02-04 tags: - attack.credential-access - attack.t1555 logsource: category: process_creation product: windows detection: selection: - Company: SecurityXploded - Image|endswith: PasswordDump.exe - OriginalFileName|endswith: PasswordDump.exe condition: selection falsepositives: - Unlikely level: critical
Sigma rule: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended bloc. Logsource: windows / process_creation. Rule: title: Use of VisualUiaVerifyNative.exe id: b30a8bc5-e21b-4ca2-9420-0a94019ac56a status: test description: VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac - https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/ - https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \VisualUiaVerifyNative.exe - OriginalFileName: VisualUiaVerifyNative.exe condition: selection falsepositives: - Legitimate testing of Microsoft UI parts. level: medium
Sigma rule: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe". Logsource: windows / process_creation. Rule: title: Lolbin Unregmp2.exe Use As Proxy id: 727454c0-d851-48b0-8b89-385611ab0704 status: test description: Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe" references: - https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/ author: frack113 date: 2022-12-29 modified: 2024-06-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \unregmp2.exe - OriginalFileName: unregmp2.exe selection_cmd: CommandLine|contains|windash: ' /HideWMP' condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\C. Logsource: windows / registry_event. Rule: title: Esentutl Volume Shadow Copy Service Keys id: 5aad0995-46ab-41bd-a9ff-724f41114971 status: test description: Detects the volume shadow copy service initialization and processing via esentutl. Registry keys such as HKLM\\System\\CurrentControlSet\\Services\\VSS\\Diag\\VolSnap\\Volume are captured. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-3---esentutlexe-sam-copy author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.002 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: System\CurrentControlSet\Services\VSS Image|endswith: esentutl.exe filter: TargetObject|contains: System\CurrentControlSet\Services\VSS\Start condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can. Logsource: windows / file_event. Rule: title: PowerShell Profile Modification id: b5b78988-486d-4a80-b991-930eff3ff8bf status: test description: Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence references: - https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/ - https://persistence-info.github.io/Data/powershellprofile.html author: HieuTT35, Nasreddine Bencherchali (Nextron Systems) date: 2019-10-24 modified: 2023-10-23 tags: - attack.persistence - attack.privilege-escalation - attack.t1546.013 logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: - \Microsoft.PowerShell_profile.ps1 - \PowerShell\profile.ps1 - \Program Files\PowerShell\7-preview\profile.ps1 - \Program Files\PowerShell\7\profile.ps1 - \Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - \WindowsPowerShell\profile.ps1 condition: selection falsepositives: - System administrator creating Powershell profile manually level: medium
Sigma rule: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the networ. Logsource: windows / file_event. Rule: title: Wmiprvse Wbemcomn DLL Hijack - File id: 614a7e17-5643-4d89-b6fe-f9df1a79641c status: test description: Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. references: - https://threathunterplaybook.com/hunts/windows/201009-RemoteWMIWbemcomnDLLHijack/notebook.html author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2020-10-12 modified: 2022-12-02 tags: - attack.execution - attack.t1047 - attack.lateral-movement - attack.t1021.002 logsource: product: windows category: file_event detection: selection: Image: System TargetFilename|endswith: \wbem\wbemcomn.dll condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. Logsource: linux / process_creation. Rule: title: Pnscan Binary Data Transmission Activity id: 97de11cd-4b67-4abf-9a8b-1020e670aa9e status: test description: 'Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT ' author: David Burkett (@signalblur) date: 2024-04-16 references: - https://www.cadosecurity.com/blog/spinning-yarn-a-new-linux-malware-campaign-targets-docker-apache-hadoop-redis-and-confluence - https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf - https://regex101.com/r/RugQYK/1 - https://www.virustotal.com/gui/file/beddf70a7bab805f0c0b69ac0989db6755949f9f68525c08cb874988353f78a9/content tags: - attack.discovery - attack.t1046 logsource: category: process_creation product: linux detection: selection: CommandLine|re: -(W|R)\s?(\s|"|')([0-9a-fA-F]{2}\s?){2,20}(\s|"|') condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload a. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Via VMware Xfer id: 9313dc13-d04c-46d8-af4a-a930cc55d93b status: test description: Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL references: - https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-02 modified: 2023-02-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574.001 logsource: product: windows category: image_load detection: selection: Image|endswith: \VMwareXferlogs.exe ImageLoaded|endswith: \glib-2.0.dll filter: ImageLoaded|startswith: C:\Program Files\VMware\ condition: selection and not filter falsepositives: - Unlikely level: high
Sigma rule: Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory re. Logsource: windows / process_creation. Rule: title: HackTool - WinPwn Execution id: d557dc06-62e8-4468-a8e8-7984124908ce related: - id: 851fd622-b675-4d26-b803-14bc7baa517a type: similar status: test description: 'Detects commandline keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation. ' author: Swachchhanda Shrawan Poudel date: 2023-12-04 references: - https://github.com/S3cur3Th1sSh1t/WinPwn - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841 - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/ - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team tags: - attack.credential-access - attack.discovery - attack.execution - attack.privilege-escalation - attack.t1046 - attack.t1082 - attack.t1106 - attack.t1518 - attack.t1548.002 - attack.t1552.001 - attack.t1555 - attack.t1555.003 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Offline_Winpwn - 'WinPwn ' - WinPwn.exe - WinPwn.ps1 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects when secret scanning rule is deleted for the project or repository.. Logsource: bitbucket / audit. Rule: title: Bitbucket Secret Scanning Rule Deleted id: ff91e3f0-ad15-459f-9a85-1556390c138d status: test description: Detects when secret scanning rule is deleted for the project or repository. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: - Projects - Repositories auditType.action: - Project secret scanning rule deleted - Repository secret scanning rule deleted condition: selection falsepositives: - Legitimate user activity. level: low