alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification id: 480421f9-417f-4d3b-9552-fd2728443ec8 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_wow_nt_current_version_base: TargetObject|contains: \SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion selection_wow_nt_current_version: TargetObject|contains: - \Windows\Appinit_Dlls - \Image File Execution Options - \Drivers32 filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_file_exec_options: Details|endswith: \Microsoft\Windows NT\CurrentVersion\Image File Execution Options condition: all of selection_* and not 1 of filter_main_* falsepositives: - Legitimate software automatically (mostly, during installation) sets up autorun keys for legitimate reason - Legitimate administrator sets up autorun keys for legitimate reason level: medium
Sigma rule: Detects when attackers or tools disable Windows Defender functionalities via the Windows registry. Logsource: windows / registry_set. Rule: title: Disable Windows Defender Functionalities Via Registry Keys id: 0eb46774-f1ab-4a74-8238-1155855f2263 related: - id: a64e4198-c1c8-46a5-bc9c-324c86455fd4 type: obsolete - id: fd115e64-97c7-491f-951c-fc8da7e042fa type: obsolete status: test description: Detects when attackers or tools disable Windows Defender functionalities via the Windows registry references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105 - https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker - https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html - https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html - https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html - https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/ author: AlertIQ, Ján Trenčanský, frack113, Nasreddine Bencherchali, Swachchhanda Shrawan Poudel date: 2022-08-01 modified: 2024-10-07 tags: - attack.defense-impairment - attack.t1685 logsource: product: windows category: registry_set detection: selection_main: TargetObject|contains: - \SOFTWARE\Microsoft\Windows Defender\ - \SOFTWARE\Policies\Microsoft\Windows Defender Security Center\ - \SOFTWARE\Policies\Microsoft\Windows Defender\ selection_dword_1: TargetObject|endswith: - \DisableAntiSpyware - \DisableAntiVirus - \DisableBehaviorMonitoring - \DisableBlockAtFirstSeen - \DisableEnhancedNotifications - \DisableIntrusionPreventionSystem - \DisableIOAVProtection - \DisableOnAccessProtection - \DisableRealtimeMonitoring - \DisableScanOnRealtimeEnable - \DisableScriptScanning Details: DWORD (0x00000001) selection_dword_0: TargetObject|endswith: - \DisallowExploitProtectionOverride - \Features\TamperProtection - \MpEngine\MpEnablePus - \PUAProtection - \Signature Update\ForceUpdateFromMU - \SpyNet\SpynetReporting - \SpyNet\SubmitSamplesConsent - \Windows Defender Exploit Guard\Controlled Folder Access\EnableControlledFolderAccess Details: DWORD (0x00000000) filter_optional_symantec: Image|startswith: C:\Program Files\Symantec\Symantec Endpoint Protection\ Image|endswith: \sepWscSvc64.exe condition: selection_main and 1 of selection_dword_*
Sigma rule: Detects enumeration of local or remote network services.. Logsource: linux / auditd. Rule: title: Linux Network Service Scanning - Auditd id: 3761e026-f259-44e6-8826-719ed8079408 related: - id: 3e102cd9-a70d-4a7a-9508-403963092f31 type: derived status: test description: Detects enumeration of local or remote network services. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md author: Alejandro Ortuno, oscd.community date: 2020-10-21 modified: 2023-09-26 tags: - attack.discovery - attack.t1046 logsource: product: linux service: auditd definition: Configure these rules https://github.com/Neo23x0/auditd/blob/e181243a7c708e9d579557d6f80e0ed3d3483b89/audit.rules#L182-L183 detection: selection: type: SYSCALL exe|endswith: - /telnet - /nmap - /netcat - /nc - /ncat - /nc.openbsd key: network_connect_4 condition: selection falsepositives: - Legitimate administration activities level: low
Sigma rule: Detects path traversal exploitation attempts. Logsource: webserver. Rule: title: Path Traversal Exploitation Attempts id: 7745c2ea-24a5-4290-b680-04359cb84b35 status: test description: Detects path traversal exploitation attempts references: - https://github.com/projectdiscovery/nuclei-templates - https://book.hacktricks.xyz/pentesting-web/file-inclusion author: Subhash Popuri (@pbssubhash), Florian Roth (Nextron Systems), Thurein Oo, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-25 modified: 2023-08-31 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-uri-query|contains: - ../../../../../lib/password - ../../../../windows/ - ../../../etc/ - ..%252f..%252f..%252fetc%252f - ..%c0%af..%c0%af..%c0%afetc%c0%af - '%252e%252e%252fetc%252f' condition: selection falsepositives: - Expected to be continuously seen on systems exposed to the Internet - Internal vulnerability scanners level: medium
Sigma rule: Detects when a secret scanning allowlist rule is added for projects.. Logsource: bitbucket / audit. Rule: title: Bitbucket Project Secret Scanning Allowlist Added id: 42ccce6d-7bd3-4930-95cd-e4d83fa94a30 status: test description: Detects when a secret scanning allowlist rule is added for projects. references: - https://confluence.atlassian.com/bitbucketserver/audit-log-events-776640423.html - https://confluence.atlassian.com/bitbucketserver/secret-scanning-1157471613.html author: Muhammad Faisal (@faisalusuf) date: 2024-02-25 tags: - attack.defense-impairment - attack.t1685 logsource: product: bitbucket service: audit definition: 'Requirements: "Basic" log level is required to receive these audit events.' detection: selection: auditType.category: Projects auditType.action: Project secret scanning allowlist rule added condition: selection falsepositives: - Legitimate user activity. level: low
Sigma rule: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attacker. Logsource: windows / process_creation. Rule: title: Rebuild Performance Counter Values Via Lodctr.EXE id: cc9d3712-6310-4320-b2df-7cb408274d53 status: test description: Detects the execution of "lodctr.exe" to rebuild the performance counter registry values. This can be abused by attackers by providing a malicious config file to overwrite performance counter configuration to confuse and evade monitoring and security solutions. references: - https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-15 modified: 2024-03-05 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: Image|endswith: \lodctr.exe OriginalFileName: LODCTR.EXE selection_cli: CommandLine|contains|windash: ' -r' condition: all of selection_* falsepositives: - Legitimate usage by an administrator level: medium
Sigma rule: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools. Logsource: windows / process_creation. Rule: title: Suspicious Program Names id: efdd8dd5-cee8-4e59-9390-7d4d5e4dd6f6 status: test description: Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md author: Florian Roth (Nextron Systems) date: 2022-02-11 modified: 2023-03-22 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_image: - Image|contains: - \CVE-202 - \CVE202 - Image|endswith: - \poc.exe - \artifact.exe - \artifact64.exe - \artifact_protected.exe - \artifact32.exe - \artifact32big.exe - obfuscated.exe - obfusc.exe - \meterpreter selection_commandline: CommandLine|contains: - inject.ps1 - Invoke-CVE - pupy.ps1 - payload.ps1 - beacon.ps1 - PowerView.ps1 - bypass.ps1 - obfuscated.ps1 - obfusc.ps1 - obfus.ps1 - obfs.ps1 - evil.ps1 - MiniDogz.ps1 - _enc.ps1 - \shell.ps1 - \rshell.ps1 - revshell.ps1 - \av.ps1 - \av_test.ps1 - adrecon.ps1 - mimikatz.ps1 - \PowerUp_ - powerup.ps1 - \Temp\a.ps1 - \Temp\p.ps1 - \Temp\1.ps1 - Hound.ps1 - encode.ps1 - powercat.ps1 condition: 1 of selection* falsepositives: - Legitimate tools that accidentally match on the searched patterns level: high
Sigma rule: Detects usage of Gpg4win to decrypt files. Logsource: windows / process_creation. Rule: title: File Decryption Using Gpg4win id: 037dcd71-33a8-4392-bb01-293c94663e5a status: test description: Detects usage of Gpg4win to decrypt files references: - https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html - https://www.gpg4win.de/documentation.html - https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-09 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_metadata: - Image|endswith: - \gpg.exe - \gpg2.exe - Description: GnuPG’s OpenPGP tool selection_cli: CommandLine|contains|all: - ' -d ' - passphrase condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog,. Logsource: linux / process_creation. Rule: title: Script Interpreter Spawning Credential Scanner - Linux id: f0025a69-e1b7-4dda-a53c-db21fa2d4071 related: - id: 0f60b28c-64dd-4e2c-9a63-5334d3e3a6e6 type: similar status: experimental description: 'Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign. ' references: - https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js - https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised - https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime - https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-25 tags: - attack.credential-access - attack.t1552 - attack.execution - attack.collection - attack.t1005 - attack.t1059.004 logsource: category: process_creation product: linux detection: selection_parent: ParentImage|endswith: - /node - /bun selection_child: - Image|endswith: - /trufflehog - /gitleaks - CommandLine|contains: - trufflehog - gitleaks condition: all of selection_* falsepositives: - Legitimate pre-commit hooks or CI/CD pipeline jobs that use a script to run a credential scanner as part of a security check. level: high
Sigma rule: Detects usage of the "usermod" binary to add users add users to the root or suoders groups. Logsource: linux / process_creation. Rule: title: User Added To Root/Sudoers Group Using Usermod id: 6a50f16c-3b7b-42d1-b081-0fdd3ba70a73 status: test description: Detects usage of the "usermod" binary to add users add users to the root or suoders groups references: - https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/ - https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/ author: TuanLe (GTSC) date: 2022-12-21 tags: - attack.privilege-escalation - attack.persistence logsource: product: linux category: process_creation detection: selection: Image|endswith: /usermod CommandLine|contains: - -aG root - -aG sudoers condition: selection falsepositives: - Legitimate administrator activities level: medium
Sigma rule: Detects the WMI Event Consumer service scrcons.exe creating a named pipe. Logsource: windows / pipe_created. Rule: title: WMI Event Consumer Created Named Pipe id: 493fb4ab-cdcc-4c4f-818c-0e363bd1e4bb status: test description: Detects the WMI Event Consumer service scrcons.exe creating a named pipe references: - https://github.com/RiccardoAncarani/LiquidSnake author: Florian Roth (Nextron Systems) date: 2021-09-01 modified: 2023-11-30 tags: - attack.t1047 - attack.execution logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: Image|endswith: \scrcons.exe condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to. Logsource: linux / process_creation. Rule: title: Curl Usage on Linux id: ea34fb97-e2c4-4afb-810f-785e4459b194 status: test description: Detects a curl process start on linux, which indicates a file download from a remote location or a simple web request to a remote server references: - https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-15 tags: - attack.command-and-control - attack.t1105 logsource: category: process_creation product: linux detection: selection: Image|endswith: /curl condition: selection falsepositives: - Scripts created by developers and admins - Administrative activity level: low
Sigma rule: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line.. Logsource: windows / process_creation. Rule: title: CobaltStrike Load by Rundll32 id: ae9c6a7c-9521-42a6-915e-5aaa8689d529 status: test description: Rundll32 can be use by Cobalt Strike with StartW function to load DLLs from the command line. references: - https://www.cobaltstrike.com/help-windows-executable - https://redcanary.com/threat-detection-report/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ author: Wojciech Lesicki date: 2021-06-01 modified: 2022-09-16 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection_rundll: - Image|endswith: \rundll32.exe - OriginalFileName: RUNDLL32.EXE - CommandLine|contains: - rundll32.exe - 'rundll32 ' selection_params: CommandLine|contains: .dll CommandLine|endswith: - ' StartW' - ',StartW' condition: all of selection* falsepositives: - Unknown level: high
Sigma rule: Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due t. Logsource: linux / auditd. Rule: title: Screen Capture with Import Tool id: dbe4b9c5-c254-4258-9688-d6af0b7967fd status: test description: 'Detects adversary creating screen capture of a desktop with Import Tool. Highly recommended using rule on servers, due to high usage of screenshot utilities on user workstations. ImageMagick must be installed. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md - https://linux.die.net/man/1/import - https://imagemagick.org/ author: Pawel Mazur date: 2021-09-21 modified: 2022-10-09 tags: - attack.collection - attack.t1113 logsource: product: linux service: auditd detection: import: type: EXECVE a0: import import_window_root: a1: -window a2: root a3|endswith: - .png - .jpg - .jpeg import_no_window_root: a1|endswith: - .png - .jpg - .jpeg condition: import and (import_window_root or import_no_window_root) falsepositives: - Legitimate use of screenshot utility level: low
Sigma rule: Detects Commandlet names and arguments from the Nishang exploitation framework. Logsource: windows / ps_script. Rule: title: Malicious Nishang PowerShell Commandlets id: f772cee9-b7c2-4cb2-8f07-49870adc02e0 status: test description: Detects Commandlet names and arguments from the Nishang exploitation framework references: - https://github.com/samratashok/nishang author: Alec Costello date: 2019-05-16 modified: 2023-01-16 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Add-ConstrainedDelegationBackdoor - Copy-VSS - Create-MultipleSessions - DataToEncode - DNS_TXT_Pwnage - Do-Exfiltration-Dns - Download_Execute - Download-Execute-PS - DownloadAndExtractFromRemoteRegistry - DumpCerts - DumpCreds - DumpHashes - Enable-DuplicateToken - Enable-Duplication - Execute-Command-MSSQL - Execute-DNSTXT-Code - Execute-OnTime - ExetoText - exfill - ExfilOption - FakeDC - FireBuster - FireListener - 'Get-Information ' - Get-PassHints - Get-Web-Credentials - Get-WebCredentials - Get-WLAN-Keys - HTTP-Backdoor - Invoke-AmsiBypass - Invoke-BruteForce - Invoke-CredentialsPhish - Invoke-Decode - Invoke-Encode - Invoke-Interceptor - Invoke-JSRatRegsvr - Invoke-JSRatRundll - Invoke-MimikatzWDigestDowngrade - Invoke-NetworkRelay - Invoke-PowerShellIcmp - Invoke-PowerShellUdp - Invoke-Prasadhak - Invoke-PSGcat - Invoke-PsGcatAgent - Invoke-SessionGopher - Invoke-SSIDExfil - LoggedKeys - Nishang - NotAllNameSpaces - Out-CHM - OUT-DNSTXT - Out-HTA - Out-RundllCommand - Out-SCF - Out-SCT - Out-Shortcut - Out-WebQuery - Out-Word - Parse_Keys - Password-List - Powerpreter - Remove-Persistence - Remove-PoshRat - Remove-Update - Run-EXEonRemote - Set-DCShadowPermissions - Set-RemotePSRemoting - Set-RemoteWMI - Shellcode32 - Shellcode64 - StringtoBase64 - TexttoExe condition: selection falsepositives: - Unknown level: high
Sigma rule: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques. Logsource: windows / system. Rule: title: Tap Driver Installation id: 8e4cf0e5-aa5d-4dc3-beff-dc26917744a9 status: test description: Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques references: - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers author: Daniil Yugoslavskiy, Ian Davis, oscd.community date: 2019-10-24 modified: 2022-12-25 tags: - attack.exfiltration - attack.t1048 logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7045 ImagePath|contains: tap0901 condition: selection falsepositives: - Legitimate OpenVPN TAP installation level: medium
Sigma rule: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys. Logsource: windows / process_creation. Rule: title: Reg Add Suspicious Paths id: b7e2a8d4-74bb-4b78-adc9-3f92af2d4829 status: test description: Detects when an adversary uses the reg.exe utility to add or modify new keys or subkeys references: - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ author: frack113, Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 modified: 2022-10-10 tags: - attack.persistence - attack.defense-impairment - attack.t1112 - attack.t1685 logsource: category: process_creation product: windows detection: selection_reg: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_path: CommandLine|contains: - \AppDataLow\Software\Microsoft\ - \Policies\Microsoft\Windows\OOBE - \Policies\Microsoft\Windows NT\CurrentVersion\Winlogon - \SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon - \CurrentControlSet\Control\SecurityProviders\WDigest - \Microsoft\Windows Defender\ condition: all of selection_* falsepositives: - Rare legitimate add to registry via cli (to these locations) level: high
Sigma rule: Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order. Logsource: windows / registry_set. Rule: title: Hypervisor Enforced Paging Translation Disabled id: 7f2954d2-99c2-4d42-a065-ca36740f187b status: test description: 'Detects changes to the "DisableHypervisorEnforcedPagingTranslation" registry value. Where the it is set to "1" in order to disable the Hypervisor Enforced Paging Translation feature. ' references: - https://twitter.com/standa_t/status/1808868985678803222 - https://github.com/AaLl86/WindowsInternals/blob/070dc4f317726dfb6ffd2b7a7c121a33a8659b5e/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%20Exploits%20(Recon2024).pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2024-07-05 tags: - attack.defense-impairment - attack.t1685 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \DisableHypervisorEnforcedPagingTranslation Details: DWORD (0x00000001) condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours obse. Logsource: proxy. Rule: title: Suspicious Network Communication With IPFS id: eb6c2004-1cef-427f-8885-9042974e5eb6 status: test description: Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages. references: - https://blog.talosintelligence.com/ipfs-abuse/ - https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11 - https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638 author: Gavin Knapp date: 2023-03-16 tags: - attack.collection - attack.credential-access - attack.t1056 logsource: category: proxy detection: selection: cs-uri|re: (?i)(ipfs\.io/|ipfs\.io\s).+\..+@.+\.[a-z]+ condition: selection falsepositives: - Legitimate use of IPFS being used in the organisation. However the cs-uri regex looking for a user email will likely negate this. level: low