alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity. Logsource: proxy. Rule: title: PwnDrp Access id: 2b1ee7e4-89b6-4739-b7bb-b811b6607e5e status: test description: Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity references: - https://breakdev.org/pwndrop/ author: Florian Roth (Nextron Systems) date: 2020-04-15 modified: 2021-11-27 tags: - attack.command-and-control - attack.t1071.001 - attack.t1102.001 - attack.t1102.003 logsource: category: proxy detection: selection: c-uri|contains: /pwndrop/ condition: selection falsepositives: - Unknown level: critical
Sigma rule: Detects when a program changes the default file association of any extension to an executable. When a file is opened, th. Logsource: windows / process_creation. Rule: title: Change Default File Association To Executable Via Assoc id: ae6f14e6-14de-45b0-9f44-c0986f50dc89 related: - id: 3d3aa6cd-6272-44d6-8afc-7e88dfef7061 type: derived status: test description: 'Detects when a program changes the default file association of any extension to an executable. When a file is opened, the default program used to open the file (also called the file association or handler) is checked. File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility. Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened. ' references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc author: Nasreddine Bencherchali (Nextron Systems) date: 2022-06-28 modified: 2023-03-06 tags: - attack.privilege-escalation - attack.persistence - attack.t1546.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \cmd.exe - OriginalFileName: Cmd.Exe selection_cli: CommandLine|contains|all: - 'assoc ' - exefile filter: CommandLine|contains: .exe=exefile condition: all of selection_* and not filter falsepositives: - Unknown level: high
Sigma rule: Detects usage of bitsadmin downloading a file. Logsource: windows / process_creation. Rule: title: File Download Via Bitsadmin id: d059842b-6b9d-4ed1-b5c3-5b89143c6ede status: test description: Detects usage of bitsadmin downloading a file references: - https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin - https://isc.sans.edu/diary/22264 - https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/ author: Michael Haag, FPT.EagleEye date: 2017-03-09 modified: 2023-02-15 tags: - attack.persistence - attack.execution - attack.stealth - attack.t1197 - attack.s0190 - attack.t1036.003 - attack.command-and-control - attack.t1105 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bitsadmin.exe - OriginalFileName: bitsadmin.exe selection_cmd: CommandLine|contains: ' /transfer ' selection_cli_1: CommandLine|contains: - ' /create ' - ' /addfile ' selection_cli_2: CommandLine|contains: http condition: selection_img and (selection_cmd or all of selection_cli_*) falsepositives: - Some legitimate apps use this, but limited. level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_bitsadmin_download/info.yml simulation: - type: atomic-red-team name: Windows - BITSAdmin BITS Download technique: T1105 atomic_guid: a1921cd3-9a2d-47d5-a891-f1d0f2a7a31b
Sigma rule: Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/writ. Logsource: windows / image_load. Rule: title: Potentially Suspicious Image Load of Offreg.dll id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95 status: experimental description: 'Detects potentially suspicious loading of the Offline Registry Library (offreg.dll). Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API, bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives while evading detection mechanisms that rely on standard registry event logs. ' references: - https://learn.microsoft.com/en-us/windows/win32/devnotes/about-the-offline-registry-library - https://github.com/MSNightmare/LegacyHive author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2026-07-23 tags: - attack.defense-impairment - attack.persistence - attack.t1112 logsource: category: image_load product: windows detection: selection: ImageLoaded|endswith: \offreg.dll filter_main_system32: Image|startswith: - C:\Windows\System32\ - C:\Windows\SysWOW64\ - C:\Windows\WinSxS\ filter_main_program_files: Image|startswith: - C:\Program Files\ - C:\Program Files (x86)\ filter_main_appdata_local_programs: Image|startswith: C:\Users\ Image|contains: \AppData\Local\Programs\ filter_main_defender: Image|startswith: C:\ProgramData\Microsoft\Windows Defender\Platform\ Image|endswith: \MsMpEng.exe condition: selection and not 1 of filter_main_* falsepositives: - Third-party backup or forensic software that performs offline registry parsing - Windows deployment tools (DISM, ADK) run from non-standard paths level: medium regression_tests_path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml
Sigma rule: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCK. Logsource: aws / cloudtrail. Rule: title: AWS IAM S3Browser Templated S3 Bucket Policy Creation id: db014773-7375-4f4e-b83b-133337c0ffee status: test description: Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>". references: - https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor author: daniel.bohannon@permiso.io (@danielhbohannon) date: 2023-05-17 tags: - attack.execution - attack.stealth - attack.t1059.009 - attack.persistence - attack.initial-access - attack.privilege-escalation - attack.t1078.004 logsource: product: aws service: cloudtrail detection: selection: eventSource: iam.amazonaws.com eventName: PutUserPolicy userAgent|contains: S3 Browser requestParameters|contains|all: - '"arn:aws:s3:::<YOUR-BUCKET-NAME>/*"' - '"s3:GetObject"' - '"Allow"' condition: selection falsepositives: - Valid usage of S3 browser with accidental creation of default Inline IAM policy without changing default S3 bucket name placeholder value level: high
Sigma rule: Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.. Logsource: windows / process_creation. Rule: title: Potential Homoglyph Attack Using Lookalike Characters id: 32e280f1-8ad4-46ef-9e80-910657611fbc status: test description: 'Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters. This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters. ' references: - https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish - http://www.irongeek.com/homoglyph-attack-generator.php author: Micah Babinski, @micahbabinski date: 2023-05-07 tags: - attack.stealth - attack.t1036 - attack.t1036.003 logsource: category: process_creation product: windows detection: selection_upper: CommandLine|contains: - А - В - Е - К - М - Н - О - Р - С - Т - Х - Ѕ - І - Ј - Ү - Ӏ - Ԍ - Ԛ - Ԝ - Α - Β - Ε - Ζ - Η - Ι - Κ - Μ - Ν - Ο - Ρ - Τ - Υ - Χ selection_lower: CommandLine|contains: - а - е - о - р - с - х - ѕ - і - ӏ - ј - һ - ԁ - ԛ - ԝ - ο condition: 1 of selection_* falsepositives: - Commandlines with legitimate Cyrillic text; will likely require tuning (or not be usable) in countries where these alphabets are in use. level: medium
Sigma rule: Detects potentially suspicious file download from file sharing domains using curl.exe. Logsource: windows / process_creation. Rule: title: Suspicious File Download From File Sharing Domain Via Curl.EXE id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb related: - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar - id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 type: similar status: test description: Detects potentially suspicious file download from file sharing domains using curl.exe references: - https://labs.withsecure.com/publications/fin7-target-veeam-servers - https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-05 modified: 2026-03-29 tags: - attack.execution logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \curl.exe - OriginalFileName: curl.exe selection_websites: CommandLine|contains: - .githubusercontent.com - 0x0.st - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - ddns.net - dl.dropboxusercontent.com - ghostbin.co - github.com - glitch.me - gofile.io - hastebin.com - mediafire.com - mega.nz - onrender.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - send.exploit.in - sendspace.com - storage.googleapis.com - storjshare.io - supabase.co - temp.sh - transfer.sh - trycloudflare.com - ufile.io - w3spaces.com - workers.dev - x0.at selection_http: CommandLine|contains: http selection_flag: CommandLine|contains: - ' -O' - --remote-name - --output selection_ext: CommandLine|endswith: - .ps1 - .ps1' - .ps1" - .dat - .dat' - .dat" - .msi - .msi' - .msi" - .bat - .bat' - .bat" - .exe - .exe' - .exe" - .vbs - .vbs' - .vbs" - .vbe - .vbe' - .vbe" - .hta - .hta' - .hta" - .dll - .dll' - .dll" - .psm1 - .psm1' - .psm1" condition: all of selection_* falsepositives: - Unknown level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains/info.yml
Sigma rule: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of Manage Engine ServiceDesk id: cea2b7ea-792b-405f-95a1-b903ea06458f status: test description: Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service references: - https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/ - https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py - https://blog.viettelcybersecurity.com/saml-show-stopper/ author: Florian Roth (Nextron Systems) date: 2023-01-18 modified: 2023-08-29 tags: - attack.command-and-control - attack.t1102 logsource: category: process_creation product: windows detection: selection: ParentImage|contains|all: - \ManageEngine\ServiceDesk\ - \java.exe Image|endswith: - \AppVLP.exe - \bash.exe - \bitsadmin.exe - \calc.exe - \certutil.exe - \cscript.exe - \curl.exe - \forfiles.exe - \mftrace.exe - \mshta.exe - \net.exe - \net1.exe - \notepad.exe - \powershell.exe - \pwsh.exe - \query.exe - \reg.exe - \schtasks.exe - \scrcons.exe - \sh.exe - \systeminfo.exe - \whoami.exe - \wmic.exe - \wscript.exe filter_main_net: Image|endswith: - \net.exe - \net1.exe CommandLine|contains: ' stop' condition: selection and not 1 of filter_main_* falsepositives: - Legitimate sub processes started by Manage Engine ServiceDesk Pro level: high
Sigma rule: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership.. Logsource: rpc_firewall / application. Rule: title: SharpHound Recon Sessions id: 6d580420-ff3f-4e0e-b6b0-41b90c787e28 status: test description: Detects remote RPC calls useb by SharpHound to map remote connections and local group membership. references: - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183 - https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md - https://github.com/zeronetworks/rpcfirewall - https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/ author: Sagie Dulce, Dekel Paz date: 2022-01-01 tags: - attack.discovery - attack.t1033 logsource: product: rpc_firewall category: application definition: 'Requirements: install and apply the RPC Firewall to all processes with "audit:true action:block uuid:4b324fc8-1670-01d3-1278-5a47bf6ee188 opnum:12' detection: selection: EventLog: RPCFW EventID: 3 InterfaceUuid: 4b324fc8-1670-01d3-1278-5a47bf6ee188 OpNum: 12 condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".. Logsource: windows / process_creation. Rule: title: Potential Provisioning Registry Key Abuse For Binary Proxy Execution id: 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25 related: - id: 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c type: similar - id: f9999590-1f94-4a34-a91e-951e47bedefd type: similar - id: 7021255e-5db3-4946-a8b9-0ba7a4644a69 type: similar status: test description: Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". references: - https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/ - https://twitter.com/0gtweet/status/1674399582162153472 author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel date: 2023-08-08 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: SOFTWARE\Microsoft\Provisioning\Commands\ condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom D. Logsource: windows / image_load. Rule: title: UAC Bypass Using Iscsicpl - ImageLoad id: 9ed5959a-c43c-4c59-84e3-d28628429456 status: test description: Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH% references: - https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC - https://twitter.com/wdormann/status/1547583317410607110 author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-17 modified: 2022-07-25 tags: - attack.privilege-escalation - attack.t1548.002 logsource: product: windows category: image_load detection: selection: Image: C:\Windows\SysWOW64\iscsicpl.exe ImageLoaded|endswith: \iscsiexe.dll filter: ImageLoaded|contains|all: - C:\Windows\ - iscsiexe.dll condition: selection and not filter falsepositives: - Unknown level: high
Sigma rule: Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign o. Logsource: windows / process_creation. Rule: title: Uncommon Child Process Of AddinUtil.EXE id: b5746143-59d6-4603-8d06-acbd60e166ee status: test description: 'Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload. ' references: - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) date: 2023-09-18 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \addinutil.exe filter_main_werfault: Image|endswith: - :\Windows\System32\conhost.exe - :\Windows\System32\werfault.exe - :\Windows\SysWOW64\werfault.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt. Logsource: windows / process_creation. Rule: title: Potentially Suspicious Child Process Of VsCode id: 5a3164f2-b373-4152-93cf-090b13c12d27 status: test description: Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. references: - https://twitter.com/nas_bench/status/1618021838407495681 - https://twitter.com/nas_bench/status/1618021415852335105 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-26 modified: 2023-10-25 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: \code.exe selection_children_images: Image|endswith: - \calc.exe - \regsvr32.exe - \rundll32.exe - \cscript.exe - \wscript.exe selection_children_cli: Image|endswith: - \powershell.exe - \pwsh.exe - \cmd.exe CommandLine|contains: - Invoke-Expressions - IEX - Invoke-Command - ICM - DownloadString - rundll32 - regsvr32 - wscript - cscript selection_children_paths: Image|contains: - :\Users\Public\ - :\Windows\Temp\ - :\Temp\ condition: selection_parent and 1 of selection_children_* falsepositives: - In development environment where VsCode is used heavily. False positives may occur when developers use task to compile or execute different types of code. Remove or add processes accordingly level: medium
Sigma rule: Detects suspicious command lines used in Covenant luanchers. Logsource: windows / process_creation. Rule: title: HackTool - Covenant PowerShell Launcher id: c260b6db-48ba-4b4a-a76f-2f67644e99d2 status: test description: Detects suspicious command lines used in Covenant luanchers references: - https://posts.specterops.io/covenant-v0-5-eee0507b85ba author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community date: 2020-06-04 modified: 2023-02-21 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1564.003 logsource: category: process_creation product: windows detection: selection_1: CommandLine|contains|all: - -Sta - -Nop - -Window - Hidden CommandLine|contains: - -Command - -EncodedCommand selection_2: CommandLine|contains: - 'sv o (New-Object IO.MemorySteam);sv d ' - mshta file.hta - GruntHTTP - -EncodedCommand cwB2ACAAbwAgA condition: 1 of selection_* level: high
Sigma rule: Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).. Logsource: proxy. Rule: title: HackTool - CobaltStrike Malleable Profile Patterns - Proxy id: f3f21ce1-cdef-4bfc-8328-ed2e826f5fac related: - id: 953b895e-5cc9-454b-b183-7f3db555452e type: obsolete - id: 41b42a36-f62c-4c34-bd40-8cb804a34ad8 type: obsolete - id: 37325383-740a-403d-b1a2-b2b4ab7992e7 type: obsolete - id: c9b33401-cc6a-4cf6-83bb-57ddcb2407fc type: obsolete status: test description: Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods). references: - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile - https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100 - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/ocsp.profile - https://github.com/yeyintminthuhtut/Malleable-C2-Profiles-Collection/ - https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/onedrive_getonly.profile author: Markus Neis, Florian Roth (Nextron Systems) date: 2024-02-15 tags: - attack.command-and-control - attack.t1071.001 logsource: category: proxy detection: selection_amazon_1: c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko cs-method: GET c-uri: /s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books cs-host: www.amazon.com cs-cookie|endswith: =csm-hit=s-24KU11BB82RZSYGJ3BDK|1419899012996 selection_amazon_2: c-useragent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko cs-method: POST c-uri: /N4215/adj/amzn.us.sr.aps cs-host: www.amazon.com selection_generic_1: c-useragent: - Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1) - Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E ) - Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2) Java/1.5.0_08 selection_generic_2: c-useragent|endswith: ; MANM; MANM) selection_oscp: c-uri|contains: /oscp/ cs-host: ocsp.verisign.com selection_onedrive: cs-method: GET c-uri|endswith: \?manifest=wac cs-host: onedrive.live.com filter_main_onedrive: c-uri|startswith: http c-uri|contains: ://onedrive.live.com/ condition: 1 of selection_* and not 1 of filter_main_* falsepositives: - Unknown level: high
Sigma rule: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are leg. Logsource: zeek / dns. Rule: title: New Kind of Network (NKN) Detection id: fa7703d6-0ee8-4949-889c-48c84bc15b6f status: test description: NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma> references: - https://github.com/nknorg/nkn-sdk-go - https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/ - https://github.com/Maka8ka/NGLite author: Michael Portera (@mportatoes) date: 2022-04-21 tags: - attack.command-and-control logsource: product: zeek service: dns detection: selection: query|contains|all: - seed - .nkn.org condition: selection falsepositives: - Unknown level: low
Sigma rule: Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity. Logsource: windows / ps_script. Rule: title: PowerShell Get-Process LSASS in ScriptBlock id: 84c174ab-d3ef-481f-9c86-a50d0b8e3edb status: test description: Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity references: - https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211 author: Florian Roth (Nextron Systems) date: 2021-04-23 modified: 2022-12-25 tags: - attack.credential-access - attack.t1003.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: Get-Process lsass condition: selection falsepositives: - Legitimate certificate exports invoked by administrators or users (depends on processes in the environment - filter if unusable) level: high