alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.. Logsource: windows / ps_script. Rule: title: PowerShell Script With File Hostname Resolving Capabilities id: fbc5e92f-3044-4e73-a5c6-1c4359b539de status: test description: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries. references: - https://www.fortypoundhead.com/showcontent.asp?artid=24022 - https://labs.withsecure.com/publications/fin7-target-veeam-servers author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 tags: - attack.exfiltration - attack.t1020 logsource: product: windows category: ps_script definition: bade5735-5ab0-4aa7-a642-a11be0e40872 detection: selection: ScriptBlockText|contains|all: - 'Get-content ' - foreach - '[System.Net.Dns]::GetHostEntry' - Out-File condition: selection falsepositives: - The same functionality can be implemented by admin scripts, correlate with name and creator level: medium
Sigma rule: Detects Windows services that got terminated for whatever reason. Logsource: windows / system. Rule: title: Windows Service Terminated With Error id: acfa2210-0d71-4eeb-b477-afab494d596c related: - id: d6b5520d-3934-48b4-928c-2aa3f92d6963 type: similar status: test description: Detects Windows services that got terminated for whatever reason references: - https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection: Provider_Name: Service Control Manager EventID: 7023 condition: selection falsepositives: - False positives could occur since service termination could happen due to multiple reasons level: low
Sigma rule: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type. Logsource: windows / process_creation. Rule: title: Suspicious Schtasks Schedule Type With High Privileges id: 7a02e22e-b885-4404-b38b-1ddc7e65258a related: - id: 24c8392b-aa3c-46b7-a545-43f71657fe98 type: similar status: test description: Detects scheduled task creations or modification to be run with high privileges on a suspicious schedule type references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-31 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.t1053.005 logsource: product: windows category: process_creation detection: selection_img: - Image|endswith: \schtasks.exe - OriginalFileName: schtasks.exe selection_time: CommandLine|contains: - ' ONLOGON ' - ' ONSTART ' - ' ONCE ' - ' ONIDLE ' selection_privs: CommandLine|contains: - NT AUT - ' SYSTEM' - HIGHEST condition: all of selection_* falsepositives: - Some installers were seen using this method of creation unfortunately. Filter them in your environment level: medium
Sigma rule: Detects handles requested to SAM registry hive. Logsource: windows / security. Rule: title: SAM Registry Hive Handle Request id: f8748f2c-89dc-4d95-afb0-5a2dfdbad332 status: test description: Detects handles requested to SAM registry hive references: - https://threathunterplaybook.com/hunts/windows/190725-SAMRegistryHiveHandleRequest/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-12 modified: 2021-11-27 tags: - attack.discovery - attack.t1012 - attack.credential-access - attack.t1552.002 logsource: product: windows service: security detection: selection: EventID: 4656 ObjectType: Key ObjectName|endswith: \SAM condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites. Logsource: windows / process_creation. Rule: title: Suspicious File Downloaded From File-Sharing Website Via Certutil.EXE id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 related: - id: 19b08b1c-861d-4e75-a1ef-ea0c1baf202b type: similar - id: 13e6fe51-d478-4c7e-b0f2-6da9b400a829 type: similar - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil - https://forensicitguy.github.io/agenttesla-vba-certutil-download/ - https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/ - https://twitter.com/egre55/status/1087685529016193025 - https://lolbas-project.github.io/lolbas/Binaries/Certutil/ - https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/ - https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin author: Nasreddine Bencherchali (Nextron Systems) date: 2023-02-15 modified: 2026-03-29 tags: - attack.stealth - attack.t1027 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_flags: CommandLine|contains: - 'urlcache ' - 'verifyctl ' - 'URL ' selection_http: CommandLine|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.goo
Sigma rule: Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded Invoke Keyword id: 6385697e-9f1b-40bd-8817-f4a91f40508e related: - id: fd6e2919-3936-40c9-99db-0aa922c356f7 type: obsolete status: test description: Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls references: - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/ author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t date: 2022-05-20 modified: 2023-04-06 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_invoke: CommandLine|contains: - SQBuAHYAbwBrAGUALQ - kAbgB2AG8AawBlAC0A - JAG4AdgBvAGsAZQAtA - SW52b2tlL - ludm9rZS - JbnZva2Ut condition: all of selection_* falsepositives: - Unknown level: high simulation: - type: atomic red team name: Create a Process using WMI Query and an Encoded Command technique: T1047 atomic_guid: 7db7a7f9-9531-4840-9b30-46220135441c regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke/info.yml
Sigma rule: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.. Logsource: windows / process_creation. Rule: title: DLL Execution via Rasautou.exe id: cd3d1298-eb3b-476c-ac67-12847de55813 status: test description: Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p. references: - https://lolbas-project.github.io/lolbas/Binaries/Rasautou/ - https://github.com/fireeye/DueDLLigence - https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html author: Julia Fomina, oscd.community date: 2020-10-09 tags: - attack.stealth - attack.t1218 logsource: product: windows category: process_creation definition: Since options '-d' and '-p' were removed in Windows 10 this rule is relevant only for Windows before 10. And as Windows 7 doesn't log command line in 4688 by default, to detect this attack you need Sysmon 1 configured or KB3004375 installed for command-line auditing (https://support.microsoft.com/en-au/help/3004375/microsoft-security-advisory-update-to-improve-windows-command-line-aud) detection: selection_img: - Image|endswith: \rasautou.exe - OriginalFileName: rasdlui.exe selection_cli: CommandLine|contains|all: - ' -d ' - ' -p ' condition: all of selection* falsepositives: - Unlikely level: medium
Sigma rule: Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or fil. Logsource: windows / process_creation. Rule: title: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image id: 584bca0f-3608-4402-80fd-4075ff6072e3 related: - id: e0552b19-5a83-4222-b141-b36184bb8d79 type: similar - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 type: similar - id: 2c0d2d7b-30d6-4d14-9751-7b9113042ab9 type: obsolete status: test description: 'Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. ' references: - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http author: frack113, Florian Roth (Nextron Systems), Josh Nickels date: 2024-09-02 modified: 2025-05-30 tags: - attack.stealth - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: Image|endswith: - \cmd.exe - \cscript.exe - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wscript.exe OriginalFileName: - Cmd.EXE - cscript.exe - PowerShell.EXE - PowerShell_ISE.EXE - pwsh.dll - wscript.exe selection_special_chars: CommandLine|contains: - ˣ - ˪ - ˢ - ∕ - ⁄ - ― - — - - ¯ - ® - ¶ - ⠀ condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: F-Secure C3 produces DLLs with a default exported StartNodeRelay function.. Logsource: windows / process_creation. Rule: title: HackTool - F-Secure C3 Load by Rundll32 id: b18c9d4c-fac9-4708-bd06-dd5bfacf200f status: test description: F-Secure C3 produces DLLs with a default exported StartNodeRelay function. references: - https://github.com/FSecureLABS/C3/blob/11a081fd3be2aaf2a879f6b6e9a96ecdd24966ef/Src/NodeRelayDll/NodeRelayDll.cpp#L12 author: Alfie Champion (ajpc500) date: 2021-06-02 modified: 2023-03-05 tags: - attack.stealth - attack.t1218.011 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - rundll32.exe - .dll - StartNodeRelay condition: selection falsepositives: - Unknown level: critical
Sigma rule: Shadow Copies deletion using operating systems utilities. Logsource: windows / process_creation. Rule: title: Shadow Copies Deletion Using Operating Systems Utilities id: c947b146-0abc-4c87-9c64-b17e9d7274a2 status: stable description: Shadow Copies deletion using operating systems utilities references: - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment - https://blog.talosintelligence.com/2017/05/wannacry.html - https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/ - https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/ - https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100 - https://github.com/Neo23x0/Raccine#the-process - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar - https://redcanary.com/blog/intelligence-insights-october-2021/ - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware author: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades) date: 2019-10-22 modified: 2022-11-03 tags: - attack.impact - attack.stealth - attack.t1070 - attack.t1490 logsource: category: process_creation product: windows detection: selection1_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \wmic.exe - \vssadmin.exe - \diskshadow.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll - wmic.exe - VSSADMIN.EXE - diskshadow.exe selection1_cli: CommandLine|contains|all: - shadow - delete selection2_img: - Image|endswith: \wbadmin.exe - OriginalFileName: WBADMIN.EXE selection2_cli: CommandLine|contains|all: - delete - catalog - quiet selection3_img: - Image|endswith: \vssadmin.exe - OriginalFileName: VSSADMIN.EXE selection3_cli: CommandLine|contains|all: - resize - shadowstorage CommandLine|contains: - unbounded - /MaxSize= condition: (all of selection1*) or (all of selection2*) or (all of selection3*) falsepositives: - Legitimate Administrator deletes Shadow Copies using operating systems utilities for legitimate reason - LANDesk LDClient Ivanti-PSModule (PS EncodedCommand) level: high
Sigma rule: Detects important or interesting Windows services that got terminated unexpectedly.. Logsource: windows / system. Rule: title: Important Windows Service Terminated Unexpectedly id: 56abae0c-6212-4b97-adc0-0b559bb950c3 status: test description: Detects important or interesting Windows services that got terminated unexpectedly. references: - https://www.randori.com/blog/vulnerability-analysis-queuejumper-cve-2023-21554/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-14 tags: - attack.stealth logsource: product: windows service: system detection: selection_eid: Provider_Name: Service Control Manager EventID: 7034 selection_name: - param1|contains: Message Queuing - Binary|contains: - 4d0053004d005100 - 6d0073006d007100 condition: all of selection_* falsepositives: - Rare false positives could occur since service termination could happen due to multiple reasons level: high
Sigma rule: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it.. Logsource: windows / process_creation. Rule: title: Suspicious File Execution From Internet Hosted WebDav Share id: f0507c0f-a3a2-40f5-acc6-7f543c334993 status: test description: Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files references: - https://twitter.com/ShadowChasing1/status/1552595370961944576 - https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior author: pH-T (Nextron Systems) date: 2022-09-01 modified: 2023-02-21 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \cmd.exe - OriginalFileName: Cmd.EXE selection_base: CommandLine|contains|all: - ' net use http' - '& start /b ' - \DavWWWRoot\ selection_ext: CommandLine|contains: - '.exe ' - '.dll ' - '.bat ' - '.vbs ' - '.ps1 ' condition: all of selection_* falsepositives: - Unknown level: high
Sigma rule: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this val. Logsource: windows / registry_set. Rule: title: New BgInfo.EXE Custom DB Path Registry Configuration id: 53330955-dc52-487f-a3a2-da24dcff99b5 status: test description: Detects setting of a new registry database value related to BgInfo configuration. Attackers can for example set this value to save the results of the commands executed by BgInfo in order to exfiltrate information. references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-08-16 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Software\Winternals\BGInfo\Database condition: selection falsepositives: - Legitimate use of external DB to save the results level: medium
Sigma rule: Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authenticatio. Logsource: kubernetes / audit. Rule: title: Kubernetes Unauthorized or Unauthenticated Access id: 0d933542-1f1f-420d-97d4-21b2c3c492d9 status: test description: 'Detects when a request to the Kubernetes API is rejected due to lack of authorization or due to an expired authentication token being used. This may indicate an attacker attempting to leverage credentials they have obtained. ' references: - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues author: kelnage date: 2024-04-12 tags: - attack.privilege-escalation logsource: product: kubernetes service: audit detection: selection: responseStatus.code: - 401 - 403 condition: selection falsepositives: - A misconfigured RBAC policy, a mistake by a valid user, or a wider issue with authentication tokens can also generate these errors. level: low
Sigma rule: Detects exploitation attempt using the JNDI-Exploit-Kit. Logsource: webserver. Rule: title: JNDIExploit Pattern id: 412d55bc-7737-4d25-9542-5b396867ce55 status: test description: Detects exploitation attempt using the JNDI-Exploit-Kit references: - https://github.com/pimps/JNDI-Exploit-Kit - https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit author: Florian Roth (Nextron Systems) date: 2021-12-12 modified: 2022-12-25 tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: keywords: - /Basic/Command/Base64/ - /Basic/ReverseShell/ - /Basic/TomcatMemshell - /Basic/JettyMemshell - /Basic/WeblogicMemshell - /Basic/JBossMemshell - /Basic/WebsphereMemshell - /Basic/SpringMemshell - /Deserialization/URLDNS/ - /Deserialization/CommonsCollections1/Dnslog/ - /Deserialization/CommonsCollections2/Command/Base64/ - /Deserialization/CommonsBeanutils1/ReverseShell/ - /Deserialization/Jre8u20/TomcatMemshell - /TomcatBypass/Dnslog/ - /TomcatBypass/Command/ - /TomcatBypass/ReverseShell/ - /TomcatBypass/TomcatMemshell - /TomcatBypass/SpringMemshell - /GroovyBypass/Command/ - /WebsphereBypass/Upload/ condition: keywords falsepositives: - Legitimate apps the use these paths level: high
Sigma rule: Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie.. Logsource: windows / process_creation. Rule: title: Suspicious WebDav Client Execution Via Rundll32.EXE id: 982e9f2d-1a85-4d5b-aea4-31f5e97c6555 status: test description: 'Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397 ' references: - https://twitter.com/aceresponder/status/1636116096506818562 - https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/ - https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/ - https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png - https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/ author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems) date: 2023-03-16 modified: 2023-09-18 tags: - attack.exfiltration - attack.t1048.003 - cve.2023-23397 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \svchost.exe ParentCommandLine|contains: -s WebClient Image|endswith: \rundll32.exe CommandLine|contains: C:\windows\system32\davclnt.dll,DavSetCookie CommandLine|re: ://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} filter_local_ips: CommandLine|contains: - ://10. - ://192.168. - ://172.16. - ://172.17. - ://172.18. - ://172.19. - ://172.20. - ://172.21. - ://172.22. - ://172.23. - ://172.24. - ://172.25. - ://172.26. - ://172.27. - ://172.28. - ://172.29. - ://172.30. - ://172.31. - ://127. - ://169.254. condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Sigma rule: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the. Logsource: windows / process_creation. Rule: title: Delete All Scheduled Tasks id: 220457c1-1c9f-4c2e-afe6-9598926222c1 status: test description: Detects the usage of schtasks with the delete flag and the asterisk symbol to delete all tasks from the schedule of the local computer, including tasks scheduled by other users. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-delete author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-09 tags: - attack.impact - attack.t1489 logsource: category: process_creation product: windows detection: selection: Image|endswith: \schtasks.exe CommandLine|contains|all: - ' /delete ' - /tn \* - ' /f' condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled.. Logsource: windows / security. Rule: title: Important Windows Event Auditing Disabled id: ab4561b1-6c7e-48a7-ad08-087cfb9ce8f1 related: - id: 69aeb277-f15f-4d2d-b32a-55e883609563 type: derived status: test description: Detects scenarios where system auditing for important events such as "Process Creation" or "Logon" events is disabled. references: - https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit - https://github.com/SigmaHQ/sigma/blob/ad1bfd3d28aa0ccc9656240f845022518ef65a2e/documentation/logsource-guides/windows/service/security.md author: Nasreddine Bencherchali (Nextron Systems) date: 2023-06-20 modified: 2023-11-17 tags: - attack.defense-impairment - attack.t1685.001 logsource: product: windows service: security definition: dfd8c0f4-e6ad-4e07-b91b-f2fca0ddef64 detection: selection_state_success_and_failure: EventID: 4719 SubcategoryGuid: - '{0CCE9210-69AE-11D9-BED3-505054503030}' - '{0CCE9211-69AE-11D9-BED3-505054503030}' - '{0CCE9212-69AE-11D9-BED3-505054503030}' - '{0CCE9215-69AE-11D9-BED3-505054503030}' - '{0CCE921B-69AE-11D9-BED3-505054503030}' - '{0CCE922B-69AE-11D9-BED3-505054503030}' - '{0CCE922F-69AE-11D9-BED3-505054503030}' - '{0CCE9230-69AE-11D9-BED3-505054503030}' - '{0CCE9235-69AE-11D9-BED3-505054503030}' - '{0CCE9236-69AE-11D9-BED3-505054503030}' - '{0CCE9237-69AE-11D9-BED3-505054503030}' - '{0CCE923F-69AE-11D9-BED3-505054503030}' - '{0CCE9240-69AE-11D9-BED3-505054503030}' - '{0CCE9242-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: - '%%8448' - '%%8450' selection_state_success_only: EventID: 4719 SubcategoryGuid: '{0CCE9217-69AE-11D9-BED3-505054503030}' AuditPolicyChanges|contains: '%%8448' condition: 1 of selection_* falsepositives: - Unlikely level: high