alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and co. Logsource: jvm / application. Rule: title: Potential Local File Read Vulnerability In JVM Based Application id: e032f5bc-4563-4096-ae3b-064bab588685 status: test description: 'Detects potential local file read vulnerability in JVM based apps. If the exceptions are caused due to user input and contain path traversal payloads then it''s a red flag. ' references: - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs author: Moti Harmats date: 2023-02-11 tags: - attack.initial-access - attack.t1190 logsource: category: application product: jvm definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)' detection: keywords_local_file_read: '|all': - FileNotFoundException - /../../.. condition: keywords_local_file_read falsepositives: - Application bugs level: high
Sigma rule: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.. Logsource: windows / process_creation. Rule: title: REGISTER_APP.VBS Proxy Execution id: 1c8774a0-44d4-4db0-91f8-e792359c70bd status: test description: Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. references: - https://twitter.com/sblmsrsn/status/1456613494783160325?s=20 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-19 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - \register_app.vbs - -register condition: selection falsepositives: - Legitimate usage of the script. Always investigate what's being registered to confirm if it's benign level: medium
Sigma rule: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary. Logsource: windows / registry_set. Rule: title: Persistence Via Hhctrl.ocx id: f10ed525-97fe-4fed-be7c-2feecca941b1 status: test description: Detects when an attacker modifies the registry value of the "hhctrl" to point to a custom binary references: - https://persistence-info.github.io/Data/hhctrl.html - https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/ author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32\(Default) filter: Details: C:\Windows\System32\hhctrl.ocx condition: selection and not filter falsepositives: - Unlikely level: high
Sigma rule: Detects a ping command that uses a hex encoded IP address. Logsource: windows / process_creation. Rule: title: Ping Hex IP id: 1a0d4aba-7668-4365-9ce4-6d79ab088dfd status: test description: Detects a ping command that uses a hex encoded IP address references: - https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna - https://twitter.com/vysecurity/status/977198418354491392 author: Florian Roth (Nextron Systems) date: 2018-03-23 modified: 2025-10-17 tags: - attack.stealth - attack.t1140 - attack.t1027 logsource: category: process_creation product: windows detection: selection: Image|endswith: \ping.exe CommandLine|re: 0x[a-fA-F0-9]{8} condition: selection falsepositives: - Unlikely, because no sane admin pings IP addresses in a hexadecimal form level: high
Sigma rule: Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary. Logsource: windows / process_creation. Rule: title: Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution id: a20391f8-76fb-437b-abc0-dba2df1952c6 related: - id: 65c3ca2c-525f-4ced-968e-246a713d164f type: similar status: test description: Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary references: - https://twitter.com/mrd0x/status/1463526834918854661 - https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5 author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-01-11 modified: 2023-04-11 tags: - attack.execution - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \Microsoft.NodejsTools.PressAnyKey.exe condition: selection falsepositives: - Legitimate use by developers as part of NodeJS development with Visual Studio Tools level: medium
Sigma rule: Detects when a Container Registry is created or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Container Registry Created or Deleted id: 93e0ef48-37c8-49ed-a02c-038aab23628e status: test description: Detects when a Container Registry is created or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/WRITE - MICROSOFT.CONTAINERREGISTRY/REGISTRIES/DELETE condition: selection falsepositives: - Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low
Sigma rule: Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentCont. Logsource: windows / process_creation. Rule: title: Potential Tampering With RDP Related Registry Keys Via Reg.EXE id: 0d5675be-bc88-4172-86d3-1e96a4476536 status: test description: Detects the execution of "reg.exe" for enabling/disabling the RDP service on the host by tampering with the 'CurrentControlSet\Control\Terminal Server' values references: - https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/ - http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/ - http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/ - https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services - https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/ - https://blog.sekoia.io/darkgate-internals/ - https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-63---disable-remote-desktop-anti-alias-setting-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/02c7d02fe1f1feb0fc7944550408ea8224273994/atomics/T1112/T1112.md#atomic-test-64---disable-remote-desktop-security-settings-through-registry - https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 - https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer - https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html - https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03 - https://web.archive.org/web/20200929062532/https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html author: pH-T (Nextron Systems), @Kostastsale, TheDFIRReport date: 2022-02-12 modified: 2025-11-22 tags: - attack.persistence - attack.lateral-movement - attack.defense-impairment - attack.t1021.001 - attack.t1112 logsource: product: windows category: process_creation detection: selection_main_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_main_cli: CommandLine|contains|all: - ' add ' - \CurrentControlSet\Control\Terminal Server - REG_DWORD - ' /f' selection_values_1:
Sigma rule: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their na. Logsource: windows / process_creation. Rule: title: HackTool - Impacket Tools Execution id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19 status: test description: Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives) references: - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries author: Florian Roth (Nextron Systems) date: 2021-07-24 modified: 2023-02-07 tags: - attack.collection - attack.execution - attack.credential-access - attack.t1557.001 logsource: category: process_creation product: windows detection: selection: - Image|contains: - \goldenPac - \karmaSMB - \kintercept - \ntlmrelayx - \rpcdump - \samrdump - \secretsdump - \smbexec - \smbrelayx - \wmiexec - \wmipersist - Image|endswith: - \atexec_windows.exe - \dcomexec_windows.exe - \dpapi_windows.exe - \findDelegation_windows.exe - \GetADUsers_windows.exe - \GetNPUsers_windows.exe - \getPac_windows.exe - \getST_windows.exe - \getTGT_windows.exe - \GetUserSPNs_windows.exe - \ifmap_windows.exe - \mimikatz_windows.exe - \netview_windows.exe - \nmapAnswerMachine_windows.exe - \opdump_windows.exe - \psexec_windows.exe - \rdp_check_windows.exe - \sambaPipe_windows.exe - \smbclient_windows.exe - \smbserver_windows.exe - \sniff_windows.exe - \sniffer_windows.exe - \split_windows.exe - \ticketer_windows.exe condition: selection falsepositives: - Legitimate use of the impacket tools level: high
Sigma rule: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder. Logsource: windows / process_creation. Rule: title: Execution of Powershell Script in Public Folder id: fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4 status: test description: This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder references: - https://www.mandiant.com/resources/evolution-of-fin7 author: Max Altgelt (Nextron Systems) date: 2022-04-06 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - -f C:\Users\Public - -f "C:\Users\Public - -f %Public% - -fi C:\Users\Public - -fi "C:\Users\Public - -fi %Public% - -fil C:\Users\Public - -fil "C:\Users\Public - -fil %Public% - -file C:\Users\Public - -file "C:\Users\Public - -file %Public% condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) t. Logsource: windows / image_load. Rule: title: Suspicious Volume Shadow Copy VSS_PS.dll Load id: 333cdbe8-27bb-4246-bf82-b41a0dca4b70 related: - id: 48bfd177-7cf2-412b-ad77-baf923489e82 type: similar - id: 37774c23-25a1-4adb-bb6d-8bb9fd59c0f8 type: similar status: test description: 'Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes. It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts. The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity. ' references: - https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add - https://twitter.com/am0nsec/status/1412232114980982787 author: Markus Neis, @markus_neis date: 2021-07-07 modified: 2025-07-11 tags: - attack.impact - attack.t1490 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \vss_ps.dll filter_main_legit: Image|startswith: C:\Windows\ Image|endswith: - \clussvc.exe - \dismhost.exe - \dllhost.exe - \inetsrv\appcmd.exe - \inetsrv\iissetup.exe - \msiexec.exe - \rundll32.exe - \searchindexer.exe - \srtasks.exe - \svchost.exe - \System32\SystemPropertiesAdvanced.exe - \taskhostw.exe - \thor.exe - \thor64.exe - \tiworker.exe - \vssvc.exe - \vssadmin.exe - \WmiPrvSE.exe - \wsmprovhost.exe filter_main_update: CommandLine|startswith: C:\$WinREAgent\Scratch\ CommandLine|contains: \dismhost.exe { filter_main_image_null: Image: null filter_optional_programfiles: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unknown level: high
Sigma rule: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script. Logsource: windows / process_creation. Rule: title: HackTool - Wmiexec Default Powershell Command id: 022eaba8-f0bf-4dd9-9217-4604b0bb3bb0 status: test description: Detects the execution of PowerShell with a specific flag sequence that is used by the Wmiexec script references: - https://github.com/fortra/impacket/blob/f4b848fa27654ca95bc0f4c73dbba8b9c2c9f30a/examples/wmiexec.py author: Nasreddine Bencherchali (Nextron Systems) date: 2023-03-08 tags: - attack.lateral-movement - attack.stealth logsource: category: process_creation product: windows detection: selection: CommandLine|contains: -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have. Logsource: windows / image_load. Rule: title: Potential DLL Sideloading Of KeyScramblerIE.DLL Via KeyScrambler.EXE id: d2451be2-b582-4e15-8701-4196ac180260 related: - id: ca5583e9-8f80-46ac-ab91-7f314d13b984 type: similar status: test description: 'Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe". Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe". ' references: - https://thehackernews.com/2024/03/two-chinese-apt-groups-ramp-up-cyber.html - https://csirt-cti.net/2024/02/01/stately-taurus-continued-new-information-on-cyberespionage-attacks-against-myanmar-military-junta/ - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ - https://twitter.com/Max_Mal_/status/1775222576639291859 - https://twitter.com/DTCERT/status/1712785426895839339 author: Swachchhanda Shrawan Poudel date: 2024-04-15 tags: - attack.persistence - attack.privilege-escalation - attack.execution - attack.stealth - attack.t1574.001 logsource: category: image_load product: windows detection: selection: Image|endswith: - \KeyScrambler.exe - \KeyScramblerLogon.exe ImageLoaded|endswith: \KeyScramblerIE.dll filter_main_legitimate_path: Image|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ ImageLoaded|contains: - C:\Program Files (x86)\KeyScrambler\ - C:\Program Files\KeyScrambler\ filter_main_signature: Signature: QFX Software Corporation SignatureStatus: Valid condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects powershell scripts that import modules from suspicious directories. Logsource: windows / ps_script. Rule: title: Import PowerShell Modules From Suspicious Directories id: 21f9162c-5f5d-4b01-89a8-b705bd7d10ab related: - id: c31364f7-8be6-4b77-8483-dd2b5a7b69a3 type: similar status: test description: Detects powershell scripts that import modules from suspicious directories references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-07 modified: 2023-01-10 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Import-Module "$Env:Temp\ - Import-Module '$Env:Temp\ - Import-Module $Env:Temp\ - Import-Module "$Env:Appdata\ - Import-Module '$Env:Appdata\ - Import-Module $Env:Appdata\ - Import-Module C:\Users\Public\ - ipmo "$Env:Temp\ - ipmo '$Env:Temp\ - ipmo $Env:Temp\ - ipmo "$Env:Appdata\ - ipmo '$Env:Appdata\ - ipmo $Env:Appdata\ - ipmo C:\Users\Public\ condition: selection falsepositives: - Unknown level: medium
Sigma rule: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag. Logsource: windows / process_creation. Rule: title: Potential NTLM Coercion Via Certutil.EXE id: 6c6d9280-e6d0-4b9d-80ac-254701b64916 status: test description: Detects possible NTLM coercion via certutil using the 'syncwithWU' flag references: - https://github.com/LOLBAS-Project/LOLBAS/issues/243 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-09-01 modified: 2023-02-14 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \certutil.exe - OriginalFileName: CertUtil.exe selection_cli: CommandLine|contains|all: - ' -syncwithWU ' - ' \\\\' condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion/info.yml
Sigma rule: Detects when a user disables the Windows Firewall via a Profile to help evade defense.. Logsource: windows / ps_script. Rule: title: Windows Firewall Profile Disabled id: 488b44e7-3781-4a71-888d-c95abfacf44d related: - id: 12f6b752-042d-483e-bf9c-915a6d06ad75 type: similar status: test description: Detects when a user disables the Windows Firewall via a Profile to help evade defense. references: - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell - https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php - http://woshub.com/manage-windows-firewall-powershell/ - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-30 tags: - attack.defense-impairment - attack.t1686.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_args: ScriptBlockText|contains|all: - 'Set-NetFirewallProfile ' - ' -Enabled ' - ' False' selection_opt: ScriptBlockText|contains: - ' -All ' - Public - Domain - Private condition: all of selection* falsepositives: - Unknown level: medium
Sigma rule: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH". Logsource: windows / ps_script. Rule: title: Add Windows Capability Via PowerShell Script id: 155c7fd5-47b4-49b2-bbeb-eb4fab335429 related: - id: b36d01a3-ddaf-4804-be18-18a6247adfcd type: similar status: test description: Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others. references: - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-22 modified: 2023-05-09 tags: - attack.execution logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmdlet: ScriptBlockText|contains: 'Add-WindowsCapability ' selection_capa: ScriptBlockText|contains: -Name OpenSSH. condition: all of selection_* falsepositives: - Legitimate usage of the capabilities by administrators or users. Add additional filters accordingly. level: medium
Sigma rule: Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by att. Logsource: windows / ps_script. Rule: title: PowerShell Hotfix Enumeration id: f5d1def8-1de0-4a0e-9794-1f6f27dd605c status: test description: Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by attackers references: - https://github.com/411Hall/JAWS/blob/233f142fcb1488172aa74228a666f6b3c5c48f1d/jaws-enum.ps1 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-21 tags: - attack.discovery logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Win32_QuickFixEngineering - HotFixID condition: selection falsepositives: - Legitimate administration scripts level: medium
Sigma rule: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware ac. Logsource: windows / file_rename. Rule: title: Suspicious Appended Extension id: e3f673b3-65d1-4d80-9146-466f8b63fa99 status: test description: Detects file renames where the target filename uses an uncommon double extension. Could indicate potential ransomware activity renaming files and adding a custom extension to the encrypted files, such as ".jpg.crypted", ".docx.locky", etc. references: - https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/ - https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/ author: frack113 date: 2022-07-16 modified: 2023-11-11 tags: - attack.impact - attack.t1486 logsource: product: windows category: file_rename definition: 'Requirements: Microsoft-Windows-Kernel-File Provider with at least the KERNEL_FILE_KEYWORD_RENAME_SETLINK_PATH keyword' detection: selection: SourceFilename|endswith: - .doc - .docx - .jpeg - .jpg - .lnk - .pdf - .png - .pst - .rtf - .xls - .xlsx TargetFilename|contains: - .doc. - .docx. - .jpeg. - .jpg. - .lnk. - .pdf. - .png. - .pst. - .rtf. - .xls. - .xlsx. filter_main_generic: TargetFilename|endswith: - .backup - .bak - .old - .orig - .temp - .tmp filter_optional_anaconda: TargetFilename|contains: :\ProgramData\Anaconda3\ TargetFilename|endswith: .c~ condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Backup software level: medium
Sigma rule: Identifies when an EKS cluster is created or deleted.. Logsource: aws / cloudtrail. Rule: title: AWS EKS Cluster Created or Deleted id: 33d50d03-20ec-4b74-a74e-1e65a38af1c0 status: test description: Identifies when an EKS cluster is created or deleted. references: - https://any-api.com/amazonaws_com/eks/docs/API_Description author: Austin Songer date: 2021-08-16 modified: 2022-10-09 tags: - attack.impact - attack.t1485 logsource: product: aws service: cloudtrail detection: selection: eventSource: eks.amazonaws.com eventName: - CreateCluster - DeleteCluster condition: selection falsepositives: - EKS Cluster being created or deleted may be performed by a system administrator. - Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - EKS Cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: low