deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Azure Firewall Rule Configuration Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-08
Log source: azure/

Description:
Identifies when a Firewall Rule Configuration is Modified or Deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/WRITE",
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/RULECOLLECTIONGROUPS/DELETE",
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/WRITE",
      "MICROSOFT.NETWORK/FIREWALLPOLICIES/RULEGROUPS/DELETE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
Sigma Detection Rule: Azure Kubernetes Service Account Modified or Deleted
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-08-07
ATT&CK techniques: T1531, T1485, T1496, T1489
Log source: azure/

Description:
Identifies when a service account is modified or deleted.

Detection logic:
{
  "selection": {
    "operationName": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/WRITE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/DELETE",
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/SERVICEACCOUNTS/IMPERSONATE/ACTION"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
  - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1
Sigma Detection Rule: Azure Service Principal Removed
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-09-03
Log source: azure/

Description:
Identifies when a service principal was removed in Azure.

Detection logic:
{
  "selection": {
    "properties.message": "Remove service principal"
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#application-proxy
Sigma Detection Rule: Azure Kubernetes CronJob
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-22
ATT&CK techniques: T1053.003
Log source: azure/

Description:
Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.
Kubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.
An Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.


Detection logic:
{
  "selection": {
    "operationName|startswith": [
      "MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/BATCH",
      "MICROSOFT.CONTAINERSERVICE/MANAGEDCLUSTERS/BATCH"
    ],
    "operationName|endswith": [
      "/CRONJOBS/WRITE",
      "/JOBS/WRITE"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
  - https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/
  - https://kubernetes.io/docs/concepts/workloads/controllers/job/
  - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
Sigma Detection Rule: Cleartext Protocol Usage
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Alexandr Yampolskyi, SOC Prime, Tim Shelton
Date: 2019-03-26
Log source: /firewall

Description:
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.


Detection logic:
{
  "selection": {
    "dst_port": [
      8080,
      21,
      80,
      23,
      50000,
      1521,
      27017,
      3306,
      1433,
      11211,
      15672,
      5900,
      5901,
      5902,
      5903,
      5904
    ]
  },
  "selection_allow1": {
    "action": [
      "forward",
      "accept",
      2
    ]
  },
  "selection_allow2": {
    "blocked": "false"
  },
  "condition": "selection and 1 of selection_allow*"
}

References:
  - https://www.cisecurity.org/controls/cis-controls-list/
  - https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
  - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf
Sigma Detection Rule: Juniper BGP Missing MD5
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Tim Brown
Date: 2023-01-09
ATT&CK techniques: T1078, T1110, T1557
Log source: juniper/

Description:
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.

Detection logic:
{
  "keywords_bgp_juniper": {
    "|all": [
      ":179",
      "missing MD5 digest"
    ]
  },
  "condition": "keywords_bgp_juniper"
}

References:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Sigma Detection Rule: Telegram Bot API Request
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-06-05
ATT&CK techniques: T1102.002
Log source: /dns

Description:
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind

Detection logic:
{
  "selection": {
    "query": "api.telegram.org"
  },
  "condition": "selection"
}

References:
  - https://core.telegram.org/bots/faq
  - https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
  - https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/
  - https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/
Sigma Detection Rule: Wannacry Killswitch Domain
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Mike Wade
Date: 2020-09-16
ATT&CK techniques: T1071.001
Log source: /dns

Description:
Detects wannacry killswitch domain dns queries

Detection logic:
{
  "selection": {
    "query": [
      "ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.testing",
      "ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.test",
      "ifferfsodp9ifjaposdfjhgosurijfaewrwergwea.com",
      "ayylmaotjhsstasdfasdfasdfasdfasdfasdfasdf.com",
      "iuqssfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mandiant.com/resources/blog/wannacry-ransomware-campaign
Sigma Detection Rule: Cobalt Strike DNS Beaconing
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-05-10
ATT&CK techniques: T1071.004
Log source: /dns

Description:
Detects suspicious DNS queries known from Cobalt Strike beacons

Detection logic:
{
  "selection1": {
    "query|startswith": [
      "aaa.stage.",
      "post.1"
    ]
  },
  "selection2": {
    "query|contains": ".stage.123456."
  },
  "condition": "1 of selection*"
}

References:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
Sigma Detection Rule: Monero Crypto Coin Mining Pool Lookup
Repository: SigmaHQ/sigma
Severity: high
Status: stable
Author: Florian Roth (Nextron Systems)
Date: 2021-10-24
ATT&CK techniques: T1496, T1567
Log source: /dns

Description:
Detects suspicious DNS queries to Monero mining pools

Detection logic:
{
  "selection": {
    "query|contains": [
      "pool.minexmr.com",
      "fr.minexmr.com",
      "de.minexmr.com",
      "sg.minexmr.com",
      "ca.minexmr.com",
      "us-west.minexmr.com",
      "pool.supportxmr.com",
      "mine.c3pool.com",
      "xmr-eu1.nanopool.org",
      "xmr-eu2.nanopool.org",
      "xmr-us-east1.nanopool.org",
      "xmr-us-west1.nanopool.org",
      "xmr-asia1.nanopool.org",
      "xmr-jp1.nanopool.org",
      "xmr-au1.nanopool.org",
      "xmr.2miners.com",
      "xmr.hashcity.org",
      "xmr.f2pool.com",
      "xmrpool.eu",
      "pool.hashvault.pro"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.nextron-systems.com/2021/10/24/monero-mining-pool-fqdns/
Sigma Detection Rule: DNS Query to External Service Interaction Domains
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Matt Kelly (list of domains)
Date: 2022-06-07
ATT&CK techniques: T1190, T1595.002
Log source: /dns

Description:
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE


Detection logic:
{
  "selection": {
    "query|endswith": [
      ".burpcollaborator.net",
      ".canarytokens.com",
      ".ceye.io",
      ".ddns.1443.eu.org",
      ".ddns.bypass.eu.org",
      ".ddns.xn--gg8h.eu.org",
      ".digimg.store",
      ".dns.su18.org",
      ".dnshook.site",
      ".dnslog.cn",
      ".dnslog.ink",
      ".instances.httpworkbench.com",
      ".interact.sh",
      ".log.dnslog.pp.ua",
      ".log.dnslog.qzz.io",
      ".log.dnslogs.dpdns.org",
      ".log.javaweb.org",
      ".log.nat.cloudns.ph",
      ".oast.fun",
      ".oast.live",
      ".oast.me",
      ".oast.online",
      ".oast.pro",
      ".oast.site",
      ".oastify.com",
      ".p8.lol",
      ".requestbin.net"
    ]
  },
  "filter_main_polling": {
    "query|contains": "polling.oastify.com"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://twitter.com/breakersall/status/[PII_REDACTED]28260866
  - https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
  - https://github.com/SigmaHQ/sigma/pull/5724#issuecomment[PII_REDACTED]
Sigma Detection Rule: Suspicious DNS Query with B64 Encoded String
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-05-10
ATT&CK techniques: T1048.003, T1071.004
Log source: /dns

Description:
Detects suspicious DNS queries using base64 encoding

Detection logic:
{
  "selection": {
    "query|contains": "==."
  },
  "condition": "selection"
}

References:
  - https://github.com/krmaxwell/dns-exfiltration
Sigma Detection Rule: DNS TXT Answer with Possible Execution Strings
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Markus Neis
Date: 2018-08-08
ATT&CK techniques: T1071.004
Log source: /dns

Description:
Detects strings used in command execution in DNS TXT Answer

Detection logic:
{
  "selection": {
    "record_type": "TXT",
    "answer|contains": [
      "IEX",
      "Invoke-Expression",
      "cmd.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/stvemillertime/status/[PII_REDACTED]47854592
  - https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1
Sigma Detection Rule: Huawei BGP Authentication Failures
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Tim Brown
Date: 2023-01-09
ATT&CK techniques: T1078, T1110, T1557
Log source: huawei/

Description:
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.

Detection logic:
{
  "keywords_bgp_huawei": {
    "|all": [
      ":179",
      "BGP_AUTH_FAILED"
    ]
  },
  "condition": "keywords_bgp_huawei"
}

References:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Sigma Detection Rule: Cisco BGP Authentication Failures
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Tim Brown
Date: 2023-01-09
ATT&CK techniques: T1078, T1110, T1557
Log source: cisco/

Description:
Detects BGP failures which may be indicative of brute force attacks to manipulate routing

Detection logic:
{
  "keywords_bgp_cisco": {
    "|all": [
      ":179",
      "IP-TCP-3-BADAUTH"
    ]
  },
  "condition": "keywords_bgp_cisco"
}

References:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Sigma Detection Rule: Cisco Stage Data
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1074, T1105, T1560.001
Log source: cisco/

Description:
Various protocols maybe used to put data on the device for exfil or infil

Detection logic:
{
  "keywords": [
    "tftp",
    "rcp",
    "puts",
    "copy",
    "configure replace",
    "archive tar"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco Sniffing
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Clark
Date: 2019-08-11
ATT&CK techniques: T1040
Log source: cisco/

Description:
Show when a monitor or a span/rspan is setup or modified

Detection logic:
{
  "keywords": [
    "monitor capture point",
    "set span",
    "set rspan"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco Clear Logs
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1070.003
Log source: cisco/

Description:
Clear command history in network OS which is used for defense evasion

Detection logic:
{
  "keywords": [
    "clear logging",
    "clear archive"
  ],
  "condition": "keywords"
}

References:
  - https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/command/reference/sysmgmt/n5k-sysmgmt-cr/n5k-sm_cmds_c.html
  - https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
Sigma Detection Rule: Cisco Disabling Logging
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Clark
Date: 2019-08-11
ATT&CK techniques: T1685
Log source: cisco/

Description:
Turn off logging locally or remote

Detection logic:
{
  "keywords": [
    "no logging",
    "no aaa new-model"
  ],
  "condition": "keywords"
}

References:
  - https://www.cisco.com/en/US/docs/ios/security/command/reference/sec_a2.pdf
Sigma Detection Rule: Cisco Denial of Service
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Clark
Date: 2019-08-15
ATT&CK techniques: T1495, T1529, T1565.001
Log source: cisco/

Description:
Detect a system being shutdown or put into different boot mode

Detection logic:
{
  "keywords": [
    "shutdown",
    "config-register 0x2100",
    "config-register 0x2142"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco Dot1x Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Luc Génaux
Date: 2026-04-28
ATT&CK techniques: T1685, T1556.004
Log source: cisco/

Description:
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.


Detection logic:
{
  "keywords": [
    "access-session port-control force-authorized",
    "authentication port-control force-authorized",
    "dot1x port-control force-authorized",
    "no access-session port-control",
    "no authentication port-control",
    "no dot1x port-control",
    "no dot1x system-auth-control"
  ],
  "condition": "keywords"
}

References:
  - https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp[PII_REDACTED]
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp[PII_REDACTED]
  - https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220
Sigma Detection Rule: Cisco File Deletion
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1070.004, T1561.001, T1561.002
Log source: cisco/

Description:
See what files are being deleted from flash file systems

Detection logic:
{
  "keywords": [
    "erase",
    "delete",
    "format"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco Discovery
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1083, T1201, T1057, T1018, T1082, T1016, T1049, T1033, T1124
Log source: cisco/

Description:
Find information about network devices that is not stored in config files

Detection logic:
{
  "keywords": [
    "dir",
    "show arp",
    "show cdp",
    "show clock",
    "show ip interface",
    "show ip route",
    "show ip sockets",
    "show processes",
    "show ssh",
    "show users",
    "show version"
  ],
  "condition": "keywords"
}

References:
  - https://www.cisco.com/c/en/us/td/docs/server_nw_virtual/2-5_release/command_reference/show.html
Sigma Detection Rule: Cisco Collect Data
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Austin Clark
Date: 2019-08-11
ATT&CK techniques: T1087.001, T1552.001, T1005
Log source: cisco/

Description:
Collect pertinent data from the configuration files

Detection logic:
{
  "keywords": [
    "show running-config",
    "show startup-config",
    "show archive config",
    "more"
  ],
  "condition": "keywords"
}

References:
  - https://blog.router-switch.com/2013/11/show-running-config/
  - https://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/cmdrefs/show_startup-config.htm
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/config-mgmt/configuration/15-sy/config-mgmt-15-sy-book/cm-config-diff.html
Sigma Detection Rule: Cisco Modify Configuration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1490, T1505, T1565.002, T1053
Log source: cisco/

Description:
Modifications to a config that will serve an adversary's impacts or persistence

Detection logic:
{
  "keywords": [
    "ip http server",
    "ip https server",
    "kron policy-list",
    "kron occurrence",
    "policy-list",
    "access-list",
    "ip access-group",
    "archive maximum",
    "ntp server"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco Local Accounts
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1136.001, T1098
Log source: cisco/

Description:
Find local accounts being created or modified as well as remote authentication configurations

Detection logic:
{
  "keywords": [
    "username",
    "aaa"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco Crypto Commands
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Clark
Date: 2019-08-12
ATT&CK techniques: T1553.004, T1552.004
Log source: cisco/

Description:
Show when private keys are being exported from the device, or when new certificates are installed

Detection logic:
{
  "keywords": [
    "crypto pki export",
    "crypto pki import",
    "crypto pki trustpoint"
  ],
  "condition": "keywords"
}

References:
  - https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-cr-book/sec-a1-cr-book_chapter_0111.html
Sigma Detection Rule: Cisco Show Commands Input
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Clark
Date: 2019-08-11
ATT&CK techniques: T1552.003
Log source: cisco/

Description:
See what commands are being input into the device by other people, full credentials can be in the history

Detection logic:
{
  "keywords": [
    "show history",
    "show history all",
    "show logging"
  ],
  "condition": "keywords"
}
Sigma Detection Rule: Cisco LDP Authentication Failures
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Tim Brown
Date: 2023-01-09
ATT&CK techniques: T1078, T1110, T1557
Log source: cisco/

Description:
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels

Detection logic:
{
  "selection_protocol": [
    "LDP"
  ],
  "selection_keywords": [
    "SOCKET_TCP_PACKET_MD5_AUTHEN_FAIL",
    "TCPMD5AuthenFail"
  ],
  "condition": "selection_protocol and selection_keywords"
}

References:
  - https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
Sigma Detection Rule: Default Cobalt Strike Certificate
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-06-23
Log source: zeek/

Description:
Detects the presence of default Cobalt Strike certificate in the HTTPS traffic

Detection logic:
{
  "selection": {
    "certificate.serial": "8BB00EE"
  },
  "condition": "selection"
}

References:
  - https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468
Sigma Detection Rule: SMB Spoolss Name Piped Usage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: OTR (Open Threat Research), @neu5ron
Date: 2018-11-28
ATT&CK techniques: T1021.002
Log source: zeek/

Description:
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.

Detection logic:
{
  "selection": {
    "path|endswith": "IPC$",
    "name": "spoolss"
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1
  - https://dirkjanm.io/a-different-way-of-abusing-zerologon/
  - https://twitter.com/_dirkjan/status/[PII_REDACTED]03588608
Sigma Detection Rule: Publicly Accessible RDP Service
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Josh Brower @DefensiveDepth
Date: 2020-08-22
ATT&CK techniques: T1021.001
Log source: zeek/

Description:
Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.


Detection logic:
{
  "selection": {
    "id.orig_h|cidr": [
      "::1/128",
      "10.0.0.0/8",
      "127.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "2620:83:8000::/48",
      "fc00::/7",
      "fe80::/10"
    ]
  },
  "condition": "not selection"
}
Sigma Detection Rule: Transferring Files with Credential Data via Network Shares - Zeek
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @neu5ron, Teymur Kheirkhabarov, oscd.community
Date: 2020-04-02
ATT&CK techniques: T1003.002, T1003.001, T1003.003
Log source: zeek/

Description:
Transferring files with well-known filenames (sensitive files with credential data) using network shares

Detection logic:
{
  "selection": {
    "name": [
      "\\mimidrv",
      "\\lsass",
      "\\windows\\minidump\\",
      "\\hiberfil",
      "\\sqldmpr",
      "\\sam",
      "\\ntds.dit",
      "\\security"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment