alirezaaminzadeh/cybersec-retrieval-benchmark huggingface dataset:
Sigma rule: Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.. Logsource: windows / process_access. Rule: title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs id: 9f5c1d59-33be-4e60-bcab-85d2f566effd related: - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 type: similar status: experimental description: 'Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques. ' references: - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.credential-access - attack.defense-impairment - attack.t1003.001 - attack.t1685 logsource: category: process_access product: windows detection: selection_lsass_calltrace: TargetImage|endswith: \lsass.exe CallTrace|contains: - dbgcore.dll - dbghelp.dll selection_susp_location: SourceImage|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Documents\ - \Downloads\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Possibly during software installation or update processes level: high regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml
Sigma rule: Detects when an user account is locked or suspended.. Logsource: onelogin / onelogin.events. Rule: title: OneLogin User Account Locked id: a717c561-d117-437e-b2d9-0118a7035d01 status: test description: Detects when an user account is locked or suspended. references: - https://developers.onelogin.com/api-docs/1/events/event-resource/ author: Austin Songer @austinsonger date: 2021-10-12 modified: 2022-12-25 tags: - attack.impact logsource: product: onelogin service: onelogin.events detection: selection1: event_type_id: 532 selection2: event_type_id: 553 selection3: event_type_id: 551 condition: 1 of selection* falsepositives: - System may lock or suspend user accounts. level: low
Sigma rule: Detects "RegAsm.exe" initiating a network connection to public IP adresses. Logsource: windows / network_connection. Rule: title: RegAsm.EXE Initiating Network Connection To Public IP id: 0531e43a-d77d-47c2-b89f-5fe50321c805 status: test description: Detects "RegAsm.exe" initiating a network connection to public IP adresses references: - https://app.any.run/tasks/ec207948-4916-47eb-a0f4-4c6abb2e7668/ - https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/ - https://lolbas-project.github.io/lolbas/Binaries/Regasm/ author: frack113 date: 2024-04-25 tags: - attack.stealth - attack.t1218.009 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' Image|endswith: \regasm.exe filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Sigma rule: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Created as System id: 590a5f4c-6c8c-4f10-8307-89afe9453a9d status: test description: Detection of child processes spawned with SYSTEM privileges by parents with LOCAL SERVICE or NETWORK SERVICE accounts references: - https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment - https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/ - https://github.com/antonioCoco/RogueWinRM - https://twitter.com/Cyb3rWard0g/status/1453123054243024897 author: Teymur Kheirkhabarov, Roberto Rodriguez (@Cyb3rWard0g), Open Threat Research (OTR) date: 2019-10-26 modified: 2024-12-01 tags: - attack.privilege-escalation - attack.stealth - attack.t1134.002 logsource: category: process_creation product: windows definition: 'Requirements: ParentUser field needs sysmon >= 13.30' detection: selection: ParentUser|contains: - AUTHORI - AUTORI ParentUser|endswith: - \NETWORK SERVICE - \LOCAL SERVICE User|contains: - AUTHORI - AUTORI User|endswith: - \SYSTEM - \Système - \СИСТЕМА IntegrityLevel: - System - S-1-16-16384 filter_rundll32: Image|endswith: \rundll32.exe CommandLine|contains: DavSetCookie condition: selection and not 1 of filter_* falsepositives: - Unknown level: high
Sigma rule: Detects attempts to query system information directly from the Windows Registry.. Logsource: windows / process_creation. Rule: title: System Information Discovery via Registry Queries id: 0022869c-49f7-4ff2-ba03-85ac42ddac58 status: experimental description: Detects attempts to query system information directly from the Windows Registry. references: - https://cert.gov.ua/article/6277849 - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md - https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md author: lazarg date: 2025-06-12 modified: 2025-10-25 tags: - attack.discovery - attack.t1082 logsource: category: process_creation product: windows detection: selection_cmd_reg: Image|endswith: \reg.exe CommandLine|contains: query CommandLine|contains|windash: -v selection_cmd_powershell: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - Get-ItemPropertyValue - gpv selection_keys: CommandLine|contains: - \SOFTWARE\Microsoft\Windows Defender - \SOFTWARE\Microsoft\Windows NT\CurrentVersion - \SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall - \SYSTEM\CurrentControlSet\Control\TimeZoneInformation - \SYSTEM\CurrentControlSet\Services condition: 1 of selection_cmd_* and selection_keys falsepositives: - Unlikely level: low regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_discovery_via_reg_queries/info.yml simulation: - type: atomic-red-team name: System Information Discovery technique: T1010 atomic_guid: 66703791-c902-4560-8770-42b8a91f7667 - type: atomic-red-team name: Discover OS Product Name via Registry technique: T1082 atomic_guid: be3b5fe3-a575-4fb8-83f6-ad4a68dd5ce7 - type: atomic-red-team name: Discover OS Build Number via Registry technique: T1082 atomic_guid: acfcd709-0013-4f1e-b9ee-bc1e7bafaaec
Sigma rule: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory. Logsource: windows / process_creation. Rule: title: Process Memory Dump via RdrLeakDiag.EXE id: edadb1e5-5919-4e4c-8462-a9e643b02c4b related: - id: 6355a919-2e97-4285-a673-74645566340d type: obsolete status: test description: Detects the use of the Microsoft Windows Resource Leak Diagnostic tool "rdrleakdiag.exe" to dump process memory references: - https://www.pureid.io/dumping-abusing-windows-credentials-part-1/ - https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/ - https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/ - https://twitter.com/0gtweet/status/1299071304805560321?s=21 - https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive author: Cedric MAURUGEON, Florian Roth (Nextron Systems), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) date: 2021-09-24 modified: 2024-08-15 tags: - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \rdrleakdiag.exe - OriginalFileName: RdrLeakDiag.exe selection_cli_dump: CommandLine|contains|windash: - /memdmp - fullmemdmp selection_cli_output_process: CommandLine|contains|windash: - ' /o ' - ' /p ' condition: all of selection_* falsepositives: - Unlikely level: high
Sigma rule: Detects network connections from the Equation Editor process "eqnedt32.exe".. Logsource: windows / network_connection. Rule: title: Network Connection Initiated By Eqnedt32.EXE id: a66bc059-c370-472c-a0d7-f8fd1bf9d583 status: test description: Detects network connections from the Equation Editor process "eqnedt32.exe". references: - https://twitter.com/forensicitguy/status/1513538712986079238 - https://forensicitguy.github.io/xloader-formbook-velvetsweatshop-spreadsheet/ - https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/ author: Max Altgelt (Nextron Systems) date: 2022-04-14 modified: 2024-05-31 tags: - attack.execution - attack.t1203 logsource: category: network_connection product: windows detection: selection: Image|endswith: \eqnedt32.exe condition: selection falsepositives: - Unlikely level: high
Sigma rule: Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with p. Logsource: windows / system. Rule: title: Active Directory Certificate Services Denied Certificate Enrollment Request id: 994bfd6d-0a2e-481e-a861-934069fcf5f5 status: test description: 'Detects denied requests by Active Directory Certificate Services. Example of these requests denial include issues with permissions on the certificate template or invalid signatures. ' references: - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10) - https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/ author: '@SerkinValery' date: 2024-03-07 tags: - attack.credential-access - attack.defense-impairment - attack.t1553.004 logsource: product: windows service: system detection: selection: Provider_Name: Microsoft-Windows-CertificationAuthority EventID: 53 condition: selection falsepositives: - Unknown level: low
Sigma rule: Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several. Logsource: windows / ps_script. Rule: title: Enumerate Credentials from Windows Credential Manager With PowerShell id: 603c6630-5225-49c1-8047-26c964553e0e status: test description: 'Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md author: frack113 date: 2021-12-20 modified: 2022-12-25 tags: - attack.credential-access - attack.t1555 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_cmd: ScriptBlockText|contains|all: - vaultcmd - '/listcreds:' selection_option: ScriptBlockText|contains: - Windows Credentials - Web Credentials condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitati. Logsource: windows / file_event. Rule: title: Suspicious File Write to SharePoint Layouts Directory id: 1f0489be-b496-4ddf-b3a9-5900f2044e9c status: experimental description: 'Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770. ' references: - https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/ - https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-07-24 tags: - attack.initial-access - attack.t1190 - attack.persistence - attack.t1505.003 logsource: product: windows category: file_event detection: selection: Image|endswith: - \cmd.exe - \powershell_ise.exe - \powershell.exe - \pwsh.exe - \w3wp.exe TargetFilename|startswith: - C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\ - C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\ TargetFilename|contains: - \15\TEMPLATE\LAYOUTS\ - \16\TEMPLATE\LAYOUTS\ TargetFilename|endswith: - .asax - .ascx - .ashx - .asmx - .asp - .aspx - .bat - .cmd - .cer - .config - .hta - .js - .jsp - .jspx - .php - .ps1 - .vbs condition: selection falsepositives: - Unknown level: high
Sigma rule: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this. Logsource: windows / registry_set. Rule: title: Registry Explorer Policy Modification id: 1c3121ed-041b-4d97-a075-07f54f20fb4a status: test description: Detects registry modifications that disable internal tools or functions in explorer (malware like Agent Tesla uses this technique) references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md author: frack113 date: 2022-03-18 modified: 2023-08-17 tags: - attack.persistence - attack.defense-impairment - attack.t1112 logsource: category: registry_set product: windows detection: selection_set_1: TargetObject|endswith: - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogOff - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileMenu - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyDocuments - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu Details: DWORD (0x00000001) condition: selection_set_1 falsepositives: - Legitimate admin script level: medium
Sigma rule: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Alias Cmdlets id: 96cd126d-f970-49c4-848a-da3a09f55c55 related: - id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 type: derived status: test description: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts references: - https://github.com/1337Rin/Swag-PSO author: frack113 date: 2023-01-08 modified: 2025-10-22 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'Set-Alias ' - 'New-Alias ' filter_main_cim: ScriptBlockText: - Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low
Sigma rule: Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modif. Logsource: windows / security. Rule: title: Windows Default Domain GPO Modification id: e5ac86dd-2da1-454b-be74-05d26c769d7d related: - id: dcff7e85-d01f-4eb5-badd-84e2e6be8294 type: similar status: experimental description: 'Detects modifications to Default Domain or Default Domain Controllers Group Policy Objects (GPOs). Adversaries may modify these default GPOs to deploy malicious configurations across the domain. ' references: - https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html - https://adsecurity.org/?p=3377 - https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/ - https://jgspiers.com/audit-group-policy-changes/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-22 tags: - attack.privilege-escalation - attack.defense-impairment - attack.t1484.001 logsource: product: windows service: security definition: 'Enable ''Audit Directory Service Changes'' in the Default Domain Controllers Policy under: Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Advanced Audit Policy Configuration -> Audit Policies -> DS Access -> Audit Directory Service Changes (Success). Additionally, proper SACL needs to be configured on the ''CN=Policies,CN=System,DC=<domain>,DC=<tld>'' container in Active Directory to capture changes to Group Policy Objects. ' detection: selection: EventID: 5136 ObjectClass: groupPolicyContainer ObjectDN|startswith: - CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM - CN={6AC1786C-016F-11D2-945F-00C04FB984F9},CN=POLICIES,CN=SYSTEM condition: selection falsepositives: - Legitimate modifications to Default Domain or Default Domain Controllers GPOs level: medium
Sigma rule: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspici. Logsource: linux / process_creation. Rule: title: Suspicious Git Clone - Linux id: cfec9d29-64ec-4a0f-9ffe-0fdb856d5446 status: test description: Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious references: - https://gist.githubusercontent.com/MichaelKoczwara/12faba9c061c12b5814b711166de8c2f/raw/e2068486692897b620c25fde1ea258c8218fe3d3/history.txt author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-03 modified: 2023-01-05 tags: - attack.reconnaissance - attack.t1593.003 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /git CommandLine|contains: ' clone ' selection_keyword: CommandLine|contains: - exploit - Vulns - vulnerability - RCE - RemoteCodeExecution - Invoke- - CVE- - poc- - ProofOfConcept - proxyshell - log4shell - eternalblue - eternal-blue - MS17- condition: all of selection_* falsepositives: - Unknown level: medium
Sigma rule: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting at. Logsource: linux / vsftpd. Rule: title: Suspicious VSFTPD Error Messages id: 377f33a1-4b36-4ee1-acee-1dbe4b43cfbe status: test description: Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts references: - https://github.com/dagwieers/vsftpd/ author: Florian Roth (Nextron Systems) date: 2017-07-05 modified: 2021-11-27 tags: - attack.initial-access - attack.t1190 logsource: product: linux service: vsftpd detection: keywords: - 'Connection refused: too many sessions for this address.' - 'Connection refused: tcp_wrappers denial.' - Bad HTTP verb. - port and pasv both active - pasv and port both active - Transfer done (but failed to open directory). - Could not set file modification time. - 'bug: pid active in ptrace_sandbox_free' - PTRACE_SETOPTIONS failure - 'weird status:' - couldn't handle sandbox event - syscall * out of bounds - 'syscall not permitted:' - 'syscall validate failed:' - Input line too long. - poor buffer accounting in str_netfd_alloc - vsf_sysutil_read_loop condition: keywords falsepositives: - Unknown level: medium
Sigma rule: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string. Logsource: proxy. Rule: title: Rclone Activity via Proxy id: 2c03648b-e081-41a5-b9fb-7d854a915091 status: test description: Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string references: - https://rclone.org/ - https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone author: Janantha Marasinghe date: 2022-10-18 tags: - attack.exfiltration - attack.t1567.002 logsource: category: proxy detection: selection: c-useragent|startswith: rclone/v condition: selection falsepositives: - Valid requests with this exact user agent to that is used by legitimate scripts or sysadmin operations level: medium
Sigma rule: Detects suspicious Plink tunnel port forwarding to a local port. Logsource: windows / process_creation. Rule: title: Suspicious Plink Port Forwarding id: 48a61b29-389f-4032-b317-b30de6b95314 status: test description: Detects suspicious Plink tunnel port forwarding to a local port references: - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/ - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d author: Florian Roth (Nextron Systems) date: 2021-01-19 modified: 2022-10-09 tags: - attack.command-and-control - attack.t1572 - attack.lateral-movement - attack.t1021.001 logsource: category: process_creation product: windows detection: selection: Description: Command-line SSH, Telnet, and Rlogin client CommandLine|contains: ' -R ' condition: selection falsepositives: - Administrative activity using a remote port forwarding to a local port level: high
Sigma rule: Detects when an attacker register a new SIP provider for persistence and defense evasion. Logsource: windows / registry_set. Rule: title: Potential Persistence Via Mpnotify id: 92772523-d9c1-4c93-9547-b0ca500baba3 status: test description: Detects when an attacker register a new SIP provider for persistence and defense evasion references: - https://persistence-info.github.io/Data/mpnotify.html - https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek author: Nasreddine Bencherchali (Nextron Systems) date: 2022-07-21 modified: 2023-08-17 tags: - attack.persistence logsource: category: registry_set product: windows detection: selection: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\mpnotify condition: selection falsepositives: - Might trigger if a legitimate new SIP provider is registered. But this is not a common occurrence in an environment and should be investigated either way level: high