deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: RottenPotato Like Attack Pattern
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @SBousseaden, Florian Roth
Date: 2019-11-15
ATT&CK techniques: T1557.001
Log source: windows/

Description:
Detects logon events that have characteristics of events generated during an attack with RottenPotato and the like

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 3,
    "TargetUserName": "ANONYMOUS LOGON",
    "WorkstationName": "-",
    "IpAddress": [
      "127.0.0.1",
      "::1"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/SBousseaden/status/[PII_REDACTED]29777665
Sigma Detection Rule: Failed Logon From Public IP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: NVISO
Date: 2020-05-06
ATT&CK techniques: T1078, T1190, T1133
Log source: windows/

Description:
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.

Detection logic:
{
  "selection": {
    "EventID": 4625
  },
  "filter_main_ip_unknown": {
    "IpAddress|contains": "-"
  },
  "filter_main_local_ranges": {
    "IpAddress|cidr": [
      "::1/128",
      "10.0.0.0/8",
      "127.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "fc00::/7",
      "fe80::/10"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
Sigma Detection Rule: Outgoing Logon with New Credentials
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2022-04-06
ATT&CK techniques: T1550
Log source: windows/

Description:
Detects logon events that specify new credentials

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 9
  },
  "condition": "selection"
}

References:
  - https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf
Sigma Detection Rule: RDP Login from Localhost
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Thomas Patzke
Date: 2019-01-28
ATT&CK techniques: T1021.001
Log source: windows/

Description:
RDP login with localhost source address may be a tunnelled login

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 10,
    "IpAddress": [
      "::1",
      "127.0.0.1"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
Sigma Detection Rule: External Remote SMB Logon from Public IP
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
Date: 2023-01-19
ATT&CK techniques: T1133, T1078, T1110
Log source: windows/

Description:
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 3
  },
  "filter_main_local_ranges": {
    "IpAddress|cidr": [
      "::1/128",
      "10.0.0.0/8",
      "127.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "fc00::/7",
      "fe80::/10"
    ]
  },
  "filter_main_empty": {
    "IpAddress": "-"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
  - https://twitter.com/Purp1eW0lf/status/[PII_REDACTED]65002752
Sigma Detection Rule: Successful Account Login Via WMI
Repository: SigmaHQ/sigma
Severity: low
Status: stable
Author: Thomas Patzke
Date: 2019-12-04
ATT&CK techniques: T1047
Log source: windows/

Description:
Detects successful logon attempts performed with WMI

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "ProcessName|endswith": "\\WmiPrvSE.exe"
  },
  "condition": "selection"
}

References:
  - Internal Research
Sigma Detection Rule: External Remote RDP Logon from Public IP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Micah Babinski (@micahbabinski), Zach Mathis (@yamatosecurity)
Date: 2023-01-19
ATT&CK techniques: T1133, T1078, T1110
Log source: windows/

Description:
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.

Detection logic:
{
  "selection": {
    "EventID": 4624,
    "LogonType": 10
  },
  "filter_main_local_ranges": {
    "IpAddress|cidr": [
      "::1/128",
      "10.0.0.0/8",
      "127.0.0.0/8",
      "172.16.0.0/12",
      "192.168.0.0/16",
      "169.254.0.0/16",
      "fc00::/7",
      "fe80::/10"
    ]
  },
  "filter_main_empty": {
    "IpAddress": "-"
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html
  - https://twitter.com/Purp1eW0lf/status/[PII_REDACTED]65002752
Sigma Detection Rule: Windows Filtering Platform Blocked Connection From EDR Agent Binary
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: @gott_cyber
Date: 2024-01-08
ATT&CK techniques: T1685
Log source: windows/

Description:
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.


Detection logic:
{
  "selection": {
    "EventID": 5157,
    "Application|endswith": [
      "\\AmSvc.exe",
      "\\cb.exe",
      "\\CETASvc.exe",
      "\\CNTAoSMgr.exe",
      "\\CrAmTray.exe",
      "\\CrsSvc.exe",
      "\\CSFalconContainer.exe",
      "\\CSFalconService.exe",
      "\\CybereasonAV.exe",
      "\\CylanceSvc.exe",
      "\\cyserver.exe",
      "\\CyveraService.exe",
      "\\CyvrFsFlt.exe",
      "\\EIConnector.exe",
      "\\elastic-agent.exe",
      "\\elastic-endpoint.exe",
      "\\EndpointBasecamp.exe",
      "\\ExecutionPreventionSvc.exe",
      "\\filebeat.exe",
      "\\fortiedr.exe",
      "\\hmpalert.exe",
      "\\hurukai.exe",
      "\\LogProcessorService.exe",
      "\\mcsagent.exe",
      "\\mcsclient.exe",
      "\\MsMpEng.exe",
      "\\MsSense.exe",
      "\\Ntrtscan.exe",
      "\\PccNTMon.exe",
      "\\QualysAgent.exe",
      "\\RepMgr.exe",
      "\\RepUtils.exe",
      "\\RepUx.exe",
      "\\RepWAV.exe",
      "\\RepWSC.exe",
      "\\sedservice.exe",
      "\\SenseCncProxy.exe",
      "\\SenseIR.exe",
      "\\SenseNdr.exe",
      "\\SenseSampleUploader.exe",
      "\\SentinelAgent.exe",
      "\\SentinelAgentWorker.exe",
      "\\SentinelBrowserNativeHost.exe",
      "\\SentinelHelperService.exe",
      "\\SentinelServiceHost.exe",
      "\\SentinelStaticEngine.exe",
      "\\SentinelStaticEngineScanner.exe",
      "\\sfc.exe",
      "\\sophos ui.exe",
      "\\sophosfilescanner.exe",
      "\\sophosfs.exe",
      "\\sophoshealth.exe",
      "\\s

References:
  - https://github.com/netero1010/EDRSilencer
  - https://github.com/amjcyber/EDRNoiseMaker
  - https://ghoulsec.medium.com/misc-series-4-forensics-on-edrsilencer-events-428b20b3f983
Sigma Detection Rule: Certificate Request Export to Exchange Webserver
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2021-08-23
ATT&CK techniques: T1505.003
Log source: windows/

Description:
Detects a write of an Exchange CSR to an untypical directory or with aspx name suffix which can be used to place a webshell

Detection logic:
{
  "keywords_export_command": {
    "|all": [
      "New-ExchangeCertificate",
      " -GenerateRequest",
      " -BinaryEncoded",
      " -RequestFile"
    ]
  },
  "keywords_export_params": [
    "\\\\\\\\localhost\\\\C$",
    "\\\\\\\\127.0.0.1\\\\C$",
    "C:\\\\inetpub",
    ".aspx"
  ],
  "condition": "keywords_export_command and keywords_export_params"
}

References:
  - https://twitter.com/GossiTheDog/status/[PII_REDACTED]05127938
Sigma Detection Rule: Remove Exported Mailbox from Exchange Webserver
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems)
Date: 2021-08-27
ATT&CK techniques: T1070
Log source: windows/

Description:
Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

Detection logic:
{
  "keywords": {
    "|all": [
      "Remove-MailboxExportRequest",
      " -Identity ",
      " -Confirm \"False\""
    ]
  },
  "condition": "keywords"
}

References:
  - https://github.com/rapid7/metasploit-framework/blob/1416b5776d963f21b7b5b45d19f3e961201e0aed/modules/exploits/windows/http/exchange_proxyshell_rce.rb#L430
Sigma Detection Rule: Mailbox Export to Exchange Webserver
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems), Rich Warren, Christian Burkard (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1505.003
Log source: windows/

Description:
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it

Detection logic:
{
  "export_command": {
    "|all": [
      "New-MailboxExportRequest",
      " -Mailbox "
    ]
  },
  "export_params": [
    "-FilePath \"\\\\\\\\",
    ".aspx"
  ],
  "role_assignment": {
    "|all": [
      "New-ManagementRoleAssignment",
      " -Role \"Mailbox Import Export\"",
      " -User "
    ]
  },
  "condition": "(export_command and export_params) or role_assignment"
}

References:
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
Sigma Detection Rule: Exchange Set OabVirtualDirectory ExternalUrl Property
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jose Rodriguez @Cyb3rPandaH
Date: 2021-03-15
ATT&CK techniques: T1505.003
Log source: windows/

Description:
Rule to detect an adversary setting OabVirtualDirectory External URL property to a script in Exchange Management log

Detection logic:
{
  "keywords": {
    "|all": [
      "Set-OabVirtualDirectory",
      "ExternalUrl",
      "Page_Load",
      "script"
    ]
  },
  "condition": "keywords"
}

References:
  - https://twitter.com/OTR_Community/status/[PII_REDACTED]71132675
Sigma Detection Rule: MSExchange Transport Agent Installation - Builtin
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-08
ATT&CK techniques: T1505.002
Log source: windows/

Description:
Detects the Installation of a Exchange Transport Agent

Detection logic:
{
  "selection": [
    "Install-TransportAgent"
  ],
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=7
Sigma Detection Rule: ProxyLogon MSExchange OabVirtualDirectory
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1587.001
Log source: windows/

Description:
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory

Detection logic:
{
  "keywords_cmdlet": {
    "|all": [
      "OabVirtualDirectory",
      " -ExternalUrl "
    ]
  },
  "keywords_params": [
    "eval(request",
    "http://f/<script",
    "\"unsafe\"};",
    "function Page_Load()"
  ],
  "condition": "keywords_cmdlet and keywords_params"
}

References:
  - https://bi-zone.medium.com/hunting-down-ms-exchange-attacks-part-1-proxylogon-cve-2021-26855-26858-27065-26857-6e885c5f197c
Sigma Detection Rule: Failed MSExchange Transport Agent Installation
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tobias Michalski (Nextron Systems)
Date: 2021-06-08
ATT&CK techniques: T1505.002
Log source: windows/

Description:
Detects a failed installation of a Exchange Transport Agent

Detection logic:
{
  "selection": {
    "EventID": 6,
    "Data|contains": "Install-TransportAgent"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=8
Sigma Detection Rule: OpenSSH Server Listening On Socket
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: mdecrevoisier
Date: 2022-10-25
ATT&CK techniques: T1021.004
Log source: windows/

Description:
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Detection logic:
{
  "selection": {
    "EventID": 4,
    "process": "sshd",
    "payload|startswith": "Server listening on "
  },
  "condition": "selection"
}

References:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
  - https://winaero.com/enable-openssh-server-windows-10/
  - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
  - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
Sigma Detection Rule: Standard User In High Privileged Group
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2023-01-13
Log source: windows/

Description:
Detect standard users login that are part of high privileged groups such as the Administrator group

Detection logic:
{
  "selection": {
    "EventID": 300,
    "TargetUserSid|startswith": "S-1-5-21-",
    "SidList|contains": [
      "S-1-5-32-544",
      "-500}",
      "-518}",
      "-519}"
    ]
  },
  "filter_main_admin": {
    "TargetUserSid|endswith": [
      "-500",
      "-518",
      "-519"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers
  - https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
  - https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml
Sigma Detection Rule: Suspicious Cobalt Strike DNS Beaconing - DNS Client
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
ATT&CK techniques: T1071.004
Log source: windows/

Description:
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

Detection logic:
{
  "selection_eid": {
    "EventID": 3008
  },
  "selection_query_1": {
    "QueryName|startswith": [
      "aaa.stage.",
      "post.1"
    ]
  },
  "selection_query_2": {
    "QueryName|contains": ".stage.123456."
  },
  "condition": "selection_eid and 1 of selection_query_*"
}

References:
  - https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  - https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/
Sigma Detection Rule: DNS Query for Anonfiles.com Domain - DNS Client
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
ATT&CK techniques: T1567.002
Log source: windows/

Description:
Detects DNS queries for anonfiles.com, which is an anonymous file upload platform often used for malicious purposes

Detection logic:
{
  "selection": {
    "EventID": 3008,
    "QueryName|contains": ".anonfiles.com"
  },
  "condition": "selection"
}

References:
  - https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte
Sigma Detection Rule: DNS Query To Put.io - DNS Client
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Omar Khaled (@beacon_exe)
Date: 2024-08-23
Log source: windows/

Description:
Detects DNS queries for subdomains related to "Put.io" sharing website.

Detection logic:
{
  "selection": {
    "EventID": 3008,
    "QueryName|contains": [
      "api.put.io",
      "upload.put.io"
    ]
  },
  "condition": "selection"
}

References:
  - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure
Sigma Detection Rule: DNS Query To MEGA Hosting Website - DNS Client
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
ATT&CK techniques: T1567.002
Log source: windows/

Description:
Detects DNS queries for subdomains related to MEGA sharing website

Detection logic:
{
  "selection": {
    "EventID": 3008,
    "QueryName|contains": "userstorage.mega.co.nz"
  },
  "condition": "selection"
}

References:
  - https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/
Sigma Detection Rule: Query Tor Onion Address - DNS Client
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-02-20
ATT&CK techniques: T1090.003
Log source: windows/

Description:
Detects DNS resolution of an .onion address related to Tor routing networks

Detection logic:
{
  "selection": {
    "EventID": 3008,
    "QueryName|endswith": [
      ".hiddenservice.net",
      ".onion.ca",
      ".onion.cab",
      ".onion.casa",
      ".onion.city",
      ".onion.direct",
      ".onion.dog",
      ".onion.glass",
      ".onion.gq",
      ".onion.guide",
      ".onion.in.net",
      ".onion.ink",
      ".onion.it",
      ".onion.link",
      ".onion.lt",
      ".onion.lu",
      ".onion.ly",
      ".onion.mn",
      ".onion.network",
      ".onion.nu",
      ".onion.pet",
      ".onion.plus",
      ".onion.pt",
      ".onion.pw",
      ".onion.rip",
      ".onion.sh",
      ".onion.si",
      ".onion.to",
      ".onion.top",
      ".onion.ws",
      ".onion",
      ".s1.tor-gateways.de",
      ".s2.tor-gateways.de",
      ".s3.tor-gateways.de",
      ".s4.tor-gateways.de",
      ".s5.tor-gateways.de",
      ".t2w.pw",
      ".tor2web.ae.org",
      ".tor2web.blutmagie.de",
      ".tor2web.com",
      ".tor2web.fi",
      ".tor2web.io",
      ".tor2web.org",
      ".tor2web.xyz",
      ".torlink.co"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.logpoint.com/en/blog/detecting-tor-use-with-logpoint/
  - https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/ASimDNS/imDNS_TorProxies.yaml
Sigma Detection Rule: DNS Query To Ufile.io - DNS Client
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
ATT&CK techniques: T1567.002
Log source: windows/

Description:
Detects DNS queries to "ufile.io", which was seen abused by malware and threat actors as a method for data exfiltration

Detection logic:
{
  "selection": {
    "EventID": 3008,
    "QueryName|contains": "ufile.io"
  },
  "condition": "selection"
}

References:
  - https://thedfirreport.com/2021/12/13/diavol-ransomware/
Sigma Detection Rule: Unsigned or Unencrypted SMB Connection to Share Established
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Mohamed Abdelghani
Date: 2025-10-19
ATT&CK techniques: T1021.002
Log source: windows/

Description:
Detects SMB server connections to shares without signing or encryption enabled.
This could indicate potential lateral movement activity using unsecured SMB shares.


Detection logic:
{
  "selection_shares": {
    "EventID": 4000,
    "ShareName|contains": [
      "IPC$",
      "ADMIN$",
      "C$"
    ]
  },
  "selection_status": [
    {
      "SigningUsed": "false"
    },
    {
      "EncyptionUsed": "false"
    }
  ],
  "filter_main_local_ips": [
    {
      "ClientAddress|cidr": [
        "127.0.0.0/8",
        "169.254.0.0/16",
        "::1/128",
        "fe80::/10",
        "fc00::/7"
      ]
    },
    {
      "ClientAddress|contains": [
        "[PII_REDACTED][PII_REDACTED][PII_REDACTED]01",
        "FE[PII_REDACTED]0000",
        "FC[PII_REDACTED]0000",
        "0200????7F",
        "0200????A9FE"
      ]
    }
  ],
  "condition": "all of selection_* and not 1 of filter_main_*"
}

References:
  - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing
Sigma Detection Rule: NTLM Logon
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2018-06-08
ATT&CK techniques: T1550.002
Log source: windows/

Description:
Detects logons using NTLM, which could be caused by a legacy source or attackers

Detection logic:
{
  "selection": {
    "EventID": 8002
  },
  "condition": "selection"
}

References:
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]95477505
Sigma Detection Rule: Potential Remote Desktop Connection to Non-Domain Host
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: James Pemberton
Date: 2020-05-22
ATT&CK techniques: T1219.002
Log source: windows/

Description:
Detects logons using NTLM to hosts that are potentially not part of the domain.

Detection logic:
{
  "selection": {
    "EventID": 8001,
    "TargetName|startswith": "TERMSRV"
  },
  "condition": "selection"
}

References:
  - n/a
Sigma Detection Rule: NTLM Brute Force
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Jerry Shockley '@jsh0x'
Date: 2022-02-02
ATT&CK techniques: T1110
Log source: windows/

Description:
Detects common NTLM brute force device names

Detection logic:
{
  "selection": {
    "EventID": 8004
  },
  "devicename": {
    "WorkstationName": [
      "Rdesktop",
      "Remmina",
      "Freerdp",
      "Windows7",
      "Windows8",
      "Windows2012",
      "Windows2016",
      "Windows2019"
    ]
  },
  "condition": "selection and devicename"
}

References:
  - https://www.varonis.com/blog/investigate-ntlm-brute-force
Sigma Detection Rule: Potential Active Directory Reconnaissance/Enumeration Via LDAP
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Adeem Mawani
Date: 2021-06-22
ATT&CK techniques: T1069.002, T1087.002, T1482
Log source: windows/

Description:
Detects potential Active Directory enumeration via LDAP

Detection logic:
{
  "generic_search": {
    "EventID": 30,
    "SearchFilter|contains": [
      "(groupType:1.2.840.113556.1.4.803:=[PII_REDACTED])",
      "(groupType:1.2.840.113556.1.4.803:=[PII_REDACTED])",
      "(groupType:1.2.840.113556.1.4.803:=[PII_REDACTED])",
      "(groupType:1.2.840.113556.1.4.803:=[PII_REDACTED])",
      "(sAMAccountType=805306369)",
      "(sAMAccountType=805306368)",
      "(sAMAccountType=536870913)",
      "(sAMAccountType=536870912)",
      "(sAMAccountType=268435457)",
      "(sAMAccountType=268435456)",
      "(objectCategory=groupPolicyContainer)",
      "(objectCategory=organizationalUnit)",
      "(objectCategory=nTDSDSA)",
      "(objectCategory=server)",
      "(objectCategory=domain)",
      "(objectCategory=person)",
      "(objectCategory=group)",
      "(objectCategory=user)",
      "(objectClass=trustedDomain)",
      "(objectClass=computer)",
      "(objectClass=server)",
      "(objectClass=group)",
      "(objectClass=user)",
      "(primaryGroupID=521)",
      "(primaryGroupID=516)",
      "(primaryGroupID=515)",
      "(primaryGroupID=512)",
      "Domain Admins",
      "objectGUID=\\*",
      "(schemaIDGUID=\\*)",
      "admincount=1"
    ]
  },
  "distinguished_name_enumeration": {
    "EventID": 30,
    "SearchFilter": "(objectclass=\\*)",
    "DistinguishedName|contains": [
      "CN=Domain Admins",
      "CN=Enterprise Admins",
      "CN=Group Policy Creator Owners"
    ]
  },
  "suspicious_flag": {
    "EventID": 30,
    "SearchFilter|contains": [
  

References:
  - https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726
  - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1
  - https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs
  - https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c
  - https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427