alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Cert. Logsource: windows / security. Rule: title: PetitPotam Suspicious Kerberos TGT Request id: 6a53d871-682d-40b6-83e0-b7c1a6c4e3a5 status: test description: 'Detect suspicious Kerberos TGT requests. Once an attacer obtains a computer certificate by abusing Active Directory Certificate Services in combination with PetitPotam, the next step would be to leverage the certificate for malicious purposes. One way of doing this is to request a Kerberos Ticket Granting Ticket using a tool like Rubeus. This request will generate a 4768 event with some unusual fields depending on the environment. This analytic will require tuning, we recommend filtering Account_Name to the Domain Controller computer accounts. ' references: - https://github.com/topotam/PetitPotam - https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/ - https://github.com/splunk/security_content/blob/88d689fe8a055d8284337b9fad5d9152b42043db/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml author: Mauricio Velazco, Michael Haag date: 2021-09-02 modified: 2022-10-05 tags: - attack.credential-access - attack.t1187 logsource: product: windows service: security definition: The advanced audit policy setting "Account Logon > Kerberos Authentication Service" must be configured for Success/Failure detection: selection: EventID: 4768 TargetUserName|endswith: $ CertThumbprint|contains: '*' filter_local: IpAddress: ::1 filter_thumbprint: CertThumbprint: '' condition: selection and not 1 of filter_* falsepositives: - False positives are possible if the environment is using certificates for authentication. We recommend filtering Account_Name to the Domain Controller computer accounts. level: high
Sigma rule: Detects Remote Utilities Host service installation on the target system.. Logsource: windows / system. Rule: title: Remote Utilities Host Service Install id: 85cce894-dd8b-4427-a958-5cc47a4dc9b9 status: test description: Detects Remote Utilities Host service installation on the target system. references: - https://www.remoteutilities.com/support/kb/host-service-won-t-start/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.persistence logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains|all: - \rutserv.exe - -service - ServiceName: Remote Utilities - Host condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Sigma rule: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign. Logsource: windows / file_event. Rule: title: OneNote Attachment File Dropped In Suspicious Location id: 7fd164ba-126a-4d9c-9392-0d4f7c243df0 status: test description: Detects creation of files with the ".one"/".onepkg" extension in suspicious or uncommon locations. This could be a sign of attackers abusing OneNote attachments references: - https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/ - https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-09-19 tags: - attack.stealth logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \AppData\Local\Temp\ - \Users\Public\ - \Windows\Temp\ - :\Temp\ TargetFilename|endswith: - .one - .onepkg filter_main_onenote: Image|contains: :\Program Files\Microsoft Office\ Image|endswith: \ONENOTE.EXE condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of ".one" or ".onepkg" files from those locations level: medium
Sigma rule: Detects possible password spraying attempts using Dsacls. Logsource: windows / process_creation. Rule: title: Potential Password Spraying Attempt Using Dsacls.EXE id: bac9fb54-2da7-44e9-988f-11e9a5edbc0c status: test description: Detects possible password spraying attempts using Dsacls references: - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/using-dsacls-to-check-ad-object-permissions#password-spraying-anyone - https://ss64.com/nt/dsacls.html - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11) author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-20 modified: 2023-02-04 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \dsacls.exe - OriginalFileName: DSACLS.EXE selection_cli: CommandLine|contains|all: - '/user:' - '/passwd:' condition: all of selection* falsepositives: - Legitimate use of dsacls to bind to an LDAP session level: medium
Sigma rule: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other. Logsource: windows / process_creation. Rule: title: PUA - System Informer Execution id: 5722dff1-4bdd-4949-86ab-fbaf707e767a related: - id: 811e0002-b13b-4a15-9d00-a613fce66e42 type: similar status: test description: Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations references: - https://github.com/winsiderss/systeminformer author: Florian Roth (Nextron Systems) date: 2023-05-08 modified: 2024-11-23 tags: - attack.persistence - attack.privilege-escalation - attack.discovery - attack.stealth - attack.t1082 - attack.t1564 - attack.t1543 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \SystemInformer.exe - OriginalFileName: SystemInformer.exe - Description: System Informer - Product: System Informer - Hashes|contains: - MD5=19426363A37C03C3ED6FEDF57B6696EC - SHA1=8B12C6DA8FAC0D5E8AB999C31E5EA04AF32D53DC - SHA256=8EE9D84DE50803545937A63C686822388A3338497CDDB660D5D69CF68B68F287 - IMPHASH=B68908ADAEB5D662F87F2528AF318F12 condition: selection falsepositives: - System Informer is regularly used legitimately by system administrators or developers. Apply additional filters accordingly level: medium
Sigma rule: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process. Logsource: windows / process_creation. Rule: title: Potential LethalHTA Technique Execution id: ed5d72a6-f8f4-479d-ba79-02f6a80d7471 status: test description: Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process references: - https://codewhitesec.blogspot.com/2018/07/lethalhta.html author: Markus Neis date: 2018-06-07 modified: 2023-02-07 tags: - attack.stealth - attack.t1218.005 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe Image|endswith: \mshta.exe condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendo. Logsource: windows / process_creation. Rule: title: Hardware Model Reconnaissance Via Wmic.EXE id: 3e3ceccd-6c06-48b8-b5ff-ab1d25db8c1d status: test description: Detects the execution of WMIC with the "csproduct" which is used to obtain information such as hardware models and vendor information references: - https://jonconwayuk.wordpress.com/2014/01/31/wmic-csproduct-using-wmi-to-identify-make-and-model-of-hardware/ - https://www.uptycs.com/blog/kuraystealer-a-bandit-using-discord-webhooks author: Florian Roth (Nextron Systems) date: 2023-02-14 tags: - attack.execution - attack.t1047 - car.2016-03-002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_cli: CommandLine|contains: csproduct condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_wmic_recon_csproduct/info.yml
Sigma rule: Detects Obfuscated Powershell via use Clip.exe in Scripts. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Via Use Clip - Powershell id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0 status: test description: Detects Obfuscated Powershell via use Clip.exe in Scripts references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Nikita Nazarov, oscd.community date: 2020-10-09 modified: 2024-04-15 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_4104: ScriptBlockText|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?) condition: selection_4104 falsepositives: - Unknown level: high
Sigma rule: Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credent. Logsource: azure / riskdetection. Rule: title: Primary Refresh Token Access Attempt id: a84fc3b1-c9ce-4125-8e74-bdcdb24021f1 status: test description: Indicates access attempt to the PRT resource which can be used to move laterally into an organization or perform credential theft references: - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#possible-attempt-to-access-primary-refresh-token-prt - https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo' date: 2023-09-07 tags: - attack.t1528 - attack.credential-access logsource: product: azure service: riskdetection detection: selection: riskEventType: attemptedPrtAccess condition: selection falsepositives: - This detection is low-volume and is seen infrequently in most organizations. When this detection appears it's high risk, and users should be remediated. level: high
Sigma rule: Detects suspicious command sequence that JexBoss. Logsource: linux. Rule: title: JexBoss Command Sequence id: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae status: test description: Detects suspicious command sequence that JexBoss references: - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A author: Florian Roth (Nextron Systems) date: 2017-08-24 modified: 2025-11-22 tags: - attack.execution - attack.t1059.004 logsource: product: linux detection: keywords: '|all': - bash -c /bin/bash - '&/dev/tcp/' condition: keywords falsepositives: - Unknown level: high
Sigma rule: Detects encoded base64 MZ header in the commandline. Logsource: windows / process_creation. Rule: title: Base64 MZ Header In CommandLine id: 22e58743-4ac8-4a9f-bf19-00a0428d8c5f status: test description: Detects encoded base64 MZ header in the commandline references: - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-12 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - TVqQAAMAAAAEAAAA - TVpQAAIAAAAEAA8A - TVqAAAEAAAAEABAA - TVoAAAAAAAAAAAAA - TVpTAQEAAAAEAAAA condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects risky authentication from a non AD registered device without MFA being required.. Logsource: azure / signinlogs. Rule: title: Suspicious SignIns From A Non Registered Device id: 572b12d4-9062-11ed-a1eb-0242ac120002 status: test description: Detects risky authentication from a non AD registered device without MFA being required. references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in author: Harjot Singh, '@cyb3rjy0t' date: 2023-01-10 modified: 2025-07-02 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: product: azure service: signinlogs detection: selection_main: Status: Success AuthenticationRequirement: singleFactorAuthentication RiskState: atRisk selection_empty1: DeviceDetail.trusttype: '' selection_empty2: DeviceDetail.trusttype: null condition: selection_main and 1 of selection_empty* falsepositives: - Unknown level: high
Sigma rule: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent rem. Logsource: macos / process_creation. Rule: title: Creation Of A Local User Account id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731 status: test description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md - https://ss64.com/osx/sysadminctl.html author: Alejandro Ortuno, oscd.community date: 2020-10-06 modified: 2023-02-18 tags: - attack.t1136.001 - attack.persistence logsource: category: process_creation product: macos detection: selection_dscl: Image|endswith: /dscl CommandLine|contains: create selection_sysadminctl: Image|endswith: /sysadminctl CommandLine|contains: addUser condition: 1 of selection_* falsepositives: - Legitimate administration activities level: low
Sigma rule: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe. Logsource: windows / process_creation. Rule: title: Windows Credential Manager Access via VaultCmd id: 58f50261-c53b-4c88-bd12-1d71f12eda4c status: test description: List credentials currently stored in Windows Credential Manager via the native Windows utility vaultcmd.exe references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.004/T1555.004.md#atomic-test-1---access-saved-credentials-via-vaultcmd author: frack113 date: 2022-04-08 modified: 2022-05-13 tags: - attack.credential-access - attack.t1555.004 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \VaultCmd.exe - OriginalFileName: VAULTCMD.EXE selection_cli: CommandLine|contains: '/listcreds:' condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32). Logsource: windows / registry_set. Rule: title: UAC Bypass Using Windows Media Player - Registry id: 5f9db380-ea57-4d1e-beab-8a2d33397e93 status: test description: Detects the pattern of UAC Bypass using Windows Media Player osksupport.dll (UACMe 32) references: - https://github.com/hfiref0x/UACME author: Christian Burkard (Nextron Systems) date: 2021-08-23 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.t1548.002 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store\C:\Program Files\Windows Media Player\osk.exe Details: Binary Data condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects Commandlet names from well-known PowerShell exploitation frameworks. Logsource: windows / ps_script. Rule: title: Malicious PowerShell Commandlets - ScriptBlock id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6 related: - id: 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c type: similar - id: 02030f2f-6199-49ec-b258-ea71b07e03dc type: similar - id: 6d3f1399-a81c-4409-aff3-1ecfe9330baf type: obsolete - id: 83083ac6-1816-4e76-97d7-59af9a9ae46e type: obsolete status: test description: Detects Commandlet names from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/calebstewart/CVE-2021-1675 - https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1 - https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/Kevin-Robertson/Powermad - https://github.com/adrecon/ADRecon - https://github.com/adrecon/AzureADRecon - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer date: 2017-03-05 modified: 2025-12-10 tags: - attack.execution - attack.discovery - attack.t1482 - attack.t1087 - attack.t1087.001 - attack.t1087.002 - attack.t1069.001 - attack.t1069.002 - attack.t1069 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Add-Exfiltration - Add-Persistence - Add-RegBackdoor - Add-RemoteRegBackdoor - Add-ScrnSave
Sigma rule: Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated. Logsource: windows / network_connection. Rule: title: Uncommon Connection to Active Directory Web Services id: b3ad3c0f-c949-47a1-a30e-b0491ccae876 status: test description: 'Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management. ' references: - https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c - https://github.com/FalconForceTeam/FalconFriday/blob/a9219dfcfd89836f34660223f47d766982bdce46/Discovery/ADWS_Connection_from_Unexpected_Binary-Win.md author: '@kostastsale' date: 2024-01-26 tags: - attack.discovery - attack.t1087 logsource: category: network_connection product: windows detection: selection: Initiated: true DestinationPort: 9389 filter_main_dsac: Image: C:\Windows\system32\dsac.exe filter_main_ms_monitoring_agent: Image: C:\Program Files\Microsoft Monitoring Agent\ filter_main_powershell: Image|startswith: - C:\Program Files\PowerShell\7\pwsh.exe - C:\Program Files\PowerShell\7-preview\pwsh.ex - C:\Windows\System32\WindowsPowerShell\ - C:\Windows\SysWOW64\WindowsPowerShell\ condition: selection and not 1 of filter_main_* falsepositives: - ADWS is used by a number of legitimate applications that need to interact with Active Directory. These applications should be added to the allow-listing to avoid false positives. level: medium
Sigma rule: Detects execution of the Notepad++ updater (gup) to launch other commands or executables. Logsource: windows / process_creation. Rule: title: Arbitrary Binary Execution Using GUP Utility id: d65aee4d-2292-4cea-b832-83accd6cfa43 status: test description: Detects execution of the Notepad++ updater (gup) to launch other commands or executables references: - https://twitter.com/nas_bench/status/1535322445439180803 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-10 modified: 2023-03-02 tags: - attack.execution logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \gup.exe Image|endswith: \explorer.exe filter: Image|endswith: \explorer.exe CommandLine|contains: \Notepad++\notepad++.exe filter_parent: ParentImage|contains: \Notepad++\updater\ filter_null: CommandLine: null condition: selection and not 1 of filter* falsepositives: - Other parent binaries using GUP not currently identified level: medium
Sigma rule: Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known fold. Logsource: windows / appxdeployment-server. Rule: title: AppX Located in Known Staging Directory Added to Deployment Pipeline id: 5cdeaf3d-1489-477c-95ab-c318559fc051 status: test description: 'Detects an appx package that was added to the pipeline of the "to be processed" packages that is located in a known folder often used as a staging directory. ' references: - https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/ - https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting - https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-11 tags: - attack.stealth logsource: product: windows service: appxdeployment-server detection: selection_eid: EventID: 854 selection_paths_forward: Path|contains: - :/Perflogs/ - :/Users/Public/ - :/Windows/Temp/ - /AppdData/Local/Temp/ - /Desktop/ - /Downloads/ selection_paths_back: Path|contains: - :\PerfLogs\ - :\Users\Public\ - :\Windows\Temp\ - \AppdData\Local\Temp\ - \Desktop\ - \Downloads\ condition: selection_eid and 1 of selection_paths_* falsepositives: - Unknown level: high
Sigma rule: Detects usage of system utilities to discover files and directories. Logsource: macos / process_creation. Rule: title: File and Directory Discovery - MacOS id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6 status: test description: Detects usage of system utilities to discover files and directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md author: Daniil Yugoslavskiy, oscd.community date: 2020-10-19 modified: 2022-11-25 tags: - attack.discovery - attack.t1083 logsource: category: process_creation product: macos detection: select_file_with_asterisk: Image: /usr/bin/file CommandLine|re: (.){200,} select_recursive_ls: Image: /bin/ls CommandLine|contains: -R select_find_execution: Image: /usr/bin/find select_mdfind_execution: Image: /usr/bin/mdfind select_tree_execution|endswith: Image: /tree condition: 1 of select* falsepositives: - Legitimate activities level: informational
Sigma rule: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.. Logsource: windows / process_creation. Rule: title: Use of Wfc.exe id: 49be8799-7b4d-4fda-ad23-cafbefdebbc5 status: test description: The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules. references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wfc/ - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io date: 2022-06-01 tags: - attack.execution - attack.stealth - attack.t1127 logsource: category: process_creation product: windows detection: selection: - Image|endswith: \wfc.exe - OriginalFileName: wfc.exe condition: selection falsepositives: - Legitimate use by a software developer level: medium