alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or othe. Logsource: windows / file_change. Rule: title: Unusual File Modification by dns.exe id: 9f383dc0-fdeb-4d56-acbc-9f9f4f8f20f3 related: - id: 8f0b1fb1-9bd4-4e74-8cdf-a8de4d2adfd0 type: similar status: test description: Detects an unexpected file being modified by dns.exe which my indicate activity related to remote code execution or other forms of exploitation as seen in CVE-2020-1350 (SigRed) references: - https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html author: Tim Rauch (Nextron Systems), Elastic (idea) date: 2022-09-27 tags: - attack.persistence - attack.initial-access - attack.t1133 logsource: category: file_change product: windows detection: selection: Image|endswith: \dns.exe filter: TargetFilename|endswith: \dns.log condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects when a new identity provider is created for Okta.. Logsource: okta / okta. Rule: title: Okta Identity Provider Created id: 969c7590-8c19-4797-8c1b-23155de6e7ac status: test description: Detects when a new identity provider is created for Okta. references: - https://developer.okta.com/docs/reference/api/system-log/ - https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection author: kelnage date: 2023-09-07 modified: 2026-04-27 tags: - attack.privilege-escalation - attack.persistence - attack.t1098.001 logsource: product: okta service: okta detection: selection: eventType: system.idp.lifecycle.create condition: selection falsepositives: - When an admin creates a new, authorised identity provider. level: medium
Sigma rule: RDP login with localhost source address may be a tunnelled login. Logsource: windows / security. Rule: title: RDP Login from Localhost id: 51e33403-2a37-4d66-a574-1fda1782cc31 status: test description: RDP login with localhost source address may be a tunnelled login references: - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html author: Thomas Patzke date: 2019-01-28 modified: 2022-10-09 tags: - attack.lateral-movement - car.2013-07-002 - attack.t1021.001 logsource: product: windows service: security detection: selection: EventID: 4624 LogonType: 10 IpAddress: - ::1 - 127.0.0.1 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred. Logsource: aws / cloudtrail. Rule: title: RDS Database Security Group Modification id: 14f3f1c8-02d5-43a2-a191-91ffb52d3015 status: test description: 'Detects changes to the security group entries for RDS databases. This can indicate that a misconfiguration has occurred which potentially exposes the database to the public internet, a wider audience within the VPC or that removal of valid rules has occurred which could impact the availability of the database to legitimate services and users. ' references: - https://www.gorillastack.com/blog/real-time-events/important-aws-cloudtrail-security-events-tracking/ author: jamesc-grafana date: 2024-07-11 tags: - attack.initial-access - attack.t1190 logsource: product: aws service: cloudtrail detection: selection: eventSource: rds.amazonaws.com eventName: - AuthorizeDBSecurityGroupIngress - CreateDBSecurityGroup - DeleteDBSecurityGroup - RevokeDBSecurityGroupIngress condition: selection falsepositives: - Creation of a new Database that needs new security group rules level: medium
Sigma rule: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass. Logsource: windows / file_delete. Rule: title: ADS Zone.Identifier Deleted By Uncommon Application id: 3109530e-ab47-4cc6-a953-cac5ebcc93ae related: - id: 7eac0a16-5832-4e81-865f-0268a6d19e4b type: similar status: test description: Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps. references: - https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/ - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2023-09-04 modified: 2025-07-04 tags: - attack.stealth - attack.t1070.004 logsource: product: windows category: file_delete detection: selection: TargetFilename|endswith: :Zone.Identifier filter_main_generic: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\explorer.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\explorer.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_optional_browsers_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_browsers_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_browsers_msedge: Image: - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - C:\Program Files\Microsoft\Edge\Application\msedge.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Other third party applications not listed. level: medium
Sigma rule: Detects potential use of Rubeus via registered new trusted logon process. Logsource: windows / security. Rule: title: Register new Logon Process by Rubeus id: 12e6d621-194f-4f59-90cc-1959e21e69f7 status: test description: Detects potential use of Rubeus via registered new trusted logon process references: - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1 author: Roberto Rodriguez (source), Ilyas Ochkov (rule), oscd.community date: 2019-10-24 modified: 2022-10-09 tags: - attack.lateral-movement - attack.privilege-escalation - attack.credential-access - attack.t1558.003 logsource: product: windows service: security detection: selection: EventID: 4611 LogonProcessName: User32LogonProcesss condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the execution of the "cloudflared" binary from a non standard location.. Logsource: windows / process_creation. Rule: title: Cloudflared Portable Execution id: fadb84f0-4e84-4f6d-a1ce-9ef2bffb6ccd status: test description: 'Detects the execution of the "cloudflared" binary from a non standard location. ' references: - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/ - https://github.com/cloudflare/cloudflared - https://www.intrinsec.com/akira_ransomware/ - https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/ - https://github.com/cloudflare/cloudflared/releases author: Nasreddine Bencherchali (Nextron Systems) tags: - attack.command-and-control - attack.t1090.001 date: 2023-12-20 logsource: category: process_creation product: windows detection: selection: Image|endswith: \cloudflared.exe filter_main_admin_location: Image|contains: - :\Program Files (x86)\cloudflared\ - :\Program Files\cloudflared\ condition: selection and not 1 of filter_main_* falsepositives: - Legitimate usage of Cloudflared portable versions level: medium
Sigma rule: Detects files that have extensions commonly seen while SDelete is used to wipe files.. Logsource: windows / security. Rule: title: Potential Secure Deletion with SDelete id: 39a80702-d7ca-4a83-b776-525b1f86a36d status: test description: Detects files that have extensions commonly seen while SDelete is used to wipe files. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm - https://www.jpcert.or.jp/english/pub/sr/ir_research.html - https://learn.microsoft.com/en-gb/sysinternals/downloads/sdelete author: Thomas Patzke date: 2017-06-14 modified: 2024-12-13 tags: - attack.impact - attack.stealth - attack.defense-impairment - attack.t1070.004 - attack.t1027.005 - attack.t1485 - attack.t1553.002 - attack.s0195 logsource: product: windows service: security detection: selection: EventID: - 4656 - 4663 - 4658 ObjectName|endswith: - .AAA - .ZZZ condition: selection falsepositives: - Legitimate usage of SDelete - Files that are interacted with that have these extensions legitimately level: medium
Sigma rule: Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic".. Logsource: windows / process_creation. Rule: title: Suspicious Eventlog Clearing or Configuration Change Activity id: cc36992a-4671-4f21-a91d-6c2b72a2edf5 status: stable description: 'Detects the clearing or configuration tampering of EventLog using utilities such as "wevtutil", "powershell" and "wmic". This technique were seen used by threat actors and ransomware strains in order to evade defenses. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee - https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/ - https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear author: Ecco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2019-09-26 modified: 2026-06-01 tags: - attack.defense-impairment - attack.t1685.005 - attack.t1685.001 - car.2016-04-002 logsource: category: process_creation product: windows detection: selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cmd: CommandLine|contains: - 'clear-log ' - ' cl ' - 'set-log ' - ' sl ' - 'lfn:' selection_other_ps_img: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe selection_other_ps_cmd: - CommandLine|contains: - 'Clear-EventLog ' - 'Remove-EventLog ' - 'Limit-EventLog ' - 'Clear-WinEvent ' - CommandLine|contains|all: - Eventing.Reader.EventLogSession - ClearLog - CommandLine|contains|all: - Diagnostics.EventLog - Clear selection_other_wmi: Image|endswith: - \powershell.exe - \powershell_ise.exe - \pwsh.exe - \wmic.exe CommandLine|contains: ClearEventLog filter_main_msiexec: ParentImage: - C:\Windows\SysWOW
Sigma rule: Detects the use of Advanced Port Scanner.. Logsource: windows / process_creation. Rule: title: PUA - Advanced Port Scanner Execution id: 54773c5f-f1cc-4703-9126-2f797d96a69d status: test description: Detects the use of Advanced Port Scanner. references: - https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20Port%20Scanner author: Nasreddine Bencherchali (Nextron Systems) date: 2021-12-18 modified: 2023-02-07 tags: - attack.discovery - attack.t1046 - attack.t1135 logsource: category: process_creation product: windows detection: selection_img: - Image|contains: \advanced_port_scanner - OriginalFileName|contains: advanced_port_scanner - Description|contains: Advanced Port Scanner selection_cli: CommandLine|contains|all: - /portable - /lng condition: 1 of selection_* falsepositives: - Legitimate administrative use - Tools with similar commandline (very rare) level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_pua_advanced_port_scanner/info.yml
Sigma rule: Detects read access to a domain user from a non-machine account. Logsource: windows / security. Rule: title: Potential AD User Enumeration From Non-Machine Account id: ab6bffca-beff-4baa-af11-6733f296d57a status: test description: Detects read access to a domain user from a non-machine account references: - https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf - http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html - https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4662 author: Maxime Thiebaut (@0xThiebaut) date: 2020-03-30 modified: 2022-11-08 tags: - attack.discovery - attack.t1087.002 logsource: product: windows service: security definition: 'Requirements: The "Read all properties" permission on the user object needs to be audited for the "Everyone" principal' detection: selection: EventID: 4662 ObjectType|contains: bf967aba-0de6-11d0-a285-00aa003049e2 AccessMask|endswith: - 1? - 3? - 4? - 7? - 9? - B? - D? - F? filter_main_machine_accounts: SubjectUserName|endswith: $ filter_main_msql: SubjectUserName|startswith: MSOL_ condition: selection and not 1 of filter_main_* falsepositives: - Administrators configuring new users. level: medium
Sigma rule: Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling. Logsource: windows / registry_set. Rule: title: Winget Admin Settings Modification id: 6db5eaf9-88f7-4ed9-af7d-9ef2ad12f236 status: test description: Detects changes to the AppInstaller (winget) admin settings. Such as enabling local manifest installations or disabling installer hash checks references: - https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget - https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-17 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment logsource: product: windows category: registry_set detection: selection: Image|endswith: \winget.exe TargetObject|startswith: \REGISTRY\A\ TargetObject|endswith: \LocalState\admin_settings condition: selection falsepositives: - The event doesn't contain information about the type of change. False positives are expected with legitimate changes level: low
Sigma rule: Monitor and alert on group membership additions of groups that have CA policy modification access. Logsource: azure / auditlogs. Rule: title: User Added To Group With CA Policy Modification Access id: 91c95675-1f27-46d0-bead-d1ae96b97cd3 status: test description: Monitor and alert on group membership additions of groups that have CA policy modification access references: - https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner' date: 2022-08-04 tags: - attack.privilege-escalation - attack.credential-access - attack.persistence - attack.defense-impairment - attack.t1548 - attack.t1556 logsource: product: azure service: auditlogs detection: selection: properties.message: Add member from group condition: selection falsepositives: - User removed from the group is approved level: medium
Sigma rule: Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect u. Logsource: linux / auditd. Rule: title: Binary Padding - Linux id: c52a914f-3d8b-4b2a-bb75-b3991e75f8ba status: test description: 'Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This rule detect using dd and truncate to add a junk data to file. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md author: Igor Fits, oscd.community date: 2020-10-13 modified: 2023-05-03 tags: - attack.stealth - attack.t1027.001 logsource: product: linux service: auditd detection: selection_execve: type: EXECVE keywords_truncate: '|all': - truncate - -s keywords_dd: '|all': - dd - if= keywords_filter: - of= condition: selection_execve and (keywords_truncate or (keywords_dd and not keywords_filter)) falsepositives: - Unknown level: high simulation: - type: atomic-red-team name: Pad Binary to Change Hash - Linux/macOS dd technique: T1027.001 atomic_guid: ffe2346c-abd5-4b45-a713-bf5f1ebd573a
Sigma rule: Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage. Logsource: windows / network_connection. Rule: title: Uncommon Outbound Kerberos Connection id: e54979bd-c5f9-4d6c-967b-a04b19ac4c74 related: - id: eca91c7c-9214-47b9-b4c5-cb1d7e4f2350 type: similar status: test description: 'Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation. ' references: - https://github.com/GhostPack/Rubeus author: Ilyas Ochkov, oscd.community date: 2019-10-24 modified: 2024-03-15 tags: - attack.credential-access - attack.t1558 - attack.lateral-movement - attack.t1550.003 logsource: category: network_connection product: windows detection: selection: DestinationPort: 88 Initiated: 'true' filter_main_lsass: Image: C:\Windows\System32\lsass.exe filter_optional_chrome: Image: - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - C:\Program Files\Google\Chrome\Application\chrome.exe filter_optional_firefox: Image: - C:\Program Files (x86)\Mozilla Firefox\firefox.exe - C:\Program Files\Mozilla Firefox\firefox.exe filter_optional_tomcat: Image|endswith: \tomcat\bin\tomcat8.exe condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Web Browsers and third party application might generate similar activity. An initial baseline is required. level: medium
Sigma rule: Detects potentially suspicious child processes of "regsvr32.exe".. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of Regsvr32 id: 6f0947a4-1c5e-4e0d-8ac7-53159b8f23ca related: - id: 8e2b24c9-4add-46a0-b4bb-0057b4e6187d type: obsolete status: test description: Detects potentially suspicious child processes of "regsvr32.exe". references: - https://redcanary.com/blog/intelligence-insights-april-2022/ - https://www.echotrail.io/insights/search/regsvr32.exe - https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo author: elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-05-05 modified: 2023-05-26 tags: - attack.stealth - attack.t1218.010 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \regsvr32.exe Image|endswith: - \calc.exe - \cscript.exe - \explorer.exe - \mshta.exe - \net.exe - \net1.exe - \nltest.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \reg.exe - \schtasks.exe - \werfault.exe - \wscript.exe filter_main_werfault: Image|endswith: \werfault.exe CommandLine|contains: ' -u -p ' condition: selection and not 1 of filter_main_* falsepositives: - Unlikely, but can rarely occur. Apply additional filters accordingly. level: high
Sigma rule: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon mod. Logsource: windows / system. Rule: title: Zerologon Exploitation Using Well-known Tools id: 18f37338-b9bd-4117-a039-280c81f7a596 status: stable description: This rule is designed to detect attempts to exploit Zerologon (CVE-2020-1472) vulnerability using mimikatz zerologon module or other exploits from machine with "kali" hostname. references: - https://www.secura.com/blog/zero-logon - https://bi-zone.medium.com/hunting-for-zerologon-f65c61586382 author: Demyan Sokolin @_drd0c, Teymur Kheirkhabarov @HeirhabarovT, oscd.community date: 2020-10-13 modified: 2021-05-30 tags: - attack.t1210 - attack.lateral-movement logsource: service: system product: windows detection: selection: EventID: - 5805 - 5723 keywords: - kali - mimikatz condition: selection and keywords level: critical
Sigma rule: Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which. Logsource: linux / process_creation. Rule: title: Suspicious Invocation of Shell via Rsync id: 297241f3-8108-4b3a-8c15-2dda9f844594 status: experimental description: 'Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation. ' references: - https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/ - https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10 author: Florian Roth date: 2025-01-18 tags: - attack.execution - attack.t1059 - attack.t1203 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /rsync - /rsyncd Image|endswith: - /ash - /bash - /csh - /dash - /ksh - /sh - /tcsh - /zsh filter_main_expected: CommandLine|contains: ' -e ' condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: Detects a WMI backdoor in Exchange Transport Agents via WMI event filters. Logsource: windows / process_creation. Rule: title: WMI Backdoor Exchange Transport Agent id: 797011dc-44f4-4e6f-9f10-a8ceefbe566b status: test description: Detects a WMI backdoor in Exchange Transport Agents via WMI event filters references: - https://twitter.com/cglyer/status/1182389676876980224 - https://twitter.com/cglyer/status/1182391019633029120 author: Florian Roth (Nextron Systems) date: 2019-10-11 modified: 2023-02-08 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.003 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \EdgeTransport.exe filter_conhost: Image: C:\Windows\System32\conhost.exe filter_oleconverter: Image|startswith: C:\Program Files\Microsoft\Exchange Server\ Image|endswith: \Bin\OleConverter.exe condition: selection and not 1 of filter_* falsepositives: - Unknown level: critical
Sigma rule: Detects known sensitive file extensions accessed on a network share. Logsource: windows / security. Rule: title: Suspicious Access to Sensitive File Extensions id: 91c945bc-2ad1-4799-a591-4d00198a1215 related: - id: 286b47ed-f6fe-40b3-b3a8-35129acd43bc type: similar status: test description: Detects known sensitive file extensions accessed on a network share references: - Internal Research author: Samir Bousseaden date: 2019-04-03 modified: 2025-10-17 tags: - attack.collection - attack.t1039 logsource: product: windows service: security detection: selection: EventID: 5145 RelativeTargetName|endswith: - .bak - .dmp - .edb - .kirbi - .msg - .nsf - .nst - .oab - .ost - .pst - .rdp condition: selection falsepositives: - Help Desk operator doing backup or re-imaging end user machine or backup software - Users working with these data types or exchanging message files level: medium