alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinter. Logsource: windows / process_creation. Rule: title: Sysmon Discovery Via Default Driver Altitude Using Findstr.EXE id: 37db85d1-b089-490a-a59a-c7b6f984f480 status: test description: Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed). references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-5---security-software-discovery---sysmon-service author: frack113 date: 2021-12-16 modified: 2023-11-14 tags: - attack.discovery - attack.t1518.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \find.exe - \findstr.exe - OriginalFileName: - FIND.EXE - FINDSTR.EXE selection_cli: CommandLine|contains: ' 385201' condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Once established within a system or network, an adversary may use automated techniques for collecting internal data.. Logsource: windows / process_creation. Rule: title: Recon Information for Export with Command Prompt id: aa2efee7-34dd-446e-8a37-40790a66efd7 related: - id: 8e0bb260-d4b2-4fff-bb8d-3f82118e6892 type: similar status: test description: Once established within a system or network, an adversary may use automated techniques for collecting internal data. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md author: frack113 date: 2021-07-30 modified: 2022-09-13 tags: - attack.collection - attack.t1119 logsource: product: windows category: process_creation detection: selection_image: - Image|endswith: - \tree.com - \WMIC.exe - \doskey.exe - \sc.exe - OriginalFileName: - wmic.exe - DOSKEY.EXE - sc.exe selection_redirect: ParentCommandLine|contains: - ' > %TEMP%\' - ' > %TMP%\' condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser LoginProfile Creation id: db014773-b1d3-46bd-ba26-133337c0ffee status: test description: Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile. references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.execution - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.stealth - attack.t1059.009 - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: - GetLoginProfile - CreateLoginProfile userAgent|contains: S3 Browser condition: selection falsepositives: - Valid usage of S3 Browser for IAM LoginProfile listing and/or creation level: high
Sigma rule: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework. Logsource: windows / ps_script. Rule: title: Potential Suspicious PowerShell Keywords id: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf status: test description: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework references: - https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462 - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1 - https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1 - https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7 author: Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup) date: 2019-02-11 modified: 2023-04-21 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - System.Reflection.Assembly.Load($ - '[System.Reflection.Assembly]::Load($' - '[Reflection.Assembly]::Load($' - System.Reflection.AssemblyName - Reflection.Emit.AssemblyBuilderAccess - Reflection.Emit.CustomAttributeBuilder - Runtime.InteropServices.UnmanagedType - Runtime.InteropServices.DllImportAttribute - SuspendThread - rundll32 condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects a Powershell process that contains download commands in its command line string. Logsource: windows / process_creation. Rule: title: PowerShell Download Pattern id: 3b6ab547-8ec2-4991-b9d2-2b06702a48d7 related: - id: e6c54d94-498c-4562-a37c-b469d8e9a275 type: derived - id: 8f70ac5f-1f6f-4f8e-b454-db19561216c5 type: obsolete status: test description: Detects a Powershell process that contains download commands in its command line string references: - https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html - https://lab52.io/blog/winter-vivern-all-summer/ - https://hatching.io/blog/powershell-analysis/ author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro date: 2019-01-16 modified: 2025-10-20 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell_ise.exe - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell_ISE.EXE - PowerShell.EXE - pwsh.dll selection_cli: CommandLine|contains|all: - new-object - net.webclient). - download CommandLine|contains: - string( - file( condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects NetSupport Manager service installation on the target system.. Logsource: windows / system. Rule: title: NetSupport Manager Service Install id: 2d510d8d-912b-45c5-b1df-36faa3d8c3f4 status: test description: Detects NetSupport Manager service installation on the target system. references: - http://resources.netsupportsoftware.com/resources/manualpdfs/nsm_manual_uk.pdf author: Nasreddine Bencherchali (Nextron Systems) date: 2022-10-31 tags: - attack.persistence logsource: product: windows service: system detection: selection_root: Provider_Name: Service Control Manager EventID: 7045 selection_service: - ImagePath|contains: \NetSupport Manager\client32.exe - ServiceName: Client32 condition: all of selection_* falsepositives: - Legitimate use of the tool level: medium
Sigma rule: Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer.. Logsource: windows / process_creation. Rule: title: HackTool - LaZagne Execution id: c2b86e67-b880-4eec-b045-50bc98ef4844 status: experimental description: 'Detects the execution of the LaZagne. A utility used to retrieve multiple types of passwords stored on a local computer. LaZagne has been leveraged multiple times by threat actors in order to dump credentials. ' references: - https://github.com/AlessandroZ/LaZagne/tree/master - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/ - https://securelist.com/defttorero-tactics-techniques-and-procedures/107610/ - https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/raw/800c0e06571993a54e39571cf27fd474dcc5c0bc/2017/2017.11.14.Muddying_the_Water/muddying-the-water-targeted-attacks.pdf author: Nasreddine Bencherchali, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2024-06-24 modified: 2025-10-07 tags: - attack.credential-access logsource: product: windows category: process_creation detection: selection_img_metadata: Image|endswith: \lazagne.exe selection_img_cli: Image|contains: - :\PerfLogs\ - :\ProgramData\ - :\Temp\ - :\Tmp\ - :\Users\Public\ - :\Windows\Temp\ - \$Recycle.bin - \AppData\ - \Desktop\ - \Downloads\ - \Favorites\ - \Links\ - \Music\ - \Photos\ - \Pictures\ - \Saved Games\ - \Searches\ - \Users\Contacts\ - \Users\Default\ - \Users\Searches\ - \Videos\ - \Windows\addins\ - \Windows\Fonts\ - \Windows\IME\ CommandLine|endswith: - .exe all - .exe browsers - .exe chats - .exe databases - .exe games - .exe git - .exe mails - .exe maven - .exe memory - .exe multimedia - .exe sysadmin - .exe unused - .exe wifi - .exe windows selection_cli_modules: CommandLine|contains: - ' all ' - ' browsers ' - ' chats ' - ' databases ' - ' games ' - ' mails ' - ' maven ' - ' memory ' - ' multimedia ' - ' php ' - ' svn ' - ' sysadmin ' - ' unused ' - ' wifi ' selection_cli_options: CommandLine|contains: - -1Password - -apachedirectorystudio - -autologon - -ChromiumBased - -coreftp - -credfiles - -credman - -cyberduck - -dbvis - -EyeCon - -filezilla - -filezillaserver - -ftpnavigator - -galconfusion - -gitforwindows - -hashdump - -iisapppool - -IISCentralCertP - -kalypsomedia - -keepass - -keepassconfig - -lsa_secrets - -mavenrepositories - -memory_dump - -Mozilla - -mRemoteNG - -mscache - -opensshforwindows - -openvpn - -outlook - -pidgin - -postgresql - -psi-im - -puttycm - -pypykatz - -Rclone - -rdpmanager - -robomongo - -roguestale - -s
Sigma rule: Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbi. Logsource: windows / process_creation. Rule: title: Potential Arbitrary File Download Via Cmdl32.EXE id: f37aba28-a9e6-4045-882c-d5004043b337 status: test description: 'Detects execution of Cmdl32 with the "/vpn" and "/lan" flags. Attackers can abuse this utility in order to download arbitrary files via a configuration file. Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious. ' references: - https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/ - https://twitter.com/SwiftOnSecurity/status/1455897435063074824 - https://github.com/LOLBAS-Project/LOLBAS/pull/151 author: frack113 date: 2021-11-03 modified: 2024-04-22 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmdl32.exe - OriginalFileName: CMDL32.EXE selection_cli: CommandLine|contains|all: - /vpn - /lan condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects when a Azure Kubernetes Cluster is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Cluster Created or Deleted id: 9541f321-7cba-4b43-80fc-fbd1fb922808 status: test description: Detects when a Azure Kubernetes Cluster is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/DELETE condition: selection falsepositives: - Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Sigma rule: Detects MSI package installation from suspicious locations. Logsource: windows / application. Rule: title: MSI Installation From Suspicious Locations id: c7c8aa1c-5aff-408e-828b-998e3620b341 status: test description: Detects MSI package installation from suspicious locations references: - https://www.trendmicro.com/en_us/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus.html author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 modified: 2023-10-23 tags: - attack.execution logsource: product: windows service: application detection: selection: Provider_Name: MsiInstaller EventID: - 1040 - 1042 Data|contains: - :\Windows\TEMP\ - \\\\ - \Desktop\ - \PerfLogs\ - \Users\Public\ filter_winget: Data|contains: \AppData\Local\Temp\WinGet\ filter_updhealthtools: Data|contains: C:\Windows\TEMP\UpdHealthTools.msi condition: selection and not 1 of filter_* falsepositives: - False positives may occur if you allow installation from folders such as the desktop, the public folder or remote shares. A baseline is required before production use. level: medium
Sigma rule: Detects suspicious parent processes that should not have any children or should only have a single possible child progra. Logsource: windows / process_creation. Rule: title: Suspicious Process Parents id: cbec226f-63d9-4eca-9f52-dfb6652f24df status: test description: Detects suspicious parent processes that should not have any children or should only have a single possible child program references: - https://twitter.com/x86matthew/status/1505476263464607744?s=12 - https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b author: Florian Roth (Nextron Systems) date: 2022-03-21 modified: 2022-09-08 tags: - attack.stealth - attack.t1036 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: - \minesweeper.exe - \winver.exe - \bitsadmin.exe selection_special: ParentImage|endswith: - \csrss.exe - \certutil.exe - \eventvwr.exe - \calc.exe - \notepad.exe filter_special: Image|endswith: - \WerFault.exe - \wermgr.exe - \conhost.exe - \mmc.exe - \win32calc.exe - \notepad.exe filter_null: Image: null condition: selection or ( selection_special and not 1 of filter_* ) falsepositives: - Unknown level: high
Sigma rule: Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organ. Logsource: github / audit. Rule: title: Outdated Dependency Or Vulnerability Alert Disabled id: 34e1c7d4-0cd5-419d-9f1b-1dad3f61018d status: test description: 'Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts. This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories. ' author: Muhammad Faisal (@faisalusuf) date: 2023-01-27 references: - https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts - https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-security-and-analysis-settings-for-your-organization tags: - attack.initial-access - attack.t1195.001 logsource: product: github service: audit definition: 'Requirements: The audit log streaming feature must be enabled to be able to receive such logs. You can enable following the documentation here: https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/streaming-the-audit-log-for-your-enterprise#setting-up-audit-log-streaming' detection: selection: action: - dependabot_alerts_new_repos.disable - dependabot_alerts.disable - dependabot_security_updates_new_repos.disable - dependabot_security_updates.disable - repository_vulnerability_alerts.disable condition: selection falsepositives: - Approved changes by the Organization owner. Please validate the 'actor' if authorized to make the changes. level: high
Sigma rule: Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than T. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Command Targeting Teams Sensitive Files id: d2eb17db-1d39-41dc-b57f-301f6512fa75 status: test description: 'Detects a commandline containing references to the Microsoft Teams database or cookies files from a process other than Teams. The database might contain authentication tokens and other sensitive information about the logged in accounts. ' references: - https://www.bleepingcomputer.com/news/security/microsoft-teams-stores-auth-tokens-as-cleartext-in-windows-linux-macs/ - https://www.vectra.ai/blogpost/undermining-microsoft-teams-security-by-mining-tokens author: '@SerkinValery' date: 2022-09-16 modified: 2023-12-18 tags: - attack.credential-access - attack.t1528 logsource: product: windows category: process_creation detection: selection: CommandLine|contains: - \Microsoft\Teams\Cookies - \Microsoft\Teams\Local Storage\leveldb filter_main_legit_locations: Image|endswith: \Microsoft\Teams\current\Teams.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauth. Logsource: aws / cloudtrail. Rule: title: Modification or Deletion of an AWS RDS Cluster id: 457cc9ac-d8e6-4d1d-8c0e-251d0f11a74c status: experimental description: Detects modifications to an RDS cluster or its deletion, which may indicate potential data exfiltration attempts, unauthorized access, or exposure of sensitive information. references: - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html - https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html - https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance author: Ivan Saakov date: 2024-12-06 tags: - attack.exfiltration - attack.t1020 logsource: product: aws service: cloudtrail detection: selection: eventSource: rds.amazonaws.com eventName: - ModifyDBCluster - DeleteDBCluster condition: selection falsepositives: - Verify if the modification or deletion was performed by an authorized administrator. - Confirm if the modification or deletion was part of a planned change or maintenance activity. level: high
Sigma rule: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. Logsource: macos / process_creation. Rule: title: Suspicious Browser Child Process - MacOS id: 0250638a-2b28-4541-86fc-ea4c558fa0c6 status: test description: Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation. references: - https://fr.slideshare.net/codeblue_jp/cb19-recent-apt-attack-on-crypto-exchange-employees-by-heungsoo-kang - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/execution_initial_access_suspicious_browser_childproc.toml author: Sohan G (D4rkCiph3r) date: 2023-04-05 tags: - attack.initial-access - attack.execution - attack.t1189 - attack.t1203 - attack.t1059 logsource: category: process_creation product: macos detection: selection: ParentImage|contains: - com.apple.WebKit.WebContent - firefox - Google Chrome Helper - Google Chrome - Microsoft Edge - Opera - Safari - Tor Browser Image|endswith: - /bash - /curl - /dash - /ksh - /osascript - /perl - /php - /pwsh - /python - /sh - /tcsh - /wget - /zsh filter_main_generic: CommandLine|contains: --defaults-torrc filter_main_ms_autoupdate: CommandLine|contains: /Library/Application Support/Microsoft/MAU*/Microsoft AutoUpdate.app/Contents/MacOS/msupdate filter_main_chrome: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains: - /Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/*/Resources/install.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_preflight.sh - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/*/Resources/keystone_promote_postflight.sh filter_main_ms_edge: ParentImage|contains: Microsoft Edge CommandLine|contains: - IOPlatformExpertDevice - hw.model filter_main_chromerecovery: ParentImage|contains: - Google Chrome Helper - Google Chrome CommandLine|contains|all: - /Users/ - /Library/Application Support/Google/Chrome/recovery/ - /ChromeRecovery filter_optional_null: CommandLine: null filter_optional_empty: CommandLine: '' condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Legitimate browser install, update and recovery scripts level: medium
Sigma rule: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get i. Logsource: windows / registry_set. Rule: title: Add Debugger Entry To Hangs Key For Persistence id: 833ef470-fa01-4631-a79b-6f291c9ac498 status: test description: Detects when an attacker adds a new "Debugger" value to the "Hangs" key in order to achieve persistence which will get invoked when an application crashes references: - https://persistence-info.github.io/Data/wer_debugger.html - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows\Windows Error Reporting\Hangs\Debugger condition: selection falsepositives: - This value is not set by default but could be rarly used by administrators level: high
Sigma rule: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order t. Logsource: linux / process_creation. Rule: title: Access of Sudoers File Content id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06 status: test description: Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights. references: - https://github.com/sleventyeleven/linuxprivchecker/ author: Florian Roth (Nextron Systems) date: 2022-06-20 modified: 2025-06-04 tags: - attack.reconnaissance - attack.t1592.004 logsource: category: process_creation product: linux detection: selection: Image|endswith: - /cat - /ed - /egrep - /emacs - /fgrep - /grep - /head - /less - /more - /nano - /tail CommandLine|contains: ' /etc/sudoers' condition: selection falsepositives: - Legitimate administration activities level: medium
Sigma rule: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure.. Logsource: windows / process_creation. Rule: title: Active Directory Structure Export Via Csvde.EXE id: e5d36acd-acb4-4c6f-a13f-9eb203d50099 status: test description: Detects the execution of "csvde.exe" in order to export organizational Active Directory structure. references: - https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms - https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf - https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit - https://redcanary.com/blog/msix-installers/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-14 tags: - attack.exfiltration - attack.discovery - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \csvde.exe - OriginalFileName: csvde.exe selection_remote: CommandLine|contains: ' -f' filter_import: CommandLine|contains: ' -i' condition: all of selection_* and not 1 of filter_* falsepositives: - Unknown level: medium